last executing test programs: 6m57.511370165s ago: executing program 2 (id=1033): r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0xffffffff, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x38}}}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1400000003010101"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) 6m56.523540638s ago: executing program 2 (id=1037): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x2710, 0x3, 0xf000, 0x2000, &(0x7f0000000000/0x2000)=nil}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) 6m55.802527919s ago: executing program 2 (id=1038): socket(0x10, 0x3, 0x0) inotify_init() bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000180)={0x3, 0x98f904, 0x3}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 6m53.373435094s ago: executing program 2 (id=1048): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_PROTOCOL(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x1, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x800) 6m53.272143258s ago: executing program 2 (id=1049): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, 0x0, 0x50) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1e4011, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x300) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r5, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r4, {0x1}}, './file0\x00'}) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @remote}}, 0x1, 0x7fff, 0x8, 0x8000005, 0x20, 0x99, 0xee}, &(0x7f0000000000)=0x9c) bind$llc(r6, &(0x7f0000000180)={0x1a, 0x20, 0x7, 0x96, 0x4, 0x9, @remote}, 0x10) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0xca43, 0x80, 0x1, 0x3b3}, &(0x7f0000000300), &(0x7f0000000380)) 6m52.258909002s ago: executing program 2 (id=1051): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x80800, 0x0) ioctl$KVM_GET_MSRS_sys(r0, 0x4018aee2, 0x0) 6m36.619414949s ago: executing program 32 (id=1051): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x80800, 0x0) ioctl$KVM_GET_MSRS_sys(r0, 0x4018aee2, 0x0) 3m1.914863426s ago: executing program 4 (id=1781): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x3e0, 0x288, 0x43, 0xa0, 0x288, 0x98, 0x388, 0x178, 0x178, 0x388, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'ip6erspan0\x00'}, 0x12a, 0x228, 0x288, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@string={{0xc0}, {0x0, 0x3, 'kmp\x00', "7af8bdb4c056dc65949041982abfe9ed51b01289c0026e2e6034ed587be5f09017b907388134b0ede40eb8d493f20d534fc37f23ec524d91a7a041f36bb1d1c3ab474544c5ef3f2fa69a80a0d967ee4464257d28d31e6843bc1221dfb9a6a27ad13af7061b737fd97d94f50942c68242819c941c0b4d9ec154c7d327187e8198", 0x38, 0x2, {0x1}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x4, 0x7, 0x5, 0x4, 0x3, 0x4], 0x2, 0x4}, {0xffffffffffffffff, [0x1, 0x1, 0x1, 0x1, 0x1, 0x2], 0x4}}}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x1b, 0x408, 0xfffffffb}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x440) socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000040)={0x2, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000140)={r2, 0x400}) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x118) r3 = syz_open_dev$radio(&(0x7f00000001c0), 0x1, 0x2) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x200000e, 0x100010, r3, 0x5dd48000) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r4, 0x80605414, &(0x7f0000000500)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x5}, {0xffff, 0xffff}, {0x4, 0x4}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xfffffd70, 0x2, {0x0, 0x1003}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80d1}, 0x10000000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000100)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c643c, &(0x7f0000000300)={0x0, 0x0, r0}) 2m59.167930474s ago: executing program 4 (id=1789): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) r3 = eventfd2(0x4001, 0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x7, 0x2, r3}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = eventfd(0x6) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x2, 0x2, r2}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2m56.587115196s ago: executing program 4 (id=1793): socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r1, &(0x7f0000002c80)={0xa, 0x14e24, 0x0, @rand_addr, 0xffff}, 0x1c) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0xd}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 2m54.513010886s ago: executing program 4 (id=1800): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0x8000001, 0x40000180, &(0x7f0000000180), 0x1, 0x4000007}) 2m50.571376812s ago: executing program 4 (id=1806): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000020961b0800000000000001090224000100000000090400000103000000092100000001220200090581130000000000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) openat$rdma_cm(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pipe2$watch_queue(&(0x7f0000001100), 0x80) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) accept$alg(r3, 0x0, 0x0) 2m45.999279519s ago: executing program 4 (id=1813): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94", 0x5) accept$alg(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r1 = openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x2180, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'adq12b\x00', [0x2f00, 0x5, 0xd09d, 0xfff7ffff, 0x2d6, 0xfffffffe, 0x20000004, 0x6, 0xffe, 0x9, 0xc, 0x1001, 0x9, 0x1, 0xfffc, 0x6, 0x8, 0x40000009, 0x830, 0x30000, 0xf4, 0x2, 0x800, 0xe2db, 0x2, 0xd, 0x7, 0x3, 0x4, 0x5, 0x70f]}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92ff, 0x0, 0x0, 0x4}) 2m30.674632132s ago: executing program 33 (id=1813): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94", 0x5) accept$alg(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r1 = openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x2180, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'adq12b\x00', [0x2f00, 0x5, 0xd09d, 0xfff7ffff, 0x2d6, 0xfffffffe, 0x20000004, 0x6, 0xffe, 0x9, 0xc, 0x1001, 0x9, 0x1, 0xfffc, 0x6, 0x8, 0x40000009, 0x830, 0x30000, 0xf4, 0x2, 0x800, 0xe2db, 0x2, 0xd, 0x7, 0x3, 0x4, 0x5, 0x70f]}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92ff, 0x0, 0x0, 0x4}) 2m1.087756872s ago: executing program 3 (id=1896): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r4}, 0x20) sendmmsg$inet6(r4, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 1m57.91201366s ago: executing program 3 (id=1901): r0 = syz_open_dev$sg(0x0, 0x0, 0x8002) fcntl$dupfd(r0, 0x0, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x3e, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4, 0x0, 0x7}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x6) r5 = socket$inet_udp(0x2, 0x2, 0x0) setrlimit(0xf, &(0x7f00000003c0)={0x4001, 0xffffffffffffffff}) timer_create(0x3, 0x0, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x448, 0x190, 0x0, 0xffffffff, 0x238, 0x0, 0x3b0, 0x3b0, 0xffffffff, 0x3b0, 0x3b0, 0x5, 0x0, {[{{@uncond, 0x0, 0x158, 0x190, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@addrtype1={{0x28}, {0x4, 0x400, 0x3}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @rand_addr=0x64010102, @loopback, @gre_key=0x3, @port=0x4e20}}}}, {{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x64}, 0xff, 0xff000000, 'veth1_to_bridge\x00', 'ip6erspan0\x00', {0xff}, {}, 0x11, 0x2, 0x78}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @remote, @local, @port=0x4e20, @gre_key=0x6}}}}, {{@ip={@loopback, @private=0xa010102, 0xff, 0x0, 'veth1_to_hsr\x00', 'batadv_slave_1\x00', {}, {}, 0x6e, 0x0, 0x4}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @remote, @icmp_id=0x67, @port=0x4e23}}}}, {{@ip={@multicast1, @broadcast, 0xff000000, 0xff, 'veth1_macvtap\x00', 'bridge0\x00', {}, {0xff}, 0x73, 0x2, 0x20}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0xc, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x26}, @port=0x4e23, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xffb2) 1m54.393497032s ago: executing program 3 (id=1910): r0 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000040), &(0x7f0000000080)=0x4) 1m54.078335555s ago: executing program 3 (id=1912): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r4}, 0x20) sendmmsg$inet6(r4, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 1m52.378219319s ago: executing program 3 (id=1916): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x20, [0x6, 0x8, 0xfffffff1, 0x9, 0x7f, 0x3, 0x2, 0x80007f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0x7fffffff, 0x40000000, 0xffff2d37, 0x1dd2, 0x3, 0x7, 0x2, 0xffff, 0x7, 0x9, 0xffff, 0x3c5b, 0x1, 0x24, 0x3, 0xfffffffe, 0x3ff, 0x402, 0x24, 0x3, 0x3, 0x10043, 0x8, 0x4c74, 0xf, 0x8001, 0x40000004, 0x4000a, 0x9, 0x80071, 0x5, 0xfffff000, 0x104, 0x0, 0x5, 0x803c, 0x4, 0x1, 0x3, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x4, 0x5, 0xa, 0x8, 0x7, 0xdd, 0xfffffffe], [0x10000004, 0xfffd, 0xfff, 0x8000, 0xc, 0xfffffff5, 0x129432e6, 0x3, 0x800006, 0x0, 0x2bf, 0x8, 0x9, 0xffff7ffe, 0x3, 0x4002, 0x101, 0x5, 0x2f, 0xe, 0xfff, 0x78, 0x10000ea3, 0xa, 0xe, 0x0, 0x8, 0xfffffff8, 0x400, 0x101, 0x3, 0xfffffffd, 0xff, 0x1005, 0x7ff, 0x5f31, 0xc, 0x5ffffff, 0x6, 0x2, 0xc, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x4, 0x1, 0x0, 0x6, 0x0, 0x7f, 0xb, 0xfff, 0x1000, 0x4, 0x143, 0x7, 0xb, 0x9, 0x48c93690, 0x2, 0x3], [0xfffffff9, 0x4, 0xffffffff, 0x64e, 0x0, 0x5, 0x8d2, 0x9, 0x5, 0xfffffff7, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x2, 0x10000009, 0x3ea, 0xb, 0x5, 0x6, 0x2, 0x14, 0x87, 0xffffffff, 0x5, 0x3ae2, 0x3b, 0xda6, 0x5, 0x80, 0x7, 0xfffffffe, 0x202, 0x0, 0xa2, 0x7, 0x53cf697b, 0x3, 0x3, 0x1, 0x7, 0x200, 0x0, 0x400002, 0x8, 0x4, 0x5, 0xf23, 0x0, 0x6, 0x8, 0x9, 0x3, 0x6, 0xd, 0x4, 0x3], [0x9, 0x7e06, 0x3, 0xb, 0x5, 0x938, 0x8, 0x3, 0xfffffffc, 0x5, 0xce7, 0x1ff, 0x6, 0x5, 0x5, 0x0, 0x101, 0x10001, 0x2006, 0x7fff, 0x8ffff, 0x6, 0x709b, 0x2, 0x1, 0x2, 0x14c, 0x5, 0x6, 0x6, 0x400007, 0xffffffa1, 0x5, 0xffffff63, 0x8, 0x4, 0x50fd, 0x10001, 0x3, 0x9, 0x100, 0x9, 0xa, 0x2, 0x80000007, 0x7, 0x21, 0x10000, 0xfffffffe, 0x8, 0x6, 0xa23, 0x8, 0x2, 0x1, 0x6c1b, 0x2d513b50, 0x4, 0x5, 0x4b1c, 0x1, 0xa, 0xffff7441, 0xfff]}, 0x45c) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r0, &(0x7f0000000040)="e2", 0x918) 1m49.043871613s ago: executing program 3 (id=1919): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0x8000001, 0x40000180, &(0x7f0000000180), 0x1, 0x4000007}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x2, 0x0, 0x80, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0c81) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f0000000240)={0x15, 0xff, 0x4, 0x0, 0x60, 0x0, 0x21, 0x0, 0x7, 0x0, 0xff, 0x2, 0x0, 0x5}, 0xe) ioctl$int_in(r6, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$igmp(0x2, 0x3, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(r6, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r6, 0x1) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="010022bd7000fcdbdf258900000008000300", @ANYRES32=r5, @ANYBLOB="14001d8001000080060005009f00000004000400"], 0x30}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x9, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x7}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x1}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0x3b, 0x3}}}}]}]}, 0x68}}, 0x24048040) 1m41.453704012s ago: executing program 1 (id=1935): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x1, 0x0) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r5, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x30}], 0x1, 0x4) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000002c0)={0x7094, 0x9a, 0x200, 0x38d129bf, 0x800, 0x6, 0x4, 0x55, r5}, 0x20) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x0, 0xc8, 0x8, 0x128, 0x5803, 0x218, 0x2e8, 0x2e8, 0x218, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [], [], 'batadv0\x00', 'wlan0\x00'}, 0x0, 0x108, 0x128, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@quota={{0x38}}, @common=@inet=@socket1={{0x28}, 0x4c}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={0x0}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, 0x0, &(0x7f00000002c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={0x0, r7}, 0x18) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/mm/ksm/run\x00', 0x2, 0x0) sendfile(r8, r8, 0x0, 0x1) 1m40.255397623s ago: executing program 1 (id=1938): r0 = syz_open_dev$radio(&(0x7f0000009e40), 0x3, 0x2) writev(r0, &(0x7f000000a100)=[{&(0x7f0000009e80)="1b27", 0x2}], 0x1) 1m36.64664102s ago: executing program 1 (id=1944): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8800, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x14) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x141102) openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) inotify_init1(0x80000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='pids.current\x00', 0x275a, 0x0) pselect6(0x40, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffffb, 0x100000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0xc3ac}, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) 1m33.936613017s ago: executing program 34 (id=1919): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0x8000001, 0x40000180, &(0x7f0000000180), 0x1, 0x4000007}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x2, 0x0, 0x80, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0c81) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f0000000240)={0x15, 0xff, 0x4, 0x0, 0x60, 0x0, 0x21, 0x0, 0x7, 0x0, 0xff, 0x2, 0x0, 0x5}, 0xe) ioctl$int_in(r6, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$igmp(0x2, 0x3, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(r6, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r6, 0x1) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="010022bd7000fcdbdf258900000008000300", @ANYRES32=r5, @ANYBLOB="14001d8001000080060005009f00000004000400"], 0x30}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x9, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x7}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x1}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0x3b, 0x3}}}}]}]}, 0x68}}, 0x24048040) 1m31.932576844s ago: executing program 1 (id=1954): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$tipc(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="25b56995", 0x4}], 0x1, 0x0, 0x0, 0x4000044}, 0x40040) 1m29.526005577s ago: executing program 1 (id=1957): r0 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x39, 0x0, 0x0, 0x62, 0x86cc4097e8288a3a, 0x0, 0x0, 0x0, 0x34, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64]}, &(0x7f00000004c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x39000, 0x0) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r5, 0x1d) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r4, 0xfeffffffffffff) 1m27.195888388s ago: executing program 1 (id=1959): ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000180)={0xff, 0x0, 0x8, 0x5, 0xfd, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x2, 0x0, 0x93}, 0xe) sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r1, 0x1) 1m11.692155998s ago: executing program 35 (id=1959): ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000180)={0xff, 0x0, 0x8, 0x5, 0xfd, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x2, 0x0, 0x93}, 0xe) sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r1, 0x1) 18.388100024s ago: executing program 0 (id=2085): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000340)={0x14, 0x0, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbf8, {0x3, 0x0, 0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x4005c}, 0x400c084) eventfd(0x0) 16.944485397s ago: executing program 0 (id=2097): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r4}, 0x20) sendmmsg$inet6(r4, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 13.342034723s ago: executing program 0 (id=2101): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x2, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x800, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0xffffffff}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r3, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x35}}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)="9f", 0x1}], 0x1}, 0x4cbe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0xb}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x39}, 0x0, 0x1, 0x0, 0x4}, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, &(0x7f0000000100)) 12.373957595s ago: executing program 6 (id=2093): fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/diskstats\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(0xffffffffffffffff, 0x8040942d, 0x0) lseek(r0, 0xc6c3, 0x0) 12.278892519s ago: executing program 8 (id=2094): pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = dup(r0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) sched_setscheduler(0x0, 0x1, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, 0x0, 0x1, 0x14, 0x0, {{0x2}, {@val={0x8}, @void}}}, 0x28}}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000000)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r2, @ANYRES16=r1, @ANYRES8=r0], 0x0) 11.306937661s ago: executing program 6 (id=2095): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfffffc99}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) listen(r2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r4, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r2}, 0x20) sendmmsg$inet6(r2, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 9.849131624s ago: executing program 6 (id=2099): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3e616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000280)={0x0, 0x0, 0x1, "12"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 8.725144033s ago: executing program 7 (id=2100): openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 8.724913803s ago: executing program 8 (id=2102): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000240)=[{0x2, 0x7, 0x7f, 0x1, @time={0x40, 0xe69}, {0xe}, {0x7, 0x9}, @ext={0x0, 0x0}}, {0x3, 0x5, 0xff, 0x0, @tick=0x6, {0x1, 0x2}, {0xa, 0x81}, @result={0x2}}], 0x38) 8.720443433s ago: executing program 5 (id=2111): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfffffc99}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmmsg$inet6(r3, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 8.103985709s ago: executing program 8 (id=2103): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000440)="36d9a32e92c131d730b1abaedb51eb66fd2d5b1f7eda4f0e859fdaf294bad706738135", 0x23, 0x800, 0x0, 0x0) recvfrom(r1, &(0x7f00000030c0)=""/4117, 0xffffffffffffffbf, 0x1, 0x0, 0xffffffffffffffb5) 7.928642337s ago: executing program 7 (id=2104): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x800, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_lsm={0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x7d2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x14, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x4, 0x4}}}}}}}, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r2, 0x400455c8, 0x1) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) 7.763989564s ago: executing program 5 (id=2105): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000001c0)={'wlan0\x00', &(0x7f0000000100)=@ethtool_gstrings={0x1b, 0x3}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x8, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0xa, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x6, 0x5, 0x4, 0x0, 0x7, 0x3c57, 0x0, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x5, 0x7, 0x83, 0x9, 0x4c74, 0x0, 0x242, 0x2, 0xe, 0x0, 0x400, 0x7, 0x17, 0x21, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x85, 0x6, 0xffff8001, 0x3ff, 0x83, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0x388000, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2b, 0xe, 0x312, 0x78, 0xea4, 0x0, 0xfff, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0xff, 0x0, 0x1000ff, 0x5, 0x1000005, 0x5f31, 0xf, 0xd86, 0x2, 0x4, 0x8, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0xbc2, 0x1, 0xfe000000, 0x8, 0x2, 0x200004, 0x9, 0x3, 0x3, 0x9, 0x4, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x1, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x3, 0x5, 0x800000, 0x1ef, 0x8, 0x8, 0x86, 0x3, 0x3038, 0xff, 0xb, 0x2, 0x2, 0x2, 0x7, 0x20000008, 0x4, 0x16d01, 0x6, 0x38, 0x800003, 0x600, 0x80, 0xbf7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x4a9, 0x5, 0x6, 0xac8, 0x5, 0x7, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x3, 0x5, 0x1b, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x80000000], [0x9, 0xbb33, 0xa, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x7, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x10000016, 0xffffffff, 0x80000000, 0x5, 0xffffffff, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xae, 0x8, 0x6, 0x226, 0x3, 0x100, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x8, 0x4, 0x5, 0x40b1e, 0xd7, 0x200, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000180), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={0x0, 0x4c}, 0x1, 0x0, 0x0, 0x20048040}, 0x40) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000000), r6) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010025bd7000ffdbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) 7.143528511s ago: executing program 8 (id=2106): syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x9685, 0x0, 0x0, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001b700)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) inotify_init1(0x0) syz_open_dev$evdev(0x0, 0x0, 0x882) pselect6(0x0, 0x0, &(0x7f00000000c0)={0x1d, 0xfffffffffffffffe, 0x40, 0x7eff, 0x0, 0x1, 0x0, 0x8}, 0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040), r1) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000bc0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000080)={0x20, r2, 0xedceecb76ebd4fd, 0x70bd28, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008000}, 0x5884) 6.090914317s ago: executing program 5 (id=2107): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r4}, 0x20) sendmmsg$inet6(r4, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 5.427109475s ago: executing program 7 (id=2108): fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/diskstats\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(0xffffffffffffffff, 0x8040942d, 0x0) lseek(r0, 0xc6c3, 0x0) 4.398773429s ago: executing program 5 (id=2109): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0xa, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) socket(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f90786401010000000000"], 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000580)={'pcm3724\x00', [0x4f27, 0x5, 0x4010000, 0x5, 0x66, 0x1cc7, 0x532, 0x80009, 0x2, 0x100, 0x9, 0x2, 0xeffeffff, 0x9, 0x1, 0x80000101, 0x7, 0x1a449, 0x3, 0x40020003, 0x100208a, 0xf, 0xd27, 0xb1, 0x7fff, 0x8, 0x3c, 0x0, 0xb, 0x0, 0x2e7]}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) 4.375675631s ago: executing program 7 (id=2110): r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000022546940fa0ae803d0990102030109023600010000000009047500038cbb2a0009050a001000010000090588"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f0000000100)={0x40, 0xc, 0x1, "06"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.349545372s ago: executing program 6 (id=2112): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x1, 0x0) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r5, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x30}], 0x1, 0x4) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000002c0)={0x7094, 0x9a, 0x200, 0x38d129bf, 0x800, 0x6, 0x4, 0x55, r5}, 0x20) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x0, 0xc8, 0x8, 0x128, 0x5803, 0x218, 0x2e8, 0x2e8, 0x218, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [], [], 'batadv0\x00', 'wlan0\x00'}, 0x0, 0x108, 0x128, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@quota={{0x38}}, @common=@inet=@socket1={{0x28}, 0x4c}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={0x0}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, 0x0, &(0x7f00000002c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={0x0, r7}, 0x18) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/mm/ksm/run\x00', 0x2, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="000326bd700000dcdf25410000000e0001006e657464657673696d0000000f0002006e657464657673"], 0x44}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 3.384187124s ago: executing program 5 (id=2113): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000340)={0x14, r5, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbf8, {0x3, 0x0, 0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x4005c}, 0x400c084) eventfd(0x0) 3.334595116s ago: executing program 8 (id=2114): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) epoll_create1(0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88, 0x1, 0x0, 0x3}, 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, &(0x7f0000000100)) shutdown(r1, 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x41dc, 0x4) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) syz_io_uring_setup(0xc97, &(0x7f0000000700)={0x0, 0x6015, 0x800, 0xff7fffff, 0x11c}, &(0x7f00000003c0), &(0x7f0000000140)) r2 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x3, 0x4, &(0x7f0000000780)=ANY=[@ANYBLOB="850000004f000000350000000000000085000000d00000009500000000000000f4670880271e3503200ffa95a2c8c037c5a142dfa8ba6287066c5197fabd5f7010e81ae0b737126ea6f7dc39cd340101000000000000e22ff5dde54704d25c79949c23e2eb15d756a2350ea7c09cc28de194f44800000000b0d3712c7e1e23166304d95433b3b30514b1ccbaa2bb755af3d576090c4867a7b6393e366c6386d5ec7209d031f40f3003006b6e51a7f550afc809000000000000007846c744ae6af3c04143cca8d95c2c505d5e37102124d85cec074c6949e1d76d067a97000247fe5f0600000000000711aba46aac3abe6c4d7f47ef6d7eb6baaa4a9779f8595caea75d0400c221c110ef050000000ee282ab76f593d928cf95846be6277c04b8c5324812696a62d992a4f8dc8dcba00b1b2d2547c45b0c52087b5efaa98496b9a95166bd008ea02a7b56c0ebfb19a3426833280be1f844ce328c10752a42dca52fb98c1452b6516e9d114ea64d15fd89e287ebf942f7147f7b2744419a2f238f173d0cd46dafc6e95500f53e5309ec91d83cf4fbd775d9c07d59101949f8982b6c403a08606d6a2fd1fdfce2b91a8665b1e629b3b28000000000000009000000d98255ea78431845ea38ca3d4dd562797c8c3265512da6fd6575ad0f0e30175cf800d0380367e653af5fd72c5335aeb479d3a397dbbde8892bb31ffcc553924e8771cbeb49ce8be25b9ef6dc614b4577391b799b65affd4c37fa18b7577b883deefb1a9543567f33aa008a338c07dbb51200"/585], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0xfffff000, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x48e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_rdma(0x10, 0x3, 0x14) 2.368063888s ago: executing program 5 (id=2115): r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = socket(0x1e, 0x5, 0x0) listen(r2, 0x0) accept4(r2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r3, &(0x7f0000032680)=""/102376, 0x18fe8) 2.227439094s ago: executing program 0 (id=2116): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c399000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) write$sysctl(0xffffffffffffffff, 0x0, 0x0) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x840, 0x0) 1.188008139s ago: executing program 0 (id=2117): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001cc0)={0x3, 0x0, [{0x0, 0x31, &(0x7f0000000000)=""/49}, {0x0, 0x77, &(0x7f0000000980)=""/119}, {0x0, 0xffb, &(0x7f0000000cc0)=""/4091}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000380)={0x0, 0x3ff, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) 1.129744991s ago: executing program 6 (id=2118): r0 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$user(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x1}, &(0x7f00000003c0)="ae", 0x4d, r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000000)=@keyring={'key_or_keyring:', r1}) keyctl$link(0x8, r1, r0) 1.079315813s ago: executing program 7 (id=2119): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x328, 0x288, 0x43, 0xa0, 0x288, 0x98, 0x388, 0x178, 0x178, 0x388, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'ip6erspan0\x00'}, 0x12a, 0x130, 0x190, 0x0, {0x0, 0x7a010000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x3, 'kmp\x00', "7af8bdb4c056dc65949041982abfe9ed51b01289c0026e2e6034ed587be5f09017b907388134b0ede40eb8d493f20d534fc37f23ec524d91a7a041f36bb1d1c3ab474544c5ef3f2fa69a80a0d967ee4464257d28d31e6843bc1221dfb9a6a27ad13af7061b737fd97d94f50942c68242819c941c0b4d9ec154c7d327187e8198", 0x38, 0x2, {0x1}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x4, 0x7, 0x5, 0x4, 0x3, 0x4], 0x2, 0x4}, {0xffffffffffffffff, [0x1, 0x1, 0x1, 0x1, 0x1, 0x2], 0x4}}}}, {{@uncond, 0x0, 0xe0, 0x100, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x1b, 0x408, 0xfffffffb}}, @common=@set={{0x40}, {{0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x0, 0x1}}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x388) socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000040)={0x2, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000140)={r2, 0x400}) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x118) r3 = syz_open_dev$radio(&(0x7f00000001c0), 0x1, 0x2) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x200000e, 0x100010, r3, 0x5dd48000) r4 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r4, 0x80605414, &(0x7f0000000500)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x5}, {0xffff, 0xffff}, {0x4, 0x4}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xfffffd70, 0x2, {0x0, 0x1003}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80d1}, 0x10000000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000100)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c643c, &(0x7f0000000300)={0x0, 0x0, r0}) 1.068533034s ago: executing program 8 (id=2120): write(0xffffffffffffffff, &(0x7f0000000100)="2600000022007dcfcd", 0x9) timer_settime(0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x27, 0x4c, 0x3, 0x40, 0x5ab, 0x60, 0x1106, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xd, 0x0, 0x0, [{{0x9, 0x4, 0xa8, 0x0, 0x0, 0xf4, 0x7, 0x50}}]}}]}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, 0x0) 942.917839ms ago: executing program 6 (id=2121): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r4}, 0x20) sendmmsg$inet6(r4, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 187.431472ms ago: executing program 0 (id=2122): fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/diskstats\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(0xffffffffffffffff, 0x8040942d, 0x0) lseek(r0, 0xc6c3, 0x0) 0s ago: executing program 7 (id=2123): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x24044085, &(0x7f00000001c0)={0x11, 0x88a8, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) kernel console output (not intermixed with test programs): tatus=0x00 [ 491.084623][ T4234] gspca_stk1135: Sensor read failed [ 491.095063][ T4234] gspca_stk1135: serial bus timeout: status=0x00 [ 491.109413][ T4234] gspca_stk1135: Sensor write failed [ 491.120531][ T4234] gspca_stk1135: serial bus timeout: status=0x00 [ 491.139668][ T4234] gspca_stk1135: Sensor write failed [ 491.155004][ T4234] stk1135: probe of 1-1:0.0 failed with error -71 [ 491.181277][ T4234] usb 1-1: USB disconnect, device number 16 [ 491.615703][ T8527] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 493.482763][ T1108] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 493.912585][ T4277] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 494.467021][ T4277] usb 1-1: Using ep0 maxpacket: 32 [ 494.662804][ T1108] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 494.672629][ T1108] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.681101][ T1108] usb 4-1: Product: syz [ 494.685963][ T1108] usb 4-1: Manufacturer: syz [ 494.690688][ T1108] usb 4-1: SerialNumber: syz [ 494.742711][ T4277] usb 1-1: config 0 interface 0 has no altsetting 0 [ 494.863087][ T8559] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 494.939877][ T4277] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 494.945189][ T8563] SET target dimension over the limit! [ 494.951118][ T4277] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.964123][ T4277] usb 1-1: Product: syz [ 494.968431][ T4277] usb 1-1: Manufacturer: syz [ 494.973570][ T4277] usb 1-1: SerialNumber: syz [ 494.981579][ T4277] usb 1-1: config 0 descriptor?? [ 495.019333][ T8564] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1199'. [ 495.382726][ T1108] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 495.388826][ T1108] cdc_ncm 4-1:1.0: bind() failure [ 495.401761][ T1108] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 495.410572][ T1108] cdc_ncm 4-1:1.1: bind() failure [ 495.983930][ T8575] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 496.688769][ T1108] usb 4-1: USB disconnect, device number 25 [ 496.755578][ T4277] usb 1-1: USB disconnect, device number 17 [ 499.063046][ T8609] Cannot find add_set index 0 as target [ 500.379904][ T8633] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 500.432615][ T4234] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 500.562608][ T4264] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 501.326636][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.334695][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.176657][ T8649] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1223'. [ 502.452876][ T4264] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 502.532723][ T4234] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 502.558617][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.616339][ T4234] usb 4-1: Product: syz [ 502.622784][ T4264] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 502.651705][ T4264] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.666904][ T4234] usb 4-1: Manufacturer: syz [ 502.698513][ T4234] usb 4-1: SerialNumber: syz [ 502.715389][ T4264] usb 6-1: Product: syz [ 502.744749][ T4264] usb 6-1: Manufacturer: syz [ 502.769604][ T4264] usb 6-1: SerialNumber: syz [ 502.811409][ T4264] usb 6-1: config 0 descriptor?? [ 503.400998][ T8661] Cannot find add_set index 0 as target [ 503.432634][ T4234] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 503.448599][ T4234] cdc_ncm 4-1:1.0: bind() failure [ 503.469121][ T8662] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1227'. [ 503.540384][ T4234] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 503.621175][ T4234] cdc_ncm 4-1:1.1: bind() failure [ 503.638630][ T8664] 9pnet_virtio: no channels available for device 127.0.0.1 [ 503.876095][ T4264] usb 6-1: USB disconnect, device number 2 [ 503.953670][ T1108] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 504.494484][ T4264] usb 4-1: USB disconnect, device number 26 [ 504.763010][ T1108] usb 1-1: Using ep0 maxpacket: 16 [ 505.433201][ T1108] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 505.485758][ T1108] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 506.513187][ T1108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.678025][ T1108] usb 1-1: config 0 descriptor?? [ 507.832759][ T1108] usb 1-1: can't set config #0, error -71 [ 507.856781][ T1108] usb 1-1: USB disconnect, device number 18 [ 508.046772][ T8705] netlink: 'syz.0.1238': attribute type 12 has an invalid length. [ 508.056239][ T8705] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1238'. [ 508.282910][ T4277] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 508.522745][ T1108] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 508.542699][ T4277] usb 6-1: Using ep0 maxpacket: 32 [ 508.672734][ T4277] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 508.682250][ T4277] usb 6-1: config 0 has no interface number 0 [ 508.698299][ T4277] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 508.777128][ T1108] usb 4-1: Using ep0 maxpacket: 8 [ 508.872775][ T4331] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 508.892893][ T4277] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 508.902075][ T4277] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.911046][ T1108] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 508.922874][ T1108] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 508.940875][ T4277] usb 6-1: Product: syz [ 508.947664][ T1108] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 508.961498][ T4277] usb 6-1: Manufacturer: syz [ 508.968149][ T4277] usb 6-1: SerialNumber: syz [ 508.975410][ T1108] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 508.996888][ T8712] SET target dimension over the limit! [ 509.003448][ T4277] usb 6-1: config 0 descriptor?? [ 509.024978][ T1108] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 509.042854][ T8704] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 509.060153][ T1108] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.079257][ T8713] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1242'. [ 509.273876][ T8704] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 509.342831][ T1108] usb 4-1: GET_CAPABILITIES returned 0 [ 509.348808][ T1108] usbtmc 4-1:16.0: can't read capabilities [ 509.443006][ T4331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 509.465593][ T4331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.488852][ T8717] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 509.536847][ T4331] usb 2-1: Product: syz [ 509.577219][ T4331] usb 2-1: Manufacturer: syz [ 509.602961][ T4331] usb 2-1: SerialNumber: syz [ 510.117638][ T4369] usb 4-1: USB disconnect, device number 27 [ 510.733468][ T4331] cdc_ncm 2-1:1.0: failed GET_NTB_PARAMETERS [ 510.745747][ T4331] cdc_ncm 2-1:1.0: bind() failure [ 510.820610][ T4331] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 510.832541][ T4331] cdc_ncm 2-1:1.1: bind() failure [ 511.900609][ T4264] usb 2-1: USB disconnect, device number 18 [ 512.034282][ T4277] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 512.044609][ T4277] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 512.055196][ T4277] asix: probe of 6-1:0.188 failed with error -71 [ 512.071580][ T4277] usb 6-1: USB disconnect, device number 3 [ 513.154210][ T8753] Cannot find add_set index 0 as target [ 513.456427][ T8758] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1254'. [ 517.944772][ T4331] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 518.961630][ T8811] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 519.834495][ T8800] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 519.862942][ T8816] SET target dimension over the limit! [ 519.967995][ T8819] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1271'. [ 521.228604][ T8835] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1277'. [ 522.227578][ T8836] Cannot find set identified by id 65534 to match [ 523.152496][ T4331] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 524.584221][ T8853] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 525.332760][ T4331] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 525.358288][ T4331] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.522555][ T4331] usb 1-1: Product: syz [ 525.542980][ T4331] usb 1-1: Manufacturer: syz [ 525.562518][ T4331] usb 1-1: SerialNumber: syz [ 526.462656][ T4331] cdc_ncm 1-1:1.0: bind() failure [ 526.493739][ T8873] SET target dimension over the limit! [ 526.506651][ T4331] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 526.544427][ T4331] cdc_ncm 1-1:1.1: bind() failure [ 526.612629][ T4331] usb 1-1: USB disconnect, device number 19 [ 526.623801][ T8880] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1287'. [ 526.978335][ T8884] tipc: Started in network mode [ 526.983845][ T8884] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 526.999808][ T8884] tipc: New replicast peer: fc00:0000:0000:0000:0000:0000:0000:0000 [ 527.009179][ T8884] tipc: Enabled bearer , priority 10 [ 528.024701][ T4264] tipc: Node number set to 1 [ 529.186731][ T8901] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 529.231938][ T8906] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1296'. [ 529.376110][ T8908] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 529.814621][ T1108] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 531.422517][ T1108] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 531.772670][ T1108] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.813533][ T1108] usb 5-1: Product: syz [ 531.842492][ T1108] usb 5-1: Manufacturer: syz [ 531.847490][ T1108] usb 5-1: SerialNumber: syz [ 532.035770][ T8944] Cannot find add_set index 0 as target [ 532.129044][ T8945] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1304'. [ 532.562613][ T7578] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 532.603322][ T1108] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 532.609739][ T1108] cdc_ncm 5-1:1.0: bind() failure [ 532.698329][ T1108] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 532.785090][ T1108] cdc_ncm 5-1:1.1: bind() failure [ 532.812702][ T7578] usb 6-1: Using ep0 maxpacket: 32 [ 532.932828][ T7578] usb 6-1: config 0 has an invalid interface number: 195 but max is 0 [ 532.989876][ T7578] usb 6-1: config 0 has no interface number 0 [ 533.098409][ T7578] usb 6-1: config 0 interface 195 has no altsetting 0 [ 533.372938][ T7578] usb 6-1: New USB device found, idVendor=0711, idProduct=0200, bcdDevice=46.32 [ 533.412572][ T7578] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.461985][ T7578] usb 6-1: Product: syz [ 533.502350][ T7578] usb 6-1: Manufacturer: syz [ 533.569850][ T7578] usb 6-1: SerialNumber: syz [ 533.620354][ T7578] usb 6-1: config 0 descriptor?? [ 533.704272][ T7578] mct_u232 6-1:0.195: MCT U232 converter detected [ 533.732129][ T7578] mct_u232 ttyUSB0: expected endpoint missing [ 533.812523][ T7578] usb 5-1: USB disconnect, device number 20 [ 533.993937][ T3523] usb 6-1: USB disconnect, device number 4 [ 534.016110][ T3523] mct_u232 6-1:0.195: device disconnected [ 535.007300][ T8975] tipc: Started in network mode [ 535.012350][ T8975] tipc: Node identity 526e8b3a17e8, cluster identity 4711 [ 535.043073][ T8975] tipc: Enabled bearer , priority 0 [ 535.142242][ T8978] device syzkaller0 entered promiscuous mode [ 535.207034][ T8974] tipc: Resetting bearer [ 535.320291][ T8974] tipc: Disabling bearer [ 535.462512][ T7578] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 535.561596][ T8986] user requested TSC rate below hardware speed [ 535.702511][ T7578] usb 6-1: Using ep0 maxpacket: 8 [ 535.822877][ T7578] usb 6-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 535.889921][ T8995] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 536.621171][ T7578] usb 6-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 537.492555][ T7578] usb 6-1: config 0 interface 0 has no altsetting 0 [ 537.502858][ T7578] usb 6-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 537.512045][ T7578] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 537.522542][ T7578] usb 6-1: config 0 descriptor?? [ 537.599037][ T9003] Cannot find add_set index 0 as target [ 537.729390][ T9004] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1322'. [ 538.032613][ T3523] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 538.631046][ T7578] gt683r_led 0003:1770:FF00.0006: hidraw0: USB HID vf4.f6 Device [HID 1770:ff00] on usb-dummy_hcd.5-1/input0 [ 538.830491][ T7578] usb 6-1: USB disconnect, device number 5 [ 538.852176][ T4277] gt683r_led 0003:1770:FF00.0006: failed to send set report request: -19 [ 538.944152][ T3523] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 539.661165][ T3523] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.772502][ T3523] usb 4-1: Product: syz [ 539.777372][ T3523] usb 4-1: Manufacturer: syz [ 539.782146][ T3523] usb 4-1: SerialNumber: syz [ 540.531697][ T9028] fido_id[9028]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 540.583127][ T4264] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 540.702626][ T4277] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 540.919831][ T9034] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 540.992806][ T4277] usb 2-1: Using ep0 maxpacket: 8 [ 541.112884][ T4277] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 541.145429][ T4277] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 541.243992][ T4277] usb 2-1: config 16 has 0 interfaces, different from the descriptor's value: 1 [ 541.330365][ T4277] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 541.415294][ T4277] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.701742][ T9039] device syzkaller1 entered promiscuous mode [ 541.717506][ T9039] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 541.822664][ T3523] cdc_ncm 4-1:1.0: failed to get mac address [ 541.913712][ T3523] cdc_ncm 4-1:1.0: bind() failure [ 541.970751][ T3523] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 541.982911][ T4264] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 542.078254][ T4264] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 542.153025][ T3523] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 542.682666][ T3523] usbtest: probe of 4-1:1.1 failed with error -71 [ 542.792584][ T4264] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 542.917995][ T4264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.992061][ T3523] usb 4-1: USB disconnect, device number 28 [ 543.024725][ T4264] usb 5-1: config 0 descriptor?? [ 543.286841][ T4234] usb 2-1: USB disconnect, device number 19 [ 543.326074][ T4264] usb 5-1: can't set config #0, error -71 [ 543.335417][ T9050] Cannot find add_set index 0 as target [ 543.350111][ T4264] usb 5-1: USB disconnect, device number 21 [ 543.579387][ T9058] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1336'. [ 544.476182][ T9077] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 545.372860][ T4264] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 546.032690][ T4264] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 546.078319][ T4264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.099720][ T4264] usb 5-1: config 0 descriptor?? [ 546.174071][ T4264] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 547.072841][ T4264] usb 5-1: USB disconnect, device number 22 [ 547.294870][ T4277] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 547.361905][ T9105] Cannot find add_set index 0 as target [ 547.431136][ T9106] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1352'. [ 547.452564][ T7578] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 548.508190][ T9120] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 548.633816][ T4331] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 548.733172][ T4277] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 548.750464][ T4277] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.759358][ T4277] usb 2-1: Product: syz [ 548.773392][ T4277] usb 2-1: Manufacturer: syz [ 548.778960][ T4277] usb 2-1: SerialNumber: syz [ 548.892750][ T7578] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 548.901888][ T4331] usb 5-1: Using ep0 maxpacket: 8 [ 548.917347][ T7578] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.956175][ T7578] usb 1-1: Product: syz [ 548.979603][ T7578] usb 1-1: Manufacturer: syz [ 549.007435][ T7578] usb 1-1: SerialNumber: syz [ 549.062725][ T4331] usb 5-1: unable to get BOS descriptor or descriptor too short [ 549.162700][ T4331] usb 5-1: config 4 interface 0 has no altsetting 0 [ 549.442762][ T4331] usb 5-1: string descriptor 0 read error: -22 [ 549.449064][ T4331] usb 5-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.ee [ 549.479626][ T4331] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.570061][ T4331] usb 5-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 549.610642][ T4331] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 549.621243][ T4331] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 549.630289][ T4331] usb 5-1: media controller created [ 549.733057][ T4331] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 549.981773][ T4277] cdc_ncm 2-1:1.0: failed to get mac address [ 550.008511][ T4277] cdc_ncm 2-1:1.0: bind() failure [ 550.052682][ T4277] cdc_ncm: probe of 2-1:1.1 failed with error -71 [ 550.072719][ T4277] cdc_mbim: probe of 2-1:1.1 failed with error -71 [ 550.149197][ T4277] usbtest: probe of 2-1:1.1 failed with error -71 [ 550.252914][ T7578] cdc_ncm 1-1:1.0: failed to get mac address [ 550.300433][ T7578] cdc_ncm 1-1:1.0: bind() failure [ 550.329057][ T4277] usb 2-1: USB disconnect, device number 20 [ 550.612980][ T7578] cdc_ncm: probe of 1-1:1.1 failed with error -71 [ 550.752862][ T7578] cdc_mbim: probe of 1-1:1.1 failed with error -71 [ 550.792720][ T7578] usbtest: probe of 1-1:1.1 failed with error -71 [ 550.875667][ T7578] usb 1-1: USB disconnect, device number 20 [ 550.883789][ T4331] zl10353_read_register: readreg error (reg=127, ret==0) [ 550.990030][ T9139] Cannot find add_set index 0 as target [ 551.028671][ T4331] usb 5-1: USB disconnect, device number 23 [ 551.107177][ T9148] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1366'. [ 551.372871][ T9152] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1368'. [ 554.672614][ T4264] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 554.862497][ T3523] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 555.232837][ T4264] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 555.242656][ T4264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 555.250765][ T4264] usb 4-1: Product: syz [ 555.255489][ T3523] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 127, changing to 10 [ 555.267013][ T4264] usb 4-1: Manufacturer: syz [ 555.271702][ T4264] usb 4-1: SerialNumber: syz [ 555.276478][ T3523] usb 6-1: New USB device found, idVendor=0c70, idProduct=f0bd, bcdDevice= 0.00 [ 555.286808][ T3523] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.308380][ T3523] usb 6-1: config 0 descriptor?? [ 555.452652][ T4234] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 555.702740][ T4234] usb 2-1: Using ep0 maxpacket: 8 [ 555.882814][ T3523] usbhid 6-1:0.0: can't add hid device: -71 [ 555.889344][ T3523] usbhid: probe of 6-1:0.0 failed with error -71 [ 555.927477][ T3523] usb 6-1: USB disconnect, device number 6 [ 556.102654][ T4234] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 556.112877][ T4234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.139426][ T4234] usb 2-1: Product: syz [ 556.195678][ T4234] usb 2-1: Manufacturer: syz [ 556.200488][ T4234] usb 2-1: SerialNumber: syz [ 556.287279][ T4234] usb 2-1: config 0 descriptor?? [ 556.536434][ T9205] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1381'. [ 556.563270][ T4264] cdc_ncm 4-1:1.0: failed to get mac address [ 556.623340][ T4234] usb 2-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 556.639156][ T4264] cdc_ncm 4-1:1.0: bind() failure [ 556.713112][ T4264] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 556.753113][ T4264] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 556.792548][ T4264] usbtest: probe of 4-1:1.1 failed with error -71 [ 556.824685][ T9201] overlayfs: missing 'lowerdir' [ 556.833974][ T4264] usb 4-1: USB disconnect, device number 29 [ 558.362794][ T4264] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 558.565082][ T9226] input: syz1 as /devices/virtual/input/input13 [ 558.694140][ T4234] usb write operation failed. (-71) [ 558.708835][ T4234] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 558.764334][ T4234] dvbdev: DVB: registering new adapter (Terratec H7) [ 558.779017][ T4234] usb 2-1: media controller created [ 558.785351][ T4264] usb 5-1: config 1 interface 0 altsetting 93 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 558.799318][ T4264] usb 5-1: config 1 interface 0 has no altsetting 0 [ 558.816037][ T4234] usb read operation failed. (-71) [ 558.862791][ T4234] usb write operation failed. (-71) [ 558.874087][ T4234] dvb_usb_az6007: probe of 2-1:0.0 failed with error -5 [ 558.902864][ T4264] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 558.933328][ T4234] usb 2-1: USB disconnect, device number 21 [ 558.940830][ T4264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 558.977299][ T4264] usb 5-1: SerialNumber: syz [ 559.153517][ T9220] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 559.332538][ T4234] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 559.435511][ T4264] cdc_ether: probe of 5-1:1.0 failed with error -71 [ 559.466269][ T4264] usb 5-1: USB disconnect, device number 24 [ 560.489909][ T9244] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 560.508580][ T9244] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 560.615687][ T4234] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 560.624127][ T4234] usb 2-1: config 0 has no interface number 0 [ 560.679876][ T9250] smc: ib device syz2 ibport 1 applied user defined pnetid SYZ1 [ 560.782573][ T4234] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 560.791824][ T4234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.987384][ T4234] usb 2-1: Product: syz [ 560.992220][ T4234] usb 2-1: Manufacturer: syz [ 560.997011][ T4234] usb 2-1: SerialNumber: syz [ 561.005246][ T4234] usb 2-1: config 0 descriptor?? [ 561.032299][ T9264] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1397'. [ 561.092727][ T4369] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 561.832708][ T4234] usb 2-1: atusb_control_msg: req 0x21 val 0x0 idx 0x1e, error -32 [ 561.841160][ T4234] usb 2-1: Firmware version (0.0) predates our first public release. [ 561.864864][ T4234] usb 2-1: Please update to version 0.2 or newer [ 561.912809][ T4234] usb 2-1: atusb_probe: initialization failed, error = -32 [ 561.929647][ T4234] atusb: probe of 2-1:0.128 failed with error -32 [ 562.082880][ T4369] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 562.092205][ T4369] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.125477][ T4369] usb 4-1: Product: syz [ 562.139903][ T4369] usb 4-1: Manufacturer: syz [ 562.147289][ T4369] usb 4-1: SerialNumber: syz [ 562.809624][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.818399][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.267548][ T9297] capability: warning: `syz.4.1408' uses 32-bit capabilities (legacy support in use) [ 563.328255][ T9298] syz.5.1405[9298] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 563.328574][ T9298] syz.5.1405[9298] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 563.583425][ T4234] usb 2-1: USB disconnect, device number 22 [ 563.843957][ T4331] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 564.702770][ T4369] cdc_ncm 4-1:1.0: failed to get mac address [ 564.722740][ T4369] cdc_ncm 4-1:1.0: bind() failure [ 564.733169][ T9307] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1410'. [ 564.774603][ T4369] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 564.793966][ T4369] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 564.859806][ T4369] usbtest: probe of 4-1:1.1 failed with error -71 [ 564.866688][ T4331] usb 1-1: Using ep0 maxpacket: 8 [ 564.875889][ T4369] usb 4-1: USB disconnect, device number 30 [ 565.142741][ T4331] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 565.155801][ T4331] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.168731][ T4331] usb 1-1: Product: syz [ 565.187315][ T4331] usb 1-1: Manufacturer: syz [ 565.197673][ T4331] usb 1-1: SerialNumber: syz [ 565.234551][ T4331] usb 1-1: config 0 descriptor?? [ 565.305057][ T4331] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 565.682498][ T4264] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 566.721385][ T9321] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 566.741757][ T9321] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 566.750933][ T9321] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 566.832801][ T4264] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 566.845257][ T4264] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 566.855836][ T4264] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 566.865490][ T4264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.902894][ T9309] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 566.972575][ T4331] gspca_sonixj: i2c_w8 err -71 [ 566.992572][ T7578] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 567.182613][ T4331] sonixj: probe of 1-1:0.0 failed with error -71 [ 567.211584][ T9309] zonefs (nullb0) ERROR: Not a zoned block device [ 567.353083][ T4331] usb 1-1: USB disconnect, device number 21 [ 567.502583][ T7578] usb 2-1: Using ep0 maxpacket: 8 [ 567.892574][ T7578] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.912501][ T7578] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 567.929827][ T7578] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.426672][ T7578] usb 2-1: config 0 descriptor?? [ 569.494188][ T7578] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 569.650660][ T9356] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1424'. [ 569.832616][ T4331] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 570.372708][ T4331] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 570.393602][ T4331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.512639][ T4331] usb 4-1: Product: syz [ 570.521043][ T4331] usb 4-1: Manufacturer: syz [ 570.537842][ T4331] usb 4-1: SerialNumber: syz [ 570.678197][ T4264] usb 5-1: USB disconnect, device number 25 [ 570.855314][ T4198] Bluetooth: unknown link type 128 [ 571.032809][ T7578] gspca_vc032x: reg_w err -71 [ 571.037590][ T7578] vc032x: probe of 2-1:0.0 failed with error -71 [ 571.094090][ T7578] usb 2-1: USB disconnect, device number 23 [ 572.107972][ T4331] cdc_ncm 4-1:1.0: failed to get mac address [ 572.182620][ T4331] cdc_ncm 4-1:1.0: bind() failure [ 572.244011][ T4331] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 572.672804][ T4331] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 573.208823][ T7578] Bluetooth: hci1: command 0x0409 tx timeout [ 573.225580][ T4331] usbtest: probe of 4-1:1.1 failed with error -71 [ 573.259793][ T4331] usb 4-1: USB disconnect, device number 31 [ 573.355138][ T9401] block nbd1: shutting down sockets [ 573.423677][ T9403] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 573.658452][ T9402] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 574.002346][ T9408] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1437'. [ 575.382496][ T4369] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 576.572824][ T4369] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 576.583150][ T4369] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 576.772931][ T4369] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 576.792954][ T4369] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.801423][ T4369] usb 1-1: Product: syz [ 576.810756][ T4369] usb 1-1: Manufacturer: syz [ 576.816328][ T4369] usb 1-1: SerialNumber: syz [ 577.020857][ T4369] cdc_mbim 1-1:1.0: skipping garbage [ 577.026291][ T4369] usb 1-1: selecting invalid altsetting 1 [ 577.082479][ T4331] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 577.174760][ T4369] cdc_mbim 1-1:1.0: bind() failure [ 577.257080][ T4369] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 577.287973][ T4369] cdc_ncm 1-1:1.1: bind() failure [ 577.745747][ T4369] usb 1-1: USB disconnect, device number 22 [ 577.942786][ T4331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 577.952032][ T4331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.692506][ T4331] usb 2-1: Product: syz [ 578.696741][ T4331] usb 2-1: Manufacturer: syz [ 578.701566][ T4331] usb 2-1: SerialNumber: syz [ 578.864126][ T9456] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1452'. [ 579.212544][ T4264] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 579.582917][ T4264] usb 4-1: config 0 has an invalid interface number: 122 but max is 0 [ 579.599494][ T4264] usb 4-1: config 0 has no interface number 0 [ 579.632040][ T4264] usb 4-1: config 0 interface 122 has no altsetting 0 [ 579.882859][ T4264] usb 4-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 579.898667][ T4264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.912485][ T4264] usb 4-1: Product: syz [ 579.917096][ T4264] usb 4-1: Manufacturer: syz [ 579.927052][ T4264] usb 4-1: SerialNumber: syz [ 579.943768][ T4264] usb 4-1: config 0 descriptor?? [ 580.502989][ T4264] usb 4-1: USB disconnect, device number 32 [ 580.848803][ T4264] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 580.934196][ T4331] cdc_ncm 2-1:1.0: failed to get mac address [ 580.940456][ T7578] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 580.969531][ T4331] cdc_ncm 2-1:1.0: bind() failure [ 581.002627][ T4331] cdc_ncm: probe of 2-1:1.1 failed with error -71 [ 581.032743][ T4331] cdc_mbim: probe of 2-1:1.1 failed with error -71 [ 581.082593][ T4331] usbtest: probe of 2-1:1.1 failed with error -71 [ 581.133898][ T4331] usb 2-1: USB disconnect, device number 24 [ 581.332569][ T7578] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 581.374549][ T7578] usb 1-1: config 0 has no interface number 0 [ 581.838125][ T7578] usb 1-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8e.1e [ 582.070061][ T7578] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.149169][ T7578] usb 1-1: config 0 descriptor?? [ 582.264908][ T7578] usb 1-1: selecting invalid altsetting 1 [ 582.320658][ T7578] dvb_ttusb_budget: ttusb_init_controller: error [ 582.365955][ T7578] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 582.647028][ T7578] DVB: Unable to find symbol cx22700_attach() [ 582.661078][ T9505] SET target dimension over the limit! [ 583.034485][ T7578] DVB: Unable to find symbol tda10046_attach() [ 583.042059][ T7578] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 585.276910][ T4331] usb 1-1: USB disconnect, device number 23 [ 585.292620][ T7578] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 585.747542][ T9539] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1476'. [ 586.532735][ T7578] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 586.629653][ T7578] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.877982][ T7578] usb 6-1: Product: syz [ 586.882296][ T7578] usb 6-1: Manufacturer: syz [ 587.478081][ T7578] usb 6-1: SerialNumber: syz [ 587.478989][ T9556] Cannot find add_set index 0 as target [ 587.542698][ T7578] usb 6-1: can't set config #1, error -71 [ 587.574214][ T7578] usb 6-1: USB disconnect, device number 7 [ 587.591023][ T9550] team0 (unregistering): Port device team_slave_0 removed [ 587.632087][ T9550] team0 (unregistering): Port device team_slave_1 removed [ 587.856352][ T9559] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1480'. [ 589.027466][ T9573] tipc: Started in network mode [ 589.070458][ T9573] tipc: Node identity 022d37bbb1b3, cluster identity 4711 [ 589.555621][ T9573] tipc: Enabled bearer , priority 0 [ 589.573710][ T9573] device syzkaller0 entered promiscuous mode [ 589.935114][ T9573] tipc: Resetting bearer [ 590.135422][ T9568] tipc: Resetting bearer [ 590.174737][ T9568] tipc: Disabling bearer [ 590.682626][ T7578] Bluetooth: hci0: command 0x0406 tx timeout [ 590.822638][ T4234] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 591.037212][ T9599] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1493'. [ 591.503160][ T4234] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 592.098231][ T4234] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.169753][ T4234] usb 6-1: Product: syz [ 592.188240][ T4234] usb 6-1: Manufacturer: syz [ 592.201813][ T9607] SET target dimension over the limit! [ 592.218296][ T4234] usb 6-1: SerialNumber: syz [ 592.283400][ T9608] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1496'. [ 592.502677][ T4264] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 592.982745][ T4264] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 593.001266][ T4264] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 593.096518][ T4264] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 593.112693][ T4264] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 593.121404][ T4264] usb 4-1: SerialNumber: syz [ 593.514329][ T4264] usb 4-1: 0:2 : does not exist [ 593.533370][ T4234] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 593.745835][ T9613] overlayfs: failed to get inode (-116) [ 593.752217][ T9613] overlayfs: failed to get inode (-116) [ 593.761745][ T4234] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM, 42:42:42:42:42:42 [ 593.773110][ T9613] overlayfs: failed to get inode (-116) [ 593.780012][ T9613] overlayfs: failed to get inode (-116) [ 593.811196][ T4234] usb 6-1: USB disconnect, device number 8 [ 593.833508][ T4234] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM [ 593.982684][ T4264] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 594.015149][ T4264] usb 4-1: USB disconnect, device number 33 [ 594.184105][ T7578] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 594.274183][ T5140] udevd[5140]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 594.652720][ T7578] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 594.775950][ T7578] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.825704][ T7578] usb 5-1: config 0 descriptor?? [ 595.061331][ T7578] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 596.083436][ T9661] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1509'. [ 596.132760][ T7578] gp8psk: usb out operation failed. [ 596.139179][ T7578] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 596.202557][ T7578] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 596.292570][ T7578] usb 5-1: USB disconnect, device number 26 [ 596.632619][ T4277] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 598.682782][ T4277] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 598.705038][ T4277] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.740961][ T4277] usb 6-1: Product: syz [ 598.745911][ T4277] usb 6-1: Manufacturer: syz [ 598.750706][ T4277] usb 6-1: SerialNumber: syz [ 598.922610][ T7578] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 598.966115][ T9699] tmpfs: Unknown parameter 'usrquota' [ 600.387879][ T4331] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 600.527303][ T4277] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 600.655214][ T7578] usb 1-1: config 0 interface 0 altsetting 251 has an invalid endpoint with address 0x93, skipping [ 600.674667][ T7578] usb 1-1: config 0 interface 0 has no altsetting 0 [ 600.721936][ T4277] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM, 42:42:42:42:42:42 [ 600.874873][ T7578] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 600.953290][ T7578] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 600.993206][ T4331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 601.084879][ T7578] usb 1-1: Product: syz [ 601.089104][ T7578] usb 1-1: Manufacturer: syz [ 601.102677][ T4277] usb 6-1: USB disconnect, device number 9 [ 601.111777][ T4331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 601.130995][ T4277] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM [ 601.156265][ T7578] usb 1-1: SerialNumber: syz [ 601.165480][ T4331] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 601.182349][ T7578] usb 1-1: config 0 descriptor?? [ 601.188015][ T4331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.202782][ T9688] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 601.233499][ T4331] usb 2-1: config 0 descriptor?? [ 601.282555][ T7578] snd-usb-audio: probe of 1-1:0.0 failed with error -22 [ 601.299816][ T9721] Cannot find add_set index 0 as target [ 601.338461][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 601.368982][ T9723] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1526'. [ 601.457002][ T4264] usb 1-1: USB disconnect, device number 24 [ 601.714521][ T4331] cp2112 0003:10C4:EA90.0007: unknown main item tag 0x0 [ 601.734211][ T4331] cp2112 0003:10C4:EA90.0007: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 601.792548][ T7578] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 601.932775][ T4331] cp2112 0003:10C4:EA90.0007: Part Number: 0x82 Device Version: 0xFE [ 602.032706][ T7578] usb 5-1: Using ep0 maxpacket: 32 [ 602.152720][ T7578] usb 5-1: unable to get BOS descriptor or descriptor too short [ 602.232553][ T7578] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 602.240227][ T7578] usb 5-1: can't read configurations, error -71 [ 602.431900][ T9763] nvme_fabrics: unknown parameter or missing value ':syz2:M:00000000000000000001:*+-':ethtool' in ctrl creation request [ 602.576084][ T9703] cp2112 0003:10C4:EA90.0007: Error starting transaction: -38 [ 602.602815][ T4331] cp2112 0003:10C4:EA90.0007: error reading lock byte: -71 [ 602.645869][ T4331] usb 2-1: USB disconnect, device number 25 [ 603.220863][ T9768] fido_id[9768]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 603.349348][ T9785] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1539'. [ 603.522552][ T4277] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 603.605480][ T9795] team0: No ports can be present during mode change [ 603.702584][ T4331] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 603.711080][ T9802] SET target dimension over the limit! [ 603.805544][ T9812] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1542'. [ 604.072645][ T4331] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 604.083039][ T4277] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 604.769236][ T4277] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.778071][ T4331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 604.790176][ T4277] usb 6-1: Product: syz [ 604.794890][ T4277] usb 6-1: Manufacturer: syz [ 604.799518][ T4277] usb 6-1: SerialNumber: syz [ 604.952611][ T4331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 604.977418][ T4331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.987845][ T9824] D‹\ [ 605.110721][ T4331] usb 2-1: Product: syz [ 605.118399][ T4331] usb 2-1: Manufacturer: syz [ 605.143030][ T4331] usb 2-1: SerialNumber: syz [ 605.860763][ T9841] device batadv_slave_1 entered promiscuous mode [ 605.961230][ T9840] device batadv_slave_1 left promiscuous mode [ 606.103135][ T4277] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 606.342547][ T4331] cdc_ncm 2-1:1.0: bind() failure [ 606.351851][ T4331] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 606.363235][ T4277] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM, 42:42:42:42:42:42 [ 606.393676][ T4331] cdc_ncm 2-1:1.1: bind() failure [ 606.403743][ T4277] usb 6-1: USB disconnect, device number 10 [ 607.063502][ T4277] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM [ 607.075713][ T4331] usb 2-1: USB disconnect, device number 26 [ 608.277088][ T9857] SET target dimension over the limit! [ 609.126282][ T9870] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1557'. [ 609.157432][ T9852] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 610.247058][ T9891] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1564'. [ 610.307137][ T9891] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1564'. [ 610.434405][ T9891] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.444184][ T9891] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.453032][ T9891] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.461754][ T9891] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.496821][ T9891] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1564'. [ 610.536426][ T9891] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1564'. [ 612.344755][ T1108] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 612.742706][ T9921] Cannot find add_set index 0 as target [ 612.804382][ T9923] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1573'. [ 613.523839][ T1108] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 613.543783][ T1108] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.552119][ T1108] usb 1-1: Product: syz [ 613.564113][ T1108] usb 1-1: Manufacturer: syz [ 613.568830][ T1108] usb 1-1: SerialNumber: syz [ 614.932819][ T1108] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 615.160995][ T1108] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42 [ 615.219891][ T1108] usb 1-1: USB disconnect, device number 25 [ 615.224285][ T9966] SET target dimension over the limit! [ 615.249158][ T1108] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM [ 615.289030][ T9967] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1587'. [ 615.452632][ T4302] usb 2-1: new full-speed USB device number 27 using dummy_hcd [ 615.995242][ T4302] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 616.011847][ T4302] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.020403][ T4302] usb 2-1: Product: syz [ 616.024889][ T4302] usb 2-1: Manufacturer: syz [ 616.029528][ T4302] usb 2-1: SerialNumber: syz [ 616.037992][ T4302] usb 2-1: config 0 descriptor?? [ 616.114530][ T9984] Invalid ELF header type: 25773 != 1 [ 616.405369][ T9979] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 616.450672][ T9979] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 616.523451][ T4302] airspy 2-1:0.0: Board ID: 00 [ 616.528426][ T4302] airspy 2-1:0.0: Firmware version: [ 617.023250][ T9998] tipc: Started in network mode [ 617.028398][ T9998] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 617.040136][ T9998] tipc: New replicast peer: fc00:0000:0000:0000:0000:0000:0000:0000 [ 617.049379][ T9998] tipc: Enabled bearer , priority 10 [ 617.472607][ T4302] airspy 2-1:0.0: usb_control_msg() failed -71 request 12 [ 617.518944][ T4302] airspy 2-1:0.0: Registered as swradio24 [ 617.544063][ T4302] airspy 2-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 617.608732][ T4302] usb 2-1: USB disconnect, device number 27 [ 617.795175][T10012] SET target dimension over the limit! [ 617.857221][T10013] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1603'. [ 617.882529][ T4277] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 618.062613][ T1108] tipc: Node number set to 1 [ 618.256670][ T1108] kernel read not supported for file /dsp1 (pid: 1108 comm: kworker/0:2) [ 618.472832][ T4277] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 618.485851][ T4277] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.503574][ T4277] usb 1-1: Product: syz [ 618.511311][ T4277] usb 1-1: Manufacturer: syz [ 618.537478][ T4277] usb 1-1: SerialNumber: syz [ 619.932595][ T4277] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 620.163062][ T4277] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42 [ 620.416408][ T4277] usb 1-1: USB disconnect, device number 26 [ 620.423357][ T4277] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM [ 620.703684][T10052] rdma_rxe: rxe_register_device failed with error -23 [ 620.714115][T10052] rdma_rxe: failed to add ipvlan0 [ 622.393319][T10063] SET target dimension over the limit! [ 622.405910][T10062] device bond0 entered promiscuous mode [ 622.431446][T10062] device bond_slave_0 entered promiscuous mode [ 622.939005][T10062] device bond_slave_1 entered promiscuous mode [ 623.008876][T10062] device batadv0 entered promiscuous mode [ 623.049204][T10062] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 623.075380][T10062] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 623.121768][T10062] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 623.164032][T10066] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1620'. [ 623.269278][T10078] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1624'. [ 623.343461][T10069] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 623.552659][ T5468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 624.212916][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.219252][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.883647][T10120] SET target dimension over the limit! [ 625.961836][T10122] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1638'. [ 626.037683][ T1108] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 626.161673][T10131] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1642'. [ 626.277119][T10137] sg_write: data in/out 28/14 bytes for SCSI command 0x0-- guessing data in; [ 626.277119][T10137] program syz.3.1644 not setting count and/or reply_len properly [ 626.502611][ T1108] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 626.533936][ T1108] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 626.544632][ T1108] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 626.553892][ T1108] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 627.242581][ T1108] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 627.334106][ T4302] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 627.362430][ T1108] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 627.370858][ T1108] usb 5-1: Product: syz [ 627.383893][ T1108] usb 5-1: Manufacturer: syz [ 627.481008][T10149] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1648'. [ 627.502321][T10149] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1648'. [ 627.802881][ T4302] usb 1-1: config 0 has an invalid interface number: 117 but max is 0 [ 627.911562][ T4302] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 628.194598][ T1108] usb 5-1: can't set config #1, error -71 [ 628.201535][ T1108] usb 5-1: USB disconnect, device number 29 [ 628.372475][ T4302] usb 1-1: config 0 has no interface number 0 [ 628.379096][ T4302] usb 1-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 628.399036][ T4302] usb 1-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 628.583406][ T4302] usb 1-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 628.597503][ T4302] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.608268][ T4302] usb 1-1: Product: syz [ 628.619012][ T4302] usb 1-1: Manufacturer: syz [ 628.626707][ T4302] usb 1-1: SerialNumber: syz [ 628.649476][ T4302] usb 1-1: config 0 descriptor?? [ 628.702455][ T1108] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 628.752562][ T4331] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 628.942704][ T1108] usb 5-1: Using ep0 maxpacket: 16 [ 629.332148][ T1108] usb 5-1: config 8 has an invalid interface number: 209 but max is 0 [ 629.450163][ T4302] usb 1-1: USB disconnect, device number 27 [ 629.503715][ T4331] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 629.643624][ T4331] usb 4-1: config 0 has no interface number 0 [ 629.649845][ T1108] usb 5-1: config 8 has no interface number 0 [ 629.656441][ T4331] usb 4-1: config 0 interface 41 has no altsetting 0 [ 629.663843][ T1108] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.0a [ 629.674150][ T1108] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.754166][T10160] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1653'. [ 629.821923][T10160] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1653'. [ 629.890228][T10172] Cannot find add_set index 0 as target [ 629.902801][ T4331] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 629.911889][ T4331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.920581][ T4331] usb 4-1: Product: syz [ 629.928625][ T4331] usb 4-1: Manufacturer: syz [ 629.937741][ T4331] usb 4-1: SerialNumber: syz [ 629.950951][ T4331] usb 4-1: config 0 descriptor?? [ 629.967301][T10173] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1656'. [ 631.652597][ T4331] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 631.723807][ T1108] usb 5-1: USB disconnect, device number 30 [ 631.874134][T10200] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 632.041659][T10199] lo speed is unknown, defaulting to 1000 [ 632.314440][T10207] fuse: Invalid rootmode [ 633.131670][ T4234] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 633.592529][ T4234] usb 1-1: Using ep0 maxpacket: 8 [ 633.683552][ T4331] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 633.694637][ T4331] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 633.704553][ T4331] CoreChips: probe of 4-1:0.41 failed with error -71 [ 633.720585][ T4331] usb 4-1: USB disconnect, device number 34 [ 634.025108][ T4302] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 634.033548][ T4302] Bluetooth: hci0: Injecting HCI hardware error event [ 634.041272][ T4198] Bluetooth: hci0: hardware error 0x00 [ 635.004226][ T4234] usb 1-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=3a.b2 [ 635.013450][ T4234] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.021486][ T4234] usb 1-1: Product: syz [ 635.042493][ T4234] usb 1-1: Manufacturer: syz [ 635.047297][ T4234] usb 1-1: SerialNumber: syz [ 635.077035][ T4234] usb 1-1: config 0 descriptor?? [ 635.235308][T10242] Cannot find add_set index 0 as target [ 635.334928][ T4234] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 636.479340][T10252] binder: 10246:10252 unknown command 1074553619 [ 636.485896][T10252] binder: 10246:10252 ioctl c0306201 200000000540 returned -22 [ 636.643001][ T4234] gspca_sunplus: reg_w_riv err -71 [ 636.664599][ T4234] sunplus: probe of 1-1:0.0 failed with error -71 [ 636.983188][ T4234] usb 1-1: USB disconnect, device number 28 [ 638.286725][ T4331] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 638.694444][ T4331] usb 6-1: Using ep0 maxpacket: 32 [ 638.873036][ T4331] usb 6-1: config 0 has an invalid interface number: 247 but max is 0 [ 638.891499][ T4331] usb 6-1: config 0 has no interface number 0 [ 639.043113][ T4331] usb 6-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 639.095807][ T4331] usb 6-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 639.131589][ T4331] usb 6-1: Product: syz [ 639.142604][ T4331] usb 6-1: Manufacturer: syz [ 639.150666][T10264] delete_channel: no stack [ 639.223702][ T4331] usb 6-1: config 0 descriptor?? [ 639.392748][ T4302] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 639.530410][ T4331] usb 6-1: USB disconnect, device number 11 [ 639.682543][ T4302] usb 5-1: Using ep0 maxpacket: 16 [ 640.107809][ T4302] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 640.118625][ T4302] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 640.129783][ T4302] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 640.140066][ T4302] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 640.150217][ T4302] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 640.652549][ T4302] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 640.661800][ T4302] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 640.710552][T10293] SET target dimension over the limit! [ 640.717024][ T4302] usb 5-1: Manufacturer: syz [ 640.750714][ T4302] usb 5-1: config 0 descriptor?? [ 640.774486][T10296] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1691'. [ 641.172524][ T4302] rc_core: IR keymap rc-hauppauge not found [ 641.178534][ T4302] Registered IR keymap rc-empty [ 641.193727][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.242792][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.273229][ T4302] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 641.320935][ T4302] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input16 [ 641.372859][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.422554][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.453085][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.522478][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.552730][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.592620][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.731952][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.773536][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.947287][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 641.983058][ T4302] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 642.360559][ T4302] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 642.369784][ T4302] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 643.597653][ T4302] usb 5-1: USB disconnect, device number 31 [ 644.834922][T10333] SET target dimension over the limit! [ 645.793856][T10344] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1705'. [ 646.226025][T10353] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1706'. [ 648.323529][T10352] bridge0: port 2(bridge_slave_1) entered disabled state [ 648.330841][T10352] bridge0: port 1(bridge_slave_0) entered disabled state [ 650.599516][T10352] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 650.853077][T10352] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 652.279132][T10352] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.293288][T10352] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.310572][T10352] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.319989][T10352] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.456281][T10397] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1719'. [ 653.193513][T10385] lo speed is unknown, defaulting to 1000 [ 653.375460][T10400] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1720'. [ 656.825806][ T4234] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 656.972764][ T4277] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 657.712557][ T4234] usb 1-1: Using ep0 maxpacket: 32 [ 657.832824][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 657.864585][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 657.909574][ T4234] usb 1-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 657.942630][ T4277] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x11, skipping [ 657.959338][ T4234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.970610][ T4234] usb 1-1: config 0 descriptor?? [ 658.182672][ T4277] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 658.191757][ T4277] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.235358][ T4277] usb 2-1: Product: syz [ 658.265794][ T4277] usb 2-1: Manufacturer: syz [ 658.274577][ T4277] usb 2-1: SerialNumber: syz [ 658.309139][ T4277] usb 2-1: config 0 descriptor?? [ 658.416903][ T4277] snd-usb-audio: probe of 2-1:0.0 failed with error -22 [ 659.789164][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 660.408558][T10468] netlink: 'syz.3.1739': attribute type 4 has an invalid length. [ 660.422614][ T4234] usbhid 1-1:0.0: can't add hid device: -71 [ 660.428635][ T4234] usbhid: probe of 1-1:0.0 failed with error -71 [ 660.480874][ T4234] usb 1-1: USB disconnect, device number 29 [ 660.619585][ T4302] usb 2-1: USB disconnect, device number 28 [ 661.033207][T10480] xt_socket: unknown flags 0x4c [ 661.222647][ T4234] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 661.602608][ T4234] usb 1-1: Using ep0 maxpacket: 16 [ 661.752711][T10470] netlink: 'syz.3.1739': attribute type 4 has an invalid length. [ 661.930348][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 661.942057][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 661.955644][ T4234] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 661.967787][ T4234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.052425][ T4234] usb 1-1: config 0 descriptor?? [ 662.756397][ T4234] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 662.772472][ T4234] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 662.789891][ T4234] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 662.800048][ T4234] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 662.820391][ T4234] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 662.830962][ T4234] mcp2221 0003:04D8:00DD.0008: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 662.977705][ T4234] usb 1-1: USB disconnect, device number 30 [ 664.952558][ T4277] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 665.205366][T10520] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1754'. [ 665.872535][ T4277] usb 4-1: Using ep0 maxpacket: 32 [ 666.322621][ T4277] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 666.335047][ T4277] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 666.345618][ T4277] usb 4-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 666.355554][ T4277] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.381572][ T4277] usb 4-1: config 0 descriptor?? [ 667.660760][T10540] xt_socket: unknown flags 0x4c [ 668.593592][ T4277] usbhid 4-1:0.0: can't add hid device: -71 [ 668.599575][ T4277] usbhid: probe of 4-1:0.0 failed with error -71 [ 668.622672][ T4277] usb 4-1: USB disconnect, device number 35 [ 669.061012][T10546] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1760'. [ 674.032835][ T4234] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 674.200140][T10581] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1768'. [ 674.392539][ T4234] usb 1-1: Using ep0 maxpacket: 32 [ 674.722822][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 674.879936][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 674.897631][ T4234] usb 1-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 674.973674][T10587] xt_socket: unknown flags 0x4c [ 675.652521][ T4234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.669882][ T4234] usb 1-1: config 0 descriptor?? [ 675.692982][ T4234] usb 1-1: can't set config #0, error -71 [ 675.700838][ T4234] usb 1-1: USB disconnect, device number 31 [ 680.169367][T10628] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 680.169367][T10628] program syz.3.1780 not setting count and/or reply_len properly [ 680.761526][T10610] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1780'. [ 682.272619][T10655] xt_socket: unknown flags 0x4c [ 683.757064][ T4277] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 684.092441][ T4277] usb 2-1: Using ep0 maxpacket: 32 [ 684.214305][ T4277] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 684.249985][ T4277] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 684.291323][ T4277] usb 2-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 684.332298][ T4277] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 684.380362][ T4277] usb 2-1: config 0 descriptor?? [ 685.690677][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.697108][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.092549][ T4277] usbhid 2-1:0.0: can't add hid device: -71 [ 686.098578][ T4277] usbhid: probe of 2-1:0.0 failed with error -71 [ 686.132596][ T4277] usb 2-1: USB disconnect, device number 29 [ 686.368724][T10686] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1798'. [ 691.492435][ T4234] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 691.822414][ T4234] usb 5-1: Using ep0 maxpacket: 32 [ 692.030225][T10737] xt_socket: unknown flags 0x4c [ 692.702632][ T4234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 692.747411][ T4234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 692.812860][ T4234] usb 5-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 692.886933][ T4234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.983829][ T4234] usb 5-1: config 0 descriptor?? [ 694.313089][ T4234] usbhid 5-1:0.0: can't add hid device: -71 [ 694.322968][ T4234] usbhid: probe of 5-1:0.0 failed with error -71 [ 694.450102][ T4234] usb 5-1: USB disconnect, device number 32 [ 700.572579][ T4234] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 700.862506][ T4234] usb 6-1: Using ep0 maxpacket: 32 [ 700.982553][ T4234] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 701.003039][ T4234] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 701.022482][ T4234] usb 6-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 701.062298][ T4234] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 701.093362][ T4234] usb 6-1: config 0 descriptor?? [ 701.519173][T10807] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1827'. [ 703.732715][ T4234] usbhid 6-1:0.0: can't add hid device: -71 [ 703.739855][ T4234] usbhid: probe of 6-1:0.0 failed with error -71 [ 703.780691][ T4234] usb 6-1: USB disconnect, device number 12 [ 710.667034][ T4277] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 711.592434][ T4277] usb 6-1: Using ep0 maxpacket: 32 [ 711.618098][T10868] lo speed is unknown, defaulting to 1000 [ 711.712639][ T4277] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 711.754441][ T4277] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 711.779286][ T4277] usb 6-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 711.829552][ T4277] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.847952][ T4277] usb 6-1: config 0 descriptor?? [ 711.981659][T10868] chnl_net:caif_netlink_parms(): no params data found [ 712.629727][ T7578] Bluetooth: hci5: command 0x0409 tx timeout [ 713.363020][T10868] bridge0: port 1(bridge_slave_0) entered blocking state [ 714.766159][ T7578] Bluetooth: hci5: command 0x041b tx timeout [ 714.773040][T10868] bridge0: port 1(bridge_slave_0) entered disabled state [ 714.781286][T10868] device bridge_slave_0 entered promiscuous mode [ 714.790646][T10868] bridge0: port 2(bridge_slave_1) entered blocking state [ 714.798107][T10868] bridge0: port 2(bridge_slave_1) entered disabled state [ 714.807055][T10868] device bridge_slave_1 entered promiscuous mode [ 714.888343][T10868] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 714.897817][ T4277] usbhid 6-1:0.0: can't add hid device: -71 [ 714.914965][ T4277] usbhid: probe of 6-1:0.0 failed with error -71 [ 714.925841][ T4277] usb 6-1: USB disconnect, device number 13 [ 714.940328][T10868] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 715.043823][T10895] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1851'. [ 715.186481][T10868] team0: Port device team_slave_0 added [ 715.229490][T10868] team0: Port device team_slave_1 added [ 715.265233][T10868] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 715.272225][T10868] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 715.337754][T10868] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 715.385956][T10868] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 715.412540][T10868] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 715.475809][T10868] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 716.158612][T10868] device hsr_slave_0 entered promiscuous mode [ 716.287706][T10868] device hsr_slave_1 entered promiscuous mode [ 716.333355][T10868] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 716.340941][T10868] Cannot create hsr debugfs directory [ 717.125833][ T4277] Bluetooth: hci5: command 0x040f tx timeout [ 717.527087][T10868] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 717.554877][T10868] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 717.594791][T10868] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 717.621650][T10868] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 717.887580][T10868] 8021q: adding VLAN 0 to HW filter on device bond0 [ 717.927117][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 717.953323][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 717.973122][T10868] 8021q: adding VLAN 0 to HW filter on device team0 [ 718.031359][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 718.051982][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 718.091319][T10331] bridge0: port 1(bridge_slave_0) entered blocking state [ 718.098617][T10331] bridge0: port 1(bridge_slave_0) entered forwarding state [ 718.136096][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 718.182925][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 718.201317][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 718.216061][T10331] bridge0: port 2(bridge_slave_1) entered blocking state [ 718.223480][T10331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 718.291426][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 718.313683][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 718.341319][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 719.162538][ T4277] Bluetooth: hci5: command 0x0419 tx timeout [ 719.170002][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 719.238831][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 719.259956][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 719.289585][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 719.419893][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 719.461213][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 719.616934][T10868] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 719.661346][T10868] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 719.676251][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 719.700953][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 719.922510][ T4242] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 720.162593][ T4242] usb 6-1: Using ep0 maxpacket: 32 [ 720.177464][T10941] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1861'. [ 720.302700][ T4242] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 720.403126][ T4242] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 720.422472][ T4242] usb 6-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 720.431602][ T4242] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 720.473440][ T4242] usb 6-1: config 0 descriptor?? [ 720.655758][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 720.670403][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 720.687926][T10868] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 722.894926][ T4419] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 722.972565][ T4242] usbhid 6-1:0.0: can't add hid device: -71 [ 722.978596][ T4242] usbhid: probe of 6-1:0.0 failed with error -71 [ 723.067174][ T4419] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 723.098485][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 723.103859][ T4242] usb 6-1: USB disconnect, device number 14 [ 723.326494][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 723.398933][T10868] device veth0_vlan entered promiscuous mode [ 723.438763][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 723.466340][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 723.564855][T10868] device veth1_vlan entered promiscuous mode [ 723.754924][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 723.772828][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 723.781382][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 723.799395][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 723.859349][T10868] device veth0_macvtap entered promiscuous mode [ 724.015123][T10868] device veth1_macvtap entered promiscuous mode [ 724.053489][ T5465] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 724.072074][ T5465] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 724.202072][T10868] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 724.224040][T10868] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.234645][T10868] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 724.247288][T10868] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.261168][T10868] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 724.274185][T10868] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.312142][T10868] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 724.862936][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 724.872790][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 724.883870][T10868] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 724.901100][T10868] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.911791][T10868] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 724.960889][T10868] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.973036][T10868] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 724.983831][T10868] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.997656][T10868] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 725.015906][ T5465] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 725.030936][ T5465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 725.053168][T10868] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.069197][T10868] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.079283][T10868] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.096452][T10868] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.193608][ T4419] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.201959][ T4419] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 725.257229][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 725.281532][T10331] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.319506][T10331] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 725.342755][ T5465] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 732.221514][T11026] delete_channel: no stack [ 733.209383][ T1108] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 734.122467][ T1108] usb 1-1: Using ep0 maxpacket: 32 [ 734.256681][ T1108] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.314178][ T1108] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 734.518975][ T1108] usb 1-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 734.597254][ T1108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.981640][ T1108] usb 1-1: config 0 descriptor?? [ 735.202560][ T1108] usb 1-1: can't set config #0, error -71 [ 735.250372][ T1108] usb 1-1: USB disconnect, device number 32 [ 738.999043][T11073] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1893'. [ 742.652486][ T4277] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 743.872437][ T4277] usb 6-1: Using ep0 maxpacket: 32 [ 743.972924][ T4277] usb 6-1: device descriptor read/all, error -71 [ 746.016310][T11133] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 746.407373][T11130] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1909'. [ 747.086983][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.723624][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.532513][ T1108] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 748.807174][ T1108] usb 6-1: Using ep0 maxpacket: 32 [ 748.933448][ T1108] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 748.966625][ T1108] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 748.989067][ T1108] usb 6-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 749.140076][ T1108] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 749.236521][ T1108] usb 6-1: config 0 descriptor?? [ 752.149787][T11176] xt_socket: unknown flags 0x4c [ 752.952583][ T1108] usbhid 6-1:0.0: can't add hid device: -71 [ 752.958615][ T1108] usbhid: probe of 6-1:0.0 failed with error -71 [ 753.094999][ T1108] usb 6-1: USB disconnect, device number 17 [ 759.177122][T11217] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1930'. [ 759.196117][T11217] 0ªî{X¹¦: renamed from gretap0 [ 759.228168][T11217] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 759.329315][T11217] syz.0.1930 (11217) used greatest stack depth: 20608 bytes left [ 759.413149][ T4277] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 759.726444][T11232] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1936'. [ 759.782476][ T4264] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 759.859954][T11235] xt_socket: unknown flags 0x4c [ 760.103531][ T4264] usb 1-1: Using ep0 maxpacket: 32 [ 760.243400][ T4264] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 760.275534][ T4264] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 760.332155][ T4264] usb 1-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 760.392531][ T4264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.413791][ T4264] usb 1-1: config 0 descriptor?? [ 761.553739][ T4277] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 762.722515][ T4277] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 762.752502][ T4277] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 762.782247][ T4277] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.838791][ T4277] usb 6-1: can't set config #27, error -71 [ 762.882509][ T4264] usbhid 1-1:0.0: can't add hid device: -71 [ 762.888541][ T4264] usbhid: probe of 1-1:0.0 failed with error -71 [ 762.911806][ T4277] usb 6-1: USB disconnect, device number 18 [ 762.926745][ T5465] tipc: Left network mode [ 762.931245][ T4264] usb 1-1: USB disconnect, device number 33 [ 765.360651][T11283] 9pnet_virtio: no channels available for device syz [ 768.825389][T11311] autofs4:pid:11311:autofs_fill_super: called with bogus options [ 768.862379][ T4302] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 769.212426][ T4302] usb 7-1: Using ep0 maxpacket: 32 [ 769.915852][T11303] lo speed is unknown, defaulting to 1000 [ 770.222630][ T4302] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 770.312953][ T4302] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 770.456477][ T4302] usb 7-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 770.603672][ T4302] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.783418][ T4369] Bluetooth: hci1: command 0x0409 tx timeout [ 770.803744][ T4302] usb 7-1: config 0 descriptor?? [ 771.052258][ T5465] device hsr_slave_0 left promiscuous mode [ 771.073516][ T5465] device hsr_slave_1 left promiscuous mode [ 771.113133][ T5465] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 771.138575][ T5465] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 771.147481][ T5465] device bridge_slave_1 left promiscuous mode [ 771.156675][ T5465] bridge0: port 2(bridge_slave_1) entered disabled state [ 771.245382][ T5465] device bridge_slave_0 left promiscuous mode [ 772.475621][ T5465] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.642177][ T4302] usbhid 7-1:0.0: can't add hid device: -71 [ 772.648762][ T4302] usbhid: probe of 7-1:0.0 failed with error -71 [ 772.664281][ T4302] usb 7-1: USB disconnect, device number 2 [ 773.082846][ T1336] Bluetooth: hci1: command 0x041b tx timeout [ 775.162409][ T4277] Bluetooth: hci1: command 0x040f tx timeout [ 777.724475][ T1336] Bluetooth: hci1: command 0x0419 tx timeout [ 777.968738][ T5465] team0 (unregistering): Port device team_slave_1 removed [ 777.992851][ T5465] team0 (unregistering): Port device team_slave_0 removed [ 778.752794][ T5465] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 778.853638][ T5465] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 779.101398][ T1336] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 779.910079][ T5465] bond0 (unregistering): Released all slaves [ 780.102398][ T1336] usb 1-1: Using ep0 maxpacket: 32 [ 780.222716][ T1336] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 780.388500][ T1336] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 780.399669][ T1336] usb 1-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 780.409317][ T1336] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 780.428596][ T1336] usb 1-1: config 0 descriptor?? [ 780.617175][T11303] chnl_net:caif_netlink_parms(): no params data found [ 783.534274][T11423] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1973'. [ 784.024365][T11303] bridge0: port 1(bridge_slave_0) entered blocking state [ 784.042507][ T1336] usbhid 1-1:0.0: can't add hid device: -71 [ 784.048628][ T1336] usbhid: probe of 1-1:0.0 failed with error -71 [ 784.064767][T11303] bridge0: port 1(bridge_slave_0) entered disabled state [ 784.093948][T11303] device bridge_slave_0 entered promiscuous mode [ 784.112480][ T1336] usb 1-1: USB disconnect, device number 34 [ 784.544544][T11303] bridge0: port 2(bridge_slave_1) entered blocking state [ 784.581680][T11303] bridge0: port 2(bridge_slave_1) entered disabled state [ 784.604643][T11303] device bridge_slave_1 entered promiscuous mode [ 784.683113][T11303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 784.877492][T11303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 784.978175][T11445] xt_socket: unknown flags 0x4c [ 785.642190][ T4277] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 785.839409][T11303] team0: Port device team_slave_0 added [ 786.624538][T11303] team0: Port device team_slave_1 added [ 786.799277][T11303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 786.942604][ T4277] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 786.952715][T11303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 786.984514][ T4277] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 787.162534][T11303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 787.228488][T11303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 788.032982][ T4277] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 788.055571][ T4277] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 788.065150][ T4277] usb 6-1: Product: syz [ 788.069367][ T4277] usb 6-1: Manufacturer: syz [ 788.074417][ T4277] usb 6-1: SerialNumber: syz [ 788.075104][T11303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 788.081254][ T4277] usb 6-1: config 0 descriptor?? [ 788.132483][ T4277] usb 6-1: can't set config #0, error -71 [ 788.169535][ T4277] usb 6-1: USB disconnect, device number 19 [ 789.233959][T11303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 789.423821][T11479] 9pnet: Insufficient options for proto=fd [ 792.130693][T11303] device hsr_slave_0 entered promiscuous mode [ 792.364678][T11303] device hsr_slave_1 entered promiscuous mode [ 792.374917][T11303] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 792.396349][T11303] Cannot create hsr debugfs directory [ 792.602529][ T4277] Bluetooth: hci2: command 0x0409 tx timeout [ 793.052268][T11484] lo speed is unknown, defaulting to 1000 [ 793.112039][T11501] device bond0 entered promiscuous mode [ 793.141894][T11501] device bond_slave_0 entered promiscuous mode [ 793.195139][T11501] device bond_slave_1 entered promiscuous mode [ 793.218281][T11501] device batadv0 entered promiscuous mode [ 793.242149][T11501] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 793.283150][T11501] Cannot create hsr debugfs directory [ 793.289576][T11501] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 793.365884][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 793.579415][T11303] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 793.664120][T11303] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 795.309870][ T4277] Bluetooth: hci2: command 0x041b tx timeout [ 795.342218][T11303] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 796.539356][T11303] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 797.485008][T11250] Bluetooth: hci2: command 0x040f tx timeout [ 797.795853][T11484] chnl_net:caif_netlink_parms(): no params data found [ 798.232558][ T4277] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 798.935005][T11484] bridge0: port 1(bridge_slave_0) entered blocking state [ 798.942109][T11484] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.967670][T11484] device bridge_slave_0 entered promiscuous mode [ 798.998331][T11484] bridge0: port 2(bridge_slave_1) entered blocking state [ 799.022568][ T4277] usb 6-1: config 0 has an invalid interface number: 122 but max is 0 [ 799.031079][T11484] bridge0: port 2(bridge_slave_1) entered disabled state [ 799.041089][ T4277] usb 6-1: config 0 has no interface number 0 [ 799.177769][T11484] device bridge_slave_1 entered promiscuous mode [ 799.184490][ T4277] usb 6-1: config 0 interface 122 has no altsetting 0 [ 800.034150][ T1336] Bluetooth: hci2: command 0x0419 tx timeout [ 800.112702][ T4277] usb 6-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 800.121887][ T4277] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.154924][T11303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 800.165936][ T4277] usb 6-1: Product: syz [ 800.168831][T11484] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 800.170189][ T4277] usb 6-1: Manufacturer: syz [ 800.198444][T11484] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 800.217857][ T4277] usb 6-1: SerialNumber: syz [ 800.235723][ T4277] usb 6-1: config 0 descriptor?? [ 800.253613][ T5468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 800.277351][ T5468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 800.363407][T11484] team0: Port device team_slave_0 added [ 800.376521][T11303] 8021q: adding VLAN 0 to HW filter on device team0 [ 800.399780][T11484] team0: Port device team_slave_1 added [ 800.431943][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 800.463055][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 800.491208][T11243] bridge0: port 1(bridge_slave_0) entered blocking state [ 800.498348][T11243] bridge0: port 1(bridge_slave_0) entered forwarding state [ 800.577573][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 800.613144][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 800.639466][T11243] bridge0: port 2(bridge_slave_1) entered blocking state [ 800.646609][T11243] bridge0: port 2(bridge_slave_1) entered forwarding state [ 800.690030][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 800.711280][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 800.766647][T11484] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 800.780864][ T1108] usb 6-1: USB disconnect, device number 20 [ 800.795680][ T1108] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 800.820323][T11484] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 800.879668][T11484] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 800.903729][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 800.914421][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 800.935861][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 800.960057][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 800.981757][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 801.003159][T11484] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 801.010754][T11484] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 801.043899][T11484] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 801.062611][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 801.071401][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 801.080568][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 801.115221][ T4419] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 801.124699][ T4419] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 801.135590][T11303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 801.157305][T11484] device hsr_slave_0 entered promiscuous mode [ 801.165963][T11484] device hsr_slave_1 entered promiscuous mode [ 801.173610][T11484] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 801.181250][T11484] Cannot create hsr debugfs directory [ 801.229880][ T5465] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.341054][ T5465] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.635518][ T5465] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.758387][ T5465] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.838513][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 802.850325][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 802.899978][T11303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 803.220885][ T5465] tipc: Disabling bearer [ 803.405453][ T5465] tipc: Left network mode [ 804.644553][T11484] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 805.420202][T11484] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 805.456610][T11484] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 805.467375][T11484] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 806.660070][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 806.713067][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 806.977464][T11303] device veth0_vlan entered promiscuous mode [ 807.014849][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 807.047811][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 807.115806][T11484] 8021q: adding VLAN 0 to HW filter on device bond0 [ 807.174116][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 807.205347][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 807.291510][T11484] 8021q: adding VLAN 0 to HW filter on device team0 [ 807.410753][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 807.431358][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 807.492792][T11303] device veth1_vlan entered promiscuous mode [ 807.603316][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 807.725677][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 807.793278][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 807.853306][ T8812] bridge0: port 1(bridge_slave_0) entered blocking state [ 807.860438][ T8812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 807.898256][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 807.946902][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 807.994532][ T8812] bridge0: port 2(bridge_slave_1) entered blocking state [ 808.001698][ T8812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 808.076739][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 808.253523][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 808.306434][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 808.320019][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 808.942479][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.948857][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.052586][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 809.101850][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 809.144722][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 809.164403][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 809.184907][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 809.220278][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 809.311460][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 809.331742][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 809.361915][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 809.388899][T11303] device veth0_macvtap entered promiscuous mode [ 809.422216][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 809.431597][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 809.441433][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 809.453734][T11484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 809.478645][T11303] device veth1_macvtap entered promiscuous mode [ 809.560141][ T5465] device hsr_slave_0 left promiscuous mode [ 809.578924][ T5465] device hsr_slave_1 left promiscuous mode [ 809.587743][ T5465] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 809.597211][ T5465] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 809.608562][ T5465] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 809.627336][ T4264] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 809.628207][ T5465] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 809.643859][ T5465] device bridge_slave_1 left promiscuous mode [ 809.650206][ T5465] bridge0: port 2(bridge_slave_1) entered disabled state [ 809.662710][ T5465] device bridge_slave_0 left promiscuous mode [ 809.669255][ T5465] bridge0: port 1(bridge_slave_0) entered disabled state [ 809.694668][ T5465] device veth1_macvtap left promiscuous mode [ 809.708792][ T5465] device veth0_macvtap left promiscuous mode [ 809.715435][ T5465] device veth1_vlan left promiscuous mode [ 809.721789][ T5465] device veth0_vlan left promiscuous mode [ 810.532752][ T4264] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 810.673885][ T4264] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 811.382623][ T4264] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 811.391723][ T4264] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.464690][ T4264] usb 7-1: Product: syz [ 811.468914][ T4264] usb 7-1: Manufacturer: syz [ 811.487084][ T4264] usb 7-1: SerialNumber: syz [ 811.511989][ T4264] usb 7-1: config 0 descriptor?? [ 811.525721][ T5465] bond1 (unregistering): Released all slaves [ 811.700922][ T5465] team0 (unregistering): Port device team_slave_1 removed [ 811.767809][ T5465] team0 (unregistering): Port device team_slave_0 removed [ 811.782338][ T1108] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 811.799834][ T5465] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 811.835613][ T4264] usb 7-1: USB disconnect, device number 3 [ 811.848151][ T5465] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 811.993570][ T5465] bond0 (unregistering): Released all slaves [ 812.052467][ T1108] usb 1-1: Using ep0 maxpacket: 8 [ 812.112141][T11303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 812.129961][T11303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.140519][T11303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 812.158360][T11303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.169541][T11303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 812.185731][T11303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.198442][ T1108] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 812.214181][ T1108] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 812.216284][T11303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 812.233315][ T1108] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 812.235922][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 812.254483][ T5466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 812.263741][ T1108] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 812.284504][T11303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 812.328081][ T1108] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 812.345554][ T1108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.352825][T11303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.525549][T11303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 812.552580][T11303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.562789][T11303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 812.573350][T11303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.590949][T11303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 812.646461][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 812.673643][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 812.700237][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 812.722990][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 812.742695][ T1108] usb 1-1: GET_CAPABILITIES returned 0 [ 812.751165][ T1108] usbtmc 1-1:16.0: can't read capabilities [ 812.765205][T11484] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 812.779973][T11303] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.856311][T11303] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.891215][T11303] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.912826][T11303] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 813.001306][ T1108] usb 1-1: USB disconnect, device number 35 [ 813.266975][ T4419] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 813.282702][ T4419] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 813.415984][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 813.471937][T11243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 813.582436][T11243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 814.579723][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 814.588106][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 814.685136][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 814.744445][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 814.776455][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 814.869596][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 814.958658][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 814.970063][T11484] device veth0_vlan entered promiscuous mode [ 815.050334][T11484] device veth1_vlan entered promiscuous mode [ 815.582504][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 815.596454][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 815.653580][T11484] device veth0_macvtap entered promiscuous mode [ 815.686404][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 815.714646][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 815.760481][T11762] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1948'. [ 815.926452][T11484] device veth1_macvtap entered promiscuous mode [ 816.042919][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 816.114494][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 816.693108][T11773] tipc: Started in network mode [ 816.698181][T11773] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 816.707450][T11773] tipc: New replicast peer: fc00:0000:0000:0000:0000:0000:0000:0000 [ 816.715657][T11773] tipc: Enabled bearer , priority 10 [ 816.754662][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 816.909375][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.997625][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 817.125334][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.170548][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 817.181729][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.205640][T11777] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 817.235064][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 817.267627][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.284720][T11484] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 817.314681][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 817.337469][T11243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 817.358222][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.389764][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.416449][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.440937][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.460933][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.491430][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.520519][T11484] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.559269][T11484] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.577333][T11484] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 817.608955][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 817.619053][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 817.652643][T11484] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.672929][T11484] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.692507][T11484] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.707908][T11484] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.732851][ T1108] tipc: Node number set to 1 [ 818.031618][T11785] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2043'. [ 819.425792][T11243] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.475176][T11243] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.513913][ T4407] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.522202][ T4407] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.530305][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 820.152449][T11747] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 820.676331][ T1108] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 821.072486][ T1108] usb 7-1: Using ep0 maxpacket: 8 [ 821.722798][ T4234] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 821.980845][ T1108] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 822.011889][ T1108] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 822.045138][ T1108] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 822.090664][ T1108] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 822.135191][ T1108] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 822.191991][ T1108] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 822.452513][ T4234] usb 9-1: Using ep0 maxpacket: 32 [ 823.020328][ T1108] usb 7-1: GET_CAPABILITIES returned 0 [ 823.030334][ T1108] usbtmc 7-1:16.0: can't read capabilities [ 823.152490][ T4234] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 823.197035][ T4234] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 823.250445][ T4234] usb 9-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 823.270241][ T1108] usb 7-1: USB disconnect, device number 4 [ 823.284900][ T4234] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 823.298391][ T4234] usb 9-1: config 0 descriptor?? [ 823.882836][ T1108] Bluetooth: hci6: command 0x1003 tx timeout [ 823.891673][ T4202] Bluetooth: hci6: sending frame failed (-49) [ 824.652644][ T4234] usbhid 9-1:0.0: can't add hid device: -71 [ 824.658775][ T4234] usbhid: probe of 9-1:0.0 failed with error -71 [ 824.863371][ T4234] usb 9-1: USB disconnect, device number 2 [ 825.738972][T11838] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 825.962732][ T1108] Bluetooth: hci6: command 0x1001 tx timeout [ 825.969259][ T4202] Bluetooth: hci6: sending frame failed (-49) [ 826.746942][T11863] tipc: Started in network mode [ 826.752370][T11863] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 826.761908][T11863] tipc: Enabling of bearer rejected, failed to enable media [ 828.843074][ T1108] Bluetooth: hci6: command 0x1009 tx timeout [ 829.622409][ T4264] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 829.872630][ T1108] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 829.919789][ T4234] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 830.002706][ T4242] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 830.042721][ T4264] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 830.051356][ T4264] usb 1-1: config 0 has no interface number 0 [ 830.117414][ T1108] usb 7-1: Using ep0 maxpacket: 32 [ 830.222860][ T4264] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 830.242819][ T1108] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 830.259098][ T4264] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.267771][ T4242] usb 6-1: Using ep0 maxpacket: 8 [ 830.277984][ T4264] usb 1-1: Product: syz [ 830.278053][ T1108] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 830.282218][ T4264] usb 1-1: Manufacturer: syz [ 830.298594][ T4264] usb 1-1: SerialNumber: syz [ 830.312821][ T4234] usb 9-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 830.322010][ T4234] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.322421][ T1108] usb 7-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 830.343314][ T4264] usb 1-1: config 0 descriptor?? [ 830.378893][ T4234] usb 9-1: config 0 descriptor?? [ 830.389965][ T1108] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.402988][ T4242] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 830.411247][ T1108] usb 7-1: config 0 descriptor?? [ 830.424686][ T4234] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 830.432235][ T4242] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 830.452148][ T4242] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 830.473088][ T4242] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 830.495228][ T4242] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 830.509324][ T4242] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.788128][ T4242] usb 6-1: GET_CAPABILITIES returned 0 [ 830.796331][ T4242] usbtmc 6-1:16.0: can't read capabilities [ 830.812571][ T4264] usb 1-1: atusb_control_msg: req 0x21 val 0x0 idx 0x1e, error -32 [ 830.843781][ T4264] usb 1-1: Firmware version (0.0) predates our first public release. [ 830.851915][ T4264] usb 1-1: Please update to version 0.2 or newer [ 830.912557][ T4264] usb 1-1: atusb_probe: initialization failed, error = -32 [ 830.924683][ T4264] atusb: probe of 1-1:0.128 failed with error -32 [ 831.015190][ T4242] usb 6-1: USB disconnect, device number 21 [ 831.085008][ T1108] usbhid 7-1:0.0: can't add hid device: -71 [ 831.101785][ T1108] usbhid: probe of 7-1:0.0 failed with error -71 [ 831.129338][ T1108] usb 7-1: USB disconnect, device number 5 [ 831.331917][ T4234] usb 9-1: USB disconnect, device number 3 [ 831.358256][T11873] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 831.433090][T11873] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 831.494719][T11873] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 831.564766][T11873] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 831.766428][T11936] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 831.817871][T11941] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 833.863466][T10931] usb 1-1: USB disconnect, device number 36 [ 833.939565][T11873] tipc: Left network mode [ 834.372376][ T1336] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 834.615188][ T1336] usb 7-1: Using ep0 maxpacket: 32 [ 835.023366][ T1336] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 835.052638][T11992] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2069'. [ 835.071986][ T1336] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 835.101416][ T1336] usb 7-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 835.128094][ T1336] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 835.176560][ T1336] usb 7-1: config 0 descriptor?? [ 835.472550][ T4242] usb 9-1: new full-speed USB device number 4 using dummy_hcd [ 835.773500][T11873] device bond0 left promiscuous mode [ 835.779054][T11873] device bond_slave_0 left promiscuous mode [ 835.793600][T11873] device bond_slave_1 left promiscuous mode [ 835.814458][T11873] device batadv0 left promiscuous mode [ 835.842587][ T1336] usbhid 7-1:0.0: can't add hid device: -71 [ 835.848601][ T1336] usbhid: probe of 7-1:0.0 failed with error -71 [ 835.852674][ T4242] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 835.896672][ T4242] usb 9-1: config 0 has no interface number 0 [ 835.898358][ T1336] usb 7-1: USB disconnect, device number 6 [ 835.966512][T11873] device hsr_slave_0 left promiscuous mode [ 835.991939][ T4242] usb 9-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8e.1e [ 836.001471][T11873] device hsr_slave_1 left promiscuous mode [ 836.172557][ T4242] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.931517][ T4369] Bluetooth: hci5: command 0x0406 tx timeout [ 836.973814][T11873] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 836.995500][ T4242] usb 9-1: config 0 descriptor?? [ 837.012620][T11873] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 837.065288][ T4242] usb 9-1: selecting invalid altsetting 1 [ 837.071782][T11873] batman_adv: batadv0: Removing interface: macvtap1 [ 837.086134][ T4242] dvb_ttusb_budget: ttusb_init_controller: error [ 837.180563][ T4242] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 837.585040][T11873] device bridge_slave_1 left promiscuous mode [ 838.379725][T11873] bridge0: port 2(bridge_slave_1) entered disabled state [ 838.409508][ T4242] DVB: Unable to find symbol cx22700_attach() [ 839.227326][T11873] device bridge_slave_0 left promiscuous mode [ 839.235142][T11873] bridge0: port 1(bridge_slave_0) entered disabled state [ 839.550395][ T4242] DVB: Unable to find symbol tda10046_attach() [ 839.564633][ T4242] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 839.812685][ T1108] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 839.899645][T11873] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 839.938145][T11873] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 840.050496][T11873] bond0 (unregistering): Released all slaves [ 840.128621][T12031] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2084'. [ 840.182645][T12038] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2077'. [ 840.193085][ T4369] usb 9-1: USB disconnect, device number 4 [ 840.282740][ T1108] usb 7-1: config 0 has an invalid interface number: 128 but max is 0 [ 840.298436][ T1108] usb 7-1: config 0 has no interface number 0 [ 841.432856][ T1108] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 841.562401][ T1108] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.750191][ T1108] usb 7-1: Product: syz [ 841.777194][ T1108] usb 7-1: Manufacturer: syz [ 841.794895][ T1108] usb 7-1: SerialNumber: syz [ 841.811095][ T1108] usb 7-1: config 0 descriptor?? [ 842.508668][T12063] 9pnet: Insufficient options for proto=fd [ 842.639530][ T1108] usb 7-1: atusb_control_msg: req 0x21 val 0x0 idx 0x1e, error -32 [ 842.648373][ T1108] usb 7-1: Firmware version (0.0) predates our first public release. [ 842.667320][ T1108] usb 7-1: Please update to version 0.2 or newer [ 843.253028][ T1108] usb 7-1: atusb_probe: initialization failed, error = -32 [ 843.817730][ T1108] atusb: probe of 7-1:0.128 failed with error -32 [ 844.507396][ T1108] usb 7-1: USB disconnect, device number 7 [ 847.855645][T12102] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2091'. [ 847.932558][ T4242] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 848.752640][ T4242] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 848.848794][ T4242] usb 8-1: config 0 has no interface number 0 [ 848.883371][ T4242] usb 8-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8e.1e [ 849.672379][ T4242] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.682543][ T4369] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 849.925363][ T4242] usb 8-1: config 0 descriptor?? [ 849.968472][ T4242] usb 8-1: selecting invalid altsetting 1 [ 850.323553][ T4242] dvb_ttusb_budget: ttusb_init_controller: error [ 850.337794][ T4242] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 851.074520][ T4242] DVB: Unable to find symbol cx22700_attach() [ 851.132466][ T4369] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 851.264215][ T4369] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 851.378113][ T4369] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 851.395602][ T4369] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 851.421227][ T4369] usb 9-1: SerialNumber: syz [ 851.752606][ T4264] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 852.002533][ T4369] usb 9-1: can't set config #1, error -71 [ 852.182129][ T4242] DVB: Unable to find symbol tda10046_attach() [ 852.216252][ T4369] usb 9-1: USB disconnect, device number 5 [ 852.222420][ T4242] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 852.262611][ T4242] usb 8-1: USB disconnect, device number 2 [ 852.279796][T12148] sg_write: data in/out 28/14 bytes for SCSI command 0x0-- guessing data in; [ 852.279796][T12148] program syz.8.2102 not setting count and/or reply_len properly [ 852.292424][ T4264] usb 7-1: Using ep0 maxpacket: 8 [ 852.434459][T12147] 9pnet: Insufficient options for proto=fd [ 852.952710][ T4264] usb 7-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 852.982495][ T4264] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.047599][ T4264] usb 7-1: Product: syz [ 853.071004][ T4264] usb 7-1: Manufacturer: syz [ 853.641796][ T4264] usb 7-1: SerialNumber: syz [ 853.709240][ T4264] usb 7-1: config 0 descriptor?? [ 853.764440][ T4264] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 856.541226][ T4264] gspca_sonixj: i2c_w8 err -71 [ 856.602544][ T4264] sonixj: probe of 7-1:0.0 failed with error -71 [ 856.645875][ T4264] usb 7-1: USB disconnect, device number 8 [ 857.332382][ T1108] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 857.772515][ T1108] usb 8-1: config 0 has an invalid interface number: 117 but max is 0 [ 858.498585][ T1108] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 858.509571][ T1108] usb 8-1: config 0 has no interface number 0 [ 858.515748][ T1108] usb 8-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 858.525928][ T1108] usb 8-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 858.729149][ T1108] usb 8-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 858.751141][ T1108] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 858.900880][ T1108] usb 8-1: Product: syz [ 858.914013][ T1108] usb 8-1: Manufacturer: syz [ 858.928071][ T1108] usb 8-1: SerialNumber: syz [ 859.758719][ T1108] usb 8-1: config 0 descriptor?? [ 859.859124][ T1108] usb 8-1: can't set config #0, error -71 [ 859.909911][ T1108] usb 8-1: USB disconnect, device number 3 [ 860.034235][T12226] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2119'. [ 860.182510][ T4264] usb 9-1: new full-speed USB device number 6 using dummy_hcd [ 860.562660][ T4264] usb 9-1: config 0 has an invalid interface number: 168 but max is 0 [ 860.586604][ T4264] usb 9-1: config 0 has no interface number 0 [ 860.620678][ T4264] usb 9-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06 [ 860.708720][ T4264] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.766914][ T4264] usb 9-1: config 0 descriptor?? [ 861.500723][ T4202] ================================================================== [ 861.509183][ T4202] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x12c0/0x3b80 [ 861.517206][ T4202] Read of size 1 at addr ffff888075ee8c03 by task kworker/u5:7/4202 [ 861.525221][ T4202] [ 861.527563][ T4202] CPU: 0 PID: 4202 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 861.535131][ T4202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 861.545205][ T4202] Workqueue: hci2 hci_rx_work [ 861.549962][ T4202] Call Trace: [ 861.553345][ T4202] [ 861.556297][ T4202] dump_stack_lvl+0x168/0x230 [ 861.561065][ T4202] ? show_regs_print_info+0x20/0x20 [ 861.566313][ T4202] ? load_image+0x3b0/0x3b0 [ 861.570852][ T4202] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 861.576339][ T4202] print_address_description+0x60/0x2d0 [ 861.581943][ T4202] ? hci_le_meta_evt+0x12c0/0x3b80 [ 861.587074][ T4202] kasan_report+0xdf/0x130 [ 861.591527][ T4202] ? hci_le_meta_evt+0x12c0/0x3b80 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 861.596768][ T4202] hci_le_meta_evt+0x12c0/0x3b80 [ 861.601743][ T4202] ? release_firmware_map_entry+0x190/0x190 [ 861.607739][ T4202] ? hci_remote_host_features_evt+0x280/0x280 [ 861.613850][ T4202] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 861.619524][ T4202] ? mutex_unlock+0x10/0x10 [ 861.624072][ T4202] ? preempt_schedule+0xa7/0xb0 [ 861.629301][ T4202] ? schedule_preempt_disabled+0x20/0x20 [ 861.634949][ T4202] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 861.640596][ T4202] hci_event_packet+0xe05/0x12f0 [ 861.645561][ T4202] ? rcu_lock_release+0x20/0x20 [ 861.650441][ T4202] ? hci_send_to_monitor+0x9c/0x4a0 [ 861.652495][ T4264] usb 9-1: string descriptor 0 read error: -71 [ 861.655683][ T4202] hci_rx_work+0x255/0xa10 [ 861.666277][ T4202] process_one_work+0x863/0x1000 [ 861.671254][ T4202] ? worker_detach_from_pool+0x240/0x240 [ 861.676899][ T4202] ? lockdep_hardirqs_off+0x70/0x100 [ 861.682268][ T4202] ? _raw_spin_lock_irq+0xab/0xe0 [ 861.687363][ T4202] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 861.692835][ T4202] ? wq_worker_running+0x97/0x170 [ 861.697898][ T4202] worker_thread+0xaa8/0x12a0 [ 861.702584][ T4202] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 861.708694][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 861.714052][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 861.719291][ T4202] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 861.725252][ T4202] kthread+0x436/0x520 [ 861.729332][ T4202] ? rcu_lock_release+0x20/0x20 [ 861.734191][ T4202] ? kthread_blkcg+0xd0/0xd0 [ 861.738885][ T4202] ret_from_fork+0x1f/0x30 [ 861.743331][ T4202] [ 861.746348][ T4202] [ 861.748685][ T4202] Allocated by task 12223: [ 861.753109][ T4202] __kasan_kmalloc+0xb5/0xf0 [ 861.757714][ T4202] __alloc_skb+0x22c/0x750 [ 861.762148][ T4202] vhci_write+0xbc/0x450 [ 861.766427][ T4202] vfs_write+0x712/0xd00 [ 861.770670][ T4202] ksys_write+0x14d/0x250 [ 861.775000][ T4202] do_syscall_64+0x4c/0xa0 [ 861.779430][ T4202] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 861.785346][ T4202] [ 861.787691][ T4202] Last potentially related work creation: [ 861.793515][ T4202] kasan_save_stack+0x35/0x60 [ 861.798197][ T4202] kasan_record_aux_stack+0xb8/0x100 [ 861.803486][ T4202] kvfree_call_rcu+0x10a/0x7c0 [ 861.808253][ T4202] drop_sysctl_table+0x2fa/0x430 [ 861.813189][ T4202] unregister_sysctl_table+0x87/0x130 [ 861.818576][ T4202] neigh_sysctl_unregister+0x74/0x90 [ 861.823859][ T4202] addrconf_notify+0x7c3/0xf00 [ 861.828629][ T4202] raw_notifier_call_chain+0xcb/0x160 [ 861.834001][ T4202] dev_change_name+0x671/0xbd0 [ 861.838761][ T4202] do_setlink+0x99d/0x3980 [ 861.843172][ T4202] rtnl_newlink+0x1419/0x17d0 [ 861.847844][ T4202] rtnetlink_rcv_msg+0x7ff/0xe90 [ 861.852783][ T4202] netlink_rcv_skb+0x1e0/0x430 [ 861.857545][ T4202] netlink_unicast+0x774/0x920 [ 861.862308][ T4202] netlink_sendmsg+0x8ab/0xbc0 [ 861.867087][ T4202] __sys_sendto+0x423/0x580 [ 861.871598][ T4202] __x64_sys_sendto+0xda/0xf0 [ 861.876399][ T4202] do_syscall_64+0x4c/0xa0 [ 861.880979][ T4202] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 861.886985][ T4202] [ 861.889311][ T4202] The buggy address belongs to the object at ffff888075ee8800 [ 861.889311][ T4202] which belongs to the cache kmalloc-1k of size 1024 [ 861.903448][ T4202] The buggy address is located 3 bytes to the right of [ 861.903448][ T4202] 1024-byte region [ffff888075ee8800, ffff888075ee8c00) [ 861.917249][ T4202] The buggy address belongs to the page: [ 861.922888][ T4202] page:ffffea0001d7ba00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x75ee8 [ 861.933046][ T4202] head:ffffea0001d7ba00 order:3 compound_mapcount:0 compound_pincount:0 [ 861.941368][ T4202] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 861.949351][ T4202] raw: 00fff00000010200 0000000000000000 0000000300000001 ffff888016841dc0 [ 861.958210][ T4202] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 861.966885][ T4202] page dumped because: kasan: bad access detected [ 861.973305][ T4202] page_owner tracks the page as allocated [ 861.979168][ T4202] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4187, ts 69589359144, free_ts 69574087366 [ 861.998479][ T4202] get_page_from_freelist+0x1b77/0x1c60 [ 862.004059][ T4202] __alloc_pages+0x1e1/0x470 [ 862.008658][ T4202] new_slab+0xc0/0x4b0 [ 862.012720][ T4202] ___slab_alloc+0x81e/0xdf0 [ 862.017396][ T4202] __kmalloc+0x1cd/0x330 [ 862.021634][ T4202] __register_sysctl_table+0xe0/0x1230 [ 862.027087][ T4202] neigh_sysctl_register+0x9a1/0xa80 [ 862.032368][ T4202] devinet_sysctl_register+0xa8/0x1f0 [ 862.037741][ T4202] inetdev_init+0x28c/0x4d0 [ 862.042277][ T4202] inetdev_event+0x280/0x1360 [ 862.046964][ T4202] raw_notifier_call_chain+0xcb/0x160 [ 862.052339][ T4202] register_netdevice+0x1275/0x16b0 [ 862.057546][ T4202] nsim_create+0x32d/0x3e0 [ 862.062044][ T4202] __nsim_dev_port_add+0x5c7/0x980 [ 862.067156][ T4202] nsim_dev_port_add_all+0x37/0x100 [ 862.072363][ T4202] nsim_dev_probe+0x754/0x9c0 [ 862.077040][ T4202] page last free stack trace: [ 862.081847][ T4202] free_unref_page_prepare+0x637/0x6c0 [ 862.087327][ T4202] free_unref_page+0x94/0x280 [ 862.092014][ T4202] __unfreeze_partials+0x1a5/0x200 [ 862.097135][ T4202] put_cpu_partial+0x12d/0x190 [ 862.101905][ T4202] qlist_free_all+0x35/0x90 [ 862.106404][ T4202] kasan_quarantine_reduce+0x150/0x160 [ 862.111872][ T4202] __kasan_slab_alloc+0x2f/0xd0 [ 862.116743][ T4202] slab_post_alloc_hook+0x4c/0x380 [ 862.121901][ T4202] kmem_cache_alloc_trace+0x103/0x2a0 [ 862.127296][ T4202] ipv6_add_addr+0x404/0xde0 [ 862.131891][ T4202] addrconf_add_linklocal+0x280/0x6b0 [ 862.137266][ T4202] addrconf_addr_gen+0x4ee/0x620 [ 862.142203][ T4202] addrconf_init_auto_addrs+0x6d5/0xa80 [ 862.147747][ T4202] addrconf_notify+0xa6b/0xf00 [ 862.152509][ T4202] raw_notifier_call_chain+0xcb/0x160 [ 862.157892][ T4202] __dev_notify_flags+0x178/0x2d0 [ 862.162915][ T4202] [ 862.165278][ T4202] Memory state around the buggy address: [ 862.171006][ T4202] ffff888075ee8b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 862.179163][ T4202] ffff888075ee8b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 862.187233][ T4202] >ffff888075ee8c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 862.195486][ T4202] ^ [ 862.199562][ T4202] ffff888075ee8c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 862.207629][ T4202] ffff888075ee8d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 862.215685][ T4202] ================================================================== [ 862.223739][ T4202] Disabling lock debugging due to kernel taint [ 862.229982][ C0] vkms_vblank_simulate: vblank timer overrun [ 862.250169][ T4202] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 862.257422][ T4202] CPU: 0 PID: 4202 Comm: kworker/u5:7 Tainted: G B syzkaller #0 [ 862.266488][ T4202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 862.276575][ T4202] Workqueue: hci2 hci_rx_work [ 862.281293][ T4202] Call Trace: [ 862.284612][ T4202] [ 862.287563][ T4202] dump_stack_lvl+0x168/0x230 [ 862.292269][ T4202] ? show_regs_print_info+0x20/0x20 [ 862.297497][ T4202] ? load_image+0x3b0/0x3b0 [ 862.302041][ T4202] panic+0x2c9/0x7f0 [ 862.306051][ T4202] ? bpf_jit_dump+0xd0/0xd0 [ 862.310595][ T4202] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 862.316501][ T4202] ? _raw_spin_unlock+0x40/0x40 [ 862.321377][ T4202] ? hci_le_meta_evt+0x12c0/0x3b80 [ 862.326520][ T4202] check_panic_on_warn+0x80/0xa0 [ 862.331591][ T4202] ? hci_le_meta_evt+0x12c0/0x3b80 [ 862.336777][ T4202] end_report+0x6d/0xf0 [ 862.340966][ T4202] kasan_report+0x102/0x130 [ 862.345489][ T4202] ? hci_le_meta_evt+0x12c0/0x3b80 [ 862.350654][ T4202] hci_le_meta_evt+0x12c0/0x3b80 [ 862.355761][ T4202] ? release_firmware_map_entry+0x190/0x190 [ 862.361670][ T4202] ? hci_remote_host_features_evt+0x280/0x280 [ 862.367750][ T4202] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 862.373504][ T4202] ? mutex_unlock+0x10/0x10 [ 862.378009][ T4202] ? preempt_schedule+0xa7/0xb0 [ 862.383023][ T4202] ? schedule_preempt_disabled+0x20/0x20 [ 862.388688][ T4202] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 862.394382][ T4202] hci_event_packet+0xe05/0x12f0 [ 862.399487][ T4202] ? rcu_lock_release+0x20/0x20 [ 862.404362][ T4202] ? hci_send_to_monitor+0x9c/0x4a0 [ 862.409575][ T4202] hci_rx_work+0x255/0xa10 [ 862.414134][ T4202] process_one_work+0x863/0x1000 [ 862.419093][ T4202] ? worker_detach_from_pool+0x240/0x240 [ 862.424823][ T4202] ? lockdep_hardirqs_off+0x70/0x100 [ 862.430685][ T4202] ? _raw_spin_lock_irq+0xab/0xe0 [ 862.435732][ T4202] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 862.441362][ T4202] ? wq_worker_running+0x97/0x170 [ 862.446412][ T4202] worker_thread+0xaa8/0x12a0 [ 862.451104][ T4202] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 862.457004][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 862.462210][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 862.467409][ T4202] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 862.473301][ T4202] kthread+0x436/0x520 [ 862.477363][ T4202] ? rcu_lock_release+0x20/0x20 [ 862.482207][ T4202] ? kthread_blkcg+0xd0/0xd0 [ 862.486883][ T4202] ret_from_fork+0x1f/0x30 [ 862.491300][ T4202] [ 862.494852][ T4202] Kernel Offset: disabled [ 862.507103][ T4202] Rebooting in 86400 seconds..