last executing test programs: 14m7.552856232s ago: executing program 0 (id=430): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x281}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x0) ioctl$I2C_SMBUS(r3, 0x720, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 14m6.54987317s ago: executing program 0 (id=432): mkdirat(0xffffffffffffff9c, 0x0, 0xd4) r0 = openat2(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x2a0400, 0x20, 0x20}, 0x18) ioctl$LOOP_CLR_FD(r0, 0x4c01) mount$afs(0x0, &(0x7f0000002840)='./file0\x00', 0x0, 0x700, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000380)=@keyring={'key_or_keyring:', r2}) 14m4.569185595s ago: executing program 0 (id=436): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, 0x0, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000001f00)) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x15, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'erspan0\x00'}}, 0x1e) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000010000100"/20, @ANYRES32=0x0, @ANYBLOB="00f33b0ac10100000400140008001b"], 0x2c}}, 0x0) 13m57.950642168s ago: executing program 0 (id=448): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001d40)={&(0x7f0000000180)='fsi_master_gpio_cmd_rel_addr\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) rt_sigaction(0x40, 0x0, 0x0, 0x8, &(0x7f0000001540)) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write$vga_arbiter(r4, &(0x7f0000000300)=ANY=[], 0xc) write$vga_arbiter(r4, &(0x7f00000001c0)=@other={'unlock', ' ', 'none'}, 0xc) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x0, 0x18c, 0x203, 0x320, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x20, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x6}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz0\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) socket$pppoe(0x18, 0x1, 0x0) syz_emit_vhci(&(0x7f0000001080)=ANY=[@ANYBLOB="04040a00e0ffffff0f77042482"], 0xd) 13m56.809986258s ago: executing program 0 (id=451): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r1) 13m51.118024404s ago: executing program 0 (id=454): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) unlink(0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x612001, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x1a3b5000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x0, 0x61}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0xfffffffe}, 0x1c) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[0x0, 0x0], 0x0, 0x0, 0x2}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f0000000e00)={0x1, r6}) 13m34.747459539s ago: executing program 32 (id=454): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) unlink(0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x612001, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x1a3b5000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x0, 0x61}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0xfffffffe}, 0x1c) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[0x0, 0x0], 0x0, 0x0, 0x2}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f0000000e00)={0x1, r6}) 2m37.126668404s ago: executing program 2 (id=1838): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000000"], 0x7c}}, 0x4000) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)={0x2c, 0x19, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x8004) 2m35.935546925s ago: executing program 2 (id=1840): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket(0x1e, 0x2, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') r3 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r3, &(0x7f0000001fc0)=""/184, 0x20002078) socket$netlink(0x10, 0x3, 0x0) 2m32.883206225s ago: executing program 2 (id=1843): r0 = syz_usb_connect(0x0, 0x1cb, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000001c0)={0x40, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m30.81967699s ago: executing program 2 (id=1848): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0xfffe}, {0xfff1, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x20008154) 2m30.804805261s ago: executing program 2 (id=1849): sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000a00)=@getstat={0xe0, 0x15, 0x1, 0x70bd2d, 0x25dfdbfe, {{'lrw-cast6-avx\x00'}, '\x00', '\x00', 0x0, 0x2000}}, 0xe0}}, 0x20004000) 2m30.555690079s ago: executing program 2 (id=1852): r0 = syz_io_uring_setup(0x3ac6, &(0x7f00000001c0)={0x0, 0xfffffffd, 0x10100, 0x4, 0x37c}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0xe3d08660d3cd4684}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfe, 0x2ffffffff}, 0xc) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f0000000180)=0x58, 0xa) io_uring_enter(r0, 0x92, 0x0, 0x0, 0x0, 0x0) 2m14.297481626s ago: executing program 33 (id=1852): r0 = syz_io_uring_setup(0x3ac6, &(0x7f00000001c0)={0x0, 0xfffffffd, 0x10100, 0x4, 0x37c}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0xe3d08660d3cd4684}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfe, 0x2ffffffff}, 0xc) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f0000000180)=0x58, 0xa) io_uring_enter(r0, 0x92, 0x0, 0x0, 0x0, 0x0) 1m2.280169316s ago: executing program 6 (id=2045): ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r1, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="010000000400000004000000070000", @ANYRES32, @ANYBLOB="000000000000409674f4", @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="0200000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r7}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r7, &(0x7f00000000c0), &(0x7f0000000100)=""/237}, 0x20) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000001000390400000000001b2347ea000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) 1m0.736821038s ago: executing program 6 (id=2049): socket$packet(0x11, 0x3, 0x300) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000380)='cgroup.procs\x00', 0x2, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000200)=0x1, 0x12) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') close(0xffffffffffffffff) write$cgroup_pid(r5, &(0x7f0000000040), 0x12) 56.827806291s ago: executing program 6 (id=2052): io_uring_setup(0x355b, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bind$rds(0xffffffffffffffff, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f00000001c0)={0x28, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 55.880812337s ago: executing program 6 (id=2055): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_submit(0x0, 0x0, 0x0) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000400)=@urb_type_interrupt={0x1, {0x1, 0x1}, 0x5, 0x4, &(0x7f00000000c0), 0x0, 0x1, 0x27a, 0x0, 0x10, 0xe, 0x0}) 54.668347603s ago: executing program 6 (id=2057): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r4, r3, &(0x7f0000002080)=0x64, 0x23b) 52.331304339s ago: executing program 6 (id=2063): mkdirat(0xffffffffffffff9c, 0x0, 0x0) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xd) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, 0x0, 0x40004840) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000007440), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fddbdf25090000003000038006000400e9000000080001000000000014"], 0x44}}, 0x48040) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast1, 0x5}, 0x1c) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 37.083090916s ago: executing program 34 (id=2063): mkdirat(0xffffffffffffff9c, 0x0, 0x0) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xd) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, 0x0, 0x40004840) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000007440), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fddbdf25090000003000038006000400e9000000080001000000000014"], 0x44}}, 0x48040) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast1, 0x5}, 0x1c) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 29.151525196s ago: executing program 3 (id=2102): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r2, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0100000004000000040000000700000000000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="0200000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r8}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r8, &(0x7f00000000c0), &(0x7f0000000100)=""/237}, 0x20) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000001000390400000000001b2347ea000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) 26.239758091s ago: executing program 3 (id=2106): io_uring_setup(0x355b, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bind$rds(0xffffffffffffffff, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2}) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, 0x0) 24.30491734s ago: executing program 3 (id=2111): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x1, 0x0) 23.415041641s ago: executing program 3 (id=2113): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x2, 0x4, 0x201a, 0x2, 0x8, 0x0, 0x3, 0xdd2fcb245114ab72}}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getpgrp(0xffffffffffffffff) getgid() syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) 19.329628863s ago: executing program 3 (id=2120): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x79902000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(r0, 0x4, &(0x7f0000000180)={0x5, 0x8000000000000001}, &(0x7f00000001c0)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') socket$nl_xfrm(0x10, 0x3, 0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 16.547118964s ago: executing program 3 (id=2125): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0xfffe}, {0xfff1, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x20008154) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4420}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_REPLAY_PROTECT={0x5}, @IFLA_MACSEC_ES={0x5, 0xa, 0x1}]}}}]}, 0x44}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x6a040000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r5}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001200)={0x1c, 0x0, 0x101, 0x70bd2b, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4008000) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x53) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005000000b7030000000000008500000073000000"], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @void, @value}, 0x94) socket$inet(0x2, 0x3, 0x6) 11.995564071s ago: executing program 5 (id=2132): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x3}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f0000000000)={{0xffffffffffffffff, 0x0, 0x9}, 0x3}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xe, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000500)="b8010000000f01c10f22a10f20e035800000000f22e066ba610066b80a0066ef66b832000f00d0b8010000000f01c166ba4300b0beee0f793c1e2e643e2e3e650f79288fc878c15b0e3f", 0x4a}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 11.4265924s ago: executing program 1 (id=2134): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x281}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfffffde6}], 0x3, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 10.344301052s ago: executing program 1 (id=2135): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x79902000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(r0, 0x4, &(0x7f0000000180)={0x5, 0x8000000000000001}, &(0x7f00000001c0)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') socket$nl_xfrm(0x10, 0x3, 0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 10.333557037s ago: executing program 5 (id=2136): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r2, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0100000004000000040000000700000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="0200000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r8}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r8, &(0x7f00000000c0), &(0x7f0000000100)=""/237}, 0x20) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000001000390400000000001b2347ea000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) 8.383602599s ago: executing program 1 (id=2137): syz_usb_connect(0x0, 0x24, &(0x7f0000000880)=ANY=[@ANYBLOB="120110026ed25008ac054902f039010203010902120001f805000c0904330000035402"], &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) mmap(&(0x7f0000ce2000/0x4000)=nil, 0x4000, 0x2000006, 0x12, 0xffffffffffffffff, 0x913e0000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x1, &(0x7f0000000100)=@raw=[@jmp={0x5, 0x0, 0x9, 0x0, 0x6, 0xfffffffffffffe88}], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1, @void, @value}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r2, &(0x7f0000000040), 0x12) setsockopt$sock_int(r1, 0x1, 0x3e, &(0x7f0000fee000)=0x3fa, 0x4) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000002, 0x80010, r0, 0x0) prctl$PR_SET_MM(0x23, 0x1, &(0x7f00008f7000/0x4000)=nil) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x275a, 0x0) mmap(&(0x7f0000c16000/0x4000)=nil, 0x4000, 0x2000003, 0x28011, r4, 0xac9d4000) r5 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000022c0), 0x80, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x5, 0xfffffff7) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) setsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000000)=0x1, 0x4) listen(0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$DRM_IOCTL_GEM_OPEN(r5, 0xc010640b, &(0x7f00000000c0)) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x40000) 8.265625024s ago: executing program 5 (id=2138): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x2, 0x4, 0x201a, 0x2, 0x8, 0x0, 0x3, 0xdd2fcb245114ab72}}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getpgrp(0xffffffffffffffff) getgid() syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) 7.839341055s ago: executing program 4 (id=2139): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f0000002080)=0x64, 0x23b) 6.765633466s ago: executing program 4 (id=2140): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCX25SDTEFACILITIES(0xffffffffffffffff, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="01000000040000000400", @ANYRES32, @ANYBLOB="000000000000409674f4d893e3484b97cd000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r6}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r6, &(0x7f00000000c0), &(0x7f0000000100)=""/237}, 0x20) 5.729344084s ago: executing program 4 (id=2141): setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(0xffffffffffffffff, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000004c0)="cc", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000b80)="bda033176eb146b36ef41f221a4e7ce4a02598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4d9f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720bf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e923a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d219206ddc35099101533cff5aee6c4783e00e6dd391f664052a6c66c62f62a49fde8fbe336543bf99b55e53b801e54c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14f03e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b019144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beacb8bc15f50c2663d684d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f93076aea55ed9cf12512ce3ac3df331695024bd1e53369a87caf6894fce811a64dad315402678de76", 0x390}, {&(0x7f0000000300)="439e9c06fc666cabc8569d63a866b31ff3ceda1e28f23f455e96a02001fc3fb089ed9e5234", 0x25}], 0x2}}], 0x2, 0x4048884) 5.687726155s ago: executing program 1 (id=2142): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f0000002080)=0x64, 0x23b) 5.51966987s ago: executing program 4 (id=2143): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = syz_open_dev$video4linux(&(0x7f00000000c0), 0x5249162b, 0x80000) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x2, 0x4, 0x201a, 0x2, 0x8, 0x0, 0x3, 0xdd2fcb245114ab72}}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) getgid() syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r5, 0xae80, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 5.054300134s ago: executing program 5 (id=2144): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc43671", 0x96}], 0x1, &(0x7f0000000380)}], 0x1, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000002c0)=[{0x0}, {&(0x7f0000000300)=""/83, 0x53}], 0x2}, 0x0) 4.167321206s ago: executing program 5 (id=2145): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) dup(0xffffffffffffffff) ioperm(0x0, 0x8, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = dup2(r1, r1) socket$vsock_stream(0x28, 0x1, 0x0) read$FUSE(r2, &(0x7f00000063c0)={0x2020}, 0x2020) syz_usb_connect(0x1, 0x2d, 0x0, 0x0) 3.475963007s ago: executing program 1 (id=2146): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r2, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0100000004000000040000000700000000000000", @ANYRES32, @ANYBLOB="000000000000409674f4d893e3484b97cd00", @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="0200000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r8}, 0x38) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000001000390400000000001b2347ea000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) 2.35597404s ago: executing program 4 (id=2147): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r2, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0100000004000000040000000700000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="0200000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r8}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r8, &(0x7f00000000c0), &(0x7f0000000100)=""/237}, 0x20) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000001000390400000000001b2347ea000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) 1.312235171s ago: executing program 35 (id=2125): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0xfffe}, {0xfff1, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x20008154) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4420}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_REPLAY_PROTECT={0x5}, @IFLA_MACSEC_ES={0x5, 0xa, 0x1}]}}}]}, 0x44}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x6a040000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r5}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001200)={0x1c, 0x0, 0x101, 0x70bd2b, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4008000) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x53) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005000000b7030000000000008500000073000000"], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @void, @value}, 0x94) socket$inet(0x2, 0x3, 0x6) 1.049545758s ago: executing program 5 (id=2149): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_submit(0x0, 0x0, 0x0) readahead(0xffffffffffffffff, 0x1de, 0x6) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='mpol=']) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000400)=@urb_type_interrupt={0x1, {0x1, 0x1}, 0x5, 0x4, &(0x7f00000000c0), 0x0, 0x1, 0x27a, 0x0, 0x10, 0xe, 0x0}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, 0x0, 0x0) r7 = dup(r5) r8 = dup(r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r8, 0x1000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000000c0)={{{@in=@multicast1, @in=@private}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r8, 0xc018937b, 0x0) 4.66537ms ago: executing program 1 (id=2150): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x59555956, 0x2, @stepwise={0x3, 0x7fff, 0x3, 0x6, 0x1000, 0x6}}) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCX25SDTEFACILITIES(0xffffffffffffffff, 0x89eb, &(0x7f0000000300)={0x3ff, 0x3, 0x8, 0x4, 0x5, 0x1b, 0x43, "d6ffdc1e06695e358e53e698e21429e50916bb6c", "3daeb258cc37a691135764fa43031f0d00"}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="01000000040000000400", @ANYRES32, @ANYBLOB="000000000000409674f4d893e3484b97cd000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r6}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r6, &(0x7f00000000c0), &(0x7f0000000100)=""/237}, 0x20) 0s ago: executing program 4 (id=2151): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x17, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$FUSE_INIT(r1, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x81, 0x10000, 0x1000, 0xf7fc, 0x4, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) vmsplice(r1, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r1, 0x407, 0x2000000) kernel console output (not intermixed with test programs): using dummy_hcd [ 728.090883][T11141] sz1: rxe_newlink: already configured on lo [ 730.024586][T11155] ptrace attach of "./syz-executor exec"[7979] was attempted by " [ 732.739480][T11177] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1209'. [ 734.105999][T11186] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1213'. [ 734.341243][T11191] openvswitch: : Dropping previously announced user features [ 736.042100][T11204] netlink: 'syz.5.1216': attribute type 10 has an invalid length. [ 736.257166][T11204] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 736.449126][T11204] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 736.789905][T11213] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 737.836547][ T7729] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 737.876354][T11220] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1219'. [ 738.675985][ T7729] usb 3-1: Using ep0 maxpacket: 8 [ 738.857423][ T7729] usb 3-1: config 6 has an invalid interface number: 2 but max is 0 [ 738.876653][ T7729] usb 3-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 738.893793][ T7729] usb 3-1: config 6 has no interface number 0 [ 738.962434][T11232] sz1: rxe_newlink: already configured on lo [ 739.557635][ T7729] usb 3-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 739.569533][ T7729] usb 3-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 739.580513][ T7729] usb 3-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 740.838645][T11250] ptrace attach of "./syz-executor exec"[5833] was attempted by " [ 741.339806][T11251] sz1: rxe_newlink: already configured on lo [ 741.788962][ T7729] usb 3-1: string descriptor 0 read error: -71 [ 741.795403][ T7729] usb 3-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 741.950805][ T7729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.965576][ T7729] usb 3-1: can't set config #6, error -71 [ 742.036035][ T7729] usb 3-1: USB disconnect, device number 24 [ 742.365823][ T7764] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 742.373751][ C0] raw-gadget.0 gadget.4: ignoring, device is not running [ 742.451592][T11248] 9pnet_fd: Insufficient options for proto=fd [ 742.458804][T11248] siw: device registration error -23 [ 742.732956][ T7764] usb 5-1: device descriptor read/64, error -32 [ 743.135815][ T7764] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 743.315829][ T7764] usb 5-1: Using ep0 maxpacket: 8 [ 743.344918][T11264] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1228'. [ 744.433032][ T7764] usb 5-1: unable to get BOS descriptor or descriptor too short [ 744.565134][ T7764] usb 5-1: config 248 has an invalid descriptor of length 0, skipping remainder of the config [ 744.581781][ T7764] usb 5-1: config 248 has 0 interfaces, different from the descriptor's value: 1 [ 744.647245][ T7764] usb 5-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 744.656559][ T7764] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 744.675785][ T7764] usb 5-1: Product: syz [ 744.680147][ T7764] usb 5-1: Manufacturer: syz [ 744.684794][ T7764] usb 5-1: SerialNumber: syz [ 745.820392][T11283] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 746.395610][ T7764] usb 5-1: USB disconnect, device number 22 [ 747.136040][T11297] netlink: 'syz.5.1238': attribute type 27 has an invalid length. [ 749.707922][T11318] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1244'. [ 750.617398][T11323] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 751.206833][T11326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1245'. [ 751.857134][T11329] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1248'. [ 752.312748][T11338] 9pnet_fd: Insufficient options for proto=fd [ 752.330639][T11338] siw: device registration error -23 [ 752.916694][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.923110][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.844986][T11352] ptrace attach of "./syz-executor exec"[5833] was attempted by " [ 753.906956][T11350] netlink: 'syz.3.1256': attribute type 1 has an invalid length. [ 753.998079][ C1] vkms_vblank_simulate: vblank timer overrun [ 754.297316][T11350] 8021q: adding VLAN 0 to HW filter on device bond1 [ 754.610826][T11361] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1257'. [ 755.258463][T11355] veth5: entered promiscuous mode [ 756.225945][ T5952] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 756.396087][ T5952] usb 6-1: Using ep0 maxpacket: 8 [ 756.412683][ T5952] usb 6-1: config 6 has an invalid interface number: 2 but max is 0 [ 756.435211][ T5952] usb 6-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 756.454538][ T5952] usb 6-1: config 6 has no interface number 0 [ 756.461323][ T5952] usb 6-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 756.478918][ T5952] usb 6-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 756.490129][ T5952] usb 6-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 756.510516][ T5952] usb 6-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 756.526722][ T5952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.545485][ T5952] usb 6-1: Product: syz [ 756.555392][ T5952] usb 6-1: Manufacturer: syz [ 756.565558][ T5952] usb 6-1: SerialNumber: syz [ 756.584712][ T5952] hso 6-1:6.2: Failed to find INT IN ep [ 757.587280][T11384] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1263'. [ 758.724247][T11391] netlink: 'syz.4.1266': attribute type 1 has an invalid length. [ 758.754662][ T44] usb 6-1: USB disconnect, device number 16 [ 759.008002][T11391] 8021q: adding VLAN 0 to HW filter on device bond2 [ 759.079979][T11404] netlink: 'syz.2.1269': attribute type 21 has an invalid length. [ 759.133398][T11393] veth5: entered promiscuous mode [ 760.487981][T11423] ptrace attach of "./syz-executor exec"[7979] was attempted by " [ 761.728800][T11436] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 762.112024][T11435] syzkaller0: entered promiscuous mode [ 762.131923][T11435] syzkaller0: entered allmulticast mode [ 762.756256][ T7729] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 762.908066][ T7729] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 762.930649][ T7729] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 762.950118][ T7729] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.969208][ T7729] usb 4-1: config 0 descriptor?? [ 762.984245][ T7729] pwc: Askey VC010 type 2 USB webcam detected. [ 763.476447][ T7729] pwc: recv_control_msg error -32 req 02 val 2b00 [ 763.493595][ T7729] pwc: recv_control_msg error -32 req 02 val 2700 [ 763.504458][ T7729] pwc: recv_control_msg error -32 req 02 val 2c00 [ 763.519598][ T7729] pwc: recv_control_msg error -32 req 04 val 1000 [ 763.529229][ T7729] pwc: recv_control_msg error -32 req 04 val 1300 [ 763.546805][ T7729] pwc: recv_control_msg error -32 req 04 val 1400 [ 763.569275][ T7729] pwc: recv_control_msg error -32 req 02 val 2000 [ 763.598740][ T7729] pwc: recv_control_msg error -32 req 02 val 2100 [ 763.609608][ T7729] pwc: recv_control_msg error -32 req 04 val 1500 [ 763.630601][ T7729] pwc: recv_control_msg error -32 req 02 val 2500 [ 763.648141][ T7729] pwc: recv_control_msg error -32 req 02 val 2400 [ 763.665041][ T7729] pwc: recv_control_msg error -32 req 02 val 2600 [ 763.680621][ T7729] pwc: recv_control_msg error -32 req 02 val 2900 [ 763.899692][ T7729] pwc: recv_control_msg error -71 req 04 val 1100 [ 763.920720][ T7729] pwc: recv_control_msg error -71 req 04 val 1200 [ 763.952093][ T7729] pwc: Registered as video103. [ 763.978968][ T7729] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input26 [ 764.011805][ T7764] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 764.049428][ T7729] usb 4-1: USB disconnect, device number 37 [ 764.205768][ T7764] usb 3-1: Using ep0 maxpacket: 8 [ 764.217714][ T7764] usb 3-1: config 6 has an invalid interface number: 2 but max is 0 [ 764.226220][ T7764] usb 3-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 764.236539][ T7764] usb 3-1: config 6 has no interface number 0 [ 764.242686][ T7764] usb 3-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 764.255317][ T7764] usb 3-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 764.265308][ T7764] usb 3-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 764.288788][ T7764] usb 3-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 764.305132][ T7764] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.316607][ T7764] usb 3-1: Product: syz [ 764.320874][ T7764] usb 3-1: Manufacturer: syz [ 764.326177][ T7764] usb 3-1: SerialNumber: syz [ 764.344467][ T7764] hso 3-1:6.2: Failed to find INT IN ep [ 764.890401][T11457] 9pnet_fd: Insufficient options for proto=fd [ 764.909319][T11457] siw: device registration error -23 [ 765.888362][ T7729] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 766.057625][ T7729] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 766.068886][ T7729] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 766.079226][ T7729] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 766.092546][ T7729] usb 4-1: config 0 descriptor?? [ 766.119128][ T7729] pwc: Askey VC010 type 2 USB webcam detected. [ 766.290575][ T5951] usb 3-1: USB disconnect, device number 25 [ 766.542320][ T7729] pwc: recv_control_msg error -32 req 02 val 2b00 [ 766.574389][ T7729] pwc: recv_control_msg error -32 req 02 val 2700 [ 766.593787][ T7729] pwc: recv_control_msg error -32 req 02 val 2c00 [ 766.613854][ T7729] pwc: recv_control_msg error -32 req 04 val 1000 [ 766.855280][ T7729] pwc: recv_control_msg error -32 req 04 val 1400 [ 766.879344][ T7729] pwc: recv_control_msg error -32 req 02 val 2000 [ 766.936067][ T7729] pwc: recv_control_msg error -32 req 02 val 2100 [ 766.948762][ T7729] pwc: recv_control_msg error -32 req 04 val 1500 [ 766.964141][ T7729] pwc: recv_control_msg error -32 req 02 val 2500 [ 766.983477][ T7729] pwc: recv_control_msg error -32 req 02 val 2400 [ 767.006239][ T7729] pwc: recv_control_msg error -32 req 02 val 2600 [ 767.029565][ T7729] pwc: recv_control_msg error -32 req 02 val 2900 [ 767.258711][T11442] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1278'. [ 767.268737][ T7729] pwc: recv_control_msg error -71 req 04 val 1100 [ 767.348405][ T7729] pwc: recv_control_msg error -71 req 04 val 1200 [ 767.391216][ T7729] pwc: Registered as video103. [ 767.438157][ T7729] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input27 [ 767.487668][ T7729] usb 4-1: USB disconnect, device number 38 [ 768.385109][T11476] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 768.977186][T11467] kexec: Could not allocate control_code_buffer [ 769.580355][T11485] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 769.838512][T11491] ptrace attach of "./syz-executor exec"[7979] was attempted by " [ 770.841396][T11495] ptrace attach of "./syz-executor exec"[5825] was attempted by " [ 771.588170][T11498] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 771.933236][T11502] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 772.036880][T11504] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1296'. [ 774.639784][T11524] 9pnet_fd: Insufficient options for proto=fd [ 774.657333][T11524] siw: device registration error -23 [ 776.192424][T11535] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 776.648095][T11536] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 778.425000][T11553] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1309'. [ 779.268299][T11561] 9pnet_fd: Insufficient options for proto=fd [ 779.285530][T11561] siw: device registration error -23 [ 780.427548][T11564] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 780.723661][T11570] netlink: 'syz.2.1316': attribute type 1 has an invalid length. [ 781.000866][T11579] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 781.020878][T11570] 8021q: adding VLAN 0 to HW filter on device bond1 [ 781.038271][T11581] program syz.1.1317 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 782.194186][T11587] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1320'. [ 782.258456][T11586] 9pnet_fd: Insufficient options for proto=fd [ 787.023722][T11626] siw: device registration error -23 [ 788.060970][T11632] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 788.373751][T11640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1335'. [ 789.138853][ T44] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 789.318551][ T44] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 789.328514][ T44] usb 3-1: config 0 has no interface number 0 [ 789.341808][ T44] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 789.352054][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.374643][ T44] usb 3-1: Product: syz [ 789.394051][ T44] usb 3-1: Manufacturer: syz [ 789.412142][ T44] usb 3-1: SerialNumber: syz [ 790.425384][T11664] 9pnet_fd: Insufficient options for proto=fd [ 790.442654][T11664] siw: device registration error -23 [ 790.765849][ T44] usb 3-1: config 0 descriptor?? [ 790.885788][ T7745] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 790.962533][T11666] siw: device registration error -23 [ 791.175825][ T7745] usb 2-1: Using ep0 maxpacket: 8 [ 791.212239][ T7745] usb 2-1: unable to get BOS descriptor or descriptor too short [ 791.222697][ T7745] usb 2-1: config 248 has an invalid interface number: 51 but max is 0 [ 791.245878][ T7745] usb 2-1: config 248 has no interface number 0 [ 791.264980][ T44] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 791.294720][ T7745] usb 2-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 791.309569][ T44] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 791.321071][ T7745] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.335405][ T7745] usb 2-1: Product: syz [ 791.366042][ T44] asix 3-1:0.251: probe with driver asix failed with error -5 [ 791.380263][ T7745] usb 2-1: Manufacturer: syz [ 791.444711][ T7745] usb 2-1: SerialNumber: syz [ 792.630274][ T7745] usbhid 2-1:248.51: couldn't find an input interrupt endpoint [ 792.716229][ T7745] usb 2-1: USB disconnect, device number 23 [ 792.931612][T11680] program syz.4.1348 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 794.920860][ T44] usb 3-1: USB disconnect, device number 26 [ 798.233991][T11704] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 799.078687][T11715] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 800.196583][T11722] openvswitch: : Dropping previously announced user features [ 801.586795][ T7764] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 801.687823][T11728] nbd3: detected capacity change from 0 to 63 [ 801.701638][ T5824] block nbd3: Receive control failed (result -104) [ 801.746525][ T7764] usb 5-1: Using ep0 maxpacket: 8 [ 801.764132][ T7764] usb 5-1: unable to get BOS descriptor or descriptor too short [ 801.805454][ T7764] usb 5-1: config 248 has an invalid interface number: 51 but max is 0 [ 801.833244][ T7764] usb 5-1: config 248 has no interface number 0 [ 801.850927][ T7764] usb 5-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 801.867198][ T7764] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.007565][ T7729] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 802.017033][ T7764] usb 5-1: Product: syz [ 802.021387][ T7764] usb 5-1: Manufacturer: syz [ 802.026603][ T7764] usb 5-1: SerialNumber: syz [ 804.160114][ T7729] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 804.180344][ T7729] usb 3-1: config 0 has no interface number 0 [ 804.200780][ T7729] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 804.210053][ T7729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.219222][ T7729] usb 3-1: Product: syz [ 804.223654][ T7729] usb 3-1: Manufacturer: syz [ 804.243031][ T7729] usb 3-1: SerialNumber: syz [ 804.252583][ T7729] usb 3-1: config 0 descriptor?? [ 804.343662][ T7764] usbhid 5-1:248.51: couldn't find an input interrupt endpoint [ 804.372496][ T7764] usb 5-1: USB disconnect, device number 23 [ 804.664932][ T7729] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 804.682919][ T7729] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 804.704856][ T7729] asix 3-1:0.251: probe with driver asix failed with error -5 [ 804.911292][T11752] fuse: Bad value for 'fd' [ 806.896299][ T7729] usb 3-1: USB disconnect, device number 27 [ 807.552283][T11776] ptrace attach of "./syz-executor exec"[5825] was attempted by " [ 807.957653][T11778] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1372'. [ 810.460336][T11792] program syz.5.1377 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 811.509197][T11814] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 814.013595][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.021183][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 816.882512][T11845] ptrace attach of "./syz-executor exec"[5833] was attempted by " [ 817.392129][T11860] netlink: 'syz.2.1400': attribute type 10 has an invalid length. [ 817.483427][ C0] vkms_vblank_simulate: vblank timer overrun [ 817.686627][T11864] 9pnet_fd: Insufficient options for proto=fd [ 817.700712][T11864] siw: device registration error -23 [ 818.329678][ T7764] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 818.498861][T11872] netlink: 'syz.3.1404': attribute type 27 has an invalid length. [ 818.667881][ T7764] usb 2-1: config 0 has an invalid interface number: 11 but max is 0 [ 818.676435][ T7764] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 818.695450][ T7764] usb 2-1: config 0 has no interface number 0 [ 818.701733][ T7764] usb 2-1: config 0 interface 11 altsetting 253 endpoint 0x7 has invalid maxpacket 32768, setting to 1024 [ 818.713228][ T7764] usb 2-1: config 0 interface 11 altsetting 253 bulk endpoint 0x7 has invalid maxpacket 1024 [ 819.417079][ T7764] usb 2-1: config 0 interface 11 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 819.503639][ T7764] usb 2-1: config 0 interface 11 has no altsetting 0 [ 819.543891][ T7764] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 819.597996][ T7764] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 819.671210][ T7764] usb 2-1: config 0 descriptor?? [ 820.207051][ T7764] keyspan 2-1:0.11: Keyspan 2 port adapter converter detected [ 820.245741][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 87 [ 820.285123][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 81 [ 820.326325][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 82 [ 820.344615][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 1 [ 820.378668][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 2 [ 820.403996][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 85 [ 820.430631][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 5 [ 820.457914][ T7764] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 820.487955][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 83 [ 820.500132][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 84 [ 820.537704][ T7745] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 820.546660][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 3 [ 820.586938][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 4 [ 820.639838][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 86 [ 820.673931][ T7764] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 6 [ 820.692759][ T7764] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 820.862850][ T7745] usb 5-1: Using ep0 maxpacket: 32 [ 820.865465][ T7764] usb 2-1: USB disconnect, device number 24 [ 820.881964][ T7764] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 820.910708][ T7764] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 820.930940][ T7745] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 820.969436][ T7745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 820.970699][ T7764] keyspan 2-1:0.11: device disconnected [ 820.987489][ T7745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 821.000238][ T7745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 821.039415][ T7745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 821.104288][T11899] ptrace attach of "./syz-executor exec"[7979] was attempted by " [ 821.110241][ T7745] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 821.579839][ T7745] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.596291][ T7745] usb 5-1: Product: syz [ 821.615729][ T7745] usb 5-1: Manufacturer: syz [ 821.620413][ T7745] usb 5-1: SerialNumber: syz [ 821.646714][ T7745] usb 5-1: config 0 descriptor?? [ 822.543750][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 822.556710][ T7745] input input28: Device does not respond to id packet M [ 822.579653][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 822.595988][ T7745] input input28: Device does not respond to id packet P [ 822.609773][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 822.660857][ T7745] input input28: Device does not respond to id packet B [ 822.680389][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 822.697765][ T7745] input input28: Device does not respond to id packet N [ 822.710645][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 822.761197][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 822.794397][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 822.812339][ T7745] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 822.841609][ T7745] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input28 [ 822.933619][ T7745] usb 5-1: USB disconnect, device number 24 [ 826.148585][T11936] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 826.325756][T11941] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 829.203920][T11965] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1432'. [ 831.611104][T11989] ptrace attach of "./syz-executor exec"[5825] was attempted by " [ 831.676799][T11991] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 832.102964][ T11] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 30 seconds [ 832.113965][ T11] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 30 seconds [ 832.126790][ T11] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 30 seconds [ 832.143366][ T11] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 30 seconds [ 834.370809][T12005] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 835.536950][T12018] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1449'. [ 836.108922][T12029] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 836.827157][T12040] program syz.5.1452 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 839.036286][T12046] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1455'. [ 839.390940][T12051] program syz.5.1456 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 841.210219][T12054] netlink: 'syz.5.1459': attribute type 27 has an invalid length. [ 842.315440][T12071] 9pnet_fd: Insufficient options for proto=fd [ 842.332403][T12071] siw: device registration error -23 [ 843.195112][T12072] mac80211_hwsim hwsim10 wlan1: entered allmulticast mode [ 843.785843][ T7764] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 844.911297][ T7764] usb 4-1: config 0 has no interfaces? [ 845.013697][ T7764] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 845.148066][ T7764] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 845.330207][ T7764] usb 4-1: Product: syz [ 845.334490][ T7764] usb 4-1: Manufacturer: syz [ 845.348973][ T7764] usb 4-1: SerialNumber: syz [ 846.007631][ T7764] usb 4-1: config 0 descriptor?? [ 847.965905][ T7764] usb 4-1: can't set config #0, error -71 [ 848.007494][ T7764] usb 4-1: USB disconnect, device number 39 [ 852.035394][T12145] 9pnet_fd: Insufficient options for proto=fd [ 854.307443][T12159] netlink: 'syz.4.1488': attribute type 11 has an invalid length. [ 854.315340][T12159] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1488'. [ 855.180043][T12162] netlink: 'syz.4.1490': attribute type 27 has an invalid length. [ 855.516284][T12165] nbd2: detected capacity change from 0 to 63 [ 855.539362][T12169] block nbd2: NBD_DISCONNECT [ 855.567139][T12169] block nbd2: Disconnected due to user request. [ 855.601465][T12169] block nbd2: shutting down sockets [ 855.623047][ C1] blk_print_req_error: 286 callbacks suppressed [ 855.623069][ C1] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 855.638565][ C1] buffer_io_error: 286 callbacks suppressed [ 855.638584][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 855.652348][ C1] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 855.661472][ C1] Buffer I/O error on dev nbd2, logical block 1, async page read [ 855.669344][ C1] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 855.678457][ C1] Buffer I/O error on dev nbd2, logical block 2, async page read [ 855.686329][ C1] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 855.695426][ C1] Buffer I/O error on dev nbd2, logical block 3, async page read [ 855.746549][ T8506] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 855.764446][ T8506] Buffer I/O error on dev nbd2, logical block 0, async page read [ 855.933287][ T8506] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 856.232808][T12185] netlink: 'syz.1.1489': attribute type 11 has an invalid length. [ 856.240858][T12185] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1489'. [ 856.905904][ T8506] Buffer I/O error on dev nbd2, logical block 1, async page read [ 856.913935][ T8506] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 857.165828][ T8506] Buffer I/O error on dev nbd2, logical block 2, async page read [ 857.173827][ T8506] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 857.213604][ T8506] Buffer I/O error on dev nbd2, logical block 3, async page read [ 857.242713][ T8506] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 857.442528][ T8506] Buffer I/O error on dev nbd2, logical block 0, async page read [ 857.976553][ T8506] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 858.466422][ T8506] Buffer I/O error on dev nbd2, logical block 1, async page read [ 858.798828][ T8506] ldm_validate_partition_table(): Disk read failed. [ 858.904611][ T8506] Dev nbd2: unable to read RDB block 0 [ 858.948979][ T8506] nbd2: unable to read partition table [ 859.102259][T12213] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1499'. [ 860.092811][ T8506] ldm_validate_partition_table(): Disk read failed. [ 860.150954][T12215] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 860.162073][ T8506] Dev nbd2: unable to read RDB block 0 [ 860.258029][ T8506] nbd2: unable to read partition table [ 860.344939][T12209] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1498'. [ 861.486593][T12233] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1501'. [ 861.818342][T12250] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 862.393256][T12265] netlink: 'syz.1.1506': attribute type 10 has an invalid length. [ 862.405185][T12265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 862.438626][T12265] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 862.670870][ T11] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 60 seconds [ 862.683083][ T11] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 60 seconds [ 862.694903][ T11] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 60 seconds [ 863.145262][T12272] netlink: 'syz.3.1509': attribute type 11 has an invalid length. [ 863.153370][T12272] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1509'. [ 863.665328][ T11] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 60 seconds [ 864.663312][ T7730] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 864.765969][ T7764] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 864.842010][ T7730] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 864.879964][ T7730] usb 5-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 864.919491][ T7730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.936893][ T7730] usb 5-1: config 0 descriptor?? [ 864.966054][ T7764] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 864.988524][ T7730] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 865.004440][ T7764] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 865.040430][ T7764] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 865.066548][ T7764] usb 4-1: config 0 descriptor?? [ 865.098124][ T7764] pwc: Askey VC010 type 2 USB webcam detected. [ 865.503805][ T7764] pwc: recv_control_msg error -32 req 02 val 2b00 [ 865.527751][ T7764] pwc: recv_control_msg error -32 req 02 val 2700 [ 865.546263][ T7764] pwc: recv_control_msg error -32 req 02 val 2c00 [ 865.554209][ T7764] pwc: recv_control_msg error -32 req 04 val 1000 [ 865.579434][ T7764] pwc: recv_control_msg error -32 req 04 val 1300 [ 865.600440][ T7764] pwc: recv_control_msg error -32 req 04 val 1400 [ 865.622782][ T7764] pwc: recv_control_msg error -32 req 02 val 2000 [ 865.718209][T12303] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 865.751039][ T7764] pwc: recv_control_msg error -32 req 02 val 2100 [ 865.873565][T12310] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1512'. [ 866.452217][ T7764] pwc: recv_control_msg error -32 req 04 val 1500 [ 866.474099][ T7764] pwc: recv_control_msg error -32 req 02 val 2500 [ 866.659256][ T7764] pwc: recv_control_msg error -32 req 02 val 2400 [ 867.120720][ T7764] pwc: recv_control_msg error -32 req 02 val 2600 [ 867.149159][ T7764] pwc: recv_control_msg error -32 req 02 val 2900 [ 867.467864][ T7764] pwc: recv_control_msg error -71 req 04 val 1100 [ 867.496012][ T7764] pwc: recv_control_msg error -71 req 04 val 1200 [ 867.525872][ T7764] pwc: Registered as video103. [ 867.550021][ T7764] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input29 [ 868.335782][ T7764] usb 4-1: USB disconnect, device number 40 [ 868.496127][ T7730] usb 5-1: USB disconnect, device number 25 [ 868.648375][T12331] netlink: 136 bytes leftover after parsing attributes in process `syz.5.1521'. [ 868.705282][T12331] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 869.553220][T12352] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1525'. [ 869.744612][T12352] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1525'. [ 869.765467][T12352] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1525'. [ 870.668007][T12365] fuse: Bad value for 'fd' [ 870.911067][T12369] random: crng reseeded on system resumption [ 872.438514][T12377] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 874.296415][ T7764] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 874.377558][T12392] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1534'. [ 874.485748][ T7764] usb 6-1: Using ep0 maxpacket: 8 [ 874.493547][ T7764] usb 6-1: unable to get BOS descriptor or descriptor too short [ 874.507338][ T7764] usb 6-1: config 248 has an invalid interface number: 51 but max is 0 [ 874.570130][ T7764] usb 6-1: config 248 has no interface number 0 [ 874.802877][T12409] ptrace attach of "./syz-executor exec"[5825] was attempted by " [ 875.233017][T12411] netlink: 'syz.4.1538': attribute type 11 has an invalid length. [ 875.548537][T12411] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1538'. [ 875.555290][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.564740][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 875.593148][ T7764] usb 6-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 875.658178][ T7764] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.046733][ T7764] usb 6-1: Product: syz [ 876.050979][ T7764] usb 6-1: Manufacturer: syz [ 876.091639][ T7764] usb 6-1: SerialNumber: syz [ 876.361185][ T7764] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:248.51/input/input30 [ 876.408926][ T5180] bcm5974 6-1:248.51: could not read from device [ 876.454230][T12422] netlink: 'syz.4.1541': attribute type 1 has an invalid length. [ 876.482123][ T7764] usb 6-1: USB disconnect, device number 17 [ 876.495180][ T5180] bcm5974 6-1:248.51: could not read from device [ 876.746573][T12422] 8021q: adding VLAN 0 to HW filter on device bond3 [ 877.106267][T12423] veth5: entered promiscuous mode [ 878.307593][T12439] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 878.616228][ T7764] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 879.048988][T12458] ptrace attach of "./syz-executor exec"[5833] was attempted by " [ 879.709685][ T7764] usb 3-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 879.848578][ T7764] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.892187][ T7764] usb 3-1: config 0 descriptor?? [ 880.067547][ T7746] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 880.246057][ T7746] usb 2-1: Using ep0 maxpacket: 8 [ 880.254050][ T7746] usb 2-1: config 6 has an invalid interface number: 2 but max is 0 [ 880.288532][ T7746] usb 2-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 880.344953][ T7746] usb 2-1: config 6 has no interface number 0 [ 880.362276][ T7746] usb 2-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 880.503059][ T7746] usb 2-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 880.681282][ T7746] usb 2-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 881.258548][ T7764] pegasus 3-1:0.0: probe with driver pegasus failed with error -121 [ 881.360744][ T7746] usb 2-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 881.424288][ T7764] usb 3-1: USB disconnect, device number 28 [ 881.485713][ T7746] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 881.505749][ T7746] usb 2-1: Product: syz [ 881.509995][ T7746] usb 2-1: Manufacturer: syz [ 881.514634][ T7746] usb 2-1: SerialNumber: syz [ 881.536082][ T7746] hso 2-1:6.2: Failed to find INT IN ep [ 881.867619][ T7745] usb 2-1: USB disconnect, device number 25 [ 882.581694][T12485] syz.4.1554 (12485) used greatest stack depth: 19584 bytes left [ 884.765759][T12513] nbd4: detected capacity change from 0 to 63 [ 884.806170][T12516] block nbd4: NBD_DISCONNECT [ 884.814705][T12520] 9pnet_fd: Insufficient options for proto=fd [ 884.822540][T12520] siw: device registration error -23 [ 884.825969][T12516] block nbd4: Disconnected due to user request. [ 884.860478][T12516] block nbd4: shutting down sockets [ 885.112994][ C1] blk_print_req_error: 138 callbacks suppressed [ 885.113020][ C1] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 885.128529][ C1] buffer_io_error: 138 callbacks suppressed [ 885.128548][ C1] Buffer I/O error on dev nbd4, logical block 0, async page read [ 885.142345][ C1] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 885.151447][ C1] Buffer I/O error on dev nbd4, logical block 1, async page read [ 885.159308][ C1] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 885.168445][ C1] Buffer I/O error on dev nbd4, logical block 2, async page read [ 885.170368][T12529] block nbd1: NBD_DISCONNECT [ 885.176306][ C1] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 885.176338][ C1] Buffer I/O error on dev nbd4, logical block 3, async page read [ 885.826789][ T8506] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 885.885721][ T8506] Buffer I/O error on dev nbd4, logical block 0, async page read [ 885.963412][ T8506] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 886.048096][ T8506] Buffer I/O error on dev nbd4, logical block 1, async page read [ 886.113182][ T8506] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 886.208382][ T8506] Buffer I/O error on dev nbd4, logical block 2, async page read [ 886.293384][ T8506] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 886.380064][ T8506] Buffer I/O error on dev nbd4, logical block 3, async page read [ 886.401692][ T8506] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 886.462546][ T8506] Buffer I/O error on dev nbd4, logical block 0, async page read [ 886.480639][ T8506] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 886.559718][ T8506] Buffer I/O error on dev nbd4, logical block 1, async page read [ 886.658025][ T8506] ldm_validate_partition_table(): Disk read failed. [ 886.766997][ T8506] Dev nbd4: unable to read RDB block 0 [ 886.774693][ T8506] nbd4: unable to read partition table [ 886.786259][T12546] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1569'. [ 887.073061][ T8506] ldm_validate_partition_table(): Disk read failed. [ 887.111182][ T8506] Dev nbd4: unable to read RDB block 0 [ 887.164329][ T8506] nbd4: unable to read partition table [ 890.172059][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1580'. [ 890.758131][T12595] lo speed is unknown, defaulting to 1000 [ 892.980668][ T11] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 90 seconds [ 892.991392][ T11] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 90 seconds [ 893.002364][ T11] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 90 seconds [ 893.795782][ T11] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 90 seconds [ 894.069740][T12595] lo speed is unknown, defaulting to 1000 [ 894.071456][T12644] lo speed is unknown, defaulting to 1000 [ 894.755806][ T5951] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 894.998384][ T5951] usb 4-1: config 0 has no interfaces? [ 895.027242][ T5951] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 895.036956][ T5951] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.355575][ T5951] usb 4-1: Product: syz [ 895.606660][ T5951] usb 4-1: Manufacturer: syz [ 895.626012][ T5951] usb 4-1: SerialNumber: syz [ 895.648846][ T5951] usb 4-1: config 0 descriptor?? [ 897.144759][T12644] lo speed is unknown, defaulting to 1000 [ 897.259222][ T7730] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 897.439444][ T7730] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 897.453545][ T7730] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 897.612990][ T7730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.634387][ T7730] usb 5-1: config 0 descriptor?? [ 897.673331][ T7730] pwc: Askey VC010 type 2 USB webcam detected. [ 898.067996][ T7730] pwc: recv_control_msg error -32 req 02 val 2b00 [ 898.082285][ T7730] pwc: recv_control_msg error -32 req 02 val 2700 [ 898.109258][ T7730] pwc: recv_control_msg error -32 req 02 val 2c00 [ 898.123234][ T7730] pwc: recv_control_msg error -32 req 04 val 1000 [ 898.130688][ T7730] pwc: recv_control_msg error -32 req 04 val 1300 [ 898.140956][ T7730] pwc: recv_control_msg error -32 req 04 val 1400 [ 898.149154][ T7730] pwc: recv_control_msg error -32 req 02 val 2000 [ 898.158729][ T7730] pwc: recv_control_msg error -32 req 02 val 2100 [ 898.196304][ T7730] pwc: recv_control_msg error -32 req 04 val 1500 [ 898.204085][ T7730] pwc: recv_control_msg error -32 req 02 val 2500 [ 898.211787][ T7730] pwc: recv_control_msg error -32 req 02 val 2400 [ 898.219517][ T7730] pwc: recv_control_msg error -32 req 02 val 2600 [ 898.227298][ T7730] pwc: recv_control_msg error -32 req 02 val 2900 [ 898.234691][ T7730] pwc: recv_control_msg error -32 req 02 val 2800 [ 898.244736][ T7730] pwc: recv_control_msg error -32 req 04 val 1100 [ 898.252256][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 898.261884][ T7730] pwc: recv_control_msg error -32 req 04 val 1200 [ 898.272241][ T7730] pwc: Registered as video103. [ 898.304182][ T7730] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input31 [ 898.391052][ T7730] usb 5-1: USB disconnect, device number 26 [ 898.774696][T12697] lo speed is unknown, defaulting to 1000 [ 898.857227][ T7764] usb 4-1: USB disconnect, device number 41 [ 899.344850][T12710] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 899.689830][T12697] lo speed is unknown, defaulting to 1000 [ 899.788196][T12706] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1603'. [ 900.224129][ T44] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 900.886807][ T44] usb 2-1: Using ep0 maxpacket: 8 [ 900.919860][ T44] usb 2-1: unable to get BOS descriptor or descriptor too short [ 900.935832][ T44] usb 2-1: config 248 has an invalid interface number: 51 but max is 0 [ 900.944187][ T44] usb 2-1: config 248 has no interface number 0 [ 900.981742][ T44] usb 2-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 900.995439][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.018881][ T44] usb 2-1: Product: syz [ 901.029929][ T44] usb 2-1: Manufacturer: syz [ 901.050922][ T44] usb 2-1: SerialNumber: syz [ 901.208244][T12737] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1612'. [ 901.242414][T12737] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1612'. [ 901.289256][T12737] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1612'. [ 901.398153][ T5824] block nbd0: Receive control failed (result -107) [ 901.446943][T12737] nbd0: detected capacity change from 0 to 256 [ 901.460932][ T44] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:248.51/input/input32 [ 901.489023][ T5180] bcm5974 2-1:248.51: could not read from device [ 901.516235][ T44] usb 2-1: USB disconnect, device number 26 [ 901.526237][ T5180] bcm5974 2-1:248.51: could not read from device [ 901.550598][ T8421] block nbd0: Dead connection, failed to find a fallback [ 901.634149][ T8421] block nbd0: shutting down sockets [ 901.650401][ T8421] blk_print_req_error: 138 callbacks suppressed [ 901.650421][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 901.675327][ T8421] buffer_io_error: 138 callbacks suppressed [ 901.675345][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 901.787817][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 901.797141][ T7746] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 901.844841][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 901.900274][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 901.986871][ T7746] usb 3-1: config 0 has no interfaces? [ 901.998708][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 902.013130][ T7746] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 902.044079][ T7746] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.056448][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 902.065562][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 902.084648][ T7746] usb 3-1: Product: syz [ 902.099034][ T7746] usb 3-1: Manufacturer: syz [ 902.115209][ T7746] usb 3-1: SerialNumber: syz [ 902.120295][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 902.161781][ T7746] usb 3-1: config 0 descriptor?? [ 902.171327][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 902.214445][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 902.320187][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 902.499000][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 902.584866][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 902.937351][T12758] random: crng reseeded on system resumption [ 903.350616][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 903.424082][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 903.442446][ T8421] ldm_validate_partition_table(): Disk read failed. [ 903.590048][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 903.600036][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 903.660798][ T8421] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 903.759171][T12765] netlink: 'syz.5.1621': attribute type 11 has an invalid length. [ 903.767181][T12765] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1621'. [ 904.643275][ T8421] Buffer I/O error on dev nbd0, logical block 0, async page read [ 904.659059][ T8421] Dev nbd0: unable to read RDB block 0 [ 904.665267][ T8421] nbd0: unable to read partition table [ 904.709692][ T8421] ldm_validate_partition_table(): Disk read failed. [ 904.732092][ T8421] Dev nbd0: unable to read RDB block 0 [ 904.783167][ T8421] nbd0: unable to read partition table [ 905.310798][T12782] netlink: 'syz.3.1624': attribute type 11 has an invalid length. [ 905.319023][T12782] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1624'. [ 906.475763][ T7730] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 906.710863][ T7764] usb 3-1: USB disconnect, device number 29 [ 906.760245][ T7730] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 906.781173][ T7730] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 906.821336][ T7730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.863736][ T7730] usb 5-1: config 0 descriptor?? [ 906.923602][ T7730] pwc: Askey VC010 type 2 USB webcam detected. [ 907.604313][ T7730] pwc: recv_control_msg error -32 req 02 val 2b00 [ 907.746147][ T7730] pwc: recv_control_msg error -32 req 02 val 2700 [ 907.777752][ T7730] pwc: recv_control_msg error -32 req 02 val 2c00 [ 907.795770][ T7730] pwc: recv_control_msg error -32 req 04 val 1000 [ 907.810796][ T7730] pwc: recv_control_msg error -32 req 04 val 1300 [ 908.046099][ T7730] pwc: recv_control_msg error -32 req 04 val 1400 [ 908.048080][ T7730] pwc: recv_control_msg error -32 req 02 val 2000 [ 908.049407][ T7730] pwc: recv_control_msg error -32 req 02 val 2100 [ 908.053150][ T7730] pwc: recv_control_msg error -32 req 04 val 1500 [ 908.056475][ T7730] pwc: recv_control_msg error -32 req 02 val 2500 [ 908.057242][ T7730] pwc: recv_control_msg error -32 req 02 val 2400 [ 908.058367][ T7730] pwc: recv_control_msg error -32 req 02 val 2600 [ 908.059295][ T7730] pwc: recv_control_msg error -32 req 02 val 2900 [ 908.060395][ T7730] pwc: recv_control_msg error -32 req 02 val 2800 [ 908.061648][ T7730] pwc: recv_control_msg error -32 req 04 val 1100 [ 908.064486][ T7730] pwc: Registered as video103. [ 908.066900][ T7730] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input33 [ 908.522761][ T7730] usb 5-1: USB disconnect, device number 27 [ 908.771955][T12820] random: crng reseeded on system resumption [ 910.033328][T12830] lo speed is unknown, defaulting to 1000 [ 910.406081][T12837] netlink: 'syz.4.1637': attribute type 11 has an invalid length. [ 910.414116][T12837] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1637'. [ 914.789380][T12830] lo speed is unknown, defaulting to 1000 [ 916.823353][T12873] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 916.949934][T12889] nbd: must specify at least one socket [ 917.242317][T12893] lo speed is unknown, defaulting to 1000 [ 918.628106][T12916] nbd4: detected capacity change from 0 to 63 [ 918.655439][T12924] block nbd4: NBD_DISCONNECT [ 918.677196][T12924] block nbd4: Disconnected due to user request. [ 918.693635][T12895] lo speed is unknown, defaulting to 1000 [ 918.700687][T12893] lo speed is unknown, defaulting to 1000 [ 918.706661][T12924] block nbd4: shutting down sockets [ 918.743009][ C0] blk_print_req_error: 27 callbacks suppressed [ 918.743035][ C0] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 918.758480][ C0] buffer_io_error: 27 callbacks suppressed [ 918.758498][ C0] Buffer I/O error on dev nbd4, logical block 0, async page read [ 918.772217][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 918.781344][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 918.789351][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 918.798506][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 918.806391][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 918.815489][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 918.999878][ T8506] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 919.029052][ T8506] Buffer I/O error on dev nbd4, logical block 0, async page read [ 919.156597][T12931] 9pnet_fd: Insufficient options for proto=fd [ 919.757560][ T8506] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 919.783562][ T8506] Buffer I/O error on dev nbd4, logical block 1, async page read [ 919.791952][ T8506] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 919.804905][ T8506] Buffer I/O error on dev nbd4, logical block 2, async page read [ 919.814163][ T8506] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 919.833900][ T8506] Buffer I/O error on dev nbd4, logical block 3, async page read [ 919.854300][ T8506] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 919.869963][ T8506] Buffer I/O error on dev nbd4, logical block 0, async page read [ 919.894122][ T8506] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 919.925570][ T8506] Buffer I/O error on dev nbd4, logical block 1, async page read [ 919.947538][ T8506] ldm_validate_partition_table(): Disk read failed. [ 919.966449][ T8506] Dev nbd4: unable to read RDB block 0 [ 920.003886][ T8506] nbd4: unable to read partition table [ 920.066492][ T8506] ldm_validate_partition_table(): Disk read failed. [ 920.121091][ T8506] Dev nbd4: unable to read RDB block 0 [ 920.151548][ T8506] nbd4: unable to read partition table [ 920.310179][T12944] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 920.532130][T12895] lo speed is unknown, defaulting to 1000 [ 920.550653][T12931] siw: device registration error -23 [ 920.680190][T12947] nbd4: detected capacity change from 0 to 63 [ 920.805026][T12951] block nbd4: NBD_DISCONNECT [ 920.835435][T12951] block nbd4: Disconnected due to user request. [ 920.863228][T12951] block nbd4: shutting down sockets [ 920.934012][ T8506] ldm_validate_partition_table(): Disk read failed. [ 920.957659][ T8506] Dev nbd4: unable to read RDB block 0 [ 920.965428][ T8506] nbd4: unable to read partition table [ 921.033437][ T8506] ldm_validate_partition_table(): Disk read failed. [ 921.067860][ T8506] Dev nbd4: unable to read RDB block 0 [ 921.088931][ T8506] nbd4: unable to read partition table [ 921.705869][ T7764] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 922.485347][T12990] rdma_rxe: rxe_newlink: failed to add lo [ 923.014873][T12994] 9pnet_fd: Insufficient options for proto=fd [ 923.706147][ T11] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 120 seconds [ 923.719660][ T11] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 120 seconds [ 923.730997][ T11] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 120 seconds [ 923.786754][ T7764] usb 4-1: config 0 has no interfaces? [ 923.804835][ T7764] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 923.815892][ T7764] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.823911][ T7764] usb 4-1: Product: syz [ 923.828251][ T11] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 120 seconds [ 923.839890][ T7764] usb 4-1: Manufacturer: syz [ 923.844513][ T7764] usb 4-1: SerialNumber: syz [ 923.852249][ T7764] usb 4-1: config 0 descriptor?? [ 924.480828][T13004] netlink: 'syz.4.1675': attribute type 27 has an invalid length. [ 924.516934][ C0] syz_tun: tun_net_xmit 58 [ 924.675980][ C0] syz_tun: tun_net_xmit 58 [ 924.844779][ T5952] usb 4-1: USB disconnect, device number 42 [ 925.004687][T13011] lo speed is unknown, defaulting to 1000 [ 926.353186][T13011] lo speed is unknown, defaulting to 1000 [ 926.394381][T13027] siw: device registration error -23 [ 926.613496][T13037] 9pnet_fd: Insufficient options for proto=fd [ 926.630815][T13037] siw: device registration error -23 [ 927.316024][ T7764] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 927.476564][ T7764] usb 2-1: Using ep0 maxpacket: 8 [ 927.486879][ T7764] usb 2-1: config 6 has an invalid interface number: 2 but max is 0 [ 927.500150][ T7764] usb 2-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 927.722189][ T7764] usb 2-1: config 6 has no interface number 0 [ 927.953318][ T5824] Bluetooth: hci1: unexpected event for opcode 0x200c [ 928.385959][ T7764] usb 2-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 928.398519][ T7764] usb 2-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 928.408385][ T7764] usb 2-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 928.876143][T13052] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 928.892489][ T7764] usb 2-1: string descriptor 0 read error: -71 [ 928.965985][ T7764] usb 2-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 928.981332][T13055] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1686'. [ 929.004834][ T7764] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.088972][ T7764] usb 2-1: can't set config #6, error -71 [ 929.118618][ T7764] usb 2-1: USB disconnect, device number 27 [ 929.838987][ T7745] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 931.377432][ T7745] usb 2-1: config 0 has no interfaces? [ 931.430982][ T7745] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 931.443079][ T7745] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 931.464038][ T7745] usb 2-1: Product: syz [ 931.498661][ T7745] usb 2-1: Manufacturer: syz [ 931.622465][ T7745] usb 2-1: SerialNumber: syz [ 931.630801][ T7745] usb 2-1: config 0 descriptor?? [ 932.605648][T13098] siw: device registration error -23 [ 935.248298][T13127] rdma_rxe: rxe_newlink: failed to add lo [ 935.479400][T13132] lo speed is unknown, defaulting to 1000 [ 936.079562][ T7745] usb 2-1: USB disconnect, device number 28 [ 936.920848][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 936.927520][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 937.843180][T13132] lo speed is unknown, defaulting to 1000 [ 938.968359][T13182] 9pnet_fd: Insufficient options for proto=fd [ 943.734533][T13217] random: crng reseeded on system resumption [ 945.435329][ T5824] Bluetooth: hci1: unexpected event for opcode 0x200c [ 946.932547][T13256] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 949.025841][T13278] random: crng reseeded on system resumption [ 950.575847][ T5195] udevd[5195]: worker [8433] /devices/virtual/block/nbd3 is taking a long time [ 950.966017][ T5952] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 951.498366][ T5952] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 951.530002][ T5952] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 951.606719][ T5952] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 951.679692][ T5952] usb 4-1: config 0 descriptor?? [ 951.781008][ T5952] pwc: Askey VC010 type 2 USB webcam detected. [ 952.136046][ T5952] pwc: recv_control_msg error -32 req 02 val 2b00 [ 952.197525][ T5952] pwc: recv_control_msg error -32 req 02 val 2700 [ 952.223964][ T5952] pwc: recv_control_msg error -32 req 02 val 2c00 [ 952.260135][ T5952] pwc: recv_control_msg error -32 req 04 val 1000 [ 952.306436][ T5952] pwc: recv_control_msg error -32 req 04 val 1300 [ 952.325982][ T5952] pwc: recv_control_msg error -32 req 04 val 1400 [ 952.349344][ T5952] pwc: recv_control_msg error -32 req 02 val 2000 [ 952.400300][ T5952] pwc: recv_control_msg error -32 req 02 val 2100 [ 952.426770][ T5952] pwc: recv_control_msg error -32 req 04 val 1500 [ 952.656380][ T5952] pwc: recv_control_msg error -32 req 02 val 2500 [ 952.664464][ T5952] pwc: recv_control_msg error -32 req 02 val 2400 [ 952.674499][ T5952] pwc: recv_control_msg error -32 req 02 val 2600 [ 952.687793][ T5952] pwc: recv_control_msg error -32 req 02 val 2900 [ 953.475046][ T5952] pwc: recv_control_msg error -32 req 02 val 2800 [ 953.695952][ T5952] pwc: recv_control_msg error -71 req 04 val 1200 [ 954.182811][ T5952] pwc: Registered as video103. [ 954.525764][ T55] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 150 seconds [ 954.536647][ T55] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 150 seconds [ 954.547754][ T55] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 150 seconds [ 954.558918][ T55] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 150 seconds [ 954.567525][ T5952] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input34 [ 954.746284][ T5952] usb 4-1: USB disconnect, device number 43 [ 954.871908][ T8421] udevd[8421]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 955.472812][T13338] lo speed is unknown, defaulting to 1000 [ 956.060070][T13338] lo speed is unknown, defaulting to 1000 [ 957.586346][ T7730] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 958.648365][ T7730] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 958.658799][ T7730] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 958.668405][ T7730] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.690405][ T7730] usb 2-1: config 0 descriptor?? [ 959.209393][ T7730] pwc: Askey VC010 type 2 USB webcam detected. [ 959.633584][ T7730] pwc: recv_control_msg error -32 req 02 val 2b00 [ 959.661711][ T7730] pwc: recv_control_msg error -32 req 02 val 2700 [ 959.685722][ T7730] pwc: recv_control_msg error -32 req 02 val 2c00 [ 959.709416][ T7730] pwc: recv_control_msg error -32 req 04 val 1000 [ 959.763090][ T7730] pwc: recv_control_msg error -32 req 04 val 1300 [ 959.772432][ T7730] pwc: recv_control_msg error -32 req 04 val 1400 [ 959.835859][ T7730] pwc: recv_control_msg error -32 req 02 val 2000 [ 959.862016][ T7730] pwc: recv_control_msg error -32 req 02 val 2100 [ 959.887521][ T7730] pwc: recv_control_msg error -32 req 04 val 1500 [ 959.897386][ T7730] pwc: recv_control_msg error -32 req 02 val 2500 [ 959.934135][ T7730] pwc: recv_control_msg error -32 req 02 val 2400 [ 959.958345][ T7730] pwc: recv_control_msg error -32 req 02 val 2600 [ 959.977711][ T7730] pwc: recv_control_msg error -32 req 02 val 2900 [ 959.987683][ T7730] pwc: recv_control_msg error -32 req 02 val 2800 [ 960.196127][ T7730] pwc: recv_control_msg error -71 req 04 val 1200 [ 960.213563][ T7730] pwc: Registered as video103. [ 960.254997][ T7730] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input35 [ 960.314302][ T7730] usb 2-1: USB disconnect, device number 29 [ 960.389439][T13414] 9pnet_fd: Insufficient options for proto=fd [ 961.205856][ T5952] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 961.353033][T13428] lo speed is unknown, defaulting to 1000 [ 961.375422][ T5952] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 961.411326][ T5952] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 961.450362][ T5952] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.158911][ T5952] usb 4-1: config 0 descriptor?? [ 962.441924][ T5952] pwc: Askey VC010 type 2 USB webcam detected. [ 962.839589][T13440] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1765'. [ 962.892283][ T5952] pwc: recv_control_msg error -32 req 02 val 2b00 [ 962.911456][ T5952] pwc: recv_control_msg error -32 req 02 val 2700 [ 962.972948][ T5952] pwc: recv_control_msg error -32 req 02 val 2c00 [ 963.194188][ T5952] pwc: recv_control_msg error -32 req 04 val 1300 [ 963.236121][ T5952] pwc: recv_control_msg error -32 req 04 val 1400 [ 963.243447][ T5952] pwc: recv_control_msg error -32 req 02 val 2000 [ 963.256897][ T5952] pwc: recv_control_msg error -32 req 02 val 2100 [ 963.274420][ T5952] pwc: recv_control_msg error -32 req 04 val 1500 [ 963.274487][T13428] lo speed is unknown, defaulting to 1000 [ 963.289328][T13432] rdma_rxe: rxe_newlink: failed to add lo [ 963.296076][ T5952] pwc: recv_control_msg error -32 req 02 val 2500 [ 963.322846][ T5952] pwc: recv_control_msg error -32 req 02 val 2400 [ 963.340798][ T5952] pwc: recv_control_msg error -32 req 02 val 2600 [ 963.365563][ T5952] pwc: recv_control_msg error -32 req 02 val 2900 [ 963.577446][ T5952] pwc: recv_control_msg error -71 req 04 val 1100 [ 963.590864][ T5952] pwc: recv_control_msg error -71 req 04 val 1200 [ 963.621383][ T5952] pwc: Registered as video103. [ 965.522139][ T5952] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input36 [ 968.437731][ T5952] usb 4-1: USB disconnect, device number 44 [ 969.890544][ T7746] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 970.444333][ T5824] Bluetooth: hci5: unexpected event for opcode 0x200c [ 970.842336][ T7746] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 970.855804][ T7746] usb 5-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 970.864903][ T7746] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.942547][ T7746] usb 5-1: config 0 descriptor?? [ 971.056182][ T7746] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 973.004766][ T5824] Bluetooth: hci2: unexpected event for opcode 0x200c [ 974.686372][T13522] nbd1: detected capacity change from 0 to 63 [ 974.693064][ T7729] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 974.878586][T13525] netlink: 'syz.2.1783': attribute type 11 has an invalid length. [ 974.888749][T13525] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1783'. [ 974.944003][ T5824] block nbd1: Receive control failed (result -32) [ 975.002925][ T8506] block nbd1: Dead connection, failed to find a fallback [ 975.097702][ T8506] block nbd1: shutting down sockets [ 975.127166][ T7729] usb 6-1: Using ep0 maxpacket: 8 [ 975.148299][ T8506] blk_print_req_error: 286 callbacks suppressed [ 975.148340][ T8506] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.174296][ T7746] usb 5-1: USB disconnect, device number 28 [ 975.210863][ T7729] usb 6-1: config 6 has an invalid interface number: 2 but max is 0 [ 975.214977][ T8506] buffer_io_error: 286 callbacks suppressed [ 975.214999][ T8506] Buffer I/O error on dev nbd1, logical block 0, async page read [ 975.236934][ T8506] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.253279][ T8506] Buffer I/O error on dev nbd1, logical block 1, async page read [ 975.261371][ T8506] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.267348][ T7729] usb 6-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 975.273566][ T8506] Buffer I/O error on dev nbd1, logical block 2, async page read [ 975.289902][ T8506] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.301785][ T8506] Buffer I/O error on dev nbd1, logical block 3, async page read [ 975.309853][ T8506] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.319010][ T8506] Buffer I/O error on dev nbd1, logical block 0, async page read [ 975.327274][ T8506] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.336444][ T8506] Buffer I/O error on dev nbd1, logical block 1, async page read [ 975.344389][ T8506] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.420652][ T8506] Buffer I/O error on dev nbd1, logical block 2, async page read [ 975.470985][ T8506] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.750733][ T8506] Buffer I/O error on dev nbd1, logical block 3, async page read [ 975.795405][ T8506] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.871953][ T8506] Buffer I/O error on dev nbd1, logical block 0, async page read [ 975.887203][ T7729] usb 6-1: config 6 has no interface number 0 [ 975.893483][ T7729] usb 6-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 975.905100][ T7729] usb 6-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 975.916113][ T7729] usb 6-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 975.954532][ T8506] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 975.980506][ T8506] Buffer I/O error on dev nbd1, logical block 1, async page read [ 976.052255][ T7729] usb 6-1: string descriptor 0 read error: -71 [ 976.061496][ T8506] ldm_validate_partition_table(): Disk read failed. [ 976.072278][ T7729] usb 6-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 976.086393][ T8506] Dev nbd1: unable to read RDB block 0 [ 976.094534][ T8506] nbd1: unable to read partition table [ 976.100713][ T7729] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.112608][ T7729] usb 6-1: can't set config #6, error -71 [ 976.789374][ T7729] usb 6-1: USB disconnect, device number 18 [ 976.816526][ T8506] ldm_validate_partition_table(): Disk read failed. [ 977.001953][T13558] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1793'. [ 977.632371][ T8506] Dev nbd1: unable to read RDB block 0 [ 977.917745][ T8506] nbd1: unable to read partition table [ 979.055982][ T7745] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 979.110116][T13574] netlink: 'syz.4.1797': attribute type 11 has an invalid length. [ 979.118166][T13574] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1797'. [ 979.827386][ T7745] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 979.841847][ T7745] usb 4-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 979.920349][ T7745] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 979.961728][ T7745] usb 4-1: config 0 descriptor?? [ 980.013345][ T7745] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 980.156147][T13579] nbd5: detected capacity change from 0 to 63 [ 980.192825][ T5824] block nbd5: Receive control failed (result -104) [ 982.306066][ T44] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 982.518045][ T44] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 982.560202][ T44] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 982.612839][ T44] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.649039][ T44] usb 6-1: config 0 descriptor?? [ 982.682099][ T44] pwc: Askey VC010 type 2 USB webcam detected. [ 983.084124][ T44] pwc: recv_control_msg error -32 req 02 val 2b00 [ 983.110449][ T44] pwc: recv_control_msg error -32 req 02 val 2700 [ 983.129704][ T44] pwc: recv_control_msg error -32 req 02 val 2c00 [ 983.147487][T13619] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1807'. [ 983.398510][ T44] pwc: recv_control_msg error -32 req 04 val 1300 [ 983.501975][ T44] pwc: recv_control_msg error -32 req 04 val 1400 [ 983.642071][ T44] pwc: recv_control_msg error -32 req 02 val 2000 [ 983.792999][ T7745] usb 4-1: USB disconnect, device number 45 [ 983.816055][ T44] pwc: recv_control_msg error -32 req 02 val 2100 [ 983.938527][ T44] pwc: recv_control_msg error -32 req 04 val 1500 [ 983.969735][ T44] pwc: recv_control_msg error -32 req 02 val 2500 [ 984.022224][ T44] pwc: recv_control_msg error -32 req 02 val 2400 [ 984.062885][ T44] pwc: recv_control_msg error -32 req 02 val 2600 [ 984.082634][ T44] pwc: recv_control_msg error -32 req 02 val 2900 [ 984.303344][ T44] pwc: recv_control_msg error -71 req 04 val 1100 [ 984.492163][T13630] 9pnet_fd: Insufficient options for proto=fd [ 984.499961][T13630] siw: device registration error -23 [ 984.975873][ T44] pwc: recv_control_msg error -71 req 04 val 1200 [ 985.005840][ T44] pwc: Registered as video103. [ 985.139402][ T55] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 180 seconds [ 985.151481][ T55] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 180 seconds [ 985.163422][ T55] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 180 seconds [ 985.189384][ T55] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 180 seconds [ 985.354876][ T44] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input37 [ 985.985887][ T44] usb 6-1: USB disconnect, device number 19 [ 986.487778][T13644] nbd: nbd3 already in use [ 987.953583][T13662] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 990.162771][T13689] netlink: 'syz.2.1821': attribute type 11 has an invalid length. [ 990.170760][T13689] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1821'. [ 991.235709][ T979] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 991.633401][ T979] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 991.660536][T13705] sz1: rxe_newlink: already configured on lo [ 991.987617][ T979] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 992.394627][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 992.439459][ T979] usb 3-1: config 0 descriptor?? [ 992.467730][ T979] pwc: Askey VC010 type 2 USB webcam detected. [ 993.375126][ T979] pwc: recv_control_msg error -32 req 02 val 2b00 [ 993.616402][ T979] pwc: recv_control_msg error -32 req 02 val 2700 [ 993.755016][ T979] pwc: recv_control_msg error -32 req 02 val 2c00 [ 993.984068][ T979] pwc: recv_control_msg error -32 req 04 val 1300 [ 994.118853][ T979] pwc: recv_control_msg error -32 req 04 val 1400 [ 994.173245][ T979] pwc: recv_control_msg error -32 req 02 val 2000 [ 994.257768][ T979] pwc: recv_control_msg error -32 req 02 val 2100 [ 994.658886][ T979] pwc: recv_control_msg error -32 req 04 val 1500 [ 994.687835][ T979] pwc: recv_control_msg error -32 req 02 val 2500 [ 994.707048][ T979] pwc: recv_control_msg error -32 req 02 val 2400 [ 994.731688][ T979] pwc: recv_control_msg error -32 req 02 val 2600 [ 994.747234][ T979] pwc: recv_control_msg error -32 req 02 val 2900 [ 994.972871][ T979] pwc: recv_control_msg error -71 req 04 val 1100 [ 995.411588][ T979] pwc: recv_control_msg error -71 req 04 val 1200 [ 995.433475][ T979] pwc: Registered as video103. [ 995.468170][ T979] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input38 [ 995.520380][ T979] usb 3-1: USB disconnect, device number 30 [ 996.024426][T13736] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 997.835817][ T979] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 998.629465][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 998.641606][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 998.754701][ T979] usb 6-1: Using ep0 maxpacket: 16 [ 998.793292][T13771] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1838'. [ 998.829232][ T979] usb 6-1: config index 0 descriptor too short (expected 59154, got 18) [ 998.895128][ T979] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 998.938129][ T979] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 999.000441][ T979] usb 6-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 999.023409][ T979] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.040468][ T979] usb 6-1: Product: syz [ 999.080698][ T979] usb 6-1: Manufacturer: syz [ 999.085391][ T979] usb 6-1: SerialNumber: syz [ 999.125084][ T979] usb 6-1: config 0 descriptor?? [ 999.138589][ T979] ssu100 6-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 999.829525][ T979] ssu100 6-1:0.0: probe with driver ssu100 failed with error -110 [ 1001.350633][T13784] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 1002.585981][ T7729] usb 6-1: USB disconnect, device number 20 [ 1003.185682][ T7729] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1003.206183][T13797] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1845'. [ 1004.253111][ T7729] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1004.296696][ T7729] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1004.319721][ T7729] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1004.350624][ T7729] usb 6-1: config 0 descriptor?? [ 1004.388323][ T7729] pwc: Askey VC010 type 2 USB webcam detected. [ 1004.871133][ T7729] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1005.036555][ T7729] pwc: recv_control_msg error -32 req 02 val 2700 [ 1005.274247][ T7729] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1005.823708][ T7729] pwc: recv_control_msg error -32 req 04 val 1300 [ 1005.837986][ T7729] pwc: recv_control_msg error -32 req 04 val 1400 [ 1005.853073][ T7729] pwc: recv_control_msg error -32 req 02 val 2000 [ 1005.864325][ T7729] pwc: recv_control_msg error -32 req 02 val 2100 [ 1005.872302][ T7729] pwc: recv_control_msg error -32 req 04 val 1500 [ 1005.880156][ T7729] pwc: recv_control_msg error -32 req 02 val 2500 [ 1005.889746][ T7729] pwc: recv_control_msg error -32 req 02 val 2400 [ 1005.890374][ T7729] pwc: recv_control_msg error -32 req 02 val 2600 [ 1005.891289][ T7729] pwc: recv_control_msg error -32 req 02 val 2900 [ 1006.094923][ T7729] pwc: recv_control_msg error -71 req 04 val 1100 [ 1006.144902][ T7729] pwc: recv_control_msg error -71 req 04 val 1200 [ 1006.185514][T13799] syz.3.1846 (13799): drop_caches: 2 [ 1006.236712][ T7729] pwc: Registered as video103. [ 1006.280788][ T7729] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input39 [ 1006.389675][ T7729] usb 6-1: USB disconnect, device number 21 [ 1006.891295][T13847] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1010.047988][ T7764] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 1010.585894][ T55] block nbd5: Possible stuck request ffff88802573e000: control (read@0,1024B). Runtime 30 seconds [ 1010.596676][ T55] block nbd5: Possible stuck request ffff88802573e1c0: control (read@1024,1024B). Runtime 30 seconds [ 1010.613347][ T55] block nbd5: Possible stuck request ffff88802573e380: control (read@2048,1024B). Runtime 30 seconds [ 1010.625365][ T55] block nbd5: Possible stuck request ffff88802573e540: control (read@3072,1024B). Runtime 30 seconds [ 1010.703917][ T7764] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 1010.712286][ T7764] usb 6-1: config 0 has no interface number 0 [ 1010.721516][ T7764] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1010.738286][ T7764] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.755664][ T7764] usb 6-1: Product: syz [ 1010.759915][ T7764] usb 6-1: Manufacturer: syz [ 1010.764551][ T7764] usb 6-1: SerialNumber: syz [ 1010.773684][ T7764] usb 6-1: config 0 descriptor?? [ 1011.221503][ T7764] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1011.234098][ T7764] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 1011.270853][ T7764] asix 6-1:0.251: probe with driver asix failed with error -5 [ 1011.363855][T13906] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1013.586325][ T7764] usb 6-1: USB disconnect, device number 22 [ 1014.279718][T13936] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1876'. [ 1015.825676][ T55] block nbd3: Possible stuck request ffff88802566fc00: control (read@0,1024B). Runtime 210 seconds [ 1015.839320][ T55] block nbd3: Possible stuck request ffff88802566fdc0: control (read@1024,1024B). Runtime 210 seconds [ 1015.852369][ T55] block nbd3: Possible stuck request ffff888025670000: control (read@2048,1024B). Runtime 210 seconds [ 1015.863469][ T55] block nbd3: Possible stuck request ffff8880256701c0: control (read@3072,1024B). Runtime 210 seconds [ 1016.426150][T13933] syz.5.1875 (13933): drop_caches: 2 [ 1016.510103][T13954] lo speed is unknown, defaulting to 1000 [ 1017.285365][T13969] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1883'. [ 1017.991513][T13971] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1885'. [ 1020.727378][T13954] lo speed is unknown, defaulting to 1000 [ 1022.441576][T12952] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1022.451818][T12952] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1022.465473][T12952] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1022.871020][T12952] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1022.881369][T12952] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1023.124934][T14022] lo speed is unknown, defaulting to 1000 [ 1024.850739][T14054] 9pnet_fd: Insufficient options for proto=fd [ 1024.955823][ T5824] Bluetooth: hci0: command tx timeout [ 1026.147805][T14022] lo speed is unknown, defaulting to 1000 [ 1026.155939][T14041] rdma_rxe: rxe_newlink: failed to add lo [ 1026.156175][T14054] siw: device registration error -23 [ 1026.436152][ T7746] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 1026.598513][ T7746] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 1026.612675][ T7746] usb 6-1: config 0 has no interface number 0 [ 1026.632773][ T7746] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1026.648562][ T7746] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.656967][ T7746] usb 6-1: Product: syz [ 1026.661301][ T7746] usb 6-1: Manufacturer: syz [ 1026.666209][ T7746] usb 6-1: SerialNumber: syz [ 1026.675478][ T7746] usb 6-1: config 0 descriptor?? [ 1027.108242][ T5824] Bluetooth: hci0: command tx timeout [ 1027.132422][ T7746] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1027.149318][T14022] chnl_net:caif_netlink_parms(): no params data found [ 1027.274066][ T7746] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 1027.314087][ T7746] asix 6-1:0.251: probe with driver asix failed with error -5 [ 1027.618696][ T7730] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1028.245340][ T7730] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1028.256002][ T7730] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1028.285061][ T7730] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1028.527034][ T7730] usb 2-1: config 0 descriptor?? [ 1028.753825][ T7730] pwc: Askey VC010 type 2 USB webcam detected. [ 1028.866053][T14022] bridge0: port 1(bridge_slave_0) entered blocking state [ 1028.888227][T14022] bridge0: port 1(bridge_slave_0) entered disabled state [ 1028.911193][T14022] bridge_slave_0: entered allmulticast mode [ 1028.953955][T14022] bridge_slave_0: entered promiscuous mode [ 1028.991244][ T7730] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1029.009778][ T7730] pwc: recv_control_msg error -32 req 02 val 2700 [ 1029.018464][ T7730] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1029.045959][T14022] bridge0: port 2(bridge_slave_1) entered blocking state [ 1029.116260][ T5824] Bluetooth: hci0: command tx timeout [ 1029.127677][T14022] bridge0: port 2(bridge_slave_1) entered disabled state [ 1029.225997][T14022] bridge_slave_1: entered allmulticast mode [ 1029.235878][T14022] bridge_slave_1: entered promiscuous mode [ 1029.286533][ T7730] pwc: recv_control_msg error -32 req 04 val 1300 [ 1029.294162][ T7730] pwc: recv_control_msg error -32 req 04 val 1400 [ 1029.302781][ T7730] pwc: recv_control_msg error -32 req 02 val 2000 [ 1029.317720][ T7730] pwc: recv_control_msg error -32 req 02 val 2100 [ 1029.414572][ T7730] pwc: recv_control_msg error -32 req 04 val 1500 [ 1029.423190][ T7730] pwc: recv_control_msg error -32 req 02 val 2500 [ 1029.430975][ T7730] pwc: recv_control_msg error -32 req 02 val 2400 [ 1029.451778][ T7730] pwc: recv_control_msg error -32 req 02 val 2600 [ 1029.473451][T14022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1029.497343][ T7730] pwc: recv_control_msg error -32 req 02 val 2900 [ 1029.563442][ T7729] usb 6-1: USB disconnect, device number 23 [ 1029.602570][T14022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1029.712707][ T7730] pwc: recv_control_msg error -71 req 04 val 1100 [ 1029.896130][ T7730] pwc: recv_control_msg error -71 req 04 val 1200 [ 1029.925664][ T7730] pwc: Registered as video103. [ 1029.966750][ T7730] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input40 [ 1030.108392][ T7730] usb 2-1: USB disconnect, device number 30 [ 1030.229043][T14022] team0: Port device team_slave_0 added [ 1030.338955][T14022] team0: Port device team_slave_1 added [ 1030.732368][T14022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1030.855634][T14022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1031.000811][T14022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1031.072714][T14022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1031.093820][T14022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1031.195757][ T5824] Bluetooth: hci0: command tx timeout [ 1031.486628][T14131] 9pnet_fd: Insufficient options for proto=fd [ 1031.498757][T14131] siw: device registration error -23 [ 1032.186277][T14022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1032.829669][T14022] hsr_slave_0: entered promiscuous mode [ 1032.842421][T14022] hsr_slave_1: entered promiscuous mode [ 1032.850642][T14022] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1032.874324][T14022] Cannot create hsr debugfs directory [ 1034.525832][T14111] syz.5.1910 (14111): drop_caches: 2 [ 1034.626452][T14150] nbd: nbd3 already in use [ 1034.669332][T14150] block nbd3: NBD_DISCONNECT [ 1034.682716][T14150] block nbd3: Send disconnect failed -32 [ 1034.693653][T14150] block nbd3: shutting down sockets [ 1034.755953][ C0] blk_print_req_error: 138 callbacks suppressed [ 1034.755976][ C0] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1034.771497][ C0] buffer_io_error: 138 callbacks suppressed [ 1034.771516][ C0] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1034.785311][ C0] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1034.794443][ C0] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1034.802313][ C0] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1034.811464][ C0] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1034.819344][ C0] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1034.828470][ C0] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1034.864810][ T8433] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1034.874598][ T8433] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1034.883070][ T8433] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1034.921682][ T8433] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1035.136041][ T8433] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1035.145262][ T8433] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1035.806781][T14161] netlink: 'syz.4.1922': attribute type 11 has an invalid length. [ 1035.814644][T14163] syz.5.1921 (14163): drop_caches: 2 [ 1035.822544][T14161] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1922'. [ 1036.620933][ T8433] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1036.652495][ T8433] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1036.717341][ T8433] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1036.752046][ T8433] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1036.841544][T14176] 9pnet_fd: Insufficient options for proto=fd [ 1036.855453][T14176] siw: device registration error -23 [ 1037.100829][ T8433] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1037.431565][ T8433] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1037.497806][ T8433] ldm_validate_partition_table(): Disk read failed. [ 1037.507106][ T8433] Dev nbd3: unable to read RDB block 0 [ 1037.617597][T14179] random: crng reseeded on system resumption [ 1038.037300][ T8433] nbd3: unable to read partition table [ 1038.180907][ T8433] ldm_validate_partition_table(): Disk read failed. [ 1038.582548][ T8433] Dev nbd3: unable to read RDB block 0 [ 1038.614336][ T8433] nbd3: unable to read partition table [ 1038.704085][T14022] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1038.801972][T14022] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1038.845658][ T5952] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1038.853075][T14022] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1039.126873][T14022] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1039.795782][ T5952] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1039.825177][T14204] 9pnet_fd: Insufficient options for proto=fd [ 1039.833032][T14204] siw: device registration error -23 [ 1039.864061][ T5952] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1039.938731][ T5952] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.320025][ T5952] usb 6-1: config 0 descriptor?? [ 1040.474257][ T5952] pwc: Askey VC010 type 2 USB webcam detected. [ 1041.035807][ T5952] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1041.091754][ T5952] pwc: recv_control_msg error -32 req 02 val 2700 [ 1041.107046][ T5952] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1041.121761][ T5952] pwc: recv_control_msg error -32 req 04 val 1000 [ 1041.131896][ T5952] pwc: recv_control_msg error -32 req 04 val 1300 [ 1041.145763][ T5952] pwc: recv_control_msg error -32 req 04 val 1400 [ 1041.153087][ T5952] pwc: recv_control_msg error -32 req 02 val 2000 [ 1041.161429][ T5952] pwc: recv_control_msg error -32 req 02 val 2100 [ 1041.183369][ T5952] pwc: recv_control_msg error -32 req 04 val 1500 [ 1041.196956][T13992] block nbd5: Possible stuck request ffff88802573e000: control (read@0,1024B). Runtime 60 seconds [ 1041.208047][ T5952] pwc: recv_control_msg error -32 req 02 val 2500 [ 1041.208211][T13992] block nbd5: Possible stuck request ffff88802573e1c0: control (read@1024,1024B). Runtime 60 seconds [ 1041.225661][T13992] block nbd5: Possible stuck request ffff88802573e380: control (read@2048,1024B). Runtime 60 seconds [ 1041.232681][T14022] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1041.237389][T13992] block nbd5: Possible stuck request ffff88802573e540: control (read@3072,1024B). Runtime 60 seconds [ 1041.255118][ T5952] pwc: recv_control_msg error -32 req 02 val 2400 [ 1041.264609][ T5952] pwc: recv_control_msg error -32 req 02 val 2600 [ 1041.304208][T14022] 8021q: adding VLAN 0 to HW filter on device team0 [ 1041.319604][ T5952] pwc: recv_control_msg error -32 req 02 val 2900 [ 1041.334722][T11850] bridge0: port 1(bridge_slave_0) entered blocking state [ 1041.342029][T11850] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1041.392440][ T5952] pwc: recv_control_msg error -32 req 02 val 2800 [ 1041.461699][ T6200] bridge0: port 2(bridge_slave_1) entered blocking state [ 1041.468940][ T6200] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1041.702971][ T5952] pwc: recv_control_msg error -71 req 04 val 1200 [ 1041.769655][ T5952] pwc: Registered as video103. [ 1041.782501][ T5952] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input41 [ 1041.832123][ T5952] usb 6-1: USB disconnect, device number 24 [ 1043.297520][T14245] 9pnet_fd: Insufficient options for proto=fd [ 1044.081381][T14022] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1044.217216][T14252] random: crng reseeded on system resumption [ 1046.502496][T14276] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1941'. [ 1046.646122][T14285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1944'. [ 1046.849514][ T30] audit: type=1800 audit(1750236332.598:2): pid=14289 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.1944" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1047.424831][T14022] veth0_vlan: entered promiscuous mode [ 1047.676307][ T7729] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1047.697019][T14022] veth1_vlan: entered promiscuous mode [ 1047.899308][T14305] 9pnet_fd: Insufficient options for proto=fd [ 1047.912571][T14305] siw: device registration error -23 [ 1048.608003][ T7729] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1048.619619][T14022] veth0_macvtap: entered promiscuous mode [ 1048.626639][ T7729] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1048.645919][ T7729] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1048.806053][T14022] veth1_macvtap: entered promiscuous mode [ 1048.913653][T14313] netlink: 'syz.3.1950': attribute type 11 has an invalid length. [ 1048.921878][T14313] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1950'. [ 1049.023370][T14314] tmpfs: Bad value for 'mpol' [ 1049.042762][T14314] usb usb8: usbfs: process 14314 (syz.1.1949) did not claim interface 0 before use [ 1049.632325][ T7729] usb 5-1: config 0 descriptor?? [ 1049.839947][ T7729] pwc: Askey VC010 type 2 USB webcam detected. [ 1050.128726][T14022] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1050.191285][T14022] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1050.240668][T14022] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.249558][T14022] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.260736][T14022] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.271641][T14022] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.285314][ T10] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1050.359248][ T7729] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1050.366801][ T7729] pwc: recv_control_msg error -32 req 02 val 2700 [ 1050.374311][ T7729] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1050.386200][ T7729] pwc: recv_control_msg error -32 req 04 val 1000 [ 1050.393700][ T7729] pwc: recv_control_msg error -32 req 04 val 1300 [ 1050.403845][ T7729] pwc: recv_control_msg error -32 req 04 val 1400 [ 1050.419810][ T7729] pwc: recv_control_msg error -32 req 02 val 2000 [ 1050.441389][ T7729] pwc: recv_control_msg error -32 req 02 val 2100 [ 1050.467322][ T7729] pwc: recv_control_msg error -32 req 04 val 1500 [ 1050.483949][ T7729] pwc: recv_control_msg error -32 req 02 val 2500 [ 1050.519106][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1050.540382][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1050.559025][ T10] usb 6-1: config 248 has an invalid interface number: 51 but max is 0 [ 1050.573942][ T7729] pwc: recv_control_msg error -32 req 02 val 2400 [ 1050.580582][ T10] usb 6-1: config 248 has no interface number 0 [ 1050.596594][ T7729] pwc: recv_control_msg error -32 req 02 val 2600 [ 1050.608720][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 1050.614273][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1050.638992][ T7729] pwc: recv_control_msg error -32 req 02 val 2900 [ 1050.653381][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1050.673459][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.695153][ T7729] pwc: recv_control_msg error -32 req 02 val 2800 [ 1050.708959][ T10] usb 6-1: Product: syz [ 1050.796495][ T10] usb 6-1: Manufacturer: syz [ 1050.801216][ T10] usb 6-1: SerialNumber: syz [ 1051.215829][ T7729] pwc: recv_control_msg error -71 req 04 val 1200 [ 1051.223265][ T6021] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1051.241703][ T6021] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1051.258133][ T7729] pwc: Registered as video103. [ 1051.290269][ T10] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:248.51/input/input43 [ 1051.325969][ T7729] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input42 [ 1052.095445][ T7729] usb 5-1: USB disconnect, device number 29 [ 1052.145950][ T10] usb 6-1: USB disconnect, device number 25 [ 1052.551885][T14339] nbd: nbd1 already in use [ 1054.644077][T14358] netlink: 'syz.1.1958': attribute type 11 has an invalid length. [ 1054.652077][T14358] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1958'. [ 1055.402076][T14361] netlink: 'syz.1.1962': attribute type 27 has an invalid length. [ 1055.875753][T14324] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1056.055657][ T10] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1056.104098][T14324] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1056.208298][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1056.244958][T14324] usb 6-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 1056.271812][ T10] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1056.938650][T14324] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1056.947713][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1056.967560][T14324] usb 6-1: config 0 descriptor?? [ 1056.974265][ T10] usb 5-1: config 0 descriptor?? [ 1057.061674][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 1057.089737][T14324] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1057.195907][ T5952] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 1057.525869][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1057.587209][ T5952] usb 7-1: config 0 has an invalid interface number: 251 but max is 0 [ 1057.603490][ T5952] usb 7-1: config 0 has no interface number 0 [ 1057.614754][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 1057.890801][ T5952] usb 7-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1057.910849][ T5952] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1058.020884][T14401] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1964'. [ 1058.560036][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1058.848451][ T5952] usb 7-1: Product: syz [ 1058.861564][ T5952] usb 7-1: Manufacturer: syz [ 1058.907122][ T10] pwc: recv_control_msg error -71 req 04 val 1000 [ 1058.912081][ T5952] usb 7-1: SerialNumber: syz [ 1058.938417][ T10] pwc: recv_control_msg error -71 req 04 val 1300 [ 1058.955194][ T10] pwc: recv_control_msg error -71 req 04 val 1400 [ 1058.988592][ T5952] usb 7-1: config 0 descriptor?? [ 1059.094482][ T10] pwc: recv_control_msg error -71 req 02 val 2000 [ 1059.132815][ T10] pwc: recv_control_msg error -71 req 02 val 2100 [ 1059.160191][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 1059.193938][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 1059.228193][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 1059.265794][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 1059.419017][T14410] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1972'. [ 1059.806921][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1059.819401][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1059.880006][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 1059.881702][ T5952] asix 7-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1059.912882][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 1059.915649][ T5952] asix 7-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 1059.935874][ T5952] asix 7-1:0.251: probe with driver asix failed with error -5 [ 1059.945443][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 1059.979358][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 1060.008376][ T10] pwc: Registered as video103. [ 1060.034395][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input44 [ 1060.124101][ T10] usb 5-1: USB disconnect, device number 30 [ 1060.207717][ T5952] usb 6-1: USB disconnect, device number 26 [ 1061.274986][ T979] usb 7-1: USB disconnect, device number 2 [ 1062.528685][T14431] Bluetooth: MGMT ver 1.23 [ 1063.695626][T14447] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1980'. [ 1064.426794][ T979] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1064.817593][ T979] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1064.833382][ T979] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1064.843071][ T979] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1064.869787][ T979] usb 7-1: config 0 descriptor?? [ 1064.893682][ T979] pwc: Askey VC010 type 2 USB webcam detected. [ 1066.124383][ T979] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1066.135478][ T979] pwc: recv_control_msg error -32 req 02 val 2700 [ 1066.454939][ T979] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1066.479931][ T979] pwc: recv_control_msg error -32 req 04 val 1000 [ 1066.503611][ T979] pwc: recv_control_msg error -32 req 04 val 1300 [ 1066.520910][ T979] pwc: recv_control_msg error -32 req 04 val 1400 [ 1066.547377][ T979] pwc: recv_control_msg error -32 req 02 val 2000 [ 1066.570082][ T979] pwc: recv_control_msg error -32 req 02 val 2100 [ 1066.590291][ T979] pwc: recv_control_msg error -32 req 04 val 1500 [ 1066.617250][ T979] pwc: recv_control_msg error -32 req 02 val 2500 [ 1066.644381][ T979] pwc: recv_control_msg error -32 req 02 val 2400 [ 1066.683376][ T979] pwc: recv_control_msg error -32 req 02 val 2600 [ 1066.701808][ T979] pwc: recv_control_msg error -32 req 02 val 2900 [ 1066.727251][ T979] pwc: recv_control_msg error -32 req 02 val 2800 [ 1067.036149][ T979] pwc: recv_control_msg error -71 req 04 val 1200 [ 1067.420634][ T979] pwc: Registered as video103. [ 1068.267644][ T979] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input45 [ 1068.475949][ T979] usb 7-1: USB disconnect, device number 3 [ 1069.137531][T14498] lo speed is unknown, defaulting to 1000 [ 1070.412700][T14498] lo speed is unknown, defaulting to 1000 [ 1071.288149][T13992] block nbd5: Possible stuck request ffff88802573e000: control (read@0,1024B). Runtime 90 seconds [ 1071.301179][T13992] block nbd5: Possible stuck request ffff88802573e1c0: control (read@1024,1024B). Runtime 90 seconds [ 1071.312319][T13992] block nbd5: Possible stuck request ffff88802573e380: control (read@2048,1024B). Runtime 90 seconds [ 1071.323395][T13992] block nbd5: Possible stuck request ffff88802573e540: control (read@3072,1024B). Runtime 90 seconds [ 1073.062751][T14549] netlink: 'syz.5.2001': attribute type 10 has an invalid length. [ 1074.728444][T14572] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1075.161671][T14579] netlink: 'syz.3.2008': attribute type 10 has an invalid length. [ 1075.277865][T14579] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1075.399787][T14579] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1076.607644][T11850] Bluetooth: hci6: Frame reassembly failed (-84) [ 1077.867770][T14613] tmpfs: Bad value for 'mpol' [ 1077.877258][T14613] usb usb8: usbfs: process 14613 (syz.3.2013) did not claim interface 0 before use [ 1078.635936][ T5824] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1080.593490][T14628] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2016'. [ 1081.474252][T14649] 9pnet_fd: Insufficient options for proto=fd [ 1081.490126][T14649] siw: device registration error -23 [ 1082.366928][T14658] random: crng reseeded on system resumption [ 1085.437481][T14689] netlink: 148 bytes leftover after parsing attributes in process `syz.5.2033'. [ 1085.467976][T14689] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 1085.565189][ T979] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1085.739107][ T979] usb 7-1: Using ep0 maxpacket: 16 [ 1085.790902][ T979] usb 7-1: config index 0 descriptor too short (expected 59154, got 18) [ 1085.804941][ T979] usb 7-1: config 0 has an invalid interface number: 0 but max is -1 [ 1085.974778][ T979] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1086.019733][ T979] usb 7-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 1086.029373][ T979] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.039320][ T979] usb 7-1: Product: syz [ 1086.044546][ T979] usb 7-1: Manufacturer: syz [ 1086.050106][ T979] usb 7-1: SerialNumber: syz [ 1086.059841][ T979] usb 7-1: config 0 descriptor?? [ 1086.071920][ T979] ssu100 7-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 1086.375799][ T7745] usb 6-1: new full-speed USB device number 27 using dummy_hcd [ 1086.740502][ T7745] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 1086.748920][ T7745] usb 6-1: config 0 has no interface number 0 [ 1086.761137][ T7745] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1086.770468][ T7745] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.837634][ T7745] usb 6-1: Product: syz [ 1086.841923][ T7745] usb 6-1: Manufacturer: syz [ 1086.855641][ T7745] usb 6-1: SerialNumber: syz [ 1086.904064][ T7745] usb 6-1: config 0 descriptor?? [ 1087.037834][ T979] ssu100 7-1:0.0: probe with driver ssu100 failed with error -71 [ 1087.067129][ T979] usb 7-1: USB disconnect, device number 4 [ 1087.359135][ T7745] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1087.387212][ T7745] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 1087.419327][ T7745] asix 6-1:0.251: probe with driver asix failed with error -5 [ 1088.756546][T14724] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2036'. [ 1089.422658][T14732] random: crng reseeded on system resumption [ 1090.074950][ T10] usb 6-1: USB disconnect, device number 27 [ 1092.005742][ T7746] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1092.652362][ T7746] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1093.052481][ T7746] usb 2-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 1093.234083][ T7746] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1093.352802][ T7746] usb 2-1: config 0 descriptor?? [ 1093.377930][ T7746] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1096.265856][T14787] netlink: 'syz.4.2048': attribute type 11 has an invalid length. [ 1096.275203][T14787] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2048'. [ 1097.851325][T14797] lo speed is unknown, defaulting to 1000 [ 1098.109386][T14788] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2044'. [ 1098.241467][ T7746] usb 2-1: USB disconnect, device number 31 [ 1098.333870][T14797] lo speed is unknown, defaulting to 1000 [ 1098.439393][T14809] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1099.305744][T14817] random: crng reseeded on system resumption [ 1099.847774][T14821] usb usb8: usbfs: process 14821 (syz.6.2055) did not claim interface 0 before use [ 1101.376068][T13992] block nbd5: Possible stuck request ffff88802573e000: control (read@0,1024B). Runtime 120 seconds [ 1101.387275][T13992] block nbd5: Possible stuck request ffff88802573e1c0: control (read@1024,1024B). Runtime 120 seconds [ 1101.398659][T13992] block nbd5: Possible stuck request ffff88802573e380: control (read@2048,1024B). Runtime 120 seconds [ 1101.421925][T13992] block nbd5: Possible stuck request ffff88802573e540: control (read@3072,1024B). Runtime 120 seconds [ 1102.008054][T14835] syz.6.2057 (14835): drop_caches: 2 [ 1102.462244][T14835] syz.6.2057 (14835): drop_caches: 2 [ 1106.654905][T14864] rdma_rxe: rxe_newlink: failed to add lo [ 1109.981799][T14898] random: crng reseeded on system resumption [ 1114.521865][T14924] rdma_rxe: rxe_newlink: failed to add lo [ 1119.029454][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2087'. [ 1119.340587][ T30] audit: type=1800 audit(1750236405.058:3): pid=14953 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.2087" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1121.219767][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1121.597578][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1123.649255][T12952] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1123.746908][T12952] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1123.846697][T12952] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1123.915620][T12952] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1123.970315][T12952] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1124.270457][ T10] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 1124.896479][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 1125.711872][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1125.755942][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1125.763594][ T10] usb 4-1: can't read configurations, error -71 [ 1126.534300][T15016] syz.1.2099 (15016): drop_caches: 2 [ 1126.540321][T15016] syz.1.2099 (15016): drop_caches: 2 [ 1126.752355][ T6021] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1127.005650][ T5824] Bluetooth: hci6: command tx timeout [ 1127.167489][T14984] lo speed is unknown, defaulting to 1000 [ 1128.072313][ T6021] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1129.036873][T12952] Bluetooth: hci6: command tx timeout [ 1129.056604][ T6021] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1129.409553][T15042] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1130.607369][ T6021] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1130.760815][T14984] lo speed is unknown, defaulting to 1000 [ 1131.119590][T12952] Bluetooth: hci6: command tx timeout [ 1131.436185][ T11] block nbd5: Possible stuck request ffff88802573e000: control (read@0,1024B). Runtime 150 seconds [ 1131.447206][ T11] block nbd5: Possible stuck request ffff88802573e1c0: control (read@1024,1024B). Runtime 150 seconds [ 1131.459427][ T11] block nbd5: Possible stuck request ffff88802573e380: control (read@2048,1024B). Runtime 150 seconds [ 1131.470881][ T11] block nbd5: Possible stuck request ffff88802573e540: control (read@3072,1024B). Runtime 150 seconds [ 1132.720463][ T6021] bridge_slave_1: left allmulticast mode [ 1132.746144][ T6021] bridge_slave_1: left promiscuous mode [ 1132.751955][ T6021] bridge0: port 2(bridge_slave_1) entered disabled state [ 1133.049099][ T6021] bridge_slave_0: left allmulticast mode [ 1133.673847][T12952] Bluetooth: hci6: command tx timeout [ 1133.698484][ T6021] bridge_slave_0: left promiscuous mode [ 1133.872538][ T6021] bridge0: port 1(bridge_slave_0) entered disabled state [ 1136.696294][T15107] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 1137.324257][ T6021] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1137.360941][ T6021] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1137.377803][ T6021] bond0 (unregistering): Released all slaves [ 1140.702928][T15142] Failed to get privilege flags for destination (handle=0x2:0x7) [ 1143.278412][T15132] lo speed is unknown, defaulting to 1000 [ 1143.293102][T14984] chnl_net:caif_netlink_parms(): no params data found [ 1146.417797][T14984] bridge0: port 1(bridge_slave_0) entered blocking state [ 1146.425074][T14984] bridge0: port 1(bridge_slave_0) entered disabled state [ 1146.450655][T14984] bridge_slave_0: entered allmulticast mode [ 1146.469727][T14984] bridge_slave_0: entered promiscuous mode [ 1146.545233][T15132] lo speed is unknown, defaulting to 1000 [ 1146.589024][T14984] bridge0: port 2(bridge_slave_1) entered blocking state [ 1146.610195][T14984] bridge0: port 2(bridge_slave_1) entered disabled state [ 1146.631199][T14984] bridge_slave_1: entered allmulticast mode [ 1146.717729][ T5195] udevd[5195]: worker [8506] /devices/virtual/block/nbd5 is taking a long time [ 1146.746956][T14984] bridge_slave_1: entered promiscuous mode [ 1146.858614][ T6021] hsr_slave_0: left promiscuous mode [ 1146.891034][ T6021] hsr_slave_1: left promiscuous mode [ 1146.901685][ T6021] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1146.921895][ T6021] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1147.034917][ T5952] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1147.066486][ T6021] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1147.113819][ T6021] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1147.239540][ T5952] usb 2-1: Using ep0 maxpacket: 8 [ 1147.242015][ T6021] veth1_macvtap: left promiscuous mode [ 1147.251088][ T6021] veth0_macvtap: left promiscuous mode [ 1147.262802][ T6021] veth1_vlan: left promiscuous mode [ 1147.273189][ T5952] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1147.281465][ T6021] veth0_vlan: left promiscuous mode [ 1147.303908][ T5952] usb 2-1: config 248 has an invalid interface number: 51 but max is 0 [ 1147.313195][ T5952] usb 2-1: config 248 has no interface number 0 [ 1147.327543][ T5952] usb 2-1: New USB device found, idVendor=05ac, idProduct=0249, bcdDevice=39.f0 [ 1147.528279][ T5952] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1147.617581][ T5952] usb 2-1: Product: syz [ 1147.631793][ T5952] usb 2-1: Manufacturer: syz [ 1147.656050][ T5952] usb 2-1: SerialNumber: syz [ 1147.966827][T15201] syz.4.2139 (15201): drop_caches: 2 [ 1147.976815][T15201] syz.4.2139 (15201): drop_caches: 2 [ 1148.063937][ T5952] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:248.51/input/input46 [ 1148.081741][ T5180] bcm5974 2-1:248.51: could not read from device [ 1148.094097][ T5952] usb 2-1: USB disconnect, device number 32 [ 1149.738014][T15214] syz.1.2142 (15214): drop_caches: 2 [ 1149.746921][T15214] syz.1.2142 (15214): drop_caches: 2 [ 1152.472028][ T6021] team0 (unregistering): Port device team_slave_1 removed [ 1152.579094][ T6021] team0 (unregistering): Port device team_slave_0 removed [ 1154.236606][ T5824] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1154.373697][T15238] tmpfs: Bad value for 'mpol' [ 1154.386751][T15239] usb usb8: usbfs: process 15239 (syz.5.2149) did not claim interface 0 before use [ 1154.938444][ T31] INFO: task syz.2.1852:13823 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1154.995828][ T31] Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 [ 1155.016957][ T9530] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1155.036237][ T9530] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1155.065873][ T9530] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1155.084188][ T9530] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1155.138047][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1155.238123][ T31] task:syz.2.1852 state:D stack:25352 pid:13823 tgid:13822 ppid:5825 task_flags:0x400140 flags:0x00004006 [ 1155.394907][ T31] Call Trace: [ 1155.399113][ T31] [ 1155.402120][ T31] __schedule+0x16a2/0x4cb0 [ 1155.406784][ T31] ? schedule+0x165/0x360 [ 1155.411324][ T31] ? __pfx___schedule+0x10/0x10 [ 1155.416901][ T31] ? schedule+0x91/0x360 [ 1155.422885][ T31] schedule+0x165/0x360 [ 1155.427189][ T31] io_schedule+0x81/0xe0 [ 1155.431506][ T31] folio_wait_bit_common+0x6b0/0xb90 [ 1155.437024][ T31] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 1155.444201][ T31] ? __pfx_wake_page_function+0x10/0x10 [ 1155.449902][ T31] ? free_pages_prepare+0x3f2/0xa30 [ 1155.455161][ T31] ? __pfx_compaction_alloc+0x10/0x10 [ 1155.773758][ T31] migrate_pages_batch+0x13a6/0x2830 [ 1156.095939][ T31] ? __pfx_compaction_free+0x10/0x10 [ 1156.164093][ T31] ? __pfx_compaction_alloc+0x10/0x10 [ 1156.198418][ T31] ? __pfx_migrate_pages_batch+0x10/0x10 [ 1156.204172][ T31] ? __lock_acquire+0xab9/0xd20 [ 1156.277457][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1156.285867][ T31] migrate_pages+0x2038/0x2930 [ 1156.290732][ T31] ? __lock_acquire+0xab9/0xd20 [ 1156.308270][ T31] ? __pfx_compaction_free+0x10/0x10 [ 1156.313622][ T31] ? __pfx_compaction_alloc+0x10/0x10 [ 1156.328580][ T31] ? __pfx_migrate_pages+0x10/0x10 [ 1156.333755][ T31] ? isolate_movable_page+0x479/0x790 [ 1156.351272][ T31] ? rcu_is_watching+0x15/0xb0 [ 1156.356952][ T31] ? isolate_migratepages_block+0x33cd/0x3a30 [ 1156.363104][ T31] compact_zone+0x23f4/0x4ad0 [ 1156.368187][ T31] ? __pfx_compact_zone+0x10/0x10 [ 1156.373282][ T31] sysctl_compaction_handler+0x3a4/0x7b0 [ 1156.379116][ T31] ? __pfx_sysctl_compaction_handler+0x10/0x10 [ 1156.385345][ T31] ? rcu_is_watching+0x15/0xb0 [ 1156.390232][ T31] ? proc_sys_call_handler+0x3f2/0x7c0 [ 1156.395896][ T31] ? trace_kmalloc+0x1f/0xd0 [ 1156.400535][ T31] ? __kvmalloc_node_noprof+0x331/0x5f0 [ 1156.406242][ T31] ? proc_sys_call_handler+0x3f2/0x7c0 [ 1156.411743][ T31] proc_sys_call_handler+0x509/0x7c0 [ 1156.417197][ T31] ? __pfx_proc_sys_call_handler+0x10/0x10 [ 1156.423051][ T31] ? __asan_memset+0x22/0x50 [ 1156.427739][ T31] iter_file_splice_write+0x937/0x1000 [ 1156.433266][ T31] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1156.439339][ T31] ? rcu_read_lock_any_held+0xb3/0x120 [ 1156.446395][ T31] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1156.452385][ T31] direct_splice_actor+0x101/0x160 [ 1156.457890][ T31] splice_direct_to_actor+0x5a5/0xcc0 [ 1156.463338][ T31] ? __pfx_direct_splice_actor+0x10/0x10 [ 1156.469107][ T31] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1156.475077][ T31] do_splice_direct+0x181/0x270 [ 1156.480110][ T31] ? __pfx_do_splice_direct+0x10/0x10 [ 1156.485573][ T31] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1156.491535][ T31] ? rw_verify_area+0x258/0x650 [ 1156.496560][ T31] do_sendfile+0x4da/0x7e0 [ 1156.501039][ T31] ? __pfx_do_sendfile+0x10/0x10 [ 1156.506109][ T31] __se_sys_sendfile64+0xd9/0x190 [ 1156.511184][ T31] ? __pfx___se_sys_futex+0x10/0x10 [ 1156.516595][ T31] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 1156.522284][ T31] ? rcu_is_watching+0x15/0xb0 [ 1156.527654][ T31] ? do_syscall_64+0xbe/0x3b0 [ 1156.532427][ T31] do_syscall_64+0xfa/0x3b0 [ 1156.537093][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1156.542344][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1156.549200][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1156.553929][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1156.560436][ T31] RIP: 0033:0x7f915478e929 [ 1156.564925][ T31] RSP: 002b:00007f9155557038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1156.573791][ T31] RAX: ffffffffffffffda RBX: 00007f91549b5fa0 RCX: 00007f915478e929 [ 1156.581901][ T31] RDX: 0000200000000180 RSI: 0000000000000008 RDI: 0000000000000009 [ 1156.589974][ T31] RBP: 00007f9154810b39 R08: 0000000000000000 R09: 0000000000000000 [ 1156.598103][ T31] R10: 000000000000000a R11: 0000000000000246 R12: 0000000000000000 [ 1156.606171][ T31] R13: 0000000000000000 R14: 00007f91549b5fa0 R15: 00007fffa6c34868 [ 1156.614215][ T31] [ 1156.656934][ T31] [ 1156.656934][ T31] Showing all locks held in the system: [ 1156.664749][ T31] 3 locks held by kworker/u8:1/13: [ 1156.741205][ T31] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1156.825639][ T31] #1: ffff8880b8623f08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39e/0x6d0 [ 1156.875652][ T31] #2: ffff8880b8733c98 (krc.lock){..-.}-{2:2}, at: kvfree_rcu_queue_batch+0x1a/0x190 [ 1156.885318][ T31] 1 lock held by khungtaskd/31: [ 1156.909298][ T31] #0: ffffffff8e13eda0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1156.923258][ T31] 3 locks held by kworker/u8:7/2942: [ 1156.934625][ T31] #0: ffff8880b863b798 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 1156.965593][ T31] #1: ffff8880b8723f08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39e/0x6d0 [ 1157.004371][ T31] #2: ffff8880b8725958 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 [ 1157.055674][ T31] 2 locks held by getty/5583: [ 1157.075648][ T31] #0: ffff8880352aa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1157.125565][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1157.178238][ T31] 1 lock held by syz-executor/5837: [ 1157.183528][ T31] 3 locks held by kworker/1:6/5952: [ 1157.196323][T12952] Bluetooth: hci0: command tx timeout [ 1157.225603][ T31] 5 locks held by kworker/u8:10/6021: [ 1157.235670][ T31] #0: ffff88801b2fb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1157.275673][ T31] #1: ffffc9000af57bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1157.315625][ T31] #2: ffffffff8f4f1410 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 1157.355621][ T31] #3: ffff88802907d4e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x116/0x2f0 [ 1157.395636][ T31] #4: ffffffff8e1448b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 1157.415750][ T31] 3 locks held by syz-executor/7979: [ 1157.421119][ T31] #0: ffff8880299f4d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 [ 1157.445598][ T31] #1: ffff8880299f4078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 1157.455400][ T31] #2: ffffffff8f666068 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 1157.469742][ T31] 1 lock held by udevd/8506: [ 1157.474404][ T31] #0: ffff8880256d3358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 1157.488916][ T31] 1 lock held by syz.2.1852/13823: [ 1157.494106][ T31] #0: ffff8880791fe428 (sb_writers#3){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 [ 1157.505260][ T31] 2 locks held by kworker/0:0/14324: [ 1157.511104][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1157.522645][ T31] #1: ffffc9000b5a7bc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1157.533395][ T31] 1 lock held by syz.3.2125/15132: [ 1157.539120][ T31] #0: ffffffff8f4f1410 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1157.549008][ T31] 2 locks held by dhcpcd/15241: [ 1157.553904][ T31] #0: ffff88804c0fee08 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 1157.564695][ T31] #1: ffffffff8e1448b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 1157.579522][ T31] 4 locks held by syz.4.2151/15253: [ 1157.584787][ T31] #0: ffff88803519cd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 [ 1157.595784][ T31] #1: ffff88803519c078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 1157.606001][ T31] #2: ffffffff8f666068 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 1157.617314][ T31] #3: ffff888035755b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 1157.627339][ T31] 1 lock held by dhcpcd/15258: [ 1157.632164][ T31] #0: ffff88804c25f408 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 1157.643233][ T31] 1 lock held by sed/15265: [ 1157.685801][ T31] [ 1157.688206][ T31] ============================================= [ 1157.688206][ T31] [ 1157.711429][ T31] NMI backtrace for cpu 0 [ 1157.711458][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full) [ 1157.711484][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1157.711498][ T31] Call Trace: [ 1157.711506][ T31] [ 1157.711516][ T31] dump_stack_lvl+0x189/0x250 [ 1157.711551][ T31] ? __wake_up_klogd+0xd9/0x110 [ 1157.711579][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1157.711618][ T31] ? __pfx__printk+0x10/0x10 [ 1157.711655][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1157.711687][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1157.711711][ T31] ? _printk+0xcf/0x120 [ 1157.711738][ T31] ? __pfx__printk+0x10/0x10 [ 1157.711762][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1157.711792][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1157.711824][ T31] watchdog+0xfee/0x1030 [ 1157.711854][ T31] ? watchdog+0x1de/0x1030 [ 1157.711890][ T31] kthread+0x70e/0x8a0 [ 1157.711917][ T31] ? __pfx_watchdog+0x10/0x10 [ 1157.711942][ T31] ? __pfx_kthread+0x10/0x10 [ 1157.711968][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1157.711997][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1157.712026][ T31] ? __pfx_kthread+0x10/0x10 [ 1157.712050][ T31] ret_from_fork+0x3f9/0x770 [ 1157.712082][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1157.712118][ T31] ? __switch_to_asm+0x39/0x70 [ 1157.712138][ T31] ? __switch_to_asm+0x33/0x70 [ 1157.712156][ T31] ? __pfx_kthread+0x10/0x10 [ 1157.712180][ T31] ret_from_fork_asm+0x1a/0x30 [ 1157.712219][ T31] [ 1157.712227][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1157.876592][ C1] NMI backtrace for cpu 1 [ 1157.876609][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full) [ 1157.876633][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1157.876645][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1157.876677][ C1] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 f6 28 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1157.876693][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 1157.876710][ C1] RAX: f7ef2687a87b6100 RBX: ffffffff81975c68 RCX: f7ef2687a87b6100 [ 1157.876724][ C1] RDX: 0000000000000001 RSI: ffffffff8d96e7f3 RDI: ffffffff8be1b800 [ 1157.876737][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f5b R09: 1ffff110170e65eb [ 1157.876751][ C1] R10: dffffc0000000000 R11: ffffed10170e65ec R12: ffffffff8f9fe3f0 [ 1157.876765][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff11003a57b40 [ 1157.876777][ C1] FS: 0000000000000000(0000) GS:ffff888125d85000(0000) knlGS:0000000000000000 [ 1157.876792][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1157.876804][ C1] CR2: 00005624929a16c0 CR3: 0000000033bf6000 CR4: 00000000003526f0 [ 1157.876821][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1157.876831][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1157.876843][ C1] Call Trace: [ 1157.876849][ C1] [ 1157.876856][ C1] default_idle+0x13/0x20 [ 1157.876874][ C1] default_idle_call+0x74/0xb0 [ 1157.876892][ C1] do_idle+0x1e8/0x510 [ 1157.876923][ C1] ? __pfx_do_idle+0x10/0x10 [ 1157.876960][ C1] cpu_startup_entry+0x44/0x60 [ 1157.876986][ C1] start_secondary+0x101/0x110 [ 1157.877007][ C1] common_startup_64+0x13e/0x147 [ 1157.877034][ C1] [ 1158.069516][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1158.076468][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full) [ 1158.088327][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1158.098440][ T31] Call Trace: [ 1158.101749][ T31] [ 1158.104707][ T31] dump_stack_lvl+0x99/0x250 [ 1158.109364][ T31] ? __asan_memcpy+0x40/0x70 [ 1158.113992][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1158.119246][ T31] ? __pfx__printk+0x10/0x10 [ 1158.123892][ T31] panic+0x2db/0x790 [ 1158.127852][ T31] ? __pfx_panic+0x10/0x10 [ 1158.132332][ T31] ? watchdog+0x101c/0x1030 [ 1158.136904][ T31] watchdog+0x102d/0x1030 [ 1158.141291][ T31] ? watchdog+0x1de/0x1030 [ 1158.145773][ T31] kthread+0x70e/0x8a0 [ 1158.149896][ T31] ? __pfx_watchdog+0x10/0x10 [ 1158.154624][ T31] ? __pfx_kthread+0x10/0x10 [ 1158.159265][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1158.164529][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1158.169779][ T31] ? __pfx_kthread+0x10/0x10 [ 1158.174421][ T31] ret_from_fork+0x3f9/0x770 [ 1158.179066][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1158.184233][ T31] ? __switch_to_asm+0x39/0x70 [ 1158.189041][ T31] ? __switch_to_asm+0x33/0x70 [ 1158.193839][ T31] ? __pfx_kthread+0x10/0x10 [ 1158.198475][ T31] ret_from_fork_asm+0x1a/0x30 [ 1158.203306][ T31] [ 1158.206696][ T31] Kernel Offset: disabled [ 1158.211040][ T31] Rebooting in 86400 seconds..