last executing test programs: 21.692826715s ago: executing program 1 (id=1141): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="480000001400190d7ebdeb75fd0d8c562c84d8c0a2bc000000000000800100000020000000040000000000000078581acb6cc5dcfa09", 0x36}], 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001b000)=""/102400, 0x19000) r2 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x169a82, 0x18c) r3 = creat(0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r6 = syz_open_dev$vim2m(0x0, 0x5a0c, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x2}) ioctl$vim2m_VIDIOC_ENUM_FMT(r6, 0xc0405668, &(0x7f0000000000)={0x2, 0x1, 0x1, "4a37f6c000190000000000000020000000000000000000000100", 0x31435641}) ioctl$SNDCTL_DSP_GETCAPS(r2, 0x8004500f, &(0x7f0000000340)) chown(&(0x7f00000003c0)='./file0\x00', r4, 0xee01) lsetxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {}, [{}, {0x2, 0x6}], {}, [], {0x10, 0x2}}, 0x34, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000380)={0x10000000}) ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000240)=""/125) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @sit={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8}, @IFLA_IPTUN_FLAGS={0x6, 0x8, 0x3f}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @local}, @IFLA_IPTUN_PROTO={0x5}, @IFLA_IPTUN_ENCAP_FLAGS={0x6}]}}}]}, 0x58}}, 0x0) setrlimit(0x6, &(0x7f0000000180)={0x0, 0x8}) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000400)={0x2, 0x0}, 0x8) r10 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000004c0)=r9, 0xffffffffffffff75) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x0, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000004000000000000000095e2bdce1d863b90e12deca2bda93e86ed8218bff84b15a442f10d5226e82c78f3b0479069a9ae017ad9ffe80fce1f519666446cd0588aef8c7a817468762d3bba39d209cd980dc64f47c83427c80d484ae020d1dd070000000000000032e9623fd172ab1cb0a4db1b16a6ef8e59779b37cecc9ba7922916f0841a330075211fe885cbab924781059f3b507f6b3ae1752217bd7eb6889196aa0ea600", @ANYRES8=r3, @ANYRESHEX=r4, @ANYRESHEX=r5], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r10, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) write$cgroup_int(r8, &(0x7f0000000040)=0x900, 0x12) 18.413976584s ago: executing program 1 (id=1146): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0xb7f, &(0x7f0000000180)={0x0, 0x38ab, 0x80, 0x0, 0x1e6}, &(0x7f0000000340)=0x0, &(0x7f0000000600)) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x0, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000e00)={0x30, 0x0, 0x829, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0xc47c47baf788eb66}, 0x8000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r3) sendmsg$NLBL_CALIPSO_C_ADD(r3, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc840}, 0x20020000) 18.267180807s ago: executing program 4 (id=1147): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r0}, 0x18) r1 = socket$kcm(0x10, 0x2, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000008000000060000000010"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r3, 0x0, 0xfffffffffffff001}, 0x18) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x28}}, 0x20050800) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x34, 0x0, 0x1, 0x70bd24, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000d811}, 0x4000080) recvmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001500)=""/4073, 0xe7c}, {&(0x7f0000002500)=""/4096, 0x1000}], 0x75}, 0x40000020) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000002d00090027bd7000fedbdf250500000008000a"], 0x1c}}, 0x20000086) socket$kcm(0x2, 0xa, 0x2) socket(0x200000000000011, 0x2, 0x1) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xd50, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2608004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0xfffffffb}, 0x1f) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x84, &(0x7f0000000000)={0x0, @in={{0x2, 0xfffd, @multicast1}}, 0xfffb}, 0x90) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000240)=0x0) syz_open_procfs$namespace(r8, &(0x7f0000000280)='ns/uts\x00') socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) 17.311145807s ago: executing program 3 (id=1148): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="50020000", @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000080001000000000004000480080002000100000010000c7d0c000b8008000a00b4ed000004000880c8000c8024000900f36aad4208000a156878badf10076800d5441e0f080009002bd49f3b0c00008008000a00697100002c000b8008000a"], 0x250}}, 0x4c000) ioctl$PTP_SYS_OFFSET(r2, 0x43403d05, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x348, 0x18c, 0x203, 0x348, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80}, {}, {}, {}, {}, {}, {}, {0x16}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x240) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="bb7fb37b9489", 'sit0\x00'}}, 0x1e) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000000000005000000000000000108000f"], 0x74}}, 0x0) syz_open_dev$vbi(0x0, 0x2, 0x2) 16.962936624s ago: executing program 2 (id=1149): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x60, 0x3fd}, 0x25) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) unshare(0x8000000) semget$private(0x0, 0x4000, 0x121) semtimedop(0x0, &(0x7f0000000040)=[{0x3, 0x8, 0x1800}, {0x3, 0xfffb, 0xc00}], 0x2, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000080)={0x0, 0x7d, 0x20f}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3000002, 0x110, 0xffffffffffffffff, 0x8000000) r2 = socket$kcm(0x11, 0x3, 0x0) getpeername$l2tp(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xfffffffc) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000000), 0x4) unshare(0x2c040000) 16.892622713s ago: executing program 1 (id=1150): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r4, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) 14.683760263s ago: executing program 1 (id=1152): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x8004) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, 0x0, 0x3, {0x0, 0xf0, 0x4}, 0xfe}, 0x18) sendmmsg(r3, &(0x7f0000000a40)=[{{&(0x7f0000000140)=@un=@file={0x1, './file0\x00'}, 0x80, 0x0}}], 0x1, 0x0) r4 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0) write$binfmt_script(r4, &(0x7f00000000c0)={'#! ', './file0', [{0x20, ')+'}, {0x20, '[k'}, {0x20, 'no&\x80\x85\xfe\x19\x17y\xb2\x82\x81AR\x86lo-\xc5hX\xbbt\b\x86xookie'}, {0x20, 'B-+'}, {0x20, 'hostdata'}, {0x20, '*'}], 0xa, '\vT'}, 0x42) syz_genetlink_get_family_id$tipc(0x0, r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) getpid() close(r5) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@getqdisc={0x24, 0x26, 0x800, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x5, 0xfff3}, {0xa, 0x8}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x20008084) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x403, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r12, 0x0, 0x20000}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_DATA={0x4}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x3}]}}}]}, 0x48}}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000003c0)={&(0x7f0000000080), 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0xc8, r9, 0x400, 0x70bd25, 0x25dfdbff, {}, [@HEADER={0x4}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}]}, @HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x240008c1}, 0x880) 12.92171683s ago: executing program 0 (id=1153): mount$binderfs(0x0, 0x0, 0x0, 0x4800, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000001100)={0x3}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) read$midi(r2, 0x0, 0x20) ioctl$SNDCTL_SEQ_RESET(r3, 0x5100) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r4, &(0x7f0000001600)=""/4103, 0x1007, 0x9b) pipe2$9p(0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, 0x0, 0x0) sendmsg$inet6(r5, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007120000000000"], 0x30}, 0x0) r6 = memfd_create(0x0, 0x7) dup(r6) fanotify_init(0x2, 0x40000) r7 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000000)=0x1) 12.857553061s ago: executing program 3 (id=1154): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'macvlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macvlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4dc1}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r2}, @IFLA_HSR_SLAVE1={0x8, 0x1, r1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x20008004) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80281, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x101000) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r6, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@broadcast, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x9000000) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r4, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) read$FUSE(0xffffffffffffffff, &(0x7f0000000140)={0x2020, 0x0, 0x0, 0x0}, 0x2020) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000002180), 0x4000) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000002200)={0x4, 0x6, {}, {0xffffffffffffffff}, 0x8000000000000001, 0x9}) setresuid(r8, r9, r9) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) 12.850335371s ago: executing program 2 (id=1155): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r0) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="6d932bbd70000000000001"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) syz_open_dev$usbfs(&(0x7f00000001c0), 0x77, 0x141301) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r4 = openat$smackfs_syslog(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) pwritev(r4, &(0x7f00000003c0)=[{0x0}, {&(0x7f00000011c0)="c015", 0x2}], 0x2, 0xc, 0x10000) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x8, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x6}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000100)=0x14) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r7, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0) 12.70816767s ago: executing program 1 (id=1156): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYBLOB="040000001000"/20, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={0xffffffffffffffff, &(0x7f00000002c0), &(0x7f0000000300)=@tcp=r0}, 0x20) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'tunl0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_PROTO={0x5, 0x9, 0x89}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0x8}]}}}]}, 0x44}}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000280)={0x9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r7, 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='devtmpfs\x00', 0x2200892, 0x0) pread64(0xffffffffffffffff, &(0x7f0000002240)=""/237, 0xed, 0x4eb) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0x0, 0x8, 0x3, 0xa, 0xb9, 0x1, 0xe, 0x5, 0x204}, {0x804, 0x1, 0x1, 0x45, 0x7, 0x2, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0x1, 0x3, 0x38, 0x3, 0x84, 0x7, 0x3, 0x50, 0x0, 0x70, 0x4, 0x5, 0x24ab}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 12.501425585s ago: executing program 4 (id=1157): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1a"], 0x7c}}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000080)='./file1\x00', 0x186) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x3, &(0x7f0000000300)=ANY=[], 0x0, 0xa, 0xb9, &(0x7f0000000140)=""/185, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x2002, 0x0) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r6, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=r5, @ANYBLOB="6f86f102a5165254f7201ac67cfaf4384690a052bb337c2a51879be7c3e35886cbf64125337fd94da62eec1f0295b4f48c8ffc118c5a1e78c3791770b40d551e74ce1cb0396bd5dbe50d46264758e426dde49c3548d6e4412a13f3d29df966e7a89e592328685854c6640706ac7173f4f0b9909fd3b8f12752f6ef9511f5544464949844b7ab0ce24e701b4d814190998670f02473bea46e6d2d955d7a2f5d5a7b52bb13e66b884f7d0ca648a15af4e83e"], 0x10}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x0) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x2000}, 0x10, 0x0) landlock_restrict_self(r7, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) 11.914068745s ago: executing program 0 (id=1158): r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOCTL_STOP_ACCEL_DEV(r0, 0x40096101, &(0x7f0000000800)={{}, 0xfd}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x11, 0x6, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], &(0x7f0000000080)='GPL\x00', 0x5, 0xb8, &(0x7f000000cf3d)=""/184, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = openat$random(0xffffffffffffff9c, 0x0, 0x40002, 0x0) fcntl$setownex(r2, 0x11, 0xfffffffffffffffe) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000100)={0x0, 0x0}) r3 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0xff, 0x1b1c, 0x1c09, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0xb0, 0x6, [{{0x9, 0x4, 0x0, 0x1, 0x2, 0x3, 0x1, 0x2, 0x40, {0x9, 0x21, 0x4, 0x80, 0x1, {0x22, 0xaca}}, {{{0x9, 0x5, 0x81, 0x3, 0x1bf, 0x4, 0x86, 0x2}}}}}]}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x18, &(0x7f0000000280)={0x5, 0xf, 0x18, 0x4, [@generic={0x3, 0x10, 0x1}, @generic={0x3, 0x10, 0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x5, 0x8, 0x2}, @ptm_cap={0x3}]}}) syz_usb_control_io(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() quotactl_fd$Q_GETINFO(0xffffffffffffffff, 0xffffffff80000501, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x2710, 0x0, &(0x7f0000000040)) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, 0x0, 0xffffffffffffffc1) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='hfsplus\x00', 0x2000010, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, 0x0, 0x80) 10.259020365s ago: executing program 1 (id=1159): r0 = syz_open_dev$vim2m(0x0, 0x3, 0x2) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x20000, 0x40) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) bind(r3, &(0x7f0000001580)=@un=@file={0x0, './file0\x00'}, 0x80) socket$nl_route(0x10, 0x3, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000002dc0)=@multiplanar_userptr={0x0, 0x1, 0x4, 0x0, 0x7, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, "488dc807"}, 0x1004, 0x2, {0x0}, 0x10000003}) 10.085902815s ago: executing program 2 (id=1160): sched_setscheduler(0x0, 0x1, 0x0) close(0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) r3 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) timerfd_create(0x9, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, 0x0, 0x10) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') tkill(r3, 0xb) r6 = accept(0xffffffffffffffff, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r1, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 9.903122612s ago: executing program 4 (id=1161): fchown(0xffffffffffffffff, 0x0, 0xee01) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$inet6(0xa, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x42}, 0x5, 0x2, 0x2, 0x1, 0x0, 0x2}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x8b32, &(0x7f0000000040)) madvise(&(0x7f00005da000/0x4000)=nil, 0x4000, 0x12) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) mkdirat(0xffffffffffffff9c, 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f0000000000)={0x2}, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r3 = memfd_create(&(0x7f0000000280)='/dev/loop#\x00', 0x3) fcntl$addseals(r3, 0x409, 0x4) fallocate(r3, 0x0, 0x0, 0x4) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) syz_open_dev$vim2m(&(0x7f0000000140), 0x2000000f5, 0x2) connect$x25(r4, &(0x7f0000000a80), 0x12) 7.628846914s ago: executing program 3 (id=1162): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r4, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) 7.181365889s ago: executing program 0 (id=1163): sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000002340)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x4000082) syz_emit_ethernet(0x12, &(0x7f0000000300)={@local, @remote, @void, {@llc={0x4, {@llc={0x42, 0x0, "7f", '\''}}}}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x8b}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$sock(r1, 0x0, 0x0, 0x20000080) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000000)=0x1ff, 0x4) getsockopt$inet_opts(r2, 0x0, 0x9, &(0x7f0000002240)=""/26, &(0x7f0000000040)=0x13) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r3, 0x84, 0x78, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) fsopen(0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r5, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) syz_open_procfs(0x0, &(0x7f0000002340)='net/udp6\x00') openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = io_uring_setup(0xab1, &(0x7f0000000300)={0x0, 0xd674, 0x10000, 0x1, 0x380}) io_uring_register$IORING_REGISTER_PBUF_STATUS(r6, 0x1a, &(0x7f0000000040), 0x1) 7.054795622s ago: executing program 4 (id=1164): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000480), 0x0, 0x20004) ioctl$MEDIA_IOC_ENUM_ENTITIES(r3, 0xc1007c01, &(0x7f0000000f40)) syz_open_dev$video(&(0x7f0000000000), 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x14000) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) io_uring_setup(0x10d7, &(0x7f00000000c0)={0x0, 0xbfff, 0x400, 0x20000002, 0x1d}) bpf$MAP_CREATE(0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='ocfs2_dlmfs\x00', 0x20, &(0x7f0000000400)) chdir(0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0x9362, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0x80049367, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000004300010000000000000000000000e708f1f3be4e65102a242f2f2d3a"], 0x24}}, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) 5.804322042s ago: executing program 4 (id=1165): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'macvtap0\x00'}) bind$netlink(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x1, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xffffffffffffffb0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000002b0009ef"], 0x14}}, 0x84) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYRESOCT=r1, @ANYRES32=0x0, @ANYRESDEC=r1], 0x48}, 0x1, 0x0, 0x0, 0x844}, 0x0) recvmmsg(r2, &(0x7f0000003bc0)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x10000, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_open_dev$ttys(0xc, 0x2, 0x1) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1f00000000000000000000000080"], 0x48) open_by_handle_at(r5, &(0x7f0000000380)=ANY=[@ANYRESOCT], 0x480242) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'hsr0\x00'}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="55460100ef000000"], 0x20}}, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r8}, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) fspick(0xffffffffffffffff, 0x0, 0x0) write$nbd(r5, &(0x7f0000000440)=ANY=[@ANYBLOB="01000000000000000200ffff0300000082b0cfc4337965941538be02000000000000000000007400a391793ba7f40000000000fdf700000000000000000000003e078b4ea9373c73f5f0d747c3d5b253355dc62ee6de97639a2541327d2576f482f67452af6c45419d074aedf0d2074848a66ba8f197463c961664"], 0x40) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000140)={0x200400, 0x2f, 0x1}, 0x18) 5.547007801s ago: executing program 2 (id=1166): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() sched_setscheduler(0x0, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000440)={0x4, &(0x7f0000000300)=[{0x8, 0x5, 0x80, 0x4}, {0x438a, 0x45, 0x4, 0x6}, {0x1, 0x0, 0x4, 0x1}, {0x8001, 0xb6, 0x4d, 0x7}]}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x440}], 0x85, 0x0, 0x0}) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) read$FUSE(r6, 0x0, 0x0) r7 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r7, &(0x7f0000000100)='disconnect aa:aa:aa:aa:aa:11 1', 0x1e) ioctl$KVM_CAP_X2APIC_API(r4, 0x4068aea3, &(0x7f0000000480)={0x81, 0x0, 0x2}) 4.667528685s ago: executing program 3 (id=1167): syz_open_dev$sndpcmc(0x0, 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f00000000c0)=0x81) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000040), 0x10) sendmsg$netlink(r3, &(0x7f0000005d80)={&(0x7f0000000440)=@kern={0x1d, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000005cc0)=[{&(0x7f0000000880)=ANY=[@ANYBLOB="18020000110000042abd7000fcdbdf2596d5ca4ec94685d95d02fccda06116c423d3b58b840614f40d8101799566ba8464c489e4a3dbc83f68f0b28329cbf13d4c93f169197e12a996a5c644121dfa7dd2805cc13b4ad5b84c9cdf07f9d0effd1372e12940e77bef1fd3d83bd72f4247750a75beafd891e81ac47308521fb3fef4a6cc58d644aa093743e2f5042e64ec55ba1eb4cf23319d4cd440746e61d6bf8ad177358bbf0e29026fb7c78db08b8f4d1a592db0f9abc1daada3221ac7375e24f4e29d06b6714f2cbb4d139291f558e8c19a7f082361c5a42eb8b2cf1be5ff6c73d130cefaac2da61e3a35751ca34eedad720c99b5ef07ae56ba5a3d8ee9c9e727b96339c74a692e8fdab3166eb092d63730a88feed54720808e440f233f4a3641b647b3c514a7000182235473bf39b3b4d8e5002580875b5b7bbbac75018120d98241b28822f70a4dc56f2880f60f58193e3dee0259883547a2b12d558c57731bae34b81cc58bce9865cb0ea90a0ea8fe941c00000000e969963804af86a49f74e7671bb3c3817fddc01149d23f2838d846d8985136cf81d5289176b68b489ef7ea73c492deedfcfd6353c17a5b423a01f1f9f9cf3d26b95dac2b71140a93493d97c8323cdf5ee61f7a04ba568518c7e32373c4af02f373b3bf5cfde401", @ANYRES32, @ANYBLOB="08007800f7ffffff0400468004003080000000000000"], 0x218}, {0x0}], 0x2, 0x0, 0x0, 0x44011}, 0x0) r4 = gettid() r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x8800, 0x0) r6 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0xc728, 0x10108, 0x2}, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x23}) io_uring_enter(r6, 0x48e9, 0x0, 0x2, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000900)={{0x0, 0x4, 0x2, 0x0, 'syz0\x00', 0xd3}, 0x1, 0x200, 0x2, r4, 0x0, 0x3, 'syz1\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'geneve0\x00', 0x0}) r12 = socket$nl_route(0x10, 0x3, 0x0) r13 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {r15, 0x1, 0x1, 0x2, {@in6_addr=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x86dd}}}]}, 0x38}}, 0x20044050) sendmsg$nl_route_sched(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4000010) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={@mcast2, 0x0, r11}) socket(0xf, 0x803, 0x0) readv(r2, &(0x7f00000006c0)=[{&(0x7f0000002480)=""/4110, 0x100e}], 0x1) 4.626690752s ago: executing program 0 (id=1168): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wg1\x00'}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, 0x0, 0x0, 0x200000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x15, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fremovexattr(0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) syz_clone3(0x0, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x118) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b37, &(0x7f0000000000)={'wlan0\x00'}) fsopen(&(0x7f0000000300)='binfmt_misc\x00', 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x7a98, 0x0, 0x0, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5) 3.977119301s ago: executing program 2 (id=1169): unshare(0x480) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) capset(&(0x7f0000000080)={0x20071026}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000280)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r2, 0x7}}, 0x48) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f0000000540)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000100)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000140)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0xfffffffd, @empty, 0x5}, r4}}, 0x30) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000200)={0x7, 0x8, 0xfa00, {r4, 0xffffffff}}, 0x10) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f00000000c0)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)) rseq(0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x1, 0xfffffff7, 0x61, 0xc7a754309d18a7cd, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5, 0xb}, 0x50) 2.625037087s ago: executing program 2 (id=1170): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYRES32=r0, @ANYRES64=r0, @ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x89}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) io_setup(0x8, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000007c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x9}}, 0x20) ioctl$int_out(r1, 0x2, &(0x7f0000000280)) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3}}, 0x20) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000000)={0x28, 0x4, r5, 0x0, &(0x7f00004f9000/0x3000)=nil, 0x3000}) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x0, 0x7, 0x0, 0x0, 0x1000}) r6 = openat$nvram(0xffffffffffffff9c, 0x0, 0x8882, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0x7040, 0x0) ioctl$IOMMU_IOAS_COPY(0xffffffffffffffff, 0x3b83, 0x0) r7 = openat$binfmt_register(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r7, &(0x7f0000000340)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x7868b77f, 0x3a, '[\x1e', 0x3a, 'z[&\x11k\xfc\xb24\\\xda\x16M\xb7\xf2\xc0\x8e\x1b\xcf\x9b\f\x88\b(\xfc\xee\nb\x958\x1b\xcfuT\x8d`\xbb\xbcJ\xe4\x8a\xc4\x13v\xa90P\x8a\xf2h\x8dI\x93\xcbu8^\x9e\xe7OT\xb6\xcc\xc7\x13\x7f\xe3\xa4\x062\'w\a\xf0\x8d\xe5Z\xfdl\xe7x\xf0\xe9\xbe', 0x3a, './file0'}, 0x7c) 2.544111959s ago: executing program 0 (id=1171): socket$unix(0x1, 0x5, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae8000000000a01010000000000000000050000000900010073797a3000000000ba000600e9eec003775c64e64f439fc0b5fb34bcd039590bba579a25436e11f718b64e3e01796b9e930a3d8eefa0bccf8429a311f3ce5ec5a0a7bb9e08c60e03cbcdd726725fb9b1bd1000cf2a77ab6ab91f2294632773ea59b8de2361cdd8045c5fdb81611e843cb814e4cfe672542287ebd3b2ed48dca1a08690b05bb9bbbcc05551bd05e4c6e0625fcae04323e0f29dbad3c57456d2ca020462188e1236ebe6da1442c71ab0a8ebfaacef2710111417370a0f8cd19c5f9e1a00000900010073797a30000000"], 0x238}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) userfaultfd(0x801) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40), 0x24, 0x0) rmdir(&(0x7f0000000040)='./bus\x00') r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000001f0000540000000e0001006e657464657673696d0000000f0002"], 0x34}}, 0x0) sendmsg$DEVLINK_CMD_GET(r2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x12, 0xb, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) 2.432759341s ago: executing program 3 (id=1172): syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r0 = socket$rxrpc(0x21, 0x2, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f00000001c0)='GPL\x00'}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$rxrpc(r0, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e22, 0x80000000, @mcast1, 0x4}}, 0x24) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x101142, 0x0) ioctl$KVM_CAP_PMU_CAPABILITY(0xffffffffffffffff, 0x4068aea3, 0x0) r4 = syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5883, 0x8, 0x0, 0xfffffdfc}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, 0x0, 0x4040140) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 1.427165343s ago: executing program 0 (id=1173): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x40000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket$packet(0x11, 0x3, 0x300) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x1602, &(0x7f0000000400)={0x0, 0x707b, 0x40, 0x204, 0x386}, 0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r1, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB], 0x0, 0x6}, 0x94) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x3, @empty}, 0x1c) sendto$inet6(r2, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) writev(r2, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xb}, 0xe) sendmmsg$sock(r3, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) shutdown(r3, 0x1) getdents(0xffffffffffffffff, 0xffffffffffffffff, 0x5a) io_uring_register$IORING_REGISTER_NAPI(0xffffffffffffffff, 0x1b, &(0x7f00000001c0)={0x1, 0xe8}, 0x1) 1.349032755s ago: executing program 4 (id=1174): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) listen(0xffffffffffffffff, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x8) accept4(r4, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, 0x0) lseek(r2, 0x9, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x50, 0x0, 0x0) socket(0x40000000015, 0x5, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x4, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5fabdb7297d069cc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r0, 0x0, 0x20000804) 0s ago: executing program 3 (id=1175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000b40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x8000) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x1e, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000c3ae66dada18aca911786cb22dd58340ad3fdb8287bc9d2b8624f0"], &(0x7f0000001f80)=""/226, 0x26, 0x81, 0x2}, 0x20) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000680)={'syz1\x00', {0xc, 0x0, 0x8, 0x9}, 0x50, [0x1, 0x0, 0x0, 0x401, 0x4, 0x0, 0x3, 0x2, 0x2, 0xebbf, 0xffff, 0x9fe, 0x3, 0x3, 0xfffffffd, 0x80000000, 0x7, 0x8001, 0x2000000, 0x1, 0x84, 0x5b, 0x2, 0x9a, 0x6, 0x9, 0x3587, 0x9, 0x8, 0xfffffff7, 0x7, 0x9, 0xffffffff, 0x0, 0xfff, 0xfffffff5, 0x14, 0x1, 0x5, 0x7, 0xfffffffc, 0x1f, 0x0, 0x581, 0x1b8000, 0x800, 0x1, 0x1, 0x2, 0x10, 0x9, 0x4c5c056b, 0x7, 0xb, 0xcb8f, 0x9, 0xa2, 0x8, 0x42, 0x6, 0x8, 0x5, 0x5c8, 0x3], [0xe, 0x8, 0x3e, 0x8, 0xb06b, 0x7, 0x5, 0x9, 0xd, 0x1000, 0x2, 0xa9, 0x695c, 0x604f, 0x80000000, 0x4, 0x0, 0x7f8, 0x6, 0x1000, 0x2, 0xfffffffa, 0x7ff, 0x9, 0x7fffffff, 0x2, 0x5, 0xa, 0x7, 0xb04, 0x9ed, 0x1, 0x2, 0x8, 0x874, 0xd, 0x7, 0x6, 0x5, 0xfffffbff, 0x9, 0x8569, 0xfffffffa, 0x0, 0x5, 0x6, 0x80000001, 0x3, 0x252, 0x0, 0x10000, 0x9, 0x4, 0xff, 0x3, 0xfffffff9, 0x52400000, 0xca, 0x5, 0x26, 0x1000, 0x80, 0x3, 0xfffffffe], [0x2, 0xa, 0x40, 0x5c9, 0x5, 0x2, 0x7fffffff, 0x3, 0x0, 0x2, 0xfffffffc, 0x9, 0xf7d, 0x5, 0x2, 0x2, 0x2, 0x0, 0x1ff, 0x4, 0xec, 0x2, 0x8, 0x73, 0x0, 0x2, 0x7, 0x4, 0x3, 0x1, 0xc5, 0x9cb, 0x6dca, 0x3a7, 0xc, 0x1, 0x9, 0x8, 0x7fffffff, 0x7, 0x9, 0x6, 0x3, 0x9, 0x1, 0x3cc7, 0x5, 0x7f, 0xb, 0x9290, 0xb, 0x5, 0x0, 0x9, 0x40, 0x0, 0x0, 0x9, 0x7, 0x3, 0x4, 0x6, 0x9, 0x4], [0x0, 0x0, 0xffff8000, 0x2, 0x40, 0x164, 0x9, 0x2, 0x0, 0x10000, 0x7, 0x400, 0x5777, 0x8, 0xcfad, 0x2, 0x3ff, 0x200, 0x1ff, 0x401, 0xfffffffb, 0x8, 0x9, 0x0, 0x5, 0x81, 0x1, 0x8, 0xb6, 0x1b, 0x8, 0x1, 0x9, 0x8, 0x7, 0x3, 0x0, 0x9, 0x3, 0x1, 0x4, 0x3, 0x1, 0x9, 0x6, 0x0, 0x1ff00, 0x3, 0x6, 0x7, 0x1, 0xfffffffd, 0x7fec, 0x0, 0x2, 0x9, 0xfe4, 0x1, 0x2, 0x6, 0x4, 0x9, 0x6, 0x6]}, 0x45c) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x8010, r3, 0xf6a5d000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x4a8, 0x0, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x508) syz_emit_ethernet(0x5e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x28, 0x3a, 0x1, @dev, @private1, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1}}}}}}, 0x0) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r5, 0x3b65, 0x4) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x2, @local}, {0xa, 0xfffd, 0x0, @empty}, 0x1, {[0x0, 0x1]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd3, &(0x7f0000000440)={{0xa, 0x0, 0x9, @local}, {0xa, 0x0, 0x0, @empty}, 0xfffd, {[0x0, 0x0, 0x0, 0x0, 0x4, 0xe3]}}, 0x5c) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): 5840] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.150858][ T5840] Cannot create hsr debugfs directory [ 86.349594][ T5854] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.404663][ T5854] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.434301][ T5854] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.463020][ T5854] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.517477][ T49] cfg80211: failed to load regulatory.db [ 86.517514][ T5839] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.537099][ T5839] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.554611][ T5839] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.567574][ T5839] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.663616][ T5852] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.683490][ T5852] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.694687][ T5852] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.722873][ T5852] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.802779][ T5844] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.815871][ T5844] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.843985][ T5844] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.862997][ T5854] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.886748][ T5844] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.984825][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.998411][ T5854] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.015225][ T5840] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.029113][ T5840] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.042678][ T5840] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.061856][ T3547] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.069174][ T3547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.084352][ T5840] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.108068][ T3547] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.115199][ T3547] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.147295][ T51] Bluetooth: hci1: command tx timeout [ 87.184456][ T5839] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.227365][ T51] Bluetooth: hci0: command tx timeout [ 87.235499][ T3547] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.242726][ T3547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.258801][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.282844][ T153] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.289998][ T153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.307038][ T51] Bluetooth: hci4: command tx timeout [ 87.316939][ T5857] Bluetooth: hci2: command tx timeout [ 87.316985][ T5846] Bluetooth: hci3: command tx timeout [ 87.378116][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.402638][ T5852] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.451982][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.459169][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.489212][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.513849][ T153] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.521044][ T153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.552824][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.560040][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.580916][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.588083][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.623599][ T5839] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 87.824722][ T5854] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.906847][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.990661][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.062266][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.069894][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.083994][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.091153][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.225816][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.394633][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.432526][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.469718][ T5839] veth0_vlan: entered promiscuous mode [ 88.505939][ T5839] veth1_vlan: entered promiscuous mode [ 88.644758][ T5854] veth0_vlan: entered promiscuous mode [ 88.652417][ T5844] veth0_vlan: entered promiscuous mode [ 88.677005][ T5839] veth0_macvtap: entered promiscuous mode [ 88.688145][ T5844] veth1_vlan: entered promiscuous mode [ 88.700572][ T5839] veth1_macvtap: entered promiscuous mode [ 88.708376][ T5852] veth0_vlan: entered promiscuous mode [ 88.714352][ T5854] veth1_vlan: entered promiscuous mode [ 88.745667][ T5852] veth1_vlan: entered promiscuous mode [ 88.764971][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.788288][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.805345][ T5844] veth0_macvtap: entered promiscuous mode [ 88.825200][ T5844] veth1_macvtap: entered promiscuous mode [ 88.841055][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.865252][ T5839] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.874529][ T5839] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.884419][ T5839] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.894109][ T5839] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.931192][ T5854] veth0_macvtap: entered promiscuous mode [ 88.940360][ T5852] veth0_macvtap: entered promiscuous mode [ 88.970135][ T5852] veth1_macvtap: entered promiscuous mode [ 89.004894][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.013190][ T5854] veth1_macvtap: entered promiscuous mode [ 89.069478][ T1098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.073685][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.088328][ T1098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.098993][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.113241][ T5840] veth0_vlan: entered promiscuous mode [ 89.129296][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.145978][ T5844] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.155152][ T5844] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.165350][ T5844] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.174341][ T5844] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.193777][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.204584][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.217182][ T5840] veth1_vlan: entered promiscuous mode [ 89.226782][ T5846] Bluetooth: hci1: command tx timeout [ 89.243242][ T5852] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.252936][ T5852] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.261687][ T5852] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.270782][ T5852] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.300927][ T5854] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.310976][ T5854] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.313333][ T5846] Bluetooth: hci0: command tx timeout [ 89.320914][ T5854] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.335310][ T5854] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.355707][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.365203][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.386680][ T5846] Bluetooth: hci4: command tx timeout [ 89.388876][ T51] Bluetooth: hci2: command tx timeout [ 89.392099][ T5846] Bluetooth: hci3: command tx timeout [ 89.474961][ T5840] veth0_macvtap: entered promiscuous mode [ 89.484709][ T5839] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 89.504310][ T5840] veth1_macvtap: entered promiscuous mode [ 89.556301][ T3547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.564182][ T3547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.696948][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.733747][ T3547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.735779][ T5959] Zero length message leads to an empty skb [ 89.828755][ T3547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.184597][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.237689][ T5840] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.257582][ T5840] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.274009][ T5840] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.288371][ T5840] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.302774][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.312952][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.336109][ T5960] delete_channel: no stack [ 90.362542][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.376860][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.536071][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.573725][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.624839][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.778058][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 90.778700][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 90.786820][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 90.816446][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 90.876073][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.184319][ T30] audit: type=1326 audit(1753312202.923:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.206487][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 91.214784][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 91.236847][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 91.245219][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 91.253785][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 91.282184][ T30] audit: type=1326 audit(1753312202.923:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.306790][ T5846] Bluetooth: hci1: command tx timeout [ 91.386357][ T5846] Bluetooth: hci0: command tx timeout [ 91.445385][ T30] audit: type=1326 audit(1753312202.923:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.470460][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.488026][ T5846] Bluetooth: hci2: command tx timeout [ 91.488056][ T5857] Bluetooth: hci3: command tx timeout [ 91.501733][ T51] Bluetooth: hci4: command tx timeout [ 91.516522][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.517223][ T30] audit: type=1326 audit(1753312202.923:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.545565][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 91.557155][ T30] audit: type=1326 audit(1753312202.923:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.586369][ T30] audit: type=1326 audit(1753312202.923:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.616276][ T30] audit: type=1326 audit(1753312202.923:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.685687][ T30] audit: type=1326 audit(1753312202.923:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.726144][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.821508][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.884945][ T30] audit: type=1326 audit(1753312202.923:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 91.933262][ T5971] trusted_key: encrypted_key: insufficient parameters specified [ 92.327982][ T30] audit: type=1326 audit(1753312202.933:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5963 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 92.739253][ T5978] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 95.235900][ T5993] 9pnet_fd: Insufficient options for proto=fd [ 95.849859][ T5993] lo speed is unknown, defaulting to 1000 [ 95.857623][ T5993] lo speed is unknown, defaulting to 1000 [ 95.865285][ T5993] lo speed is unknown, defaulting to 1000 [ 95.876482][ T5993] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 95.944011][ T5996] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 96.066708][ T5993] infiniband 3yz0: RDMA CMA: cma_listen_on_dev, error -98 [ 96.103945][ T5993] lo speed is unknown, defaulting to 1000 [ 97.838399][ T5993] lo speed is unknown, defaulting to 1000 [ 97.847350][ T5993] lo speed is unknown, defaulting to 1000 [ 97.854359][ T5993] lo speed is unknown, defaulting to 1000 [ 97.861409][ T5993] lo speed is unknown, defaulting to 1000 [ 98.776478][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 98.776496][ T30] audit: type=1326 audit(1753312210.513:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5992 comm="syz.4.10" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7118e9a9 code=0x7ffc0000 [ 98.942576][ T6017] process 'syz.3.13' launched '/dev/fd/3' with NULL argv: empty string added [ 99.560433][ T6018] program syz.2.14 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 99.729777][ T30] audit: type=1326 audit(1753312210.513:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5992 comm="syz.4.10" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7118e9a9 code=0x7ffc0000 [ 99.786991][ T6020] program syz.2.14 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 99.803794][ T6020] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 100.235503][ T6018] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14'. [ 102.411257][ T6039] mmap: syz.2.18 (6039) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 105.793535][ T6063] "syz.4.27" (6063) uses obsolete ecb(arc4) skcipher [ 107.847356][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 109.088499][ T2153] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 109.142736][ T6097] af_packet: tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 109.158614][ T24] usb 4-1: device descriptor read/all, error -71 [ 109.337096][ T2153] usb 1-1: Using ep0 maxpacket: 32 [ 109.396025][ T2153] usb 1-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 109.407902][ T2153] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.420940][ T2153] usb 1-1: config 0 descriptor?? [ 109.461751][ T6103] tipc: Started in network mode [ 109.461782][ T6103] tipc: Node identity 7f000001, cluster identity 4711 [ 109.470423][ T6103] tipc: Enabled bearer , priority 10 [ 109.514987][ T6103] tipc: Enabled bearer , priority 0 [ 109.586340][ T24] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 109.756278][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 109.779383][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 109.854249][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 109.935629][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 109.965887][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 110.004117][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 110.039613][ T2153] usb 1-1: string descriptor 0 read error: -71 [ 110.052572][ T2153] uclogic 0003:256C:006E.0001: failed retrieving string descriptor #200: -71 [ 110.061780][ T2153] uclogic 0003:256C:006E.0001: failed retrieving pen parameters: -71 [ 110.079356][ T2153] uclogic 0003:256C:006E.0001: failed probing pen v2 parameters: -71 [ 110.101527][ T2153] uclogic 0003:256C:006E.0001: failed probing parameters: -71 [ 110.102973][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 110.137656][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 110.152484][ T2153] uclogic 0003:256C:006E.0001: probe with driver uclogic failed with error -71 [ 110.161882][ T24] usb 4-1: Manufacturer: syz [ 110.189302][ T24] usb 4-1: config 0 descriptor?? [ 110.219240][ T2153] usb 1-1: USB disconnect, device number 2 [ 110.286313][ T926] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 110.427854][ T5955] libceph: connect (1)[c::]:6789 error -101 [ 110.435401][ T5955] libceph: mon0 (1)[c::]:6789 connect error [ 110.509816][ T5955] tipc: Node number set to 2130706433 [ 110.519377][ T6115] ceph: No mds server is up or the cluster is laggy [ 110.536348][ T926] usb 5-1: Using ep0 maxpacket: 8 [ 110.637399][ T926] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 110.775065][ T926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.971336][ T5955] libceph: connect (1)[c::]:6789 error -101 [ 110.982593][ T926] usb 5-1: Product: syz [ 110.987904][ T5955] libceph: mon0 (1)[c::]:6789 connect error [ 110.993933][ T926] usb 5-1: Manufacturer: syz [ 111.017389][ T926] usb 5-1: SerialNumber: syz [ 111.062332][ T24] rc_core: IR keymap rc-hauppauge not found [ 111.070238][ T926] usb 5-1: config 0 descriptor?? [ 111.104042][ T24] Registered IR keymap rc-empty [ 111.118266][ T926] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 111.133898][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.146453][ T926] usb 5-1: setting power ON [ 111.166862][ T926] dvb-usb: bulk message failed: -22 (2/0) [ 111.178360][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.230147][ T926] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 111.239240][ T6122] netlink: 'syz.0.46': attribute type 1 has an invalid length. [ 111.268090][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 111.269161][ T6122] netlink: 'syz.0.46': attribute type 2 has an invalid length. [ 111.290401][ T926] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 111.334095][ T6113] dvb-usb: bulk message failed: -22 (3/0) [ 111.343740][ T926] usb 5-1: media controller created [ 111.349780][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input5 [ 111.416156][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.442546][ T926] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 111.468836][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.492181][ T926] usb 5-1: selecting invalid altsetting 6 [ 111.498195][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.506375][ T926] usb 5-1: digital interface selection failed (-22) [ 111.513635][ T926] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 111.524456][ T926] usb 5-1: setting power OFF [ 111.529489][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.539020][ T926] dvb-usb: bulk message failed: -22 (2/0) [ 111.551135][ T926] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 111.568981][ T926] (NULL device *): no alternate interface [ 111.576323][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.626436][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.676489][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.736991][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.753750][ T926] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 111.796292][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.804331][ T926] usb 5-1: USB disconnect, device number 2 [ 111.830128][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 111.868531][ T24] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 111.907998][ T24] mceusb 4-1:0.0: 2 tx ports (0x1 cabled) and 2 rx sensors (0x0 active) [ 111.937142][ T24] usb 4-1: USB disconnect, device number 3 [ 111.979938][ T6135] No buffer was provided with the request [ 112.336793][ T926] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 112.616117][ T6151] xt_CT: No such helper "snmp" [ 113.240122][ T6157] tipc: Started in network mode [ 113.245176][ T6157] tipc: Node identity 7f000001, cluster identity 4711 [ 113.252432][ T6157] tipc: Enabled bearer , priority 10 [ 113.265109][ T6157] tipc: Enabled bearer , priority 0 [ 113.291810][ T926] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.311028][ T926] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 113.335303][ T926] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 113.344707][ T926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 113.406298][ T926] usb 3-1: SerialNumber: syz [ 113.681752][ T926] usb 3-1: 0:2 : does not exist [ 113.765840][ T926] usb 3-1: USB disconnect, device number 2 [ 113.852314][ T6133] udevd[6133]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 113.887931][ T30] audit: type=1326 audit(1753312225.613:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6166 comm="syz.3.63" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28c7f8e9a9 code=0x7fc00000 [ 113.922821][ T6173] Illegal XDP return value 4294967294 on prog (id 15) dev N/A, expect packet loss! [ 114.207993][ T6182] netlink: 36 bytes leftover after parsing attributes in process `syz.1.70'. [ 114.707693][ T926] tipc: Node number set to 2130706433 [ 115.576804][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 115.754713][ T10] usb 1-1: config 0 has an invalid interface number: 30 but max is 0 [ 115.776245][ T10] usb 1-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 115.799876][ T10] usb 1-1: config 0 has no interface number 0 [ 115.812174][ T10] usb 1-1: config 0 interface 30 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 115.834229][ T10] usb 1-1: config 0 interface 30 has no altsetting 0 [ 115.843647][ T10] usb 1-1: New USB device found, idVendor=041e, idProduct=3f19, bcdDevice=74.47 [ 115.878440][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.904324][ T10] usb 1-1: config 0 descriptor?? [ 115.915571][ T10] usb 1-1: unknown interface protocol 0x41, assuming v1 [ 115.924686][ T10] usb 1-1: 30:2 : does not exist [ 115.974411][ T2153] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 116.051279][ T30] audit: type=1326 audit(1753312227.813:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6232 comm="syz.1.87" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x0 [ 116.148082][ T10] usb 1-1: USB disconnect, device number 3 [ 116.156483][ T2153] usb 5-1: Using ep0 maxpacket: 16 [ 116.196089][ T2153] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.218342][ T2153] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 116.218378][ T2153] usb 5-1: config 0 interface 0 has no altsetting 0 [ 116.218410][ T2153] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 116.218431][ T2153] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.239534][ T2153] usb 5-1: config 0 descriptor?? [ 116.507011][ T6240] warning: `syz.2.90' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 116.975443][ T926] usb 5-1: USB disconnect, device number 3 [ 117.663619][ T6256] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 117.922032][ T6261] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.930430][ T6261] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.968874][ T6261] netlink: 132 bytes leftover after parsing attributes in process `syz.2.96'. [ 118.597648][ T2153] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 118.839971][ T2153] usb 2-1: Using ep0 maxpacket: 16 [ 118.880483][ T2153] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 118.916456][ T51] Bluetooth: hci4: command tx timeout [ 118.934023][ T2153] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 119.059905][ T2153] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.497678][ T2153] usb 2-1: config 0 descriptor?? [ 120.497352][ T2153] mcp2221 0003:04D8:00DD.0003: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 121.014730][ T2153] usb 2-1: USB disconnect, device number 2 [ 121.426561][ T5951] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 121.922552][ T5914] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 122.982225][ T6303] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 123.106328][ T5914] usb 1-1: Using ep0 maxpacket: 8 [ 123.132586][ T5914] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 123.156970][ T5914] usb 1-1: config 0 has no interface number 0 [ 123.163118][ T5914] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 123.177030][ T5951] usb 4-1: Using ep0 maxpacket: 32 [ 123.192241][ T6308] netlink: 4 bytes leftover after parsing attributes in process `syz.2.114'. [ 123.198890][ T5951] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 123.201768][ T5914] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 123.219617][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.230980][ T5951] usb 4-1: config 0 has no interface number 0 [ 123.264745][ T5914] usb 1-1: config 0 descriptor?? [ 123.275987][ T5951] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 123.317557][ T5914] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 123.328278][ T5951] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.328300][ T5951] usb 4-1: Product: syz [ 123.328315][ T5951] usb 4-1: Manufacturer: syz [ 123.328329][ T5951] usb 4-1: SerialNumber: syz [ 123.354858][ T5951] usb 4-1: config 0 descriptor?? [ 123.401081][ T30] audit: type=1326 audit(1753312235.163:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 123.588799][ T5951] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 123.867157][ T5914] usb 1-1: USB disconnect, device number 4 [ 123.908141][ T5951] usb 4-1: selecting invalid altsetting 1 [ 123.927414][ T5951] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 123.946910][ T30] audit: type=1326 audit(1753312235.163:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 123.947407][ T5207] udevd[5207]: worker [6133] terminated by signal 33 (Unknown signal 33) [ 123.986801][ T5951] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 123.997927][ T5951] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 124.008868][ T30] audit: type=1326 audit(1753312235.173:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 124.031765][ T5951] usb 4-1: media controller created [ 124.070196][ T30] audit: type=1326 audit(1753312235.173:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 124.095572][ T5951] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 124.116543][ T5207] udevd[5207]: worker [6133] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.1/usbmisc/iowarrior0' [ 124.137129][ T30] audit: type=1326 audit(1753312235.173:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 124.174221][ T6316] gtp0: entered promiscuous mode [ 124.187938][ T6316] gtp0: entered allmulticast mode [ 124.197266][ T5951] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 124.204498][ T5951] zl10353_read_register: readreg error (reg=127, ret==-71) [ 124.634864][ T30] audit: type=1326 audit(1753312235.363:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 124.694789][ T5951] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 124.753704][ T30] audit: type=1326 audit(1753312235.363:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fe969f85967 code=0x7ffc0000 [ 124.888895][ T30] audit: type=1326 audit(1753312235.363:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe969f2ab89 code=0x7ffc0000 [ 124.937663][ T5951] usb 4-1: USB disconnect, device number 4 [ 124.993528][ T30] audit: type=1326 audit(1753312235.363:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7fe969f8e9a9 code=0x7ffc0000 [ 125.060611][ T6328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.121'. [ 125.108325][ T30] audit: type=1326 audit(1753312235.363:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6311 comm="syz.1.115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fe969f85967 code=0x7ffc0000 [ 125.476307][ T2153] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 125.648297][ T2153] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.676052][ T2153] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 126.033897][ T2153] usb 2-1: New USB device found, idVendor=0416, idProduct=c168, bcdDevice= 0.00 [ 126.046231][ T2153] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.137767][ T2153] usb 2-1: config 0 descriptor?? [ 126.273281][ T6345] syz.0.127: attempt to access beyond end of device [ 126.273281][ T6345] loop0: rw=0, sector=16, nr_sectors = 2 limit=0 [ 126.969628][ T2153] hid (null): nested delimiters [ 126.985088][ T2153] hid-generic 0003:0416:C168.0004: nested delimiters [ 127.000769][ T2153] hid-generic 0003:0416:C168.0004: item 0 1 2 10 parsing failed [ 127.014556][ T2153] hid-generic 0003:0416:C168.0004: probe with driver hid-generic failed with error -22 [ 127.156304][ T926] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 127.172185][ T5951] usb 2-1: USB disconnect, device number 3 [ 127.207519][ T5914] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 127.344767][ T926] usb 3-1: Using ep0 maxpacket: 32 [ 127.396333][ T5914] usb 4-1: Using ep0 maxpacket: 32 [ 127.415596][ T5914] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 127.424348][ T926] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 127.428972][ T5914] usb 4-1: config 0 has no interface number 0 [ 127.466072][ T926] usb 3-1: config 0 has no interface number 0 [ 127.503142][ T926] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.507849][ T5914] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 127.556079][ T926] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.561211][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.567319][ T926] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 127.575412][ T5914] usb 4-1: Product: syz [ 127.584564][ T926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.686966][ T5914] usb 4-1: Manufacturer: syz [ 127.738926][ T926] usb 3-1: config 0 descriptor?? [ 127.765507][ T5914] usb 4-1: SerialNumber: syz [ 127.809130][ T5914] usb 4-1: config 0 descriptor?? [ 127.854403][ T5914] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 128.113667][ T6360] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 128.113846][ T5914] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 128.191249][ T5914] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 128.414210][ T926] uclogic 0003:28BD:0094.0005: pen parameters not found [ 128.434650][ T926] uclogic 0003:28BD:0094.0005: interface is invalid, ignoring [ 128.486554][ T5955] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 128.525897][ T6368] syzkaller1: entered promiscuous mode [ 128.536145][ T6368] syzkaller1: entered allmulticast mode [ 128.643348][ T926] usb 3-1: USB disconnect, device number 3 [ 128.652975][ T5955] usb 2-1: Using ep0 maxpacket: 8 [ 128.662690][ T6373] netlink: 44 bytes leftover after parsing attributes in process `syz.4.137'. [ 128.676641][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 128.678179][ T5955] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 128.685364][ T5914] usb 4-1: USB disconnect, device number 5 [ 128.700194][ T5955] usb 2-1: config 179 has no interface number 0 [ 128.723612][ T5955] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 128.747878][ T5955] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 128.760648][ T5955] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 128.761861][ T5914] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 128.779301][ T5955] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 128.812513][ T5955] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 128.830473][ T5914] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 128.859382][ T5955] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 128.867133][ T5914] quatech2 4-1:0.51: device disconnected [ 128.879631][ T5955] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.935462][ T6363] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 129.470571][ T5955] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input6 [ 129.498353][ T6363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.710451][ T6363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.634475][ T5914] usb 2-1: USB disconnect, device number 4 [ 130.634482][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 130.634525][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 132.631684][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.643263][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.950502][ T6420] tipc: Started in network mode [ 132.996564][ T6420] tipc: Node identity 7f000001, cluster identity 4711 [ 133.209774][ T6420] tipc: Enabled bearer , priority 10 [ 133.630209][ T6420] tipc: Enabled bearer , priority 0 [ 134.747343][ T5955] tipc: Node number set to 2130706433 [ 135.338387][ T6443] ceph: No mds server is up or the cluster is laggy [ 135.587633][ T5956] libceph: connect (1)[c::]:6789 error -101 [ 135.595635][ T5956] libceph: mon0 (1)[c::]:6789 connect error [ 135.631728][ T6452] sctp: [Deprecated]: syz.0.164 (pid 6452) Use of int in max_burst socket option deprecated. [ 135.631728][ T6452] Use struct sctp_assoc_value instead [ 136.938868][ T5955] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 137.036274][ T5956] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 137.071297][ T5914] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 137.098345][ T6481] evm: overlay not supported [ 137.142813][ T5955] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 137.260337][ T5955] usb 5-1: config 0 interface 0 has no altsetting 0 [ 137.307901][ T5955] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 137.314456][ T5956] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 137.323169][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 137.329691][ T5956] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 137.340606][ T5955] usb 5-1: Product: syz [ 137.352098][ T5914] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 137.352132][ T5914] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 24623, setting to 1024 [ 137.391886][ T5955] usb 5-1: Manufacturer: syz [ 137.396766][ T5955] usb 5-1: SerialNumber: syz [ 137.446213][ T5914] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 137.447359][ T5955] usb 5-1: config 0 descriptor?? [ 137.486825][ T5956] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 137.582379][ T5914] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 137.668103][ T5956] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 137.683646][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.685824][ T5955] usb 5-1: selecting invalid altsetting 0 [ 137.691725][ T5956] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 137.691752][ T5956] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.752077][ T6476] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 137.775897][ T5956] usb 4-1: config 0 descriptor?? [ 137.814902][ T6488] syz.1.181 uses obsolete (PF_INET,SOCK_PACKET) [ 137.835357][ T5914] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 137.861866][ T5955] usb 5-1: USB disconnect, device number 4 [ 138.011197][ T5914] usb 1-1: USB disconnect, device number 5 [ 138.146409][ T5951] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 138.214920][ T5956] plantronics 0003:047F:FFFF.0006: ignoring exceeding usage max [ 138.283600][ T5956] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 138.318313][ T5951] usb 3-1: config 0 has no interfaces? [ 138.324010][ T5951] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 138.334801][ T5951] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.347595][ T5951] usb 3-1: config 0 descriptor?? [ 138.476289][ T926] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 138.644855][ T926] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 138.669688][ T926] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 138.685838][ T926] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 138.696248][ T926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.716388][ T926] usb 2-1: config 0 descriptor?? [ 138.781323][ T6490] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.810564][ T6490] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.910854][ T5951] usb 3-1: USB disconnect, device number 4 [ 139.501044][ T926] cm6533_jd 0003:0D8C:0022.0007: unknown main item tag 0x0 [ 139.509394][ T926] cm6533_jd 0003:0D8C:0022.0007: unknown main item tag 0x0 [ 139.537423][ T926] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.0007/input/input7 [ 139.589863][ T926] cm6533_jd 0003:0D8C:0022.0007: input,hiddev1,hidraw1: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 139.737108][ T10] usb 2-1: USB disconnect, device number 5 [ 140.249334][ T5914] usb 4-1: USB disconnect, device number 6 [ 141.404992][ T6526] tipc: Started in network mode [ 141.410591][ T6526] tipc: Node identity 7f000001, cluster identity 4711 [ 141.424220][ T6526] tipc: Enabled bearer , priority 10 [ 141.476318][ T6526] tipc: Enabled bearer , priority 0 [ 142.226405][ T6538] tipc: Started in network mode [ 142.247850][ T6538] tipc: Node identity 7, cluster identity 4711 [ 142.297020][ T6538] tipc: Node number set to 7 [ 142.529970][ T6547] Bluetooth: MGMT ver 1.23 [ 142.536456][ T5951] tipc: Node number set to 2130706433 [ 142.978424][ T6553] lo speed is unknown, defaulting to 1000 [ 143.034455][ T6552] KVM: debugfs: duplicate directory 6552-4 [ 143.275157][ T6557] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 143.317566][ T5956] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 143.588503][ T5956] usb 2-1: config 0 has no interfaces? [ 143.696870][ T5956] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 143.716329][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.729894][ T5956] usb 2-1: Product: syz [ 143.734120][ T5956] usb 2-1: Manufacturer: syz [ 143.775653][ T5956] usb 2-1: SerialNumber: syz [ 143.802492][ T5956] usb 2-1: config 0 descriptor?? [ 144.097398][ T6553] veth1_macvtap: left promiscuous mode [ 144.116655][ T5955] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 144.124261][ T5951] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 144.159570][ T6553] veth1_macvtap: entered promiscuous mode [ 144.166320][ T926] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 144.179230][ T5914] usb 2-1: USB disconnect, device number 6 [ 144.276448][ T5951] usb 1-1: Using ep0 maxpacket: 16 [ 144.286737][ T5951] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 144.298437][ T5955] usb 5-1: too many endpoints for config 1 interface 0 altsetting 7: 255, using maximum allowed: 30 [ 144.309603][ T5955] usb 5-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 255 [ 144.322820][ T5951] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 144.334867][ T5955] usb 5-1: config 1 interface 0 has no altsetting 0 [ 144.343845][ T5955] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 144.353181][ T926] usb 3-1: Using ep0 maxpacket: 8 [ 144.359706][ T5955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 144.368103][ T5951] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 144.377830][ T5955] usb 5-1: SerialNumber: syz [ 144.382629][ T5951] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.392422][ T926] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 144.403590][ T5951] usb 1-1: Product: syz [ 144.409364][ T926] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 144.419422][ T5955] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 144.427512][ T5951] usb 1-1: Manufacturer: syz [ 144.432122][ T5951] usb 1-1: SerialNumber: syz [ 144.438203][ T5955] cdc_acm 5-1:1.0: This needs exactly 3 endpoints [ 144.444661][ T5955] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -22 [ 144.452708][ T926] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 144.463833][ T926] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 144.477823][ T5951] usb 1-1: config 0 descriptor?? [ 144.488844][ T5951] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 144.503195][ T5951] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 144.511013][ T926] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 144.521772][ T926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.613698][ T24] usb 5-1: USB disconnect, device number 5 [ 144.762095][ T926] usb 3-1: usb_control_msg returned -32 [ 144.768685][ T926] usbtmc 3-1:16.0: can't read capabilities [ 144.779862][ T6569] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.804397][ T6569] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.846578][ T24] usb 3-1: USB disconnect, device number 5 [ 144.954979][ T12] veth1_macvtap: left promiscuous mode [ 145.060270][ T6576] block nbd1: NBD_DISCONNECT [ 145.065561][ T6576] block nbd1: Disconnected due to user request. [ 145.072691][ T6576] block nbd1: shutting down sockets [ 145.092429][ T5951] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 145.102919][ T5951] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 145.118463][ T926] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 145.287627][ T926] usb 4-1: Using ep0 maxpacket: 16 [ 145.300307][ T926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 145.313263][ T926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.323434][ T926] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 145.336923][ T926] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 145.348148][ T5951] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 145.356495][ T5951] em28xx 1-1:0.0: No AC97 audio processor [ 145.393177][ T926] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.585474][ T926] usb 4-1: config 0 descriptor?? [ 145.669643][ T5951] usb 1-1: USB disconnect, device number 6 [ 145.830160][ T5951] em28xx 1-1:0.0: Disconnecting em28xx [ 145.894204][ T5951] em28xx 1-1:0.0: Freeing device [ 146.131261][ T926] HID 045e:07da: Invalid code 65791 type 1 [ 146.176015][ T926] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0008/input/input8 [ 146.235826][ T926] microsoft 0003:045E:07DA.0008: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 146.258525][ T5914] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 146.388413][ T10] usb 4-1: USB disconnect, device number 7 [ 146.449024][ T5914] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 146.462028][ T6598] input: syz1 as /devices/virtual/input/input9 [ 146.491963][ T5914] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 146.503335][ T5914] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 146.512622][ T5914] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 146.540511][ T6596] fido_id[6596]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 146.562729][ T5914] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 146.587645][ T5914] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 146.600981][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 146.640122][ T5914] usb 3-1: Product: syz [ 146.654016][ T5914] usb 3-1: Manufacturer: syz [ 146.707614][ T5914] cdc_wdm 3-1:1.0: skipping garbage [ 146.720412][ T5914] cdc_wdm 3-1:1.0: skipping garbage [ 146.747732][ T5914] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 146.760491][ T5914] cdc_wdm 3-1:1.0: Unknown control protocol [ 147.266292][ T5951] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 147.365368][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -EPIPE [ 147.526343][ T5951] usb 1-1: Using ep0 maxpacket: 16 [ 147.538737][ T5951] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 147.549448][ T10] usb 3-1: USB disconnect, device number 6 [ 147.590146][ T5951] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 147.602361][ T5951] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 147.619454][ T5951] usb 1-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice=50.0d [ 147.629291][ T5951] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.637464][ T5951] usb 1-1: Product: syz [ 147.641705][ T5951] usb 1-1: Manufacturer: syz [ 147.646458][ T5951] usb 1-1: SerialNumber: syz [ 147.671255][ T5951] usb 1-1: config 0 descriptor?? [ 147.695250][ T5951] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 147.702263][ T5951] gspca_stv06xx: st6422 sensor detected [ 147.743348][ T5914] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 147.808566][ T6625] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input10 [ 147.953363][ T5914] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.966665][ T5951] STV06xx 1-1:0.0: probe with driver STV06xx failed with error -71 [ 147.992605][ T5951] usb 1-1: USB disconnect, device number 7 [ 148.001576][ T5914] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 148.014924][ T5914] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 148.054740][ T5914] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.069778][ T5914] usb 5-1: Product: syz [ 148.105956][ T5914] usb 5-1: Manufacturer: syz [ 148.113078][ T5914] usb 5-1: SerialNumber: syz [ 148.211793][ T6632] dummy0: entered promiscuous mode [ 148.221933][ T6632] bond0: entered promiscuous mode [ 148.228334][ T6632] bond_slave_0: entered promiscuous mode [ 148.234503][ T6632] bond_slave_1: entered promiscuous mode [ 148.249581][ T6632] hsr1: entered allmulticast mode [ 148.264186][ T6632] dummy0: entered allmulticast mode [ 148.272136][ T6632] bond0: entered allmulticast mode [ 148.280083][ T6632] bond_slave_0: entered allmulticast mode [ 148.290232][ T6632] bond_slave_1: entered allmulticast mode [ 148.346951][ T5914] usb 5-1: 0:2 : does not exist [ 148.372349][ T5914] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 148.432088][ T5914] usb 5-1: USB disconnect, device number 6 [ 148.731782][ T6491] udevd[6491]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 149.046583][ T6645] "syz.3.240" (6645) uses obsolete ecb(arc4) skcipher [ 149.115710][ T6649] loop2: detected capacity change from 0 to 7 [ 149.140353][ T5860] Dev loop2: unable to read RDB block 7 [ 149.158385][ T6652] netlink: 104 bytes leftover after parsing attributes in process `syz.1.243'. [ 149.168588][ T5860] loop2: unable to read partition table [ 149.179157][ T5860] loop2: partition table beyond EOD, truncated [ 149.198300][ T6649] Dev loop2: unable to read RDB block 7 [ 149.210606][ T6649] loop2: unable to read partition table [ 149.225977][ T6649] loop2: partition table beyond EOD, truncated [ 149.237988][ T6649] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 149.435929][ T6660] netlink: 'syz.2.246': attribute type 12 has an invalid length. [ 149.498195][ T6660] netlink: 4 bytes leftover after parsing attributes in process `syz.2.246'. [ 149.533682][ T6660] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.542806][ T6660] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.551671][ T6660] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.561873][ T6660] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.629159][ T6660] netlink: 'syz.2.246': attribute type 12 has an invalid length. [ 149.650466][ T6660] netlink: 4 bytes leftover after parsing attributes in process `syz.2.246'. [ 149.948324][ T5951] kernel read not supported for file /dsp (pid: 5951 comm: kworker/1:5) [ 150.001010][ T5951] libceph: connect (1)[c::]:6789 error -101 [ 150.008071][ T5951] libceph: mon0 (1)[c::]:6789 connect error [ 150.016245][ T5956] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 150.055588][ T6669] ceph: No mds server is up or the cluster is laggy [ 150.176601][ T5956] usb 1-1: Using ep0 maxpacket: 32 [ 150.201159][ T5956] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 150.223132][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 150.269400][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 150.316245][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 150.355456][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 150.371334][ T6680] input: syz1 as /devices/virtual/input/input11 [ 150.411567][ T5956] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 150.427189][ T5956] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.450072][ T5956] usb 1-1: Product: syz [ 150.454288][ T5956] usb 1-1: Manufacturer: syz [ 150.469518][ T5956] usb 1-1: SerialNumber: syz [ 150.495498][ T5956] usb 1-1: config 0 descriptor?? [ 150.606616][ T6686] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 150.774027][ T6688] block device autoloading is deprecated and will be removed. [ 150.897404][ T6698] loop2: detected capacity change from 0 to 7 [ 150.930639][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 150.938578][ T6698] Dev loop2: unable to read RDB block 7 [ 150.944203][ T6698] loop2: unable to read partition table [ 150.946041][ T5956] input input12: Device does not respond to id packet M [ 150.961199][ T6698] loop2: partition table beyond EOD, truncated [ 150.969979][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 150.976031][ T5956] input input12: Device does not respond to id packet P [ 151.000478][ T6702] syz.1.265: attempt to access beyond end of device [ 151.000478][ T6702] loop1: rw=0, sector=16, nr_sectors = 2 limit=0 [ 151.036917][ T6698] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 151.066852][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 151.072901][ T5956] input input12: Device does not respond to id packet B [ 151.100722][ T24] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 151.287265][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 151.301310][ T24] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 151.319026][ T24] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 151.332901][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 151.342332][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 151.352250][ T24] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 151.362443][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 151.363709][ T24] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 151.379593][ T5956] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 151.383157][ T24] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 151.398558][ T2153] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 151.415062][ T24] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 151.424924][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.430196][ T5956] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input12 [ 151.524700][ T5956] usb 1-1: USB disconnect, device number 8 [ 151.564936][ T2153] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 151.586214][ T2153] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 151.605496][ T2153] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 151.629665][ T2153] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.665121][ T6704] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 151.683853][ T2153] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 151.691758][ T24] usb 5-1: usb_control_msg returned -32 [ 151.697606][ T24] usbtmc 5-1:16.0: can't read capabilities [ 151.904609][ T926] usb 2-1: USB disconnect, device number 7 [ 152.127017][ T6722] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 152.302609][ T6732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.278'. [ 152.311976][ T6732] netlink: 4 bytes leftover after parsing attributes in process `syz.3.278'. [ 152.328600][ T5951] usb 5-1: USB disconnect, device number 7 [ 152.338506][ T6732] wireguard0: entered promiscuous mode [ 152.360334][ T6732] wireguard0: entered allmulticast mode [ 152.396539][ T926] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 152.470760][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 152.470774][ T30] audit: type=1800 audit(1753312264.233:56): pid=6735 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.279" name="nullb0" dev="tmpfs" ino=313 res=0 errno=0 [ 152.588684][ T926] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 152.607111][ T926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 152.631767][ T926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 152.657554][ T926] usb 1-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 152.667465][ T926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.684894][ T926] usb 1-1: Product: syz [ 152.696268][ T926] usb 1-1: Manufacturer: syz [ 152.703504][ T926] usb 1-1: SerialNumber: syz [ 152.720222][ T926] usb 1-1: config 0 descriptor?? [ 152.988683][ T6725] syz.2.275: vmalloc error: size 2768896, failed to allocated page array size 5408, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 153.007878][ T6725] CPU: 1 UID: 0 PID: 6725 Comm: syz.2.275 Not tainted 6.16.0-rc7-syzkaller-00018-g01a412d06bc5 #0 PREEMPT(full) [ 153.007906][ T6725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 153.007924][ T6725] Call Trace: [ 153.007935][ T6725] [ 153.007943][ T6725] dump_stack_lvl+0x189/0x250 [ 153.007980][ T6725] ? __pfx_dump_stack_lvl+0x10/0x10 [ 153.008009][ T6725] ? __pfx__printk+0x10/0x10 [ 153.008034][ T6725] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 153.008058][ T6725] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 153.008083][ T6725] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 153.008110][ T6725] warn_alloc+0x214/0x310 [ 153.008140][ T6725] ? __pfx_warn_alloc+0x10/0x10 [ 153.008171][ T6725] ? __get_vm_area_node+0x28f/0x300 [ 153.008193][ T6725] ? vb2_vmalloc_alloc+0xef/0x340 [ 153.008226][ T6725] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 153.008276][ T6725] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 153.008304][ T6725] ? __kasan_kmalloc+0x93/0xb0 [ 153.008327][ T6725] vmalloc_user_noprof+0xad/0xf0 [ 153.008348][ T6725] ? vb2_vmalloc_alloc+0xef/0x340 [ 153.008377][ T6725] vb2_vmalloc_alloc+0xef/0x340 [ 153.008405][ T6725] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 153.008434][ T6725] __vb2_queue_alloc+0x9c2/0x15a0 [ 153.008485][ T6725] vb2_core_reqbufs+0xc31/0x1420 [ 153.008528][ T6725] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 153.008554][ T6725] ? vb2_verify_memory_type+0x1fc/0x570 [ 153.008582][ T6725] ? vb2_reqbufs+0x3a9/0x630 [ 153.008615][ T6725] v4l2_m2m_ioctl_reqbufs+0x10d/0x200 [ 153.008638][ T6725] __video_do_ioctl+0xc98/0xdb0 [ 153.008676][ T6725] ? __pfx___video_do_ioctl+0x10/0x10 [ 153.008719][ T6725] video_usercopy+0x871/0x14f0 [ 153.008756][ T6725] ? __pfx___video_do_ioctl+0x10/0x10 [ 153.008785][ T6725] ? __pfx_video_usercopy+0x10/0x10 [ 153.008809][ T6725] ? smack_file_ioctl+0x2a9/0x340 [ 153.008842][ T6725] ? __fget_files+0x2a/0x420 [ 153.008862][ T6725] ? __fget_files+0x3a0/0x420 [ 153.008885][ T6725] v4l2_ioctl+0x18d/0x1e0 [ 153.008911][ T6725] ? __pfx_v4l2_ioctl+0x10/0x10 [ 153.008936][ T6725] __se_sys_ioctl+0xf9/0x170 [ 153.008965][ T6725] do_syscall_64+0xfa/0x3b0 [ 153.008991][ T6725] ? lockdep_hardirqs_on+0x9c/0x150 [ 153.009010][ T6725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.009028][ T6725] ? clear_bhb_loop+0x60/0xb0 [ 153.009050][ T6725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.009067][ T6725] RIP: 0033:0x7fbf3bb8e9a9 [ 153.009087][ T6725] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 153.009102][ T6725] RSP: 002b:00007fbf3caaf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 153.009120][ T6725] RAX: ffffffffffffffda RBX: 00007fbf3bdb5fa0 RCX: 00007fbf3bb8e9a9 [ 153.009133][ T6725] RDX: 00002000000000c0 RSI: 00000000c0145608 RDI: 0000000000000003 [ 153.009144][ T6725] RBP: 00007fbf3bc10d69 R08: 0000000000000000 R09: 0000000000000000 [ 153.009155][ T6725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 153.009165][ T6725] R13: 0000000000000000 R14: 00007fbf3bdb5fa0 R15: 00007ffd150bf128 [ 153.009192][ T6725] [ 153.009267][ T6725] Mem-Info: [ 153.333008][ T6725] active_anon:275 inactive_anon:5734 isolated_anon:0 [ 153.333008][ T6725] active_file:5913 inactive_file:45383 isolated_file:0 [ 153.333008][ T6725] unevictable:768 dirty:286 writeback:0 [ 153.333008][ T6725] slab_reclaimable:10156 slab_unreclaimable:97813 [ 153.333008][ T6725] mapped:30143 shmem:1379 pagetables:1345 [ 153.333008][ T6725] sec_pagetables:0 bounce:0 [ 153.333008][ T6725] kernel_misc_reclaimable:0 [ 153.333008][ T6725] free:1290885 free_pcp:16707 free_cma:0 [ 153.382415][ T6725] Node 0 active_anon:1100kB inactive_anon:23036kB active_file:23456kB inactive_file:181532kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120572kB dirty:1140kB writeback:0kB shmem:3980kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12064kB pagetables:5340kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 153.416913][ T6725] Node 1 active_anon:0kB inactive_anon:0kB active_file:196kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 153.450974][ T6725] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 153.498755][ T6725] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 153.505126][ T6725] Node 0 DMA32 free:1246096kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1096kB inactive_anon:22996kB active_file:21680kB inactive_file:181464kB unevictable:1536kB writepending:1140kB present:3129332kB managed:2560996kB mlocked:0kB bounce:0kB free_pcp:48152kB local_pcp:28784kB free_cma:0kB [ 153.615443][ T6725] lowmem_reserve[]: 0 0 1 1 1 [ 153.630056][ T6725] Node 0 Normal free:8kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:40kB active_file:1776kB inactive_file:68kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 153.745492][ T6725] lowmem_reserve[]: 0 0 0 0 0 [ 153.773641][ T6725] Node 1 Normal free:3900984kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:196kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:18720kB local_pcp:14304kB free_cma:0kB [ 153.889669][ T6725] lowmem_reserve[]: 0 0 0 0 0 [ 153.909882][ T6725] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 153.937769][ T6725] Node 0 DMA32: 246*4kB (ME) 60*8kB (ME) 84*16kB (M) 178*32kB (UM) 415*64kB (UM) 49*128kB (UM) 43*256kB (UME) 27*512kB (UME) 13*1024kB (UME) 5*2048kB (UM) 281*4096kB (UM) = 1240696kB [ 153.965803][ T6725] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 153.997303][ T6725] Node 1 Normal: 168*4kB (UME) 41*8kB (UME) 43*16kB (UME) 97*32kB (UME) 20*64kB (UME) 9*128kB (UME) 4*256kB (UM) 3*512kB (ME) 2*1024kB (ME) 1*2048kB (E) 949*4096kB (M) = 3900984kB [ 154.019415][ T6725] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 154.032646][ T6725] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 154.046384][ T6725] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 154.056030][ T6725] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 154.073437][ T6725] 52671 total pagecache pages [ 154.078502][ T6725] 0 pages in swap cache [ 154.082687][ T6725] Free swap = 124996kB [ 154.090569][ T6725] Total swap = 124996kB [ 154.094780][ T6725] 2097051 pages RAM [ 154.098951][ T6725] 0 pages HighMem/MovableOnly [ 154.103755][ T6725] 424695 pages reserved [ 154.113301][ T6725] 0 pages cma reserved [ 155.069116][ T6777] tipc: Enabled bearer , priority 10 [ 155.159492][ T6777] tipc: Enabled bearer , priority 0 [ 156.916291][ T5951] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 157.116421][ T5951] usb 5-1: Using ep0 maxpacket: 16 [ 157.142122][ T5951] usb 5-1: config index 0 descriptor too short (expected 59154, got 18) [ 157.163367][ T5951] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 157.182708][ T6804] fuse: Bad value for 'fd' [ 157.202820][ T5951] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 157.227400][ T5951] usb 5-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 157.256471][ T5951] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.276058][ T5951] usb 5-1: Product: syz [ 157.284220][ T5951] usb 5-1: Manufacturer: syz [ 157.307904][ T5951] usb 5-1: SerialNumber: syz [ 157.330278][ T5951] usb 5-1: config 0 descriptor?? [ 157.350399][ T5951] ssu100 5-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 157.799772][ T6821] capability: warning: `syz.3.312' uses deprecated v2 capabilities in a way that may be insecure [ 157.826078][ T6821] overlayfs: failed to clone upperpath [ 158.568138][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 158.574463][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 158.649034][ T6830] ceph: No mds server is up or the cluster is laggy [ 158.656204][ T5951] ssu100 5-1:0.0: probe with driver ssu100 failed with error -71 [ 158.674917][ T5951] usb 5-1: USB disconnect, device number 8 [ 159.607198][ T10] libceph: connect (1)[c::]:6789 error -101 [ 159.613421][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 159.723541][ T6859] ceph: No mds server is up or the cluster is laggy [ 160.393174][ T30] audit: type=1326 audit(1753312272.153:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6866 comm="syz.1.330" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe969f8e9a9 code=0x0 [ 160.521510][ T6872] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 160.816622][ T5841] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 160.828209][ T6885] netlink: 'syz.3.338': attribute type 6 has an invalid length. [ 160.976416][ T5841] usb 3-1: Using ep0 maxpacket: 16 [ 160.989083][ T5841] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 160.999602][ T5841] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 161.018092][ T5841] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 254 [ 161.039334][ T5841] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 161.051819][ T5841] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 161.062511][ T5841] usb 3-1: SerialNumber: syz [ 161.101960][ T5841] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 161.267774][ T6896] syz.1.342: attempt to access beyond end of device [ 161.267774][ T6896] loop1: rw=0, sector=16, nr_sectors = 2 limit=0 [ 161.287638][ T5841] usb 3-1: USB disconnect, device number 7 [ 161.331134][ T6897] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 161.346573][ T6897] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 161.896451][ T5841] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 162.046940][ T6894] overlayfs: statfs failed on './file0' [ 162.049872][ T6897] overlayfs: statfs failed on './file0' [ 162.068902][ T5841] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.080565][ T5841] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 162.098069][ T5841] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 162.108815][ T5841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.117435][ T5841] usb 2-1: Product: syz [ 162.122044][ T5841] usb 2-1: Manufacturer: syz [ 162.127052][ T5841] usb 2-1: SerialNumber: syz [ 162.262288][ T6917] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 162.628003][ T6925] No buffer was provided with the request [ 163.397381][ T5841] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 163.403976][ T5841] cdc_ncm 2-1:1.0: dwNtbInMaxSize=256 is too small. Using 2048 [ 163.446227][ T5841] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 163.620248][ T5841] cdc_ncm 2-1:1.0: setting tx_max = 184 [ 163.706654][ T5841] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 163.758892][ T5841] usb 2-1: USB disconnect, device number 8 [ 163.779338][ T5841] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 164.535619][ T6994] fuse: Bad value for 'fd' [ 164.916469][ T5841] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 165.086292][ T5841] usb 2-1: Using ep0 maxpacket: 32 [ 165.112279][ T5841] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 165.145583][ T5841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 165.176307][ T5841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 165.216125][ T5841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 165.259794][ T5841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 165.301729][ T5841] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 165.311728][ T5841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.352758][ T5841] usb 2-1: Product: syz [ 165.371115][ T5841] usb 2-1: Manufacturer: syz [ 165.416315][ T5841] usb 2-1: SerialNumber: syz [ 165.435339][ T5841] usb 2-1: config 0 descriptor?? [ 165.851042][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 165.865332][ T5841] input input14: Device does not respond to id packet M [ 165.905132][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 165.936404][ T5841] input input14: Device does not respond to id packet P [ 165.971954][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 165.978569][ T5841] input input14: Device does not respond to id packet B [ 165.986713][ T5841] input input14: Limiting number of effects to 32 (device reports 109) [ 166.188734][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 166.205178][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 166.214783][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 166.226776][ T5841] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 166.248717][ T5841] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input14 [ 166.326700][ T5841] usb 2-1: USB disconnect, device number 9 [ 166.876820][ T5955] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 167.094143][ T5955] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 167.114711][ T5955] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 167.166336][ T5955] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 167.189431][ T5955] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.212838][ T5955] usb 3-1: Product: syz [ 167.223506][ T5955] usb 3-1: Manufacturer: syz [ 167.234689][ T5955] usb 3-1: SerialNumber: syz [ 167.245057][ T5955] usb 3-1: config 0 descriptor?? [ 167.261682][ T7036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 167.292894][ T7036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 167.536310][ T7036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 167.563324][ T7036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 167.750234][ T7062] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 168.204958][ T7080] netlink: 28 bytes leftover after parsing attributes in process `syz.3.417'. [ 168.214776][ T7080] netlink: 'syz.3.417': attribute type 7 has an invalid length. [ 168.221595][ T7077] lo speed is unknown, defaulting to 1000 [ 168.226515][ T7080] netlink: 'syz.3.417': attribute type 8 has an invalid length. [ 168.257850][ T7080] netlink: 4 bytes leftover after parsing attributes in process `syz.3.417'. [ 168.404404][ T5955] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): MDIO read error: -71 [ 168.524473][ T5955] dm9601 3-1:0.0 eth1: register 'dm9601' at usb-dummy_hcd.2-1, Davicom DM96xx USB 10/100 Ethernet, 58:6c:57:16:7e:00 [ 168.655516][ T5955] usb 3-1: USB disconnect, device number 8 [ 168.740392][ T5955] dm9601 3-1:0.0 eth1: unregister 'dm9601' usb-dummy_hcd.2-1, Davicom DM96xx USB 10/100 Ethernet [ 170.269194][ T7118] input: syz1 as /devices/virtual/input/input15 [ 171.715722][ T7153] netlink: 'syz.1.445': attribute type 3 has an invalid length. [ 171.756229][ T7153] netlink: 201372 bytes leftover after parsing attributes in process `syz.1.445'. [ 173.563743][ T926] iguanair 1-1:0.0: failed to get version [ 173.597541][ T926] iguanair 1-1:0.0: probe with driver iguanair failed with error -110 [ 173.647014][ T926] usb 1-1: USB disconnect, device number 9 [ 174.117588][ T2153] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 174.289609][ T2153] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 174.296801][ T926] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 174.302229][ T2153] usb 5-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 174.409784][ T2153] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 174.424387][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.453125][ T2153] usb 5-1: Product: syz [ 174.464670][ T2153] usb 5-1: Manufacturer: syz [ 174.474147][ T2153] usb 5-1: SerialNumber: syz [ 174.488061][ T926] usb 1-1: Using ep0 maxpacket: 32 [ 174.504126][ T926] usb 1-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 174.522177][ T926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.549837][ T926] usb 1-1: config 0 descriptor?? [ 174.568399][ T926] gspca_main: sunplus-2.14.0 probing 041e:400b [ 175.279983][ T7238] syz.1.478: attempt to access beyond end of device [ 175.279983][ T7238] loop1: rw=0, sector=16, nr_sectors = 2 limit=0 [ 175.585498][ T2153] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 175.653282][ T2153] cdc_ncm 5-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 175.721744][ T2153] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 175.797814][ T2153] cdc_ncm 5-1:1.0: setting tx_max = 184 [ 175.896271][ T2153] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 175.961561][ T2153] usb 5-1: USB disconnect, device number 9 [ 175.998392][ T2153] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 176.058115][ T926] gspca_sunplus: reg_w_riv err -71 [ 176.086708][ T926] sunplus 1-1:0.0: probe with driver sunplus failed with error -71 [ 176.120052][ T926] usb 1-1: USB disconnect, device number 10 [ 176.511305][ T7262] netlink: 4 bytes leftover after parsing attributes in process `syz.1.488'. [ 176.942651][ T7272] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 176.968544][ T7272] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 177.013690][ T7278] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 177.034196][ T7279] syz_tun: entered allmulticast mode [ 177.048011][ T7276] syz_tun: left allmulticast mode [ 177.132230][ T2153] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 177.202278][ C1] Unknown status report in ack skb [ 177.351028][ T2153] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 177.420473][ T2153] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.443322][ T2153] usb 2-1: Product: syz [ 177.456210][ T2153] usb 2-1: Manufacturer: syz [ 177.465725][ T2153] usb 2-1: SerialNumber: syz [ 177.708259][ T2153] usb 2-1: config 0 descriptor?? [ 177.854001][ T2153] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 178.191984][ T7308] bridge: RTM_NEWNEIGH with invalid ether address [ 178.450278][ T7314] overlayfs: failed to clone upperpath [ 179.534413][ T2153] usb 2-1: USB disconnect, device number 10 [ 180.405524][ T7339] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 180.470753][ T7345] netlink: 8 bytes leftover after parsing attributes in process `syz.2.521'. [ 182.867641][ T7397] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 182.912330][ T7397] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 183.156944][ T2153] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 183.349825][ T2153] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 183.374757][ T2153] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 183.389476][ T2153] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 183.419339][ T2153] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 183.455798][ T2153] usb 3-1: SerialNumber: syz [ 183.692751][ T2153] usb 3-1: 0:2 : does not exist [ 183.721508][ T2153] usb 3-1: USB disconnect, device number 9 [ 183.779458][ T6491] udevd[6491]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 183.988303][ T5921] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 184.182178][ T5921] usb 1-1: Using ep0 maxpacket: 16 [ 184.198168][ T5921] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 184.213791][ T5921] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 184.240782][ T5921] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 7 [ 184.264067][ T5921] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 184.298266][ T5921] usb 1-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 184.322640][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.351979][ T5921] usb 1-1: Product: syz [ 184.376217][ T5921] usb 1-1: Manufacturer: syz [ 184.386529][ T2153] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 184.397611][ T5921] usb 1-1: SerialNumber: syz [ 184.412289][ T5921] usb 1-1: config 0 descriptor?? [ 184.556278][ T2153] usb 5-1: Using ep0 maxpacket: 8 [ 184.586907][ T2153] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 184.606197][ T5921] rc_core: IR keymap rc-xbox-dvd not found [ 184.618530][ T5921] Registered IR keymap rc-empty [ 184.626215][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.635557][ T5921] rc rc0: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 184.656314][ T2153] usb 5-1: Product: syz [ 184.662594][ T2153] usb 5-1: Manufacturer: syz [ 184.670416][ T5921] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input16 [ 184.686336][ T2153] usb 5-1: SerialNumber: syz [ 184.709738][ T2153] usb 5-1: config 0 descriptor?? [ 184.751259][ T2153] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 185.542923][ T5951] usb 1-1: USB disconnect, device number 11 [ 185.542968][ C0] xbox_remote 1-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 185.853281][ T7452] binder: 7451:7452 unknown command 0 [ 185.860727][ T7452] binder: 7451:7452 ioctl c0306201 2000000003c0 returned -22 [ 186.367594][ T5914] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 186.536278][ T5914] usb 2-1: Using ep0 maxpacket: 8 [ 186.565320][ T5914] usb 2-1: unable to get BOS descriptor or descriptor too short [ 186.600567][ T5914] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 113, changing to 10 [ 186.618546][ T7466] Bluetooth: MGMT ver 1.23 [ 186.620054][ T5914] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 186.643115][ T5914] usb 2-1: config 1 interface 0 has no altsetting 0 [ 186.656064][ T5914] usb 2-1: New USB device found, idVendor=05ac, idProduct=0237, bcdDevice= 0.40 [ 186.666033][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.679100][ T5914] usb 2-1: Product: syz [ 186.683511][ T5914] usb 2-1: Manufacturer: syz [ 186.690257][ T5914] usb 2-1: SerialNumber: syz [ 186.708398][ T7459] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 186.866065][ T2153] gspca_sonixj: reg_w1 err -71 [ 186.873224][ T2153] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 186.926580][ T2153] usb 5-1: USB disconnect, device number 10 [ 186.949306][ T5914] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input17 [ 186.983308][ T5192] bcm5974 2-1:1.0: could not read from device [ 186.990761][ T7471] netlink: 76 bytes leftover after parsing attributes in process `syz.3.565'. [ 187.039237][ T5192] bcm5974 2-1:1.0: could not read from device [ 187.039642][ T5914] usb 2-1: USB disconnect, device number 11 [ 187.880429][ T7490] binder: 7489:7490 unknown command 0 [ 187.955336][ T7490] binder: 7489:7490 ioctl c0306201 200000000080 returned -22 [ 189.069387][ T7522] netlink: 4 bytes leftover after parsing attributes in process `syz.2.580'. [ 189.255222][ T24] libceph: connect (1)[c::]:6789 error -101 [ 189.261559][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 189.271921][ T24] libceph: connect (1)[c::]:6789 error -101 [ 189.278535][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 189.401768][ T7528] ceph: No mds server is up or the cluster is laggy [ 190.575742][ T7551] Invalid option length (57448) for dns_resolver key [ 192.268835][ T7576] syz.0.600: attempt to access beyond end of device [ 192.268835][ T7576] loop0: rw=0, sector=16, nr_sectors = 2 limit=0 [ 194.038394][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.107448][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.149095][ T7598] syzkaller0: entered allmulticast mode [ 195.079567][ T7621] overlayfs: failed to clone upperpath [ 196.027930][ T7637] syz.2.620: attempt to access beyond end of device [ 196.027930][ T7637] loop2: rw=0, sector=16, nr_sectors = 2 limit=0 [ 196.613805][ T7649] sd 0:0:1:0: device reset [ 197.527716][ T7655] overlayfs: failed to clone upperpath [ 197.610753][ T7659] netlink: 8 bytes leftover after parsing attributes in process `syz.1.627'. [ 197.668439][ T7659] netlink: 16 bytes leftover after parsing attributes in process `syz.1.627'. [ 197.836607][ T7658] syzkaller0: entered promiscuous mode [ 197.842151][ T7658] syzkaller0: entered allmulticast mode [ 198.777582][ T7679] ======================================================= [ 198.777582][ T7679] WARNING: The mand mount option has been deprecated and [ 198.777582][ T7679] and is ignored by this kernel. Remove the mand [ 198.777582][ T7679] option from the mount to silence this warning. [ 198.777582][ T7679] ======================================================= [ 198.812574][ C1] vkms_vblank_simulate: vblank timer overrun [ 199.206234][ T24] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 199.356365][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 199.370013][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.384955][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 199.408385][ T24] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 199.419952][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.439141][ T24] usb 1-1: config 0 descriptor?? [ 199.454637][ T24] hub 1-1:0.0: USB hub found [ 200.006735][ T24] hub 1-1:0.0: 1 port detected [ 200.951297][ T7702] syz.4.643: attempt to access beyond end of device [ 200.951297][ T7702] loop4: rw=0, sector=16, nr_sectors = 2 limit=0 [ 201.857645][ T24] hub 1-1:0.0: hub_ext_port_status failed (err = -32) [ 204.387291][ T7735] syz.4.651: attempt to access beyond end of device [ 204.387291][ T7735] nbd4: rw=0, sector=64, nr_sectors = 1 limit=0 [ 204.435343][ T7735] syz.4.651: attempt to access beyond end of device [ 204.435343][ T7735] nbd4: rw=0, sector=256, nr_sectors = 1 limit=0 [ 204.458878][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 204.474225][ T7735] syz.4.651: attempt to access beyond end of device [ 204.474225][ T7735] nbd4: rw=0, sector=512, nr_sectors = 1 limit=0 [ 204.488083][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 204.511843][ T7735] syz.4.651: attempt to access beyond end of device [ 204.511843][ T7735] nbd4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 204.537157][ T7735] syz.4.651: attempt to access beyond end of device [ 204.537157][ T7735] nbd4: rw=0, sector=512, nr_sectors = 2 limit=0 [ 204.556270][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 204.570920][ T7735] syz.4.651: attempt to access beyond end of device [ 204.570920][ T7735] nbd4: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 204.585300][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 204.631437][ T7735] syz.4.651: attempt to access beyond end of device [ 204.631437][ T7735] nbd4: rw=0, sector=64, nr_sectors = 4 limit=0 [ 204.650639][ T7735] syz.4.651: attempt to access beyond end of device [ 204.650639][ T7735] nbd4: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 204.664023][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 204.674647][ T7735] syz.4.651: attempt to access beyond end of device [ 204.674647][ T7735] nbd4: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 204.688114][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 204.800991][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 204.816346][ T7735] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 204.826512][ T7735] UDF-fs: warning (device nbd4): udf_fill_super: No partition found (1) [ 205.425205][ T5921] usb 1-1: USB disconnect, device number 12 [ 206.379093][ T5851] Bluetooth: hci1: command 0x0406 tx timeout [ 206.385191][ T5851] Bluetooth: hci3: command 0x0406 tx timeout [ 206.391692][ T5157] Bluetooth: hci0: command 0x0406 tx timeout [ 206.392084][ T5849] Bluetooth: hci2: command 0x0406 tx timeout [ 207.470498][ T7764] overlayfs: failed to clone upperpath [ 207.812475][ T7781] SET target dimension over the limit! [ 210.085302][ T7800] netlink: 4 bytes leftover after parsing attributes in process `syz.0.671'. [ 210.243319][ T7800] netlink: 4 bytes leftover after parsing attributes in process `syz.0.671'. [ 218.934306][ T7902] bio_check_eod: 4 callbacks suppressed [ 218.934438][ T7902] syz.4.705: attempt to access beyond end of device [ 218.934438][ T7902] loop4: rw=0, sector=16, nr_sectors = 2 limit=0 [ 230.159875][ T8003] netlink: 4 bytes leftover after parsing attributes in process `syz.0.735'. [ 234.595453][ T8048] netlink: 36 bytes leftover after parsing attributes in process `syz.4.746'. [ 236.067150][ T8058] kvm: pic: single mode not supported [ 236.067255][ T8058] kvm: pic: level sensitive irq not supported [ 236.073985][ T8058] kvm: pic: single mode not supported [ 236.080257][ T8058] kvm: pic: level sensitive irq not supported [ 236.119064][ T8058] kvm: pic: level sensitive irq not supported [ 238.432112][ T30] audit: type=1800 audit(1753312350.183:58): pid=8071 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.754" name="/" dev="9p" ino=144678138029342722 res=0 errno=0 [ 239.754250][ T30] audit: type=1800 audit(1753312351.513:59): pid=8091 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.761" name="nullb0" dev="tmpfs" ino=839 res=0 errno=0 [ 239.836737][ T8092] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 241.246403][ T5921] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 241.416418][ T5921] usb 1-1: Using ep0 maxpacket: 32 [ 241.562452][ T5921] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 241.571919][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.748909][ T5921] usb 1-1: Product: syz [ 241.782640][ T5921] usb 1-1: Manufacturer: syz [ 242.387852][ T5921] usb 1-1: SerialNumber: syz [ 242.578383][ T5921] usb 1-1: config 0 descriptor?? [ 243.688726][ T8105] team_slave_0: entered promiscuous mode [ 243.694593][ T8105] team_slave_1: entered promiscuous mode [ 243.716332][ T5921] airspy 1-1:0.0: usb_control_msg() failed -110 request 09 [ 243.723584][ T5921] airspy 1-1:0.0: Could not detect board [ 243.729663][ T5921] airspy 1-1:0.0: probe with driver airspy failed with error -110 [ 243.762415][ T8105] vlan2: entered promiscuous mode [ 243.769515][ T8105] team0: entered promiscuous mode [ 243.987110][ T5956] usb 1-1: USB disconnect, device number 13 [ 244.148003][ T8151] tipc: Enabling of bearer rejected, failed to enable media [ 245.515638][ T8167] netlink: 28 bytes leftover after parsing attributes in process `syz.4.784'. [ 245.536288][ T8167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.784'. [ 245.558050][ T8167] netlink: 'syz.4.784': attribute type 10 has an invalid length. [ 245.568232][ T8167] bridge0: port 3(team0) entered blocking state [ 245.574667][ T8167] bridge0: port 3(team0) entered disabled state [ 245.596442][ T8167] team0: entered allmulticast mode [ 245.601621][ T8167] team_slave_0: entered allmulticast mode [ 245.646310][ T8167] team_slave_1: entered allmulticast mode [ 245.678002][ T8172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.787'. [ 245.696726][ T8167] team0: entered promiscuous mode [ 245.718278][ T8167] team_slave_0: entered promiscuous mode [ 245.749932][ T8167] team_slave_1: entered promiscuous mode [ 245.769391][ T8167] bridge0: port 3(team0) entered blocking state [ 245.775801][ T8167] bridge0: port 3(team0) entered forwarding state [ 245.779554][ T8176] netlink: 20 bytes leftover after parsing attributes in process `syz.3.787'. [ 245.813207][ T8172] tipc: Resetting bearer [ 246.653154][ T8172] tipc: Disabling bearer [ 246.880070][ T8172] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 246.926885][ T8172] team0 (unregistering): Port device team_slave_0 removed [ 246.978485][ T8172] team0 (unregistering): Failed to send options change via netlink (err -105) [ 247.014702][ T8172] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 247.184453][ T8172] team0 (unregistering): Port device team_slave_1 removed [ 247.196582][ T8192] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 248.827141][ T8204] netlink: 'syz.3.795': attribute type 39 has an invalid length. [ 251.373116][ T8230] tipc: Enabled bearer , priority 0 [ 251.385965][ T8230] syzkaller0: entered promiscuous mode [ 251.401618][ T8230] syzkaller0: entered allmulticast mode [ 251.501814][ T8231] tipc: Resetting bearer [ 252.317008][ T8229] tipc: Resetting bearer [ 252.958755][ T8229] tipc: Disabling bearer [ 255.486767][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.504300][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.410070][ T8276] tipc: Enabling of bearer rejected, failed to enable media [ 259.743777][ T8295] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 261.394054][ T8314] tipc: Enabling of bearer rejected, failed to enable media [ 261.540779][ T8318] exFAT-fs (nullb0): invalid boot record signature [ 261.547919][ T8318] exFAT-fs (nullb0): failed to read boot sector [ 261.554311][ T8318] exFAT-fs (nullb0): failed to recognize exfat type [ 262.276515][ T8323] vlan2: entered promiscuous mode [ 262.281759][ T8323] syz_tun: entered promiscuous mode [ 263.190006][ T8332] syz.0.827: attempt to access beyond end of device [ 263.190006][ T8332] loop0: rw=0, sector=16, nr_sectors = 2 limit=0 [ 266.004492][ T8357] tipc: Enabling of bearer rejected, failed to enable media [ 268.947263][ T8381] netlink: 4 bytes leftover after parsing attributes in process `syz.3.843'. [ 269.966239][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 269.972851][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 269.979622][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 269.986233][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 271.056331][ T8393] ubi31: attaching mtd0 [ 271.081638][ T8393] ubi31 error: ubi_attach_mtd_dev: bad VID header (12288) or data offsets (12352) [ 271.626855][ T5841] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 272.446249][ T5841] usb 1-1: Using ep0 maxpacket: 16 [ 272.466691][ T5841] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 272.478943][ T5841] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 273.263737][ T8414] netlink: 16 bytes leftover after parsing attributes in process `syz.3.854'. [ 273.349636][ T5841] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 273.359128][ T5841] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.367237][ T5841] usb 1-1: Product: syz [ 273.371526][ T5841] usb 1-1: Manufacturer: syz [ 273.376361][ T5841] usb 1-1: SerialNumber: syz [ 273.600503][ T5841] usb 1-1: 0:2 : does not exist [ 273.646935][ T5841] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 273.891198][ T5841] usb 1-1: USB disconnect, device number 14 [ 277.395781][ T8453] tipc: Enabling of bearer rejected, failed to enable media [ 279.697004][ T8475] netlink: 8 bytes leftover after parsing attributes in process `syz.2.870'. [ 283.506171][ T5857] Bluetooth: hci4: command 0x0406 tx timeout [ 283.563671][ T8504] batadv1: entered promiscuous mode [ 284.587292][ T12] batman_adv: batadv1: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 284.929005][ T8520] netlink: 4 bytes leftover after parsing attributes in process `syz.1.883'. [ 284.945598][ T8520] macvtap1: entered promiscuous mode [ 284.952357][ T8520] macvtap1: entered allmulticast mode [ 285.106179][ T8522] netlink: 'syz.0.881': attribute type 1 has an invalid length. [ 285.114132][ T8522] netlink: 16 bytes leftover after parsing attributes in process `syz.0.881'. [ 285.536677][ T8520] syz_tun: entered allmulticast mode [ 285.918015][ T8519] syz.2.884 (8519) used greatest stack depth: 16184 bytes left [ 288.647042][ T8550] netlink: 'syz.2.888': attribute type 6 has an invalid length. [ 288.742086][ T8550] netlink: 20 bytes leftover after parsing attributes in process `syz.2.888'. [ 289.950852][ T8568] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 289.950924][ T8568] CIFS: Unable to determine destination address [ 291.190232][ T8582] comedi comedi0: dt2815: I/O port conflict (0x9,2) [ 292.107415][ T8585] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !寿$ULvyآDUDw}z [ 300.235700][ T8666] tipc: Enabled bearer , priority 0 [ 300.437640][ T8671] syzkaller0: entered promiscuous mode [ 300.489266][ T8671] syzkaller0: entered allmulticast mode [ 301.326070][ T8666] tipc: Resetting bearer [ 301.344288][ T8665] tipc: Resetting bearer [ 301.908607][ T8665] tipc: Disabling bearer [ 303.088289][ T8693] overlayfs: failed to clone upperpath [ 305.573882][ T8704] netlink: 44 bytes leftover after parsing attributes in process `syz.2.930'. [ 308.839487][ T5956] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 309.633974][ T5956] usb 3-1: config 0 has no interfaces? [ 309.652175][ T5956] usb 3-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 309.744571][ T5956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.779479][ T5956] usb 3-1: Product: syz [ 309.783678][ T5956] usb 3-1: Manufacturer: syz [ 309.873955][ T5956] usb 3-1: SerialNumber: syz [ 310.371335][ T5956] usb 3-1: config 0 descriptor?? [ 310.384977][ T5850] Bluetooth: hci3: unexpected event for opcode 0x2040 [ 310.758572][ T49] usb 3-1: USB disconnect, device number 10 [ 311.031504][ T8754] netlink: 36 bytes leftover after parsing attributes in process `syz.3.939'. [ 311.536644][ T8757] random: crng reseeded on system resumption [ 313.666981][ T8775] block device autoloading is deprecated and will be removed. [ 313.676759][ T8775] syz.0.943: attempt to access beyond end of device [ 313.676759][ T8775] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 316.910535][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.917081][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.937959][ T8812] overlayfs: failed to clone upperpath [ 318.367095][ T2153] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 319.447404][ T5857] Bluetooth: hci4: command 0x0406 tx timeout [ 319.645569][ T2153] usb 3-1: config 1 interface 0 altsetting 6 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 319.696604][ T2153] usb 3-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 319.823020][ T2153] usb 3-1: config 1 interface 0 has no altsetting 0 [ 319.833234][ T2153] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 319.845998][ T2153] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.856612][ T2153] usb 3-1: Manufacturer: 뗘╺⪬㟭䋍Æ籪鈘樀釟廸움刘蝶橄ᠩⷼ俛藇剅譋瘄´俒䩾籢峽っ↏ﴵ킻揕⌍۵T䣒昜솹〟⼩슒擟᷇㦚䁇嘗䙓훢䛵ｅ駚囖荂쁪ઃ⋸앓偁ꀒꆎ [ 320.872104][ T2153] usb 3-1: SerialNumber: 倊 [ 320.893328][ T2153] usb 3-1: can't set config #1, error -71 [ 321.015546][ T2153] usb 3-1: USB disconnect, device number 11 [ 321.566716][ T8866] ecryptfs_validate_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README [ 321.580491][ T8866] Error validating options; rc = [-22] [ 328.107356][ T8899] netlink: 8 bytes leftover after parsing attributes in process `syz.1.977'. [ 334.478696][ T30] audit: type=1326 audit(1753312446.223:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8944 comm="syz.3.989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28c7f8e9a9 code=0x7fc00000 [ 334.633222][ T8951] syzkaller0: entered promiscuous mode [ 334.696309][ T8951] syzkaller0: entered allmulticast mode [ 338.178837][ T9008] ntfs3(nullb0): Primary boot signature is not NTFS. [ 338.187644][ T9008] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 338.906343][ T2153] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 340.847970][ T5951] IPVS: starting estimator thread 0... [ 341.078276][ T9020] IPVS: using max 28 ests per chain, 67200 per kthread [ 343.335762][ T9019] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 343.344852][ T9019] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 343.432230][ T2153] usb 5-1: unable to get BOS descriptor or descriptor too short [ 343.461903][ T2153] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 343.556212][ T2153] usb 5-1: can't read configurations, error -71 [ 346.338303][ T9064] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1017'. [ 346.348052][ T9064] vlan0: entered promiscuous mode [ 346.552675][ T9069] hugetlbfs: syz.1.1018 (9069): Using mlock ulimits for SHM_HUGETLB is obsolete [ 346.899164][ T9073] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1019'. [ 348.053105][ T9086] : renamed from veth1_macvtap (while UP) [ 351.278673][ T9109] /dev/nullb0: Can't lookup blockdev [ 354.252102][ T9130] vlan2: entered promiscuous mode [ 354.258986][ T9130] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 354.873260][ T9130] vlan2: entered allmulticast mode [ 354.881438][ T9130] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 354.917442][ T9137] sysfs: cannot create duplicate filename '/class/ieee80211/!寿$ULvyآDUDw}zR3p(@O>P' [ 354.933916][ T9137] CPU: 0 UID: 0 PID: 9137 Comm: syz.2.1035 Not tainted 6.16.0-rc7-syzkaller-00018-g01a412d06bc5 #0 PREEMPT(full) [ 354.933941][ T9137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 354.933953][ T9137] Call Trace: [ 354.933961][ T9137] [ 354.933970][ T9137] dump_stack_lvl+0x189/0x250 [ 354.933999][ T9137] ? __pfx_dump_stack_lvl+0x10/0x10 [ 354.934013][ T9137] ? __pfx__printk+0x10/0x10 [ 354.934030][ T9137] ? kernfs_path_from_node+0x2c/0x260 [ 354.934046][ T9137] ? kernfs_path_from_node+0x2c/0x260 [ 354.934060][ T9137] ? kernfs_path_from_node+0x2c/0x260 [ 354.934076][ T9137] ? kernfs_path_from_node+0x22c/0x260 [ 354.934090][ T9137] ? kernfs_path_from_node+0x2c/0x260 [ 354.934107][ T9137] sysfs_warn_dup+0x8e/0xa0 [ 354.934121][ T9137] sysfs_do_create_link_sd+0xc0/0x110 [ 354.934138][ T9137] device_add_class_symlinks+0x1cf/0x240 [ 354.934159][ T9137] device_add+0x475/0xb50 [ 354.934180][ T9137] wiphy_register+0x199a/0x26b0 [ 354.934208][ T9137] ? __pfx_wiphy_register+0x10/0x10 [ 354.934223][ T9137] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 354.934245][ T9137] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 354.934267][ T9137] ieee80211_register_hw+0x33e1/0x4120 [ 354.934297][ T9137] ? ieee80211_register_hw+0x1451/0x4120 [ 354.934322][ T9137] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 354.934344][ T9137] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 354.934362][ T9137] ? __hrtimer_setup+0x187/0x210 [ 354.934381][ T9137] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 354.934405][ T9137] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 354.934444][ T9137] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 354.934462][ T9137] ? trace_kmalloc+0x1f/0xd0 [ 354.934472][ T9137] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 354.934485][ T9137] ? kstrndup+0xbf/0x160 [ 354.934509][ T9137] hwsim_new_radio_nl+0xea4/0x1b10 [ 354.934529][ T9137] ? __pfx___nla_validate_parse+0x10/0x10 [ 354.934564][ T9137] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 354.934592][ T9137] ? __nla_parse+0x40/0x60 [ 354.934610][ T9137] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 354.934631][ T9137] genl_family_rcv_msg_doit+0x212/0x300 [ 354.934650][ T9137] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 354.934673][ T9137] ? bpf_lsm_capable+0x9/0x20 [ 354.934690][ T9137] ? security_capable+0x7e/0x2e0 [ 354.934711][ T9137] genl_rcv_msg+0x60e/0x790 [ 354.934729][ T9137] ? __pfx_genl_rcv_msg+0x10/0x10 [ 354.934743][ T9137] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 354.934771][ T9137] netlink_rcv_skb+0x205/0x470 [ 354.934790][ T9137] ? __pfx_genl_rcv_msg+0x10/0x10 [ 354.934805][ T9137] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 354.934834][ T9137] ? down_read+0x1ad/0x2e0 [ 354.934856][ T9137] genl_rcv+0x28/0x40 [ 354.934867][ T9137] netlink_unicast+0x759/0x8e0 [ 354.934892][ T9137] netlink_sendmsg+0x805/0xb30 [ 354.934917][ T9137] ? __pfx_netlink_sendmsg+0x10/0x10 [ 354.934941][ T9137] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 354.934953][ T9137] ? __pfx_netlink_sendmsg+0x10/0x10 [ 354.934973][ T9137] __sock_sendmsg+0x219/0x270 [ 354.934991][ T9137] ____sys_sendmsg+0x505/0x830 [ 354.935015][ T9137] ? __pfx_____sys_sendmsg+0x10/0x10 [ 354.935042][ T9137] ? import_iovec+0x74/0xa0 [ 354.935062][ T9137] ___sys_sendmsg+0x21f/0x2a0 [ 354.935084][ T9137] ? __pfx____sys_sendmsg+0x10/0x10 [ 354.935129][ T9137] ? __fget_files+0x2a/0x420 [ 354.935143][ T9137] ? __fget_files+0x3a0/0x420 [ 354.935165][ T9137] __x64_sys_sendmsg+0x19b/0x260 [ 354.935187][ T9137] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 354.935215][ T9137] ? rcu_is_watching+0x15/0xb0 [ 354.935233][ T9137] ? do_syscall_64+0xbe/0x3b0 [ 354.935250][ T9137] do_syscall_64+0xfa/0x3b0 [ 354.935264][ T9137] ? lockdep_hardirqs_on+0x9c/0x150 [ 354.935277][ T9137] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.935289][ T9137] ? clear_bhb_loop+0x60/0xb0 [ 354.935305][ T9137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.935318][ T9137] RIP: 0033:0x7fbf3bb8e9a9 [ 354.935338][ T9137] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 354.935349][ T9137] RSP: 002b:00007fbf3ca8e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 354.935368][ T9137] RAX: ffffffffffffffda RBX: 00007fbf3bdb6080 RCX: 00007fbf3bb8e9a9 [ 354.935377][ T9137] RDX: 0000000020004840 RSI: 0000200000000040 RDI: 0000000000000004 [ 354.935385][ T9137] RBP: 00007fbf3bc10d69 R08: 0000000000000000 R09: 0000000000000000 [ 354.935393][ T9137] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 354.935401][ T9137] R13: 0000000000000000 R14: 00007fbf3bdb6080 R15: 00007ffd150bf128 [ 354.935421][ T9137] [ 356.986404][ T24] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 357.158250][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 357.223634][ T24] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 357.247849][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 357.306436][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 357.314462][ T24] usb 3-1: SerialNumber: syz [ 357.889734][ T9162] netlink: 'syz.1.1044': attribute type 1 has an invalid length. [ 358.312411][ T51] Bluetooth: hci5: command 0x1003 tx timeout [ 358.587172][ T5857] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 358.924426][ T10] usb 3-1: USB disconnect, device number 12 [ 360.032190][ T9182] veth0_to_team: entered promiscuous mode [ 360.038221][ T9182] veth0_to_team: entered allmulticast mode [ 364.753028][ T9222] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1057'. [ 365.687547][ T9227] overlayfs: failed to clone lowerpath [ 366.858981][ T9234] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 371.857459][ T9263] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1067'. [ 372.578299][ T9273] ptrace attach of "./syz-executor exec"[5839] was attempted by "./syz-executor exec"[9273] [ 373.126383][ T9263] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1067'. [ 378.405507][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.411951][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 382.097012][ T9332] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 382.200564][ T9338] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1084'. [ 383.606422][ T24] IPVS: starting estimator thread 0... [ 383.704461][ T9352] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 383.746510][ T9354] IPVS: using max 31 ests per chain, 74400 per kthread [ 383.786425][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 384.466586][ T9364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1090'. [ 384.475751][ T9364] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1090'. [ 384.604734][ T9364] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.613530][ T9364] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.622313][ T9364] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.631055][ T9364] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.826281][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 385.866213][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 386.126176][ T24] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 386.680199][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 386.724732][ T24] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 386.741310][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.751668][ T24] usb 3-1: Product: syz [ 386.821364][ T9392] No buffer was provided with the request [ 386.826775][ T24] usb 3-1: Manufacturer: syz [ 386.906317][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 387.057192][ T24] usb 3-1: SerialNumber: syz [ 387.276557][ T24] usb 3-1: config 0 descriptor?? [ 387.590937][ T9393] netlink: 'syz.3.1098': attribute type 3 has an invalid length. [ 387.606493][ T9393] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1098'. [ 387.752412][ T24] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 387.946237][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 388.986253][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 389.471865][ T24] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 390.026213][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 390.288045][ T24] usb 3-1: USB disconnect, device number 13 [ 391.066230][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 392.106202][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 392.921898][ T24] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 393.146192][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 393.826303][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 393.857451][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 394.136616][ T24] usb 3-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 394.150364][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.169237][ T24] usb 3-1: config 0 descriptor?? [ 394.186226][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 395.226276][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 396.266351][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 396.842108][ T9438] netlink: 'syz.3.1109': attribute type 10 has an invalid length. [ 396.884966][ T9438] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 396.892691][ T9438] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 396.902121][ T9438] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 397.135551][ T24] usb 3-1: USB disconnect, device number 14 [ 397.210584][ T9450] netlink: 'syz.1.1111': attribute type 11 has an invalid length. [ 397.306228][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 397.399610][ T30] audit: type=1326 audit(1753312509.153:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 398.346229][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 398.843279][ T30] audit: type=1326 audit(1753312509.153:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 398.884098][ T30] audit: type=1326 audit(1753312509.153:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 398.955901][ T30] audit: type=1326 audit(1753312509.153:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 399.024620][ T30] audit: type=1326 audit(1753312509.163:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 399.050033][ T30] audit: type=1326 audit(1753312509.163:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 399.080652][ T30] audit: type=1326 audit(1753312509.163:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 399.256642][ T5857] Bluetooth: hci3: command 0x0406 tx timeout [ 399.256725][ T30] audit: type=1326 audit(1753312509.163:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 399.284772][ T30] audit: type=1326 audit(1753312509.163:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 399.386192][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 399.626355][ T30] audit: type=1326 audit(1753312509.163:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9451 comm="syz.2.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fbf3bb8e9a9 code=0x7ffc0000 [ 400.304914][ T9477] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1120'. [ 400.313881][ T9477] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1120'. [ 400.426191][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 400.715141][ T9475] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 401.466259][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 401.526988][ T9475] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 401.739943][ T9475] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 401.814402][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.823637][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.832891][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.842144][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.851341][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.860523][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.870229][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 401.879577][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 402.482729][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 402.506255][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 402.589367][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 402.824898][ T9475] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 403.165224][ T9475] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 403.176251][ T9475] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 403.546265][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 403.909611][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 403.994788][ T9475] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 404.020173][ T9475] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 404.058816][ T9475] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 404.069699][ T9475] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 404.145720][ T9508] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 404.587096][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 404.681080][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 405.246211][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 405.626231][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 406.146151][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 406.152295][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 406.158427][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 406.666228][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 407.706578][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 408.746203][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 409.246138][ T5857] Bluetooth: hci2: command 0x0406 tx timeout [ 409.252307][ T5857] Bluetooth: hci4: command 0x0406 tx timeout [ 409.258476][ T5857] Bluetooth: hci3: command 0x0406 tx timeout [ 409.786255][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 410.826193][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 410.878565][ T9551] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 411.866182][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 412.863645][ T9570] __nla_validate_parse: 41 callbacks suppressed [ 412.863664][ T9570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1140'. [ 412.906302][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 413.915875][ T9576] IPv6: sit1: Disabled Multicast RS [ 413.946239][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 414.289030][ T9577] 9pnet: Could not find request transport: fd0xffffffffffffffff [ 414.378327][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 414.986299][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 415.734107][ T9595] lo speed is unknown, defaulting to 1000 [ 415.740403][ T9595] lo speed is unknown, defaulting to 1000 [ 415.751966][ T9595] lo speed is unknown, defaulting to 1000 [ 415.848823][ T9595] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 416.026207][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 416.261483][ T9595] lo speed is unknown, defaulting to 1000 [ 416.269089][ T9595] lo speed is unknown, defaulting to 1000 [ 416.276664][ T9595] lo speed is unknown, defaulting to 1000 [ 416.284200][ T9595] lo speed is unknown, defaulting to 1000 [ 416.291744][ T9595] lo speed is unknown, defaulting to 1000 [ 416.438525][ T9587] ceph: No mds server is up or the cluster is laggy [ 417.066210][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 417.938847][ T9610] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1148'. [ 417.979176][ T9610] netlink: 'syz.3.1148': attribute type 5 has an invalid length. [ 418.106195][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 419.146245][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 419.155701][ T9610] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1148'. [ 419.683827][ T9626] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 420.186311][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 420.685397][ T9610] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 420.712118][ T9610] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 420.730150][ T9610] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 420.742866][ T9610] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 420.769444][ T9610] geneve2: entered promiscuous mode [ 420.774756][ T9610] geneve2: entered allmulticast mode [ 421.033946][ T9640] macvlan0: entered promiscuous mode [ 421.057856][ T9640] macvlan1: entered promiscuous mode [ 421.064398][ T9640] hsr2: entered promiscuous mode [ 421.226320][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 421.584669][ T9647] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1155'. [ 422.266187][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 423.306200][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 423.557170][ T9681] QAT: Device 253 not found [ 424.044671][ T9702] hfsplus: unable to find HFS+ superblock [ 424.346183][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 425.386205][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 425.922929][ T9726] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1159'. [ 426.096371][ T9716] ceph: No mds server is up or the cluster is laggy [ 426.426397][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 427.087201][ T9745] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1164'. [ 427.466296][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 428.506288][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 429.476935][ T9757] binder: 9755:9757 ioctl c0306201 200000000280 returned -14 [ 429.546280][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 429.547514][ T9757] binder: 9755:9757 ioctl 4068aea3 200000000480 returned -22 [ 430.586276][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 431.626232][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 432.666305][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 433.706273][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 434.746257][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 434.793067][ T5857] non-paged memory [ 434.797250][ T5857] list_del corruption, ffff88802fbb4d80->next is LIST_POISON1 (dead000000000100) [ 434.807792][ T5857] ------------[ cut here ]------------ [ 434.813328][ T5857] kernel BUG at lib/list_debug.c:58! [ 435.786294][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 436.543327][ T5857] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 436.549637][ T5857] CPU: 1 UID: 0 PID: 5857 Comm: kworker/u9:8 Not tainted 6.16.0-rc7-syzkaller-00018-g01a412d06bc5 #0 PREEMPT(full) [ 436.561810][ T5857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 436.571878][ T5857] Workqueue: hci4 hci_conn_timeout [ 436.577029][ T5857] RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 [ 436.584085][ T5857] Code: 80 bd e1 8b 48 89 de e8 40 20 68 fc 90 0f 0b 4c 89 e7 e8 d5 03 40 fd 48 c7 c7 e0 bd e1 8b 48 89 de 4c 89 e2 e8 23 20 68 fc 90 <0f> 0b 4c 89 e7 e8 b8 03 40 fd 48 c7 c7 40 be e1 8b 48 89 de 4c 89 [ 436.603709][ T5857] RSP: 0018:ffffc9000418f980 EFLAGS: 00010246 [ 436.609782][ T5857] RAX: 000000000000004e RBX: ffff88802fbb4d80 RCX: e1b1fa473cbe4000 [ 436.617767][ T5857] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 436.625750][ T5857] RBP: ffffffff8a758e80 R08: ffffc9000418f6a7 R09: 1ffff92000831ed4 [ 436.633728][ T5857] R10: dffffc0000000000 R11: fffff52000831ed5 R12: dead000000000100 [ 436.641713][ T5857] R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 [ 436.649703][ T5857] FS: 0000000000000000(0000) GS:ffff888125d57000(0000) knlGS:0000000000000000 [ 436.658647][ T5857] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 436.665248][ T5857] CR2: 000020000000f000 CR3: 00000000374e2000 CR4: 00000000003526f0 [ 436.673223][ T5857] Call Trace: [ 436.676501][ T5857] [ 436.679432][ T5857] hci_cmd_sync_dequeue_once+0x24a/0x370 [ 436.685081][ T5857] hci_cancel_connect_sync+0xc8/0x120 [ 436.690479][ T5857] hci_abort_conn+0x191/0x330 [ 436.695163][ T5857] ? process_scheduled_works+0x9ef/0x17b0 [ 436.700911][ T5857] process_scheduled_works+0xade/0x17b0 [ 436.706472][ T5857] ? __pfx_process_scheduled_works+0x10/0x10 [ 436.712469][ T5857] worker_thread+0x8a0/0xda0 [ 436.717070][ T5857] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 436.723404][ T5857] ? __kthread_parkme+0x7b/0x200 [ 436.728366][ T5857] kthread+0x711/0x8a0 [ 436.732455][ T5857] ? __pfx_worker_thread+0x10/0x10 [ 436.737571][ T5857] ? __pfx_kthread+0x10/0x10 [ 436.742167][ T5857] ? _raw_spin_unlock_irq+0x23/0x50 [ 436.747390][ T5857] ? lockdep_hardirqs_on+0x9c/0x150 [ 436.752599][ T5857] ? __pfx_kthread+0x10/0x10 [ 436.757223][ T5857] ret_from_fork+0x3fc/0x770 [ 436.761819][ T5857] ? __pfx_ret_from_fork+0x10/0x10 [ 436.767049][ T5857] ? __switch_to_asm+0x39/0x70 [ 436.771825][ T5857] ? __switch_to_asm+0x33/0x70 [ 436.776598][ T5857] ? __pfx_kthread+0x10/0x10 [ 436.781190][ T5857] ret_from_fork_asm+0x1a/0x30 [ 436.785962][ T5857] [ 436.788997][ T5857] Modules linked in: [ 436.793703][ T5857] ---[ end trace 0000000000000000 ]--- [ 436.806090][ T5857] RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 [ 436.813165][ T5857] Code: 80 bd e1 8b 48 89 de e8 40 20 68 fc 90 0f 0b 4c 89 e7 e8 d5 03 40 fd 48 c7 c7 e0 bd e1 8b 48 89 de 4c 89 e2 e8 23 20 68 fc 90 <0f> 0b 4c 89 e7 e8 b8 03 40 fd 48 c7 c7 40 be e1 8b 48 89 de 4c 89 [ 436.832947][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 436.840093][ T5857] RSP: 0018:ffffc9000418f980 EFLAGS: 00010246 [ 436.851694][ T5857] RAX: 000000000000004e RBX: ffff88802fbb4d80 RCX: e1b1fa473cbe4000 [ 436.859869][ T5857] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 436.867982][ T5857] RBP: ffffffff8a758e80 R08: ffffc9000418f6a7 R09: 1ffff92000831ed4 [ 436.875960][ T5857] R10: dffffc0000000000 R11: fffff52000831ed5 R12: dead000000000100 [ 436.884120][ T5857] R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 [ 436.892822][ T5857] FS: 0000000000000000(0000) GS:ffff888125d57000(0000) knlGS:0000000000000000 [ 436.901912][ T5857] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 436.908991][ T5857] CR2: 00005620e6a670a8 CR3: 0000000033246000 CR4: 00000000003526f0 [ 436.917145][ T5857] Kernel panic - not syncing: Fatal exception [ 436.923513][ T5857] Kernel Offset: disabled [ 436.927838][ T5857] Rebooting in 86400 seconds..