last executing test programs: 19.683930572s ago: executing program 0 (id=174): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x24, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15.186328869s ago: executing program 0 (id=188): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000000040)={0x0, @remote}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) gettid() syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000300)={0x0, 0x1, 0x7}) mq_timedsend(r2, 0x0, 0x0, 0x0, 0x0) 13.517096976s ago: executing program 0 (id=193): mkdir(&(0x7f0000000400)='./file1\x00', 0x8) mkdir(&(0x7f0000000040)='./file0\x00', 0x1a2) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="b0000000000000008d15c937040795e9ec68ba339b8fd15e58983b3da9"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) mount$overlay(0x0, &(0x7f0000000080)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 11.876036557s ago: executing program 0 (id=197): syz_usb_connect(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000080)={0x3ff, 0x800, 0x0, 0x3}) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0xa) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000), 0x4) write(0xffffffffffffffff, &(0x7f00000000c0)="2700000014000707030e0000120f0a0011004ad75147a2c01f52ea064d13620100f5fe0012ff00", 0x27) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r6, @ANYBLOB="01000000000000007fff010000000c0005006c000000000000000c0002000000000000000000040007800c000800000000000000000008000100000000004400078008000100", @ANYRES32, @ANYBLOB="380001"], 0x90}}, 0x0) 10.693245777s ago: executing program 3 (id=201): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x48, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{0x0}, {0x0}], 0x2}, 0x0, 0x20000041}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) 10.05939359s ago: executing program 0 (id=204): recvfrom$l2tp(0xffffffffffffffff, 0x0, 0x0, 0x40002001, 0x0, 0x0) syz_io_uring_complete(0x0) syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfec9}, &(0x7f0000000380), &(0x7f0000000280)) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r3, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}, 0x3}], 0x400000000000162, 0x2, 0x0) 8.212260006s ago: executing program 4 (id=207): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)={{0x12, 0x1, 0x0, 0x90, 0xc3, 0x3f, 0x40, 0xaf7, 0x101, 0x2d62, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xcb, 0x35, 0x52}}]}}]}}, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000340)={0x7, 0x56f2, 0x1, 0x4, 0x9, 0x4f5fe95a}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) sendmsg$ETHTOOL_MSG_WOL_GET(0xffffffffffffffff, 0x0, 0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0xfffff010}, {0x20, 0x7, 0x0, 0xa56e}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) 7.832978059s ago: executing program 1 (id=209): r0 = syz_usb_connect(0x0, 0x1cb, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f00000001c0)=ANY=[@ANYBLOB="000e1c"], 0x0, 0x0}) 7.769906044s ago: executing program 2 (id=210): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000008) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f000000ac40)={0x2020}, 0x2020) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) 7.597216069s ago: executing program 3 (id=211): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0xff, 0x1f}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) read$midi(r0, 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r1, 0x5100) ioctl$SNDCTL_SEQ_RESET(r1, 0x5100) 7.492296077s ago: executing program 2 (id=212): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt(0xffffffffffffffff, 0x8, 0xe, &(0x7f00000001c0)="6530a273264a5a6630e7c452fe", 0xd) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100001000, 0x1000000, 0x9, 0x0, 0x0, 0x2004c5, 0x8000000, 0xffffffffffffffff, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x0, 0x3fd, 0x1], 0xeeee0000, 0x42800}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.466130696s ago: executing program 3 (id=213): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16], 0x128}, 0xc810) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x141842, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f00000000c0), 0xfea7) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) syz_emit_ethernet(0x44, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x36, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b"}}}}}, 0x0) copy_file_range(r4, &(0x7f00000001c0), r3, 0x0, 0x81, 0x10000000000000) 6.153107437s ago: executing program 1 (id=214): syz_usb_connect(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000080)={0x3ff, 0x800, 0x0, 0x3}) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0xa) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000), 0x4) write(0xffffffffffffffff, &(0x7f00000000c0)="2700000014000707030e0000120f0a0011004ad75147a2c01f52ea064d13620100f5fe0012ff00", 0x27) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r6, @ANYBLOB="01000000000000007fff010000000c0005006c000000000000000c0002000000000000000000040007800c000800000000000000000008000100000000004400078008000100", @ANYRES32, @ANYBLOB="380001"], 0x90}}, 0x0) 6.020687426s ago: executing program 3 (id=215): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = userfaultfd(0x80000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$admmidi(&(0x7f0000000080), 0x2, 0x80000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e20, 0x6, @empty, 0x4}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000001000000000000000241000000030013"], 0x2c}}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0x6}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x300, 0x0, 0x26}, 0x9c) 5.918223294s ago: executing program 2 (id=216): r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) socket(0x2b, 0x80801, 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$bind(0x0, 0x0, 0x0, 0x101091, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f00000002c0)={0xf0f044, 0x50000800}) 4.657140187s ago: executing program 4 (id=217): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000000040)={0x0, @remote}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) gettid() syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000300)={0x0, 0x1, 0x7}) mq_timedsend(r2, 0x0, 0x0, 0x0, 0x0) 4.472502507s ago: executing program 3 (id=218): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.899034764s ago: executing program 2 (id=219): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2, 0x2044}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_STATS_PER_PORT={0x5, 0x2d, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44}, 0x4094) 3.849241508s ago: executing program 1 (id=220): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', 0x0, 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0x80000300, 0x0, 0x0) open(&(0x7f0000000040)='./bus\x00', 0x1612c2, 0x0) 3.093757956s ago: executing program 4 (id=221): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x14, r2, 0x1, 0x70bd2e, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x800) r3 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x5) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000240)=0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, 0x0, 0x0, 0x2, 0x0) close_range(r3, r3, 0x2) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8923, 0x0) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="18000000041401"], 0x18}}, 0x0) add_key$keyring(&(0x7f0000000100), &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(r4, 0x8, &(0x7f00000002c0)=0x81) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x3c1, 0x3, 0x560, 0x0, 0xffffff80, 0x178, 0x330, 0x178, 0x490, 0x230, 0x258, 0x490, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x308, 0x330, 0x340, {0x1e0002a8, 0x7203000000000c00}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}]}}, @common=@unspec=@cluster={{0x30}}]}, @common=@unspec=@AUDIT={0x28}}, {{@ipv6={@loopback, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'veth1_to_bridge\x00', 'geneve1\x00'}, 0x0, 0x100, 0x160, 0x0, {}, [@common=@ah={{0x30}}, @common=@ipv6header={{0x28}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0, [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x6}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5c0) socket$inet_sctp(0x2, 0x1, 0x84) r9 = fspick(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000040)='f\xb1-*,]\x00', &(0x7f0000000100)='[]\x00', 0x0) socket$netlink(0x10, 0x3, 0x9) 3.093529928s ago: executing program 2 (id=222): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x48, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{0x0}, {0x0}], 0x2}, 0x0, 0x20000041}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) 2.983268071s ago: executing program 1 (id=223): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000008) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f000000ac40)={0x2020}, 0x2020) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) 2.848856952s ago: executing program 0 (id=224): open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000019080)='./file0\x00', 0x0, 0x23010, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x3) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000019100)={[&(0x7f0000000200)=' ']}) 2.778335895s ago: executing program 1 (id=225): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r0}, 0x18) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) 1.446325942s ago: executing program 1 (id=226): syz_usb_connect(0x2, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000243f1f810240419cf29e7010203010902240001050220030904"], &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0}) 1.445406563s ago: executing program 4 (id=227): dup(0xffffffffffffffff) syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = syz_io_uring_setup(0x10d, &(0x7f00000006c0)={0x0, 0x5885, 0x0, 0x2}, &(0x7f0000000340)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, 0x0, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x5, r3, 0x0, 0x0, 0x0, 0x80800, 0x1}) io_uring_enter(r4, 0x3516, 0xc2de, 0x8, 0x0, 0x0) 217.257631ms ago: executing program 4 (id=228): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = syz_io_uring_setup(0x1458, &(0x7f00000004c0)={0x0, 0x4, 0x10180, 0x2000, 0x3ae}, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x6a, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2040, 0x1}) io_uring_enter(r0, 0x2d3e, 0xfffffffd, 0x0, 0x0, 0x0) 202.905954ms ago: executing program 3 (id=229): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3f}]}}}]}, 0x40}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x40081, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x4, 0x6, @local}, 0x14) 88.942169ms ago: executing program 4 (id=230): syz_usb_connect(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000080)={0x3ff, 0x800, 0x0, 0x3}) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0xa) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000), 0x4) write(0xffffffffffffffff, &(0x7f00000000c0)="2700000014000707030e0000120f0a0011004ad75147a2c01f52ea064d13620100f5fe0012ff00", 0x27) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r6, @ANYBLOB="01000000000000007fff010000000c0005006c000000000000000c0002000000000000000000040007800c000800000000000000000008000100000000004400078008000100", @ANYRES32, @ANYBLOB="380001"], 0x90}}, 0x0) 0s ago: executing program 2 (id=231): r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) poll(&(0x7f0000000080)=[{r0, 0x1101}], 0x1, 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.100' (ED25519) to the list of known hosts. [ 75.107854][ T5820] cgroup: Unknown subsys name 'net' [ 75.248763][ T5820] cgroup: Unknown subsys name 'cpuset' [ 75.256887][ T5820] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.772102][ T5820] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.266234][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.286904][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.295419][ T5839] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.303510][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.311584][ T5839] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.319348][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.328239][ T5839] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.334004][ T5843] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.335704][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.348454][ T5844] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.353398][ T5839] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 79.364167][ T5844] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.364271][ T5839] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 79.371780][ T5844] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.379868][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.386903][ T5844] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.394612][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.400304][ T5844] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.424039][ T5138] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.426695][ T5844] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.445570][ T5138] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 79.462147][ T5138] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.497626][ T5138] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 79.503727][ T5843] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 79.514268][ T5138] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.522112][ T5138] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 79.530655][ T5138] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 79.539076][ T5138] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 79.547059][ T5138] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 79.554706][ T5138] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 79.897537][ T5830] chnl_net:caif_netlink_parms(): no params data found [ 79.978565][ T5831] chnl_net:caif_netlink_parms(): no params data found [ 80.077777][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 80.128022][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 80.153448][ T5849] chnl_net:caif_netlink_parms(): no params data found [ 80.243763][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.251842][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.263237][ T5831] bridge_slave_0: entered allmulticast mode [ 80.270273][ T5831] bridge_slave_0: entered promiscuous mode [ 80.280300][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.287601][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.294760][ T5831] bridge_slave_1: entered allmulticast mode [ 80.302019][ T5831] bridge_slave_1: entered promiscuous mode [ 80.309489][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.317412][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.324606][ T5830] bridge_slave_0: entered allmulticast mode [ 80.331460][ T5830] bridge_slave_0: entered promiscuous mode [ 80.374882][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.383716][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.391594][ T5830] bridge_slave_1: entered allmulticast mode [ 80.398562][ T5830] bridge_slave_1: entered promiscuous mode [ 80.431873][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.478003][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.498773][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.512364][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.522089][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.529422][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.537066][ T5836] bridge_slave_0: entered allmulticast mode [ 80.543767][ T5836] bridge_slave_0: entered promiscuous mode [ 80.603694][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.610988][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.618841][ T5836] bridge_slave_1: entered allmulticast mode [ 80.626104][ T5836] bridge_slave_1: entered promiscuous mode [ 80.641995][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.649253][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.656568][ T5849] bridge_slave_0: entered allmulticast mode [ 80.663371][ T5849] bridge_slave_0: entered promiscuous mode [ 80.670622][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.677807][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.684938][ T5837] bridge_slave_0: entered allmulticast mode [ 80.691783][ T5837] bridge_slave_0: entered promiscuous mode [ 80.703459][ T5831] team0: Port device team_slave_0 added [ 80.712014][ T5830] team0: Port device team_slave_0 added [ 80.719963][ T5830] team0: Port device team_slave_1 added [ 80.736830][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.743906][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.752324][ T5849] bridge_slave_1: entered allmulticast mode [ 80.759324][ T5849] bridge_slave_1: entered promiscuous mode [ 80.774743][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.781974][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.789228][ T5837] bridge_slave_1: entered allmulticast mode [ 80.796413][ T5837] bridge_slave_1: entered promiscuous mode [ 80.812891][ T5831] team0: Port device team_slave_1 added [ 80.837833][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.849647][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.869247][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.915261][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.922253][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.948680][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.961979][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.969270][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.995441][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.014880][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.034162][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.043881][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.050956][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.077178][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.112459][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.122671][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.134205][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.160723][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.180919][ T5836] team0: Port device team_slave_0 added [ 81.190433][ T5836] team0: Port device team_slave_1 added [ 81.199241][ T5849] team0: Port device team_slave_0 added [ 81.233422][ T5837] team0: Port device team_slave_0 added [ 81.241921][ T5837] team0: Port device team_slave_1 added [ 81.249374][ T5849] team0: Port device team_slave_1 added [ 81.313747][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.321204][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.347963][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.368687][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.377836][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.404347][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.419578][ T5830] hsr_slave_0: entered promiscuous mode [ 81.429925][ T5830] hsr_slave_1: entered promiscuous mode [ 81.445046][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.446400][ T5138] Bluetooth: hci1: command tx timeout [ 81.458177][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.485345][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.500252][ T5831] hsr_slave_0: entered promiscuous mode [ 81.506857][ T5831] hsr_slave_1: entered promiscuous mode [ 81.512931][ T5831] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.516520][ T5138] Bluetooth: hci2: command tx timeout [ 81.521236][ T5844] Bluetooth: hci0: command tx timeout [ 81.532839][ T5831] Cannot create hsr debugfs directory [ 81.539024][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.546085][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.572312][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.588685][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.596341][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.597685][ T5138] Bluetooth: hci3: command tx timeout [ 81.622426][ T5844] Bluetooth: hci4: command tx timeout [ 81.629590][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.647377][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.654339][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.680518][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.825713][ T5836] hsr_slave_0: entered promiscuous mode [ 81.831976][ T5836] hsr_slave_1: entered promiscuous mode [ 81.838328][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.846001][ T5836] Cannot create hsr debugfs directory [ 81.854739][ T5837] hsr_slave_0: entered promiscuous mode [ 81.861008][ T5837] hsr_slave_1: entered promiscuous mode [ 81.867510][ T5837] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.875099][ T5837] Cannot create hsr debugfs directory [ 81.892201][ T5849] hsr_slave_0: entered promiscuous mode [ 81.898763][ T5849] hsr_slave_1: entered promiscuous mode [ 81.904729][ T5849] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.912602][ T5849] Cannot create hsr debugfs directory [ 82.227923][ T5831] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 82.244460][ T5831] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 82.261408][ T5831] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 82.287323][ T5831] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.324867][ T5837] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.335364][ T5837] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.361910][ T5837] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.371040][ T5837] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.398621][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.409363][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.442336][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.470262][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.497894][ T5849] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 82.513686][ T5849] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 82.524931][ T5849] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 82.546504][ T5849] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 82.615445][ T5836] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.656636][ T5836] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.666224][ T5836] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.687082][ T5836] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.769015][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.799887][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.816300][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.832381][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.857950][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.878738][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.885993][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.913716][ T968] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.920876][ T968] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.931906][ T968] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.939380][ T968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.955593][ T5849] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.971358][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.978467][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.992555][ T1098] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.999682][ T1098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.019556][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.033968][ T2969] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.041146][ T2969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.074162][ T5830] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.103896][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.111052][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.149102][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.156246][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.300520][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.358114][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.391347][ T5830] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.430032][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.437185][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.515715][ T5138] Bluetooth: hci1: command tx timeout [ 83.531333][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.538514][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.595865][ T5138] Bluetooth: hci2: command tx timeout [ 83.596380][ T5844] Bluetooth: hci0: command tx timeout [ 83.639078][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.659813][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.675945][ T5844] Bluetooth: hci3: command tx timeout [ 83.681027][ T5138] Bluetooth: hci4: command tx timeout [ 83.722818][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.760398][ T5836] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.808143][ T5837] veth0_vlan: entered promiscuous mode [ 83.849233][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.888557][ T5837] veth1_vlan: entered promiscuous mode [ 83.963840][ T5831] veth0_vlan: entered promiscuous mode [ 83.984080][ T5837] veth0_macvtap: entered promiscuous mode [ 84.013196][ T5837] veth1_macvtap: entered promiscuous mode [ 84.024352][ T5831] veth1_vlan: entered promiscuous mode [ 84.042453][ T5830] veth0_vlan: entered promiscuous mode [ 84.111484][ T5830] veth1_vlan: entered promiscuous mode [ 84.129914][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.143844][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.182941][ T5837] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.193444][ T5837] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.202478][ T5837] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.211515][ T5837] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.243861][ T5831] veth0_macvtap: entered promiscuous mode [ 84.281826][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.299252][ T5831] veth1_macvtap: entered promiscuous mode [ 84.306618][ T5849] veth0_vlan: entered promiscuous mode [ 84.325821][ T5830] veth0_macvtap: entered promiscuous mode [ 84.344539][ T5849] veth1_vlan: entered promiscuous mode [ 84.374134][ T5830] veth1_macvtap: entered promiscuous mode [ 84.434070][ T5830] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.452530][ T5830] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.464649][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.483357][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.496668][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.507098][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.518195][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.529369][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.543166][ T5830] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.553815][ T5830] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.568995][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.589126][ T1144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.593248][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.610671][ T1144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.614132][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.628081][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.639119][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.650291][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.662968][ T5831] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.672185][ T5831] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.681247][ T5831] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.690384][ T5831] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.703689][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.712562][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.722556][ T5830] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.732068][ T5830] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.754920][ T5836] veth0_vlan: entered promiscuous mode [ 84.782833][ T5836] veth1_vlan: entered promiscuous mode [ 84.792811][ T5849] veth0_macvtap: entered promiscuous mode [ 84.817252][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.829445][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.859811][ T5849] veth1_macvtap: entered promiscuous mode [ 84.914884][ T5836] veth0_macvtap: entered promiscuous mode [ 84.948992][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.964424][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.975402][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.986219][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.996513][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.007314][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.019308][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.047212][ T5837] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 85.107587][ T5836] veth1_macvtap: entered promiscuous mode [ 85.121235][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.137305][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.148557][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.159585][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.170067][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.181136][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.191659][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.210414][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.222408][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.264052][ T5849] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.276962][ T5849] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.286413][ T5849] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.295267][ T5849] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.309492][ T1098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.318056][ T1098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.343338][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.369757][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.386460][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.400952][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.413808][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.431888][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.452518][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.463438][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.484654][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.501266][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.514226][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.558716][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.587266][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.597421][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.608017][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.618352][ T5836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.628927][ T5836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.640176][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.659537][ T5138] Bluetooth: hci1: command tx timeout [ 85.675289][ T5138] Bluetooth: hci0: command tx timeout [ 85.681049][ T5138] Bluetooth: hci2: command tx timeout [ 85.755651][ T5844] Bluetooth: hci3: command tx timeout [ 85.761573][ T5138] Bluetooth: hci4: command tx timeout [ 86.016142][ T5836] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.025062][ T5836] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.035936][ T5836] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.044665][ T5836] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.083972][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.100607][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.161478][ T968] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.200483][ T968] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.214672][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.249898][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.348393][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.385861][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.481132][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.517908][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.605407][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.626859][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.680433][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 86.695386][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 87.055431][ T5914] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 87.308593][ T5914] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 87.396374][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 87.450906][ T5914] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 87.495310][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.589941][ T5914] usb 1-1: config 0 descriptor?? [ 87.630964][ T5914] pwc: Askey VC010 type 2 USB webcam detected. [ 87.695371][ T5844] Bluetooth: hci1: command tx timeout [ 87.767108][ T5844] Bluetooth: hci2: command tx timeout [ 87.772595][ T5844] Bluetooth: hci0: command tx timeout [ 87.845419][ T5844] Bluetooth: hci3: command tx timeout [ 87.851031][ T5844] Bluetooth: hci4: command tx timeout [ 88.006076][ T5885] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 88.082586][ T5914] pwc: recv_control_msg error -32 req 02 val 2b00 [ 88.096342][ T5914] pwc: recv_control_msg error -32 req 02 val 2700 [ 88.111443][ T5914] pwc: recv_control_msg error -32 req 02 val 2c00 [ 88.129857][ T5914] pwc: recv_control_msg error -32 req 04 val 1000 [ 88.147332][ T5914] pwc: recv_control_msg error -32 req 04 val 1300 [ 88.154505][ T5914] pwc: recv_control_msg error -32 req 04 val 1400 [ 88.163121][ T5914] pwc: recv_control_msg error -32 req 02 val 2000 [ 88.172149][ T5914] pwc: recv_control_msg error -32 req 02 val 2100 [ 88.181117][ T5914] pwc: recv_control_msg error -32 req 04 val 1500 [ 88.188473][ T5914] pwc: recv_control_msg error -32 req 02 val 2500 [ 88.195600][ T5914] pwc: recv_control_msg error -32 req 02 val 2400 [ 88.275427][ T5922] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 88.295270][ T5885] usb 5-1: Using ep0 maxpacket: 16 [ 88.332005][ T5885] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 88.342022][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 88.367296][ T5885] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.403924][ T5914] pwc: recv_control_msg error -71 req 02 val 2900 [ 88.416971][ T5914] pwc: recv_control_msg error -71 req 02 val 2800 [ 88.444752][ T5914] pwc: recv_control_msg error -71 req 04 val 1100 [ 88.489210][ T5885] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 88.498197][ T5914] pwc: recv_control_msg error -71 req 04 val 1200 [ 88.519360][ T5922] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 88.532871][ T5914] pwc: Registered as video103. [ 88.548778][ T5885] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 88.565610][ T5922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.574512][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.577602][ T5914] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input5 [ 88.589607][ T5922] usb 4-1: Product: syz [ 88.615705][ T5885] usb 5-1: Product: syz [ 88.620004][ T5885] usb 5-1: Manufacturer: syz [ 88.628226][ T5922] usb 4-1: Manufacturer: syz [ 88.633045][ T5922] usb 4-1: SerialNumber: syz [ 88.647863][ T5885] usb 5-1: SerialNumber: syz [ 88.665554][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 88.674481][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 88.683305][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 88.705437][ T5914] usb 1-1: USB disconnect, device number 2 [ 88.910702][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 88.920564][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 88.934161][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 89.709301][ T5922] r8152-cfgselector 4-1: Unknown version 0x0000 [ 89.762348][ T5922] r8152-cfgselector 4-1: config 0 descriptor?? [ 89.936569][ T5885] usb 5-1: 0:2 : does not exist [ 91.693918][ T26] r8152-cfgselector 4-1: USB disconnect, device number 2 [ 92.677079][ T9] cfg80211: failed to load regulatory.db [ 93.355162][ T5885] usb 5-1: 1:0: failed to get current value for ch 0 (-22) [ 93.497140][ T5885] usb 5-1: USB disconnect, device number 2 [ 93.554256][ T5976] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 93.627668][ T5980] netlink: 32 bytes leftover after parsing attributes in process `syz.0.18'. [ 94.795842][ T5851] udevd[5851]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 97.796211][ T976] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 97.895351][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 98.087376][ T976] usb 3-1: Using ep0 maxpacket: 8 [ 98.145238][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 98.155531][ T976] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 98.187429][ T5914] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 98.195372][ T976] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.203730][ T976] usb 3-1: Product: syz [ 98.211016][ T976] usb 3-1: Manufacturer: syz [ 98.215866][ T9] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 98.224579][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.234883][ T976] usb 3-1: SerialNumber: syz [ 98.242167][ T976] usb 3-1: config 0 descriptor?? [ 98.247915][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 98.267500][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 98.282258][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.291879][ T9] usb 2-1: Product: syz [ 98.301781][ T9] usb 2-1: Manufacturer: syz [ 98.309732][ T9] usb 2-1: SerialNumber: syz [ 98.361670][ T5914] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 98.375376][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.390628][ T5914] usb 4-1: Product: syz [ 98.394869][ T5914] usb 4-1: Manufacturer: syz [ 98.401565][ T5914] usb 4-1: SerialNumber: syz [ 98.419490][ T5914] r8152-cfgselector 4-1: Unknown version 0x0000 [ 98.433191][ T5914] r8152-cfgselector 4-1: config 0 descriptor?? [ 98.474133][ T976] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 98.739190][ T9] usb 2-1: 0:2 : does not exist [ 98.863245][ T5883] r8152-cfgselector 4-1: USB disconnect, device number 3 [ 99.036437][ T5844] Bluetooth: hci4: command 0x0405 tx timeout [ 99.092751][ T976] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 99.126638][ T976] usb 3-1: USB disconnect, device number 2 [ 99.145427][ T5914] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 99.425692][ T5914] usb 1-1: Using ep0 maxpacket: 8 [ 99.436198][ T5914] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 100.254765][ T5914] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 100.264238][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.280655][ T5914] usb 1-1: Product: syz [ 100.285077][ T5914] usb 1-1: Manufacturer: syz [ 100.290650][ T5914] usb 1-1: SerialNumber: syz [ 100.302296][ T5914] usb 1-1: config 0 descriptor?? [ 101.791481][ T9] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 101.839876][ T9] usb 2-1: USB disconnect, device number 2 [ 102.733903][ T26] usb 1-1: USB disconnect, device number 3 [ 103.818578][ T5851] udevd[5851]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 103.878469][ T6046] overlayfs: conflicting lowerdir path [ 104.026998][ T6053] warning: `syz.2.40' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 105.952059][ T6059] lo speed is unknown, defaulting to 1000 [ 105.958138][ T6059] lo speed is unknown, defaulting to 1000 [ 105.966072][ T6059] lo speed is unknown, defaulting to 1000 [ 105.977280][ T6059] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 105.990540][ T6059] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 106.040932][ T6056] »»»»»»: renamed from lo (while UP) [ 106.500112][ T6059] »»»»»» speed is unknown, defaulting to 1000 [ 106.510845][ T6059] »»»»»» speed is unknown, defaulting to 1000 [ 106.518249][ T6059] »»»»»» speed is unknown, defaulting to 1000 [ 106.525569][ T6059] »»»»»» speed is unknown, defaulting to 1000 [ 106.532794][ T6059] »»»»»» speed is unknown, defaulting to 1000 [ 107.225343][ T976] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 107.395357][ T26] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 107.405279][ T976] usb 1-1: Using ep0 maxpacket: 16 [ 107.428015][ T976] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 107.450444][ T976] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 107.479022][ T976] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 107.509950][ T976] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 107.528731][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.554464][ T976] usb 1-1: Product: syz [ 107.569740][ T976] usb 1-1: Manufacturer: syz [ 107.574398][ T976] usb 1-1: SerialNumber: syz [ 107.585735][ T26] usb 5-1: Using ep0 maxpacket: 8 [ 107.608979][ T26] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 107.628564][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.655227][ T26] usb 5-1: Product: syz [ 107.675779][ T26] usb 5-1: Manufacturer: syz [ 107.696172][ T26] usb 5-1: SerialNumber: syz [ 107.713527][ T26] usb 5-1: config 0 descriptor?? [ 107.958673][ T26] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 108.010353][ T976] usb 1-1: 0:2 : does not exist [ 108.729497][ T26] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 109.494711][ T26] usb 5-1: USB disconnect, device number 3 [ 110.305342][ T26] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 110.545352][ T26] usb 2-1: Using ep0 maxpacket: 8 [ 110.625824][ T26] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 110.756401][ T26] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 110.808264][ T26] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.066419][ T26] usb 2-1: Product: syz [ 111.235298][ T26] usb 2-1: Manufacturer: syz [ 111.239964][ T26] usb 2-1: SerialNumber: syz [ 111.278599][ T26] usb 2-1: config 0 descriptor?? [ 111.380995][ T976] usb 1-1: 1:0: failed to get current value for ch 0 (-22) [ 111.426633][ T976] usb 1-1: USB disconnect, device number 4 [ 111.849123][ T5851] udevd[5851]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 113.283981][ T26] usb 2-1: USB disconnect, device number 3 [ 114.627451][ T6119] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 117.235959][ T5852] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 117.395325][ T5852] usb 5-1: Using ep0 maxpacket: 16 [ 117.403124][ T5852] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 117.741617][ T5852] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.786327][ T5852] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 117.833598][ T5852] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 117.844613][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.861417][ T5852] usb 5-1: Product: syz [ 117.867557][ T5852] usb 5-1: Manufacturer: syz [ 117.872263][ T5852] usb 5-1: SerialNumber: syz [ 117.885319][ T5920] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 118.035196][ T5920] usb 3-1: device descriptor read/64, error -71 [ 118.096524][ T976] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 118.347426][ T5920] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 118.637899][ T5920] usb 3-1: device descriptor read/64, error -71 [ 118.818634][ T5920] usb usb3-port1: attempt power cycle [ 119.142011][ T5852] usb 5-1: 0:2 : does not exist [ 119.265193][ T5920] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 119.326165][ T5920] usb 3-1: device descriptor read/8, error -71 [ 119.765284][ T5920] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 119.798709][ T5920] usb 3-1: device descriptor read/8, error -71 [ 119.916576][ T5920] usb usb3-port1: unable to enumerate USB device [ 120.083494][ T5852] usb 5-1: 1:0: cannot get min/max values for control 4 (id 1) [ 120.096610][ T976] usb 4-1: Using ep0 maxpacket: 8 [ 120.126320][ T976] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 120.138878][ T6163] netlink: 12 bytes leftover after parsing attributes in process `syz.1.68'. [ 120.155588][ T976] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 120.181358][ T976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.182369][ T5852] usb 5-1: USB disconnect, device number 4 [ 120.196713][ T976] usb 4-1: Product: syz [ 120.200915][ T976] usb 4-1: Manufacturer: syz [ 120.310396][ T976] usb 4-1: SerialNumber: syz [ 120.341120][ T976] usb 4-1: config 0 descriptor?? [ 120.542484][ T6167] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 121.032518][ T5851] udevd[5851]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 122.924086][ T5922] usb 4-1: USB disconnect, device number 4 [ 127.145834][ T6224] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 127.589215][ T6234] befs: (nullb0): No write support. Marking filesystem read-only [ 127.600036][ T6234] befs: (nullb0): invalid magic header [ 127.695586][ T26] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 128.534900][ T26] usb 2-1: Using ep0 maxpacket: 8 [ 128.546201][ T26] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 128.562577][ T26] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.571155][ T26] usb 2-1: Product: syz [ 128.575726][ T26] usb 2-1: Manufacturer: syz [ 128.580358][ T26] usb 2-1: SerialNumber: syz [ 128.588118][ T26] usb 2-1: config 0 descriptor?? [ 129.273624][ T26] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 129.473901][ T26] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 131.269786][ T26] usb 2-1: USB disconnect, device number 4 [ 132.092171][ T6273] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 132.429408][ T6283] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 132.445310][ T26] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 133.175767][ T6286] 9pnet_virtio: no channels available for device 127.0.0.1 [ 133.195174][ T6286] netlink: 12 bytes leftover after parsing attributes in process `syz.2.103'. [ 133.281878][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.305610][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.355920][ T26] usb 1-1: Using ep0 maxpacket: 16 [ 133.581759][ T26] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 7.79 [ 133.623368][ T26] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 133.670945][ T26] usb 1-1: Manufacturer: syz [ 133.767957][ T26] usb 1-1: config 0 descriptor?? [ 134.081279][ T26] usb 1-1: Limiting number of CPorts to U8_MAX [ 134.141377][ T26] usb 1-1: Not enough endpoints found in device, aborting! [ 135.033796][ T26] usb 1-1: USB disconnect, device number 5 [ 135.941449][ T5883] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 136.220773][ T5883] usb 4-1: Using ep0 maxpacket: 8 [ 136.263482][ T5883] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 136.289356][ T5883] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.754141][ T5883] usb 4-1: Product: syz [ 136.759022][ T5883] usb 4-1: Manufacturer: syz [ 136.763835][ T5883] usb 4-1: SerialNumber: syz [ 136.786434][ T5883] usb 4-1: config 0 descriptor?? [ 136.963719][ T6318] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 137.009847][ T5883] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 137.234717][ T5883] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 138.525474][ T9] usb 4-1: USB disconnect, device number 5 [ 139.103049][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880276d4000: rx timeout, send abort [ 139.612411][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880276d4000: abort rx timeout. Force session deactivation [ 142.171508][ T6372] fuse: Unknown parameter 'group_id00' [ 142.236587][ T5883] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 142.522991][ T6380] Zero length message leads to an empty skb [ 143.494226][ T1165] wlan1: Trigger new scan to find an IBSS to join [ 143.518745][ T5883] usb 2-1: Using ep0 maxpacket: 8 [ 143.535070][ T5883] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 143.544206][ T5883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.358125][ T5883] usb 2-1: Product: syz [ 144.526645][ T5883] usb 2-1: Manufacturer: syz [ 144.639152][ T5883] usb 2-1: SerialNumber: syz [ 144.656569][ T5883] usb 2-1: config 0 descriptor?? [ 144.937194][ T5883] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 144.970869][ C0] vcan0: j1939_tp_rxtimer: 0xffff888033080c00: rx timeout, send abort [ 145.350841][ T5883] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 145.479222][ C0] vcan0: j1939_tp_rxtimer: 0xffff888033080c00: abort rx timeout. Force session deactivation [ 145.980953][ T6402] netlink: 8 bytes leftover after parsing attributes in process `syz.4.136'. [ 146.991424][ T9] usb 2-1: USB disconnect, device number 5 [ 148.208615][ T6421] fuse: Unknown parameter 'group_id00' [ 148.246243][ T6423] befs: (nullb0): No write support. Marking filesystem read-only [ 148.255340][ T6423] befs: (nullb0): invalid magic header [ 148.428093][ T62] wlan1: Trigger new scan to find an IBSS to join [ 150.539146][ T9] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 151.103707][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 151.145481][ T9] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 151.159602][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.194283][ T9] usb 5-1: config 0 descriptor?? [ 151.476877][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 151.672656][ C0] vcan0: j1939_tp_rxtimer: 0xffff888028ca8800: rx timeout, send abort [ 152.243920][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 152.255782][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 152.265475][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 152.275715][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 152.288474][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 152.304125][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 152.304971][ T968] wlan1: Creating new IBSS network, BSSID fe:2c:50:07:ab:e2 [ 152.386388][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 152.515581][ T9] pwc: recv_control_msg error -32 req 02 val 2100 [ 152.717460][ T9] pwc: recv_control_msg error -32 req 04 val 1500 [ 152.783331][ T9] pwc: recv_control_msg error -32 req 02 val 2500 [ 152.799365][ T9] pwc: recv_control_msg error -32 req 02 val 2400 [ 153.050404][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 153.076395][ T5883] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 153.110390][ T6451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.152'. [ 153.122059][ T6451] netlink: 4 bytes leftover after parsing attributes in process `syz.1.152'. [ 153.127102][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 153.131130][ T6451] netlink: 52 bytes leftover after parsing attributes in process `syz.1.152'. [ 153.189958][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 153.209736][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 153.235375][ T9] pwc: Registered as video103. [ 153.261973][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input6 [ 153.275420][ T5883] usb 3-1: Using ep0 maxpacket: 8 [ 153.296952][ T5883] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 153.318024][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.343916][ T9] usb 5-1: USB disconnect, device number 5 [ 153.386699][ T5883] usb 3-1: Product: syz [ 153.405263][ T5883] usb 3-1: Manufacturer: syz [ 153.411225][ T5883] usb 3-1: SerialNumber: syz [ 153.426073][ T5883] usb 3-1: config 0 descriptor?? [ 153.649580][ T5883] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 153.857075][ T5883] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 154.571875][ T6479] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 154.578645][ T6479] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 154.587635][ T6479] vhci_hcd vhci_hcd.0: Device attached [ 154.815628][ T3082] vhci_hcd: vhci_device speed not set [ 154.935413][ T3082] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 155.424618][ T6481] vhci_hcd: connection reset by peer [ 155.985219][ T1098] vhci_hcd: stop threads [ 155.989918][ T1098] vhci_hcd: release socket [ 156.060732][ T5883] usb 3-1: USB disconnect, device number 7 [ 156.093508][ T1098] vhci_hcd: disconnect device [ 157.301737][ T6499] 9pnet_virtio: no channels available for device 127.0.0.1 [ 157.325068][ T6499] netlink: 12 bytes leftover after parsing attributes in process `syz.0.165'. [ 157.744310][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025182c00: rx timeout, send abort [ 158.186277][ T6501] netlink: 8 bytes leftover after parsing attributes in process `syz.0.167'. [ 158.195318][ T6501] netlink: 4 bytes leftover after parsing attributes in process `syz.0.167'. [ 158.204141][ T6501] netlink: 52 bytes leftover after parsing attributes in process `syz.0.167'. [ 158.252928][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025182c00: abort rx timeout. Force session deactivation [ 159.416915][ T5883] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 159.846050][ T5883] usb 1-1: Using ep0 maxpacket: 8 [ 159.914398][ T5883] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 159.924308][ T5883] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.949707][ T5883] usb 1-1: Product: syz [ 159.963793][ T5883] usb 1-1: Manufacturer: syz [ 160.090260][ T6531] netlink: 12 bytes leftover after parsing attributes in process `syz.4.178'. [ 160.445234][ T5883] usb 1-1: SerialNumber: syz [ 160.467160][ T5883] usb 1-1: config 0 descriptor?? [ 160.532296][ T3082] vhci_hcd: vhci_device speed not set [ 160.678789][ T5883] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 160.873569][ T6537] netlink: 12 bytes leftover after parsing attributes in process `syz.4.180'. [ 161.271105][ T5883] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 162.480853][ T6557] netlink: 8 bytes leftover after parsing attributes in process `syz.4.185'. [ 162.489963][ T6557] netlink: 4 bytes leftover after parsing attributes in process `syz.4.185'. [ 162.498824][ T6557] netlink: 52 bytes leftover after parsing attributes in process `syz.4.185'. [ 163.301921][ T26] usb 1-1: USB disconnect, device number 6 [ 165.150560][ T6577] overlayfs: conflicting lowerdir path [ 166.054453][ T6582] input: syz0 as /devices/virtual/input/input7 [ 166.061179][ T6582] input: failed to attach handler leds to device input7, error: -6 [ 167.504680][ T6602] nvme_fabrics: unknown parameter or missing value 'ó' in ctrl creation request [ 167.587277][ T6593] netlink: 8 bytes leftover after parsing attributes in process `syz.0.197'. [ 167.596251][ T6593] netlink: 4 bytes leftover after parsing attributes in process `syz.0.197'. [ 167.605042][ T6593] netlink: 52 bytes leftover after parsing attributes in process `syz.0.197'. [ 167.915612][ T5883] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 168.556079][ T5883] usb 2-1: Using ep0 maxpacket: 8 [ 168.605760][ T5883] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 168.641139][ T5883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.773450][ T5883] usb 2-1: Product: syz [ 169.268958][ T5883] usb 2-1: Manufacturer: syz [ 169.273724][ T5883] usb 2-1: SerialNumber: syz [ 169.457193][ T5883] usb 2-1: config 0 descriptor?? [ 170.400250][ T5883] dvb_usb_rtl28xxu 2-1:0.0: chip type detection failed -71 [ 170.415314][ T5883] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 170.444156][ T5883] usb 2-1: USB disconnect, device number 6 [ 170.618429][ T6629] overlayfs: conflicting lowerdir path [ 170.815615][ T976] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 170.989114][ T976] usb 5-1: New USB device found, idVendor=0af7, idProduct=0101, bcdDevice=2d.62 [ 171.052847][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.095206][ T976] usb 5-1: config 0 descriptor?? [ 171.127197][ T976] usb 5-1: selecting invalid altsetting 1 [ 171.144620][ T976] flexcop_usb: set interface failed. [ 171.168725][ T976] b2c2_flexcop_usb 5-1:0.0: probe with driver b2c2_flexcop_usb failed with error -22 [ 173.850797][ T6654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.214'. [ 173.860220][ T6654] netlink: 4 bytes leftover after parsing attributes in process `syz.1.214'. [ 173.869332][ T6654] netlink: 52 bytes leftover after parsing attributes in process `syz.1.214'. [ 174.005207][ T9] usb 5-1: USB disconnect, device number 6 [ 174.884732][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 175.258679][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 175.317403][ T9] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 175.334941][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.358420][ T9] usb 4-1: Product: syz [ 175.362680][ T9] usb 4-1: Manufacturer: syz [ 175.390759][ T9] usb 4-1: SerialNumber: syz [ 175.411679][ T9] usb 4-1: config 0 descriptor?? [ 175.607458][ T6677] netlink: 8 bytes leftover after parsing attributes in process `syz.4.221'. [ 175.640331][ T9] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 176.243695][ T9] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 176.274678][ T6687] process 'syz.0.224' launched './file0' with NULL argv: empty string added [ 178.258764][ T3082] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 178.357072][ T5885] usb 4-1: USB disconnect, device number 6 [ 178.436503][ T3082] usb 2-1: not running at top speed; connect to a high speed hub [ 178.453134][ T3082] usb 2-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 178.475625][ T3082] usb 2-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=e7.29 [ 178.484709][ T3082] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.565515][ T3082] usb 2-1: Product: syz [ 178.580050][ T3082] usb 2-1: Manufacturer: syz [ 178.584702][ T3082] usb 2-1: SerialNumber: syz [ 178.896244][ T3082] usb 2-1: USB disconnect, device number 7 [ 178.911747][ T3082] ================================================================== [ 178.919864][ T3082] BUG: KASAN: slab-use-after-free in hdm_disconnect+0x10d/0x1c0 [ 178.927552][ T3082] Read of size 8 at addr ffff888031a1d898 by task kworker/1:2/3082 [ 178.935463][ T3082] [ 178.937819][ T3082] CPU: 1 UID: 0 PID: 3082 Comm: kworker/1:2 Not tainted 6.14.0-rc6-syzkaller-00205-g3571e8b091f4 #0 [ 178.937844][ T3082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 178.937858][ T3082] Workqueue: usb_hub_wq hub_event [ 178.937887][ T3082] Call Trace: [ 178.937894][ T3082] [ 178.937902][ T3082] dump_stack_lvl+0x241/0x360 [ 178.937925][ T3082] ? __pfx_dump_stack_lvl+0x10/0x10 [ 178.937943][ T3082] ? __pfx__printk+0x10/0x10 [ 178.937973][ T3082] ? _printk+0xd5/0x120 [ 178.938000][ T3082] ? __virt_addr_valid+0x183/0x530 [ 178.938028][ T3082] ? __virt_addr_valid+0x183/0x530 [ 178.938058][ T3082] print_report+0x16e/0x5b0 [ 178.938085][ T3082] ? __virt_addr_valid+0x183/0x530 [ 178.938113][ T3082] ? __virt_addr_valid+0x183/0x530 [ 178.938139][ T3082] ? __virt_addr_valid+0x45f/0x530 [ 178.938184][ T3082] ? __phys_addr+0xba/0x170 [ 178.938213][ T3082] ? hdm_disconnect+0x10d/0x1c0 [ 178.938237][ T3082] kasan_report+0x143/0x180 [ 178.938265][ T3082] ? kobject_put+0x272/0x480 [ 178.938297][ T3082] ? hdm_disconnect+0x10d/0x1c0 [ 178.938328][ T3082] hdm_disconnect+0x10d/0x1c0 [ 178.938353][ T3082] usb_unbind_interface+0x25b/0x940 [ 178.938382][ T3082] ? kernfs_find_ns+0x2b8/0x340 [ 178.938406][ T3082] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 178.938431][ T3082] ? __pfx_usb_unbind_interface+0x10/0x10 [ 178.938456][ T3082] device_release_driver_internal+0x503/0x7c0 [ 178.938484][ T3082] bus_remove_device+0x34f/0x420 [ 178.938515][ T3082] device_del+0x57a/0x9b0 [ 178.938539][ T3082] ? __pfx_device_del+0x10/0x10 [ 178.938558][ T3082] ? __pfx___mutex_lock+0x10/0x10 [ 178.938587][ T3082] ? _raw_spin_lock_irq+0xdf/0x120 [ 178.938616][ T3082] usb_disable_device+0x3bf/0x850 [ 178.938645][ T3082] usb_disconnect+0x340/0x950 [ 178.938669][ T3082] hub_event+0x1ebc/0x5150 [ 178.938702][ T3082] ? debug_object_deactivate+0x2d5/0x390 [ 178.938737][ T3082] ? do_raw_spin_unlock+0x13c/0x8b0 [ 178.938768][ T3082] ? __pfx_hub_event+0x10/0x10 [ 178.938793][ T3082] ? __pfx_lock_acquire+0x10/0x10 [ 178.938822][ T3082] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 178.938851][ T3082] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 178.938885][ T3082] ? process_scheduled_works+0x9c6/0x18e0 [ 178.938909][ T3082] process_scheduled_works+0xabe/0x18e0 [ 178.938946][ T3082] ? __pfx_process_scheduled_works+0x10/0x10 [ 178.938974][ T3082] ? assign_work+0x364/0x3d0 [ 178.938999][ T3082] worker_thread+0x870/0xd30 [ 178.939030][ T3082] ? __kthread_parkme+0x169/0x1d0 [ 178.939056][ T3082] ? __pfx_worker_thread+0x10/0x10 [ 178.939082][ T3082] kthread+0x7a9/0x920 [ 178.939110][ T3082] ? __pfx_kthread+0x10/0x10 [ 178.939139][ T3082] ? __pfx_worker_thread+0x10/0x10 [ 178.939164][ T3082] ? __pfx_kthread+0x10/0x10 [ 178.939202][ T3082] ? __pfx_kthread+0x10/0x10 [ 178.939231][ T3082] ? __pfx_kthread+0x10/0x10 [ 178.939256][ T3082] ? _raw_spin_unlock_irq+0x23/0x50 [ 178.939279][ T3082] ? lockdep_hardirqs_on+0x99/0x150 [ 178.939311][ T3082] ? __pfx_kthread+0x10/0x10 [ 178.939356][ T3082] ret_from_fork+0x4b/0x80 [ 178.939381][ T3082] ? __pfx_kthread+0x10/0x10 [ 178.939410][ T3082] ret_from_fork_asm+0x1a/0x30 [ 178.939439][ T3082] [ 178.939446][ T3082] [ 178.999388][ T6707] netlink: 8 bytes leftover after parsing attributes in process `syz.4.230'. [ 179.000333][ T3082] Allocated by task 3082: [ 179.004857][ T6707] netlink: 4 bytes leftover after parsing attributes in process `syz.4.230'. [ 179.009925][ T3082] kasan_save_track+0x3f/0x80 [ 179.009960][ T3082] __kasan_kmalloc+0x98/0xb0 [ 179.009989][ T3082] __kmalloc_cache_noprof+0x243/0x390 [ 179.010009][ T3082] hdm_probe+0x98/0x13f0 [ 179.010032][ T3082] usb_probe_interface+0x641/0xbb0 [ 179.010061][ T3082] really_probe+0x2b9/0xad0 [ 179.010082][ T3082] __driver_probe_device+0x1a2/0x390 [ 179.015293][ T6707] netlink: 52 bytes leftover after parsing attributes in process `syz.4.230'. [ 179.020289][ T3082] driver_probe_device+0x50/0x430 [ 179.314059][ T3082] __device_attach_driver+0x2d6/0x530 [ 179.319451][ T3082] bus_for_each_drv+0x24e/0x2e0 [ 179.324310][ T3082] __device_attach+0x333/0x520 [ 179.329080][ T3082] bus_probe_device+0x189/0x260 [ 179.333936][ T3082] device_add+0x856/0xbf0 [ 179.338289][ T3082] usb_set_configuration+0x1976/0x1fb0 [ 179.343778][ T3082] usb_generic_driver_probe+0x88/0x140 [ 179.349253][ T3082] usb_probe_device+0x1b8/0x380 [ 179.354123][ T3082] really_probe+0x2b9/0xad0 [ 179.358645][ T3082] __driver_probe_device+0x1a2/0x390 [ 179.363937][ T3082] driver_probe_device+0x50/0x430 [ 179.368972][ T3082] __device_attach_driver+0x2d6/0x530 [ 179.374369][ T3082] bus_for_each_drv+0x24e/0x2e0 [ 179.379239][ T3082] __device_attach+0x333/0x520 [ 179.384015][ T3082] bus_probe_device+0x189/0x260 [ 179.388883][ T3082] device_add+0x856/0xbf0 [ 179.393235][ T3082] usb_new_device+0x104a/0x19a0 [ 179.398105][ T3082] hub_event+0x2d6d/0x5150 [ 179.402543][ T3082] process_scheduled_works+0xabe/0x18e0 [ 179.408108][ T3082] worker_thread+0x870/0xd30 [ 179.412714][ T3082] kthread+0x7a9/0x920 [ 179.416800][ T3082] ret_from_fork+0x4b/0x80 [ 179.421226][ T3082] ret_from_fork_asm+0x1a/0x30 [ 179.426002][ T3082] [ 179.428330][ T3082] Freed by task 3082: [ 179.432319][ T3082] kasan_save_track+0x3f/0x80 [ 179.437006][ T3082] kasan_save_free_info+0x40/0x50 [ 179.442044][ T3082] __kasan_slab_free+0x59/0x70 [ 179.446812][ T3082] kfree+0x196/0x430 [ 179.450707][ T3082] device_release+0x99/0x1c0 [ 179.455313][ T3082] kobject_put+0x22f/0x480 [ 179.459761][ T3082] hdm_disconnect+0xf3/0x1c0 [ 179.464361][ T3082] usb_unbind_interface+0x25b/0x940 [ 179.469571][ T3082] device_release_driver_internal+0x503/0x7c0 [ 179.475650][ T3082] bus_remove_device+0x34f/0x420 [ 179.480603][ T3082] device_del+0x57a/0x9b0 [ 179.484943][ T3082] usb_disable_device+0x3bf/0x850 [ 179.489975][ T3082] usb_disconnect+0x340/0x950 [ 179.494659][ T3082] hub_event+0x1ebc/0x5150 [ 179.499085][ T3082] process_scheduled_works+0xabe/0x18e0 [ 179.504639][ T3082] worker_thread+0x870/0xd30 [ 179.509244][ T3082] kthread+0x7a9/0x920 [ 179.513320][ T3082] ret_from_fork+0x4b/0x80 [ 179.517741][ T3082] ret_from_fork_asm+0x1a/0x30 [ 179.522508][ T3082] [ 179.524827][ T3082] The buggy address belongs to the object at ffff888031a1c000 [ 179.524827][ T3082] which belongs to the cache kmalloc-8k of size 8192 [ 179.538891][ T3082] The buggy address is located 6296 bytes inside of [ 179.538891][ T3082] freed 8192-byte region [ffff888031a1c000, ffff888031a1e000) [ 179.552879][ T3082] [ 179.555215][ T3082] The buggy address belongs to the physical page: [ 179.561721][ T3082] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31a18 [ 179.570485][ T3082] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 179.578990][ T3082] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 179.586534][ T3082] page_type: f5(slab) [ 179.590519][ T3082] raw: 00fff00000000040 ffff88801b042280 ffffea0001bf5200 dead000000000002 [ 179.599107][ T3082] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 179.607691][ T3082] head: 00fff00000000040 ffff88801b042280 ffffea0001bf5200 dead000000000002 [ 179.616359][ T3082] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 179.625028][ T3082] head: 00fff00000000003 ffffea0000c68601 ffffffffffffffff 0000000000000000 [ 179.633696][ T3082] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 179.642359][ T3082] page dumped because: kasan: bad access detected [ 179.648778][ T3082] page_owner tracks the page as allocated [ 179.654494][ T3082] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22817523877, free_ts 0 [ 179.674224][ T3082] post_alloc_hook+0x1f4/0x240 [ 179.678999][ T3082] get_page_from_freelist+0x3651/0x37a0 [ 179.684549][ T3082] __alloc_frozen_pages_noprof+0x292/0x710 [ 179.690362][ T3082] alloc_pages_mpol+0x311/0x660 [ 179.695313][ T3082] allocate_slab+0x8f/0x3a0 [ 179.699821][ T3082] ___slab_alloc+0xc27/0x14a0 [ 179.704500][ T3082] __slab_alloc+0x58/0xa0 [ 179.708832][ T3082] __kmalloc_cache_noprof+0x27b/0x390 [ 179.714207][ T3082] ipv4_sysctl_init_net+0x224/0x420 [ 179.719417][ T3082] ops_init+0x349/0x5b0 [ 179.723590][ T3082] register_pernet_operations+0x30d/0x630 [ 179.729319][ T3082] register_pernet_subsys+0x28/0x40 [ 179.734538][ T3082] sysctl_ipv4_init+0x51/0x90 [ 179.739219][ T3082] do_one_initcall+0x248/0x930 [ 179.743985][ T3082] do_initcall_level+0x157/0x210 [ 179.748924][ T3082] do_initcalls+0x71/0xd0 [ 179.753257][ T3082] page_owner free stack trace missing [ 179.758623][ T3082] [ 179.760952][ T3082] Memory state around the buggy address: [ 179.766590][ T3082] ffff888031a1d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.774653][ T3082] ffff888031a1d800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.782715][ T3082] >ffff888031a1d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.790779][ T3082] ^ [ 179.795627][ T3082] ffff888031a1d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.803680][ T3082] ffff888031a1d980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.811735][ T3082] ================================================================== [ 179.995139][ T3082] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 180.002485][ T3082] CPU: 1 UID: 0 PID: 3082 Comm: kworker/1:2 Not tainted 6.14.0-rc6-syzkaller-00205-g3571e8b091f4 #0 [ 180.013264][ T3082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 180.023333][ T3082] Workqueue: usb_hub_wq hub_event [ 180.028492][ T3082] Call Trace: [ 180.031789][ T3082] [ 180.034740][ T3082] dump_stack_lvl+0x241/0x360 [ 180.039439][ T3082] ? __pfx_dump_stack_lvl+0x10/0x10 [ 180.044649][ T3082] ? __pfx__printk+0x10/0x10 [ 180.049248][ T3082] ? preempt_schedule+0xe1/0xf0 [ 180.054105][ T3082] ? vscnprintf+0x5d/0x90 [ 180.058439][ T3082] panic+0x349/0x880 [ 180.062348][ T3082] ? check_panic_on_warn+0x21/0xb0 [ 180.067467][ T3082] ? __pfx_panic+0x10/0x10 [ 180.071912][ T3082] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 180.077931][ T3082] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 180.084266][ T3082] ? print_report+0x519/0x5b0 [ 180.088963][ T3082] check_panic_on_warn+0x86/0xb0 [ 180.093908][ T3082] ? hdm_disconnect+0x10d/0x1c0 [ 180.098762][ T3082] end_report+0x77/0x160 [ 180.103015][ T3082] kasan_report+0x154/0x180 [ 180.107536][ T3082] ? kobject_put+0x272/0x480 [ 180.112141][ T3082] ? hdm_disconnect+0x10d/0x1c0 [ 180.117005][ T3082] hdm_disconnect+0x10d/0x1c0 [ 180.121683][ T3082] usb_unbind_interface+0x25b/0x940 [ 180.126889][ T3082] ? kernfs_find_ns+0x2b8/0x340 [ 180.131747][ T3082] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 180.137475][ T3082] ? __pfx_usb_unbind_interface+0x10/0x10 [ 180.143197][ T3082] device_release_driver_internal+0x503/0x7c0 [ 180.149270][ T3082] bus_remove_device+0x34f/0x420 [ 180.154213][ T3082] device_del+0x57a/0x9b0 [ 180.158543][ T3082] ? __pfx_device_del+0x10/0x10 [ 180.163389][ T3082] ? __pfx___mutex_lock+0x10/0x10 [ 180.168417][ T3082] ? _raw_spin_lock_irq+0xdf/0x120 [ 180.173548][ T3082] usb_disable_device+0x3bf/0x850 [ 180.178582][ T3082] usb_disconnect+0x340/0x950 [ 180.183258][ T3082] hub_event+0x1ebc/0x5150 [ 180.187687][ T3082] ? debug_object_deactivate+0x2d5/0x390 [ 180.193341][ T3082] ? do_raw_spin_unlock+0x13c/0x8b0 [ 180.198550][ T3082] ? __pfx_hub_event+0x10/0x10 [ 180.203317][ T3082] ? __pfx_lock_acquire+0x10/0x10 [ 180.208353][ T3082] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 180.214337][ T3082] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 180.220678][ T3082] ? process_scheduled_works+0x9c6/0x18e0 [ 180.226406][ T3082] process_scheduled_works+0xabe/0x18e0 [ 180.231977][ T3082] ? __pfx_process_scheduled_works+0x10/0x10 [ 180.237967][ T3082] ? assign_work+0x364/0x3d0 [ 180.242568][ T3082] worker_thread+0x870/0xd30 [ 180.247172][ T3082] ? __kthread_parkme+0x169/0x1d0 [ 180.252207][ T3082] ? __pfx_worker_thread+0x10/0x10 [ 180.257327][ T3082] kthread+0x7a9/0x920 [ 180.261407][ T3082] ? __pfx_kthread+0x10/0x10 [ 180.266008][ T3082] ? __pfx_worker_thread+0x10/0x10 [ 180.271125][ T3082] ? __pfx_kthread+0x10/0x10 [ 180.275749][ T3082] ? __pfx_kthread+0x10/0x10 [ 180.280354][ T3082] ? __pfx_kthread+0x10/0x10 [ 180.284958][ T3082] ? _raw_spin_unlock_irq+0x23/0x50 [ 180.290166][ T3082] ? lockdep_hardirqs_on+0x99/0x150 [ 180.295378][ T3082] ? __pfx_kthread+0x10/0x10 [ 180.299981][ T3082] ret_from_fork+0x4b/0x80 [ 180.304408][ T3082] ? __pfx_kthread+0x10/0x10 [ 180.309012][ T3082] ret_from_fork_asm+0x1a/0x30 [ 180.313786][ T3082] [ 180.317188][ T3082] Kernel Offset: disabled [ 180.321512][ T3082] Rebooting in 86400 seconds..