last executing test programs: 4m40.326586302s ago: executing program 3 (id=2317): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) write$tun(0xffffffffffffffff, 0x0, 0x3e) socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x49) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0xf) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x40000102) setsockopt(r1, 0x84, 0x7f, &(0x7f0000000040)="02000000", 0x4) 4m38.210031181s ago: executing program 3 (id=2325): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x19, &(0x7f0000000540)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1dc7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f782db", 0xd}], 0x1}, 0x0) r2 = socket$kcm(0x2, 0x5, 0x84) close(0xffffffffffffffff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x84, 0x22, &(0x7f0000000000)=r3, 0x10) 4m37.158533504s ago: executing program 3 (id=2330): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300", 0x2e}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x300) 4m37.078415633s ago: executing program 3 (id=2331): openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x100) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="9343"], 0xfe33) sendmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)='@', 0x1}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$cont(0x20, r0, 0x0, 0x0) 4m35.77886252s ago: executing program 3 (id=2335): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c40)=@newtaction={0x2d4, 0x30, 0x300, 0x71bd22, 0x25dfdbff, {}, [{0x4}, {0x2bc, 0x1, [@m_connmark={0x110, 0x1c, 0x0, 0x0, {{0xd}, {0x90, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffe01, 0xeab9, 0x6, 0x7, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x1000, 0x3, 0x1, 0xffa}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x80, 0x3, 0x5, 0x5}, 0xd2a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0xfffffffe, 0x5, 0x9, 0x1}, 0x101}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x2, 0x0, 0x5}, 0x4}}]}, {0x51, 0x6, "06081f972c75dc3e25913a9244759758ca2a684b23ba369f326e9677ae093592efc91432f56b8e0350b6d1a51365ea0092ba6958035003b95cb308b5d3be914698f7857768baecea3ff93ebe0f"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_csum={0x1a8, 0x19, 0x0, 0x0, {{0x9}, {0x4}, {0x179, 0x6, "f0b8bf92cf8611111a0ff27fcc8825ca405600cfd0f6876d2892df6b5723118bb7d9d86de0a2706031cc8c62f7d1baf9b04f3a9ed11665c75023f87c16ce970413ede5e5f6782d0d17be877ac54c09075ed841c7daeddf3395a210eab4335ed3bcb36fe1598dc94259da01363ad59d8dc384cb8fe469869c99849bd0d19e999b2e8f62d563a2dcea91347cdc754302a566d6d8b7de1368972acbf9cfbdc3db5b71ceed91d4e9613e9cbf5e1ca71f3bf3b25cdf1ce11e5843ff89da11b01cf0b27474847e4fd8e648244e0dc6b3b99b8089d418ec3d6d27aa68b96ef236cc10ce12fb9c2fcd2426620f308c5e7fdb41bd5c78d6dfc482d978b6e7840a4280feab0b46813e74f89578a8084202486b4337e82b2790e39812421153e3352d7c704aa7333c65f298e8ce3466ac49f56e77602fe7e2c4667cb28a496da043ce93e094503497cad7145b73985b54e461016f5ecd42496334b73898ef674afffd9832a3f8df083e77ae2d16badf65e8b3525f750d4d6dcecf"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x2d4}, 0x1, 0x0, 0x0, 0x4000810}, 0x20040850) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 4m32.214753497s ago: executing program 3 (id=2344): r0 = syz_open_dev$dri(0x0, 0x1, 0x11f1c0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x10000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[]) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000e9ffffff0b0200000002000000000000120000"], 0x0, 0x33, 0x0, 0x2}, 0x28) lsetxattr$trusted_overlay_upper(0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0) quotactl_fd$Q_SYNC(r0, 0xffffffff80000102, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x8, 0x0, 0x1, [@broadcast]}, @IFLA_BOND_UPDELAY={0x8}]}}}]}, 0x44}}, 0x0) 4m16.528377484s ago: executing program 32 (id=2344): r0 = syz_open_dev$dri(0x0, 0x1, 0x11f1c0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x10000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[]) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000e9ffffff0b0200000002000000000000120000"], 0x0, 0x33, 0x0, 0x2}, 0x28) lsetxattr$trusted_overlay_upper(0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0) quotactl_fd$Q_SYNC(r0, 0xffffffff80000102, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x8, 0x0, 0x1, [@broadcast]}, @IFLA_BOND_UPDELAY={0x8}]}}}]}, 0x44}}, 0x0) 9.963896269s ago: executing program 4 (id=3281): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, r1) r2 = syz_open_procfs(0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r5 = fsopen(&(0x7f0000000300)='tracefs\x00', 0x0) socket$inet6(0xa, 0x800, 0x4000000) chdir(&(0x7f0000000480)='./cgroup\x00') fchmodat(r2, &(0x7f0000000300)='.\x00', 0xffffff70) mkdir(0x0, 0xff0c) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000580)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) dup2(r3, r3) sendmsg$alg(r1, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40010}, 0x0) 8.916860734s ago: executing program 2 (id=3284): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x41) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x46}, 0x28) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3", 0x4) accept4(r1, 0x0, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x4, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r2, 0x5) r3 = open(&(0x7f0000000280)='.\x00', 0x80, 0x122) fcntl$notify(r3, 0x402, 0x8000003d) fcntl$setown(r3, 0x8, 0xffffffffffffffff) 8.916509544s ago: executing program 4 (id=3285): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000200)=@security={'security\x00', 0x44, 0x4, 0x424, 0xffffffff, 0xc8, 0x294, 0xc8, 0xffffffff, 0xffffffff, 0x35c, 0x35c, 0x35c, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@private0, @mcast1, [0x0, 0x0, 0xffffffff], [], 'nr0\x00', 'veth0_vlan\x00'}, 0x203, 0xa4, 0xc8, 0x8502}, @common=@unspec=@CONNSECMARK={0x24, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xa4, 0x1cc}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, 'system_u:object_r:modem_device_t:s0\x00'}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @common=@unspec=@AUDIT={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x480) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000180)={0x5, 0x40, 0x0, 'queue0\x00'}) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000080)}], 0x1) 8.740917541s ago: executing program 4 (id=3287): r0 = socket$l2tp(0x2, 0x2, 0x73) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pselect6(0xa0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x80000000000300, 0x0, 0x0, 0x4, 0x80000000000}, 0x0, &(0x7f0000000100)={0x8, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) socket$inet6(0xa, 0x3, 0x6) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x47f, 0xc055, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x0, 0x4, 0x7, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x7, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0xc, 0x2, 0x6}}}}}]}}]}}, 0x0) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) syz_usb_disconnect(r2) r3 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b1a, 0x0) 7.660666616s ago: executing program 2 (id=3292): open(&(0x7f00000001c0)='./file0\x00', 0x16927e, 0x10) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) syz_usb_connect$cdc_ecm(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a44000000001010902"], 0x0) socket$kcm(0x10, 0x2, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x3, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002211c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}}, 0x0) 7.296552525s ago: executing program 0 (id=3294): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 7.143806664s ago: executing program 0 (id=3296): pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}], 0x1, 0x40) sendfile(r0, r2, 0x0, 0x10ffff) 7.06826243s ago: executing program 0 (id=3297): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) timerfd_create(0x4, 0x80800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x19ff, 0x0, &(0x7f0000000240), 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000001a40), 0x1003, r4}, 0x38) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r5, 0x10000002, 0x1001}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7a8, &(0x7f0000000000)={{@my=0x1}, @my=0x1, 0x0, 0x0, 0x421}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r6, 0x7a9, &(0x7f00000003c0)={{@my=0x1}, 0xfff, 0xffffffffffffffff, 0x0, 0x0, 0x80000, 0x2, 0x1000000000ff6, 0x58df}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x50) socket$kcm(0x2, 0xa, 0x2) 5.929579267s ago: executing program 1 (id=3299): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd364158a4591c559f76c0130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce74c4dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f00c484d339c480f70006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08ef74c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d3287a7b01ab84d336f3c0f45a0642d6f2c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d253e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd3153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be15579518540000bc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e99948a9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676080000007229e0237c1e34641848531712ff09e89fb062a3e66f4f3c9d7a7fc9aab1ced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a690bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b270a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b380380020000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000240)=ANY=[], 0xfdef) 5.805867495s ago: executing program 2 (id=3300): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) write$char_usb(r0, &(0x7f0000001300)='7', 0x1) 5.288532738s ago: executing program 4 (id=3301): syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000740)=@newtaction={0x80, 0x30, 0x9, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_bpf={0x68, 0x1, 0x0, 0x0, {{0x8}, {0x40, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {}, {0x3}, {}, {0x0, 0x0, 0xfe}, {}, {0x6}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x1, [], [], [], [0x0, 0x100000000]}) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = syz_usb_connect(0x2, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000544fb2f00090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSKEYCODE(r3, 0x40084504, &(0x7f0000000340)=[0x2a, 0xf0]) r4 = dup(r1) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0502103, 0xfffffffffffffffe) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000080)}) write$UHID_CREATE(r5, &(0x7f0000000b00)={0x0, {'syz1\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000040)=""/15, 0xf, 0xa0, 0x8, 0x3, 0x5, 0x1635}}, 0x120) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r5, &(0x7f0000000c40)={0x8, {"751be3c602a0e5276e79c086adc21270633fb3d067b21d544abb92036ecf489f5b3345ad3d6df45ba403e3d9b1137267182b6c67e967f54aaae1a43f4632e4e173f8ce97adfb7996e5cd702f546f95645b64fc34a8730dc2b3be9d88f47e1f6a862b07ab1d850e3e817f6005dabb3381780aa95a7c31cb78bf8721902712937891e9438cd773ef9e8c64c67bf47ea562d9f71def0c6ea559873b67cbdec5e83ec479104c3b3d54aa973d173522c9779135e0b5d91a1cdec65798dd915f2f59515b9335b256d166d9aace8f6c881272af4514796e6bc6549a4c65a0b1fe100f9136250d114800ff60013f6361bd7a772bdba813242130a6afcd8df14522aeb8ab20c8b7ceaae10e40c273c91c9c6462141ccb4f873279862524f0252c25aabc8386c3e404f0acd9033d24103d662d33be10a409713a13b557843396136ffc3111cbebac293d82cf913a5ea34a5b728d8da1f80327f4386ae7e9c2b6997638c372ef75f40a8688e8c74b2689dafb6b2ad2b3d6b7d558beb22a305e5904ac8a291f188334baeecbabd5d0431d63468e2d456a30da83ce133247a76e72cb1b8794e2967ef0bc18f8fdab10838b725840dba1817f2ba431b5f4ff40c19f5c36195afd79cba926416b0f94283ecb68aab6bf10a562cc3291fd5b2ce009f966fd0a94b388a6c172305e281cfeec6f8688b98b36e9910913b12d7e8c4bee96918f412d409a873a56d863df5c254afed14ce8a8c43fc84d2036b40879290f282faf06a2884c74a79594776f260618a245769ab877c1ef31e27878ea89e4ca8bdd646ce95bab8a7d5a1de735048639a2d3680126211dc9c20085dd8d715e647197a0187d03a985bf06c8da5fd961aa49645b88a927b2a2455cbda4dd3382dd2af7a9430b8606f984f4424d19562d14380b171ef1424b84ea1d22e31555b7758264962a6fa03d39c7887f47a91815189dc63ab0ecef4692b2983025bab06aad0c7ff178aa62cc882a482940f3767ea1c679176a9bd308222625570ce4ce1b49cef27a3e2f50fae9eea4a6819be790a685ede4a36d6eaba696cde1d5b7b05765b84d4b70f750aff9dd455106d816ca6324b85b07d2622150605472b72a36f503dc5e01a5390458747aa3f19c8db247b97cb14222b5e79cc6e3135be812bc8ca7c9a155852cef9dcf017ae378d9ecc9482b4857dc98c403beaf9f8bc4960292777fc58221ad46e9d5976ce2941e4fe427810dfb032c99cef90cf17f4e0083c986d66e0e170c2fea96a7360897a81a57921a9025dd021c2b0f6bbe08f8a49d8ac428a7074930bd2ef7ad28a0f17550b45bbfddd723b710994160bcc0ea2e92dbcbb114fefe22db643b9d392118ec05d7f48807ea1c4b5e39845d8207dc6b24d5d8a573034189b3563cdd14f102e2b41239ad1581a7839981d56cbdb7d8c843560272a075788603ec9b62aec5de81c734e3d8118e271179cfdb9e0ffb460519d769c05ad2b5044c2eca76a2c0824b5275c06b8715c0b6df6625a70ca14cc86ebc401f7abbd6d53e8e5d391371840510a9fb2d515be1bb1581a7e2b3a8610425da60d9ba8a841c324c3e1487036a20bc4d9149cbad2be5ed0e37f5cd21eb0d475f0c5730139d8b790e768ea169ef74069b6ccb4d09c78fcd1f1b791faef2218ce5e2707ffd0e38ada6a96a88a53dfc2ad72c9791a92d6a4d86f0f832062d62d3b425f260f654266196584729971fc3903d24300c9da725d47daa985bddff4b6fe301eb324bf6a35157bd79a0cf213398380de3bd91f583d537415afff80658992a949e433ff048c1d2495dec0461f0dd5bf4c8ac506268cd959f3493d37f8feb754062ca89398ade01f923c850eebc84ba9ee3d8c46d880d6f54f0ceafa451669c44b3e5c64411b0c855c94e8d3c345915412e041d284481e4242a1ae828345d76614979c252316b0f5eec34b98077cf89ff1834c25de73e83ad92873f2da115c02af04b71e7303e6289dbe76aaf9e5400dbbd9952c985283ff18aea8a7cab00ae650d21d235b62d9c21965c9888deebd4102bc75b95d33c6b5548f64c3c3f8fa256f21ab2577354221d5ddbc7247d46fb3532ed6322eef55aa24ac77797a38d1614923e24a9d70f6a24e0a1f28519a202fd91100f4d12ce61c37c819874bfbe5c61b4eb06c1b2b1cce56afaf16d560cf4ea727566f701e10233051dd633f4cca90c09c7aa733ecc0932d855abc08566dffe484de6d498c3625f7c2ba5bb12925d5f12e6194e21df4a4d69e1d0915963a04959348d49de928635128126557f8b5b87e1a47da42b311c47d3f0f969f069404e72d8a0d3cb0147ae6ee87abf994f384959eae9c7a91509f94f53098a8017d62bb1050b28c7976309957c34321d5a9520567970280714857904fb6e8f8c54fcdbb768028e4b37d47fd53ebd9cadb94baecbb54c78c81f7a80dd4c616df98d20ec22a0459844828c18eb7ec6d46cdc535266468bef9cfc6ce844b4b7ec9e3ff9e2619c05b477f72be3448f931312ff85727d8e1f48fbb978cb4b22bf959e97ebf4f25e19710f38a2c518702853410b32e74a68c98d58973a4a5c9d3d99c331f0d918a76fd047bb77a18eb655f72f6867cb3093438a26f080dbff4c4cd9544b9f401da3db9d235921a44c61e8292b83f83e8c9825d50bb0dbe32216e21733da8024343206e571c1d051daa670895566a9a218fb112ab2cdfa6a76bfd6374454ee1c211e5871d4186af9c7fef85af11c5b8a11774a1dd890ed2d5723b8698c339bc32473a1b5a9ec39b093ed24a3ec02b6455479bb34fa5a96c1b38fbe356c36b863e28d1234b64bcc0d071c790283b9b71137948776d6a60b67ff552d64286db810ecb90f1117dbedf6d2ce3162ec4ca4070333d1bce11419c13fdc1772ffe70fb03ad824f285660ec0c1985fff2441eddd0fa4b58dc53256ffa0df94a59a3c4165d4ae8bb883b23a8512d435e026da4583183d5147dfb2e05742803c6e9a3166f9dc40e1565887b3fd5d97c00b97b1ac542c23658d4ff03e8b9f3ecf3e35206e6ab3f38f26b70ee4e101f84ad6e3dce689ebdfa544b27af4a9a78667f6ef3564f1f0ffd0a9ed142c77961c7ae9c9a1b300023b6d79511e65d3db989052be9166b4bf9fc128b05fc500af7e7938f4e7ba7d67a117cde6c6330ca18d57150c2d51281df54d8735410805a92d4e5885a580124ecc54bc49bf451c6110a7fa195ae5691743bc4f0d3ab0a1e434884bbfbe8d0e8a5de217269c54f2f2415dbdb7e9285c7006c21cf3b593eefffd79c52c4a95da668651ed12ffe7ec0d2206588c452d107d543cf90f514a417d67b30082ed8ea7ab609d27b4ef9a7e3ac9c0d32020bca61f1df1c83e0b9625e7d6944f6d1fa3e388fb88dc0fd053fe1f1d2c5fa282a59eb2459475c6f1b556fbc791104a6707b8d37d81e7bdf158417f3e920d07d3b6ff305bafec00291c825ffc7d965e570094853389f6996ef02cc3e2f5ce3468e2d0a4ded990d372c2b234c3c1bbd6b6cff24ce474cdd98c42e7179295ac12740cefaf6e86898fb7180db31116ac7bb6d06a242f1fff5530ac7fc47f6593ac73c1a231a73e28d5b4b90d1a596b981675e4f7e0616095dffa6807c49c9d147f5a81b2822b128b035f4de8e017e54ac06e2e7dd52b3bbd778a76477dbe33e6fce5ae786879ba0739de0dee0987258912445664a405cb12a01bb94a97abccdc6d3afe7b61ba72b403a2e66c4c6b2cad20c427c0daf1d9d2dc57ccd502ff4993367dd0debcadee0e431e9115977e1c51a1905fb54268d25aa71cf056358f6d2c4c8bccdc675e350499f7776a15b41fb9e74d56ce3c82a28e9ee1815e039c6b18c8c551ddd46689e27e4c6b4ec384ee8d7fe1bd0ef40a6c288111fd61f00302f7dc442183e6dc0a2cdbbd6d43e061687989f9fef7ce54b238038461bf941a0706e2dfa8c069f4d90d1381a7429b3e692e346074c4de9e208f473a8794a6aaac2a297c29a396a28a10f4a5fa17863ed592fc39d7e8549af9f952366cee76372cf17812964c7322b370ff7f8f2074cc16b88b7cf8fd44bc3504c77efa6effb0813fe4f8ad6da76054d84d50bd9d7e1ff78b9afb4988d843d298515895d9aeaa29e496492097c79d0ecd887045cbd37cc476decc5836640d9a000e2a0a9e389dd6a996cea1dc0a7f62e2abf25d6ebee990ef19db33783d0485eaf43476b134d6873fd9a4f376ec2e4ae0993407683597ebd9376ca9d9d85d4399b3d24b8b6bf0e4910f257f6f54887f321a3768f82982144c5fe4fdf40068c3c71d34ffec82726e704c40f82f537d41b3621f06c1bb11b1665de3732df4f3eb727c04ad6b25910d9d97163119a2b72ff40109edbc58676682e0f86f75870b6f639d368d11aa1ceae80708288757db2389b16a4420008ce4a7a8487cbb7c922108a1acff54a0da5fc32c4c1e29a483e50ab9818c15c86a4997b4c8ef8dce08f633d2b558823a1c3476e61badcbb4ebcfd5f89f4075f093f5ea52c5c6f6c3025a8558ffb7c38a0662c05b8c44c0af1f15d3df1b1814255e27e9edec3346e2d59202fd643cf51a8ac5fe2a17579433afb9898cdba1c31c6083a8040064cd67c5012738660a09677e2b2156074a6586c76b86b745e7e209884185226fdbc2d826e2264e0b8d9e8896af60d82cc06452366c5dbf959e14a1a12b56bea30e35b1f50cdf95e37e0a5d272a792caec048947dd56abfe85271f0131e8d7f542525230ee0b005fe6bdec05a5f42c7027b555292374b210b7a6d72139574e10500f7db0914270d122ad93a0893c6875008e6b055a0358a48ef9b9309089323a110fcc7c5122c45401532c075957214dd6c86305819ead9cdcddec00faf31b0be040165aee5210c648eb7ac1d856dfce811391876735a05e71f2c8fa0beed3c5489897de524dd52da8a18c5a69d0be29a59dba736addf52ba02bb14121660f973a030d705480ae121b44f6d46441af124982c6b759389977e32de862bf409eeae3eaf7321c779b1c2e32080e031d854c34ce5413a098e18ac7a4b871985c83b0ba4fe68d82061923547d3ea28e004fab11afa63fcd5a6149c4bb3a2480061e5d58899a5d717893c0b73be62d4a42eb3fec479aea240fae76ef79561d4a7bf26c4f67cbe1659557f20f8fce0e183e2b4da3553741cbd764714d3e6ebec6ff0a9fb7efcd99bc71c3938b4142ca0a69faa54bab2b4f7b9143633fd6e9a26f7766b8353f491a0bcb62066df77faaaf7b639d9455bdc8937968c51848e4391c52db579a48dcc3a7f1406053bbf06ee64eb3a5b7d2e0c63efdd5edeef53820e3e52d3d12828e39d698095aa3c3cd84989fc7ca73e541ba7da40aa2297a5e3633096dfb81b5c2ec6fbeb894e41bce4e8ec5096326feece88f5a795cad6097ea7c91ec487092ebad33c06f355a195d64d17afe092a0d7ae2161ad3d33f863336ed1e4055f7f81c065230e0c1fa5b332cd6a57692f3b0f60115dcece23ee7c46a45ac79e8ec19ca091c98f06750c802b103480ebe72849b22b7419ea1e35999d0b374286c20fe64880fc5259c61e300d15659b9f6a43127aaf0587048ca9a4284b2e25f3d079ddc194a7bf12a211bdc8f969be78e6d9a686c8ebdec19bd3518a901fd9bc3ad02065f0b145a8b72abf97d7584c7ebe6054e36d6f095df5a0cfc80e82878c4a5845f31e8f351e7411b0c81880523040585881fd87424e6288fc4b877a39bb81a9a40200c8e7a438d944c268d12d7ff1f234d2a12001d3a97ad15da3d628a420bcecd3f365488120", 0x1000}}, 0x1006) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x5}, 0x0) 5.129566855s ago: executing program 5 (id=3302): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x12c, 0x0, 0x14}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0xfdff, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c) 4.995124927s ago: executing program 1 (id=3303): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x41) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x46}, 0x28) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3", 0x4) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x4, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r2, 0x5) r3 = open(&(0x7f0000000280)='.\x00', 0x80, 0x122) fcntl$notify(r3, 0x402, 0x8000003d) fcntl$setown(r3, 0x8, 0xffffffffffffffff) 4.863799036s ago: executing program 5 (id=3304): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000000c0)="ff07000000000000ab5becdc7da9", 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.711419343s ago: executing program 1 (id=3305): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x4, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0x0, 0x0, 0x0, 0x2}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x6, 0x1}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$cec(0x0, 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$vim2m(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYRES32], 0x44}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x8}]}}]}, 0x38}}, 0x40000) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000d00)={[&(0x7f0000000840)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) 4.387512113s ago: executing program 5 (id=3306): writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f00000000c0)="aa9c526a83560720c2631d8f55799becf25bb65e55d7f9be6e0aab5429a94f1a50a35a1f2b5cb19fc96a4ca6c211d918472c6753adcb45b860e0c9e40cea4e8c85ed353612cd83e172d44fee166a6c592421dda5fddbb309b698991dc6eb3d5a548d3280ca207db609827e15d8cb084dfc56113e7cfd27aca0135414ebc8ecb32de02037844426b96deff5457212a29b26891e2c504fd25da76534d45e67efd8", 0xa0}], 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@arm64={0x7, 0x6, 0x81, '\x00', 0x3c}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.12790106s ago: executing program 5 (id=3307): ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000000c0)={0x4, 0x0, [{0x6, 0x4, 0x8000, 0xc7da, 0x9}, {0x40000000, 0x8, 0x4772, 0x8, 0x4}, {0x0, 0xa, 0x3ff, 0xc0000000, 0x5}, {0x80000000, 0x6, 0x3, 0x9, 0x3}]}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'syztnl1\x00', 0x0}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x25dfdbfc, {0x7a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0xffffa888}, @IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}]}}}]}, 0x3c}}, 0x0) 2.812550266s ago: executing program 2 (id=3308): r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r1 = dup(r0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x4004) dup(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@local, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xfffc, 0x0, 0xfffe, 0x0, 0xa}, {0x0, 0x0, 0x4, 0x0, 0x9, 0x20000005}, {0xfaf5, 0x4, 0x0, 0x400000000a789}, 0xfffffffe, 0x0, 0x1}, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3, 0x32}, 0x0, @in=@loopback, 0x0, 0x3, 0x1, 0x7, 0x700, 0x1000}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) 2.812008365s ago: executing program 5 (id=3309): socket$inet(0x2, 0x1, 0x100) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000c40)={'vxcan0\x00'}) socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185648, &(0x7f0000000100)={0xa00000, 0x1, 0x49, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x9e69, '\x00', @ptr=0x6}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\b\x00'/18, @ANYRES32, @ANYBLOB='\x00'/14], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000957494e382b01b15c8a7399b9a9f3f190800000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r6 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) tkill(r6, 0xb) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r7, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) 2.162725917s ago: executing program 0 (id=3310): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x3}, 0x4) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x801, 0xf84, 0x3}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0xffff, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x2d, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x2b, [0x8000, 0xc95a, 0xffffdff3, 0x1, 0x80, 0x6, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x800, 0x5, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x24, 0x9, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x242, 0xc, 0xe, 0x0, 0x71, 0x7, 0x7, 0x3, 0x2, 0x8005, 0x3f, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x3, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x9, 0x3, 0x3, 0x8000, 0x9, 0x400, 0x401, 0x6, 0x1, 0x8, 0x5, 0x10005, 0x5f31, 0x4, 0x0, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x7, 0x28, 0x1, 0xfe000000, 0xffff, 0x2, 0x7, 0x9, 0x3ff, 0x3, 0x9, 0x1, 0x7, 0x3, 0x9, 0x48c93690, 0x12000000, 0x2], [0x100007, 0x4, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x2, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x8, 0x8, 0x86, 0x10000003, 0x1000, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x5, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0x83, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x2ac8, 0xbf, 0x2, 0x3, 0x7ff, 0xfffffff9, 0x0, 0x1, 0xffff, 0x0, 0x4, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0x25], [0x9, 0x6, 0x3, 0xb, 0x5, 0x934, 0x6, 0x6, 0x0, 0xbdfe, 0xce7, 0x1ff, 0xfffffffe, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x8003, 0xffff, 0x81, 0xff, 0x5, 0x1, 0xfffffffe, 0x14c, 0x60a7, 0xa71d, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x3ff, 0x9602, 0x7, 0x2, 0x7, 0x6, 0x1, 0x10080, 0x5, 0x8, 0x30b1d693, 0xa23, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x2, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 1.607041306s ago: executing program 4 (id=3311): r0 = syz_open_dev$cec(0x0, 0x0, 0x180) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x1, 0x6, 0x2, 0x0, 0x0, "f700", '\x00\x00\a\x00', "030100", "fcffffff", ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ff0d00ffff00", "0c436d743c97c443084000", "ff81000000008000"]}) 1.368713726s ago: executing program 4 (id=3312): timer_create(0x8, &(0x7f00000002c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) geteuid() bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000009c0)={'lo\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000190001008f09000000000000f8ffffffffffffff00000000"], 0x1c}}, 0x0) openat$vicodec0(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0", 0x8e, 0x0, 0x0, 0x0) timer_create(0x4, 0x0, &(0x7f0000000280)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000080)={0x4, 0x2, 0x7b1, 0x3a, 0x0, "4d1ad4edf02624a6"}) 1.044394933s ago: executing program 0 (id=3313): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd364158a4591c559f76c0130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce74c4dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f00c484d339c480f70006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08ef74c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d3287a7b01ab84d336f3c0f45a0642d6f2c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d253e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd3153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be15579518540000bc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e99948a9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676080000007229e0237c1e34641848531712ff09e89fb062a3e66f4f3c9d7a7fc9aab1ced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a690bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b270a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b380380020000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000240)=ANY=[], 0xfdef) 694.416227ms ago: executing program 2 (id=3314): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x12c, 0x0, 0x14}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0xfdff, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c) 634.159112ms ago: executing program 0 (id=3315): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x41) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x46}, 0x28) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x4, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r2, 0x5) r3 = open(&(0x7f0000000280)='.\x00', 0x80, 0x122) fcntl$notify(r3, 0x402, 0x8000003d) fcntl$setown(r3, 0x8, 0xffffffffffffffff) 532.671793ms ago: executing program 1 (id=3316): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="ff07000000000000ab5becdc7da9", 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 324.347214ms ago: executing program 1 (id=3317): writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f00000000c0)="aa9c526a83560720c2631d8f55799becf25bb65e55d7f9be6e0aab5429a94f1a50a35a1f2b5cb19fc96a4ca6c211d918472c6753adcb45b860e0c9e40cea4e8c85ed353612cd83e172d44fee166a6c592421dda5fddbb309b698991dc6eb3d5a548d3280ca207db609827e15d8cb084dfc56113e7cfd27aca0135414ebc8ecb32de02037844426b96deff5457212a29b26891e2c504fd25da76534d45e67efd8", 0xa0}], 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@arm64={0x7, 0x6, 0x81, '\x00', 0x3c}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_RUN(r3, 0xae80, 0x0) 258.149565ms ago: executing program 2 (id=3318): pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000300)={0x18, 0x0, 0x0, {0xfffffffffffffffa}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f0000002100)=ANY=[@ANYBLOB="b0000000000000001659ec0889419429aa5db97288b0f8a87ea8e66d9a"], 0xb0) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="10"], 0x10) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) write$FUSE_INIT(r3, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@posixacl}]}}) 9.105629ms ago: executing program 1 (id=3319): ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000000c0)={0x4, 0x0, [{0x6, 0x4, 0x8000, 0xc7da, 0x9}, {0x40000000, 0x8, 0x4772, 0x8, 0x4}, {0x0, 0xa, 0x3ff, 0xc0000000, 0x5}, {0x80000000, 0x6, 0x3, 0x9, 0x3}]}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'syztnl1\x00', 0x0}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x25dfdbfc, {0x7a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0xffffa888}, @IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}]}}}]}, 0x3c}}, 0x0) 0s ago: executing program 5 (id=3320): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000002640), 0x4) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x1508}, 0x1, 0x0, 0x0, 0x24000080}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, 0x0, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0x11, 0x0, 0x11) kernel console output (not intermixed with test programs): tributes in process `syz.0.1668'. [ 498.384128][T11007] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1673'. [ 499.286457][T11026] netlink: 120 bytes leftover after parsing attributes in process `syz.1.1679'. [ 500.505313][T11039] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 500.515502][T11039] ubi: mtd0 is already attached to ubi31 [ 500.990306][T11041] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1686'. [ 501.007996][T11048] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.567058][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.567154][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.734761][T11059] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1694'. [ 503.011092][ T5956] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 503.016213][T11087] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1704'. [ 503.381438][ T10] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 503.453895][ T5956] usb 1-1: Using ep0 maxpacket: 16 [ 503.534540][ T5956] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 503.553884][ T5956] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 503.601547][ T5956] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 503.614242][ T5956] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.636246][ T10] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 503.641706][T11092] netlink: 120 bytes leftover after parsing attributes in process `syz.2.1706'. [ 503.654929][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.664381][ T5956] usb 1-1: Product: syz [ 503.688723][ T5956] usb 1-1: Manufacturer: syz [ 503.693425][ T5956] usb 1-1: SerialNumber: syz [ 503.715804][ T10] usb 5-1: config 0 descriptor?? [ 503.734860][ T10] cp210x 5-1:0.0: cp210x converter detected [ 503.838574][T11101] vivid-002: disconnect [ 503.843263][T11100] vivid-002: reconnect [ 503.940715][ T5956] usb 1-1: cannot find UAC_HEADER [ 503.953974][ T10] cp210x 5-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 503.962738][ T10] cp210x 5-1:0.0: querying part number failed [ 503.987978][ T10] usb 5-1: cp210x converter now attached to ttyUSB0 [ 504.003414][ T5956] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 504.015555][ T5956] usb 1-1: USB disconnect, device number 26 [ 505.254970][T11118] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1717'. [ 505.265695][T11119] netlink: 252 bytes leftover after parsing attributes in process `syz.3.1716'. [ 505.352861][T11121] netlink: 120 bytes leftover after parsing attributes in process `syz.1.1719'. [ 505.403728][T11124] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1721'. [ 505.418691][ T5835] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 505.523007][T11131] vivid-001: disconnect [ 505.730716][ T5835] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 505.741388][ T5835] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 505.753094][ T5835] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 505.763018][ T5835] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 505.779560][ T5835] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 505.789130][ T5835] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 505.797494][ T5835] usb 1-1: Manufacturer: syz [ 505.807386][ T5835] usb 1-1: config 0 descriptor?? [ 505.841979][T11141] syz.1.1725: attempt to access beyond end of device [ 505.841979][T11141] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 505.858183][T11141] SQUASHFS error: Failed to read block 0x0: -5 [ 505.864795][T11141] unable to read squashfs_super_block [ 505.942624][T11141] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 505.947177][ T5956] usb 5-1: USB disconnect, device number 12 [ 505.996351][ T5956] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 506.018492][ T5956] cp210x 5-1:0.0: device disconnected [ 506.169250][ T5835] rc_core: IR keymap rc-hauppauge not found [ 506.175326][ T5835] Registered IR keymap rc-empty [ 506.197210][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.249155][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.290320][ T5835] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 506.323503][T11153] netlink: 252 bytes leftover after parsing attributes in process `syz.3.1731'. [ 506.331525][ T5835] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input18 [ 506.383333][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.438598][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.477079][T11156] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1732'. [ 506.488618][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.508870][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.541975][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.550862][T11158] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1733'. [ 506.588645][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.612791][T11160] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1734'. [ 506.631101][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.690828][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.729812][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.758746][ T5835] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 506.780551][ T5835] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 506.798772][ T5835] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 506.801102][T11167] vivid-004: disconnect [ 506.822344][ T5835] usb 1-1: USB disconnect, device number 27 [ 506.862841][T11166] vivid-004: reconnect [ 507.734832][T11197] vivid-004: disconnect [ 507.743056][T11196] vivid-004: reconnect [ 508.098676][T11217] __nla_validate_parse: 4 callbacks suppressed [ 508.098697][T11217] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1759'. [ 509.081822][T11231] vivid-003: disconnect [ 509.619384][ T10] libceph: connect (1)[c::]:6789 error -101 [ 509.633269][T11247] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1770'. [ 509.672889][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 509.685341][T11246] ceph: No mds server is up or the cluster is laggy [ 510.004927][ T10] libceph: connect (1)[c::]:6789 error -101 [ 510.064477][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 512.441491][T11268] netlink: 'syz.4.1773': attribute type 1 has an invalid length. [ 513.183226][T11278] netlink: 120 bytes leftover after parsing attributes in process `syz.1.1778'. [ 513.585979][T11289] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1783'. [ 515.476922][T11317] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1791'. [ 515.840316][T11327] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1796'. [ 515.879859][T11329] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1798'. [ 518.461795][T11354] netlink: 120 bytes leftover after parsing attributes in process `syz.1.1805'. [ 518.604225][T11360] cgroup: fork rejected by pids controller in /syz0 [ 518.847809][T11372] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1812'. [ 521.241404][T11402] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1825'. [ 523.628227][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 524.249298][ T5834] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 524.341356][ T5834] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 524.466010][ T5834] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 524.492380][ T5834] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 524.982487][ T5854] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 524.996905][ T5854] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 525.007544][ T5854] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 525.018151][ T5854] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 525.030626][ T5854] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 525.130316][T11424] lo speed is unknown, defaulting to 1000 [ 526.561536][T11424] chnl_net:caif_netlink_parms(): no params data found [ 527.079495][ T5834] Bluetooth: hci2: command tx timeout [ 527.476384][T11424] bridge0: port 1(bridge_slave_0) entered blocking state [ 527.505858][T11424] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.518541][ T5835] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 527.532170][T11424] bridge_slave_0: entered allmulticast mode [ 527.542660][T11424] bridge_slave_0: entered promiscuous mode [ 527.555134][T11424] bridge0: port 2(bridge_slave_1) entered blocking state [ 527.566771][T11424] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.579392][T11424] bridge_slave_1: entered allmulticast mode [ 527.587670][T11424] bridge_slave_1: entered promiscuous mode [ 527.664500][T11424] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 527.691982][ T5835] usb 5-1: Using ep0 maxpacket: 32 [ 527.701890][T11424] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 527.725799][ T5835] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 527.754940][ T5835] usb 5-1: config 0 has no interface number 0 [ 527.788609][ T5835] usb 5-1: config 0 interface 12 has no altsetting 0 [ 527.855535][T11471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1843'. [ 527.905607][ T5835] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 528.512138][ T5835] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.529266][ T5835] usb 5-1: Product: syz [ 528.538950][ T5835] usb 5-1: Manufacturer: syz [ 528.545127][ T5835] usb 5-1: SerialNumber: syz [ 528.574766][ T5835] usb 5-1: config 0 descriptor?? [ 528.866779][T11424] team0: Port device team_slave_0 added [ 528.953270][T11424] team0: Port device team_slave_1 added [ 529.158573][ T5834] Bluetooth: hci2: command tx timeout [ 529.225085][T11480] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 529.235143][T11480] ubi: mtd0 is already attached to ubi31 [ 529.935700][T11483] xt_bpf: check failed: parse error [ 531.283536][ T5834] Bluetooth: hci2: command tx timeout [ 531.310490][T11488] xt_CT: No such helper "snmp" [ 531.485981][T11424] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 531.510822][T11424] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 531.540131][T11491] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1849'. [ 531.571251][T11424] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 531.633562][T11424] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 531.645269][T11424] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 531.680053][T11424] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 532.510019][ T5835] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 532.517720][ T5835] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 532.528972][ T5835] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 532.536757][ T5835] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 532.554868][ T5835] usb 5-1: USB disconnect, device number 13 [ 532.596280][T11424] hsr_slave_0: entered promiscuous mode [ 532.641295][T11424] hsr_slave_1: entered promiscuous mode [ 532.647941][T11424] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 532.656851][T11424] Cannot create hsr debugfs directory [ 532.791694][T11507] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1855'. [ 533.269536][T11515] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 533.278337][T11515] ubi: mtd0 is already attached to ubi31 [ 533.929582][ T5834] Bluetooth: hci2: command tx timeout [ 534.026063][T11518] netlink: 'syz.2.1854': attribute type 1 has an invalid length. [ 534.895198][T11526] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1861'. [ 535.543649][T11424] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.600404][ T93] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 535.683672][T11424] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.685500][T11545] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1869'. [ 535.762580][ T93] usb 4-1: Using ep0 maxpacket: 32 [ 535.791337][ T93] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 535.810035][ T93] usb 4-1: config 0 has no interface number 0 [ 535.817944][ T93] usb 4-1: config 0 interface 12 has no altsetting 0 [ 535.820440][T11424] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.834345][ T93] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 535.854822][ T93] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.873214][ T93] usb 4-1: Product: syz [ 535.878536][ T93] usb 4-1: Manufacturer: syz [ 535.883189][ T93] usb 4-1: SerialNumber: syz [ 535.904373][ T93] usb 4-1: config 0 descriptor?? [ 536.125726][T11424] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.236939][T11553] netlink: 'syz.4.1872': attribute type 1 has an invalid length. [ 537.089802][T11555] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1873'. [ 537.101084][ T93] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 537.127490][ T93] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 537.142295][ T93] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 537.165480][T11557] bond0: entered promiscuous mode [ 537.175087][ T93] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 537.183292][T11557] bond_slave_0: entered promiscuous mode [ 537.191083][T11557] bond_slave_1: entered promiscuous mode [ 537.202870][ T93] usb 4-1: USB disconnect, device number 12 [ 537.311859][T11424] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 537.347520][T11424] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 537.367831][T11424] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 537.385871][T11424] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 539.175552][T11424] 8021q: adding VLAN 0 to HW filter on device bond0 [ 539.283955][T11424] 8021q: adding VLAN 0 to HW filter on device team0 [ 539.323897][ T6008] bridge0: port 1(bridge_slave_0) entered blocking state [ 539.331464][ T6008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 539.935454][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 539.942933][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 539.965007][T11577] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1880'. [ 540.157012][T11424] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 540.251270][T11424] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 540.968858][T11592] can0: slcan on ttyS3. [ 541.118403][T11593] can0 (unregistered): slcan off ttyS3. [ 541.175165][T11601] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1885'. [ 541.288898][T11597] netlink: 'syz.2.1883': attribute type 1 has an invalid length. [ 541.736736][T11612] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 541.747016][T11612] ubi: mtd0 is already attached to ubi31 [ 544.478964][ T6155] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 544.889962][ T6155] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 544.922422][ T6155] usb 3-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 544.933019][ T6155] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.967469][ T6155] usb 3-1: config 0 descriptor?? [ 544.982183][T11618] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 545.019069][T11424] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 545.156009][T11424] veth0_vlan: entered promiscuous mode [ 545.175801][T11424] veth1_vlan: entered promiscuous mode [ 545.265446][T11640] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1899'. [ 545.283012][T11424] veth0_macvtap: entered promiscuous mode [ 545.309986][T11424] veth1_macvtap: entered promiscuous mode [ 545.498812][ T6155] elan 0003:04F3:0755.0003: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.2-1/input0 [ 545.526462][T11424] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 545.596268][T11645] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 545.606367][T11645] ubi: mtd0 is already attached to ubi31 [ 546.246118][T11424] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 546.267524][T11424] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.289117][ T6155] usb 3-1: USB disconnect, device number 23 [ 546.332685][T11424] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.361033][T11424] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.391606][T11424] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.632028][T11655] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1904'. [ 546.846654][T11658] netlink: 'syz.3.1901': attribute type 1 has an invalid length. [ 547.849456][ T5982] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 547.923284][ T5982] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 548.609545][ T6465] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 548.677741][ T6465] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 549.771114][T11675] syz.1.1907: attempt to access beyond end of device [ 549.771114][T11675] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 549.893465][T11683] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1913'. [ 549.916402][T11677] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 549.965439][T11675] SQUASHFS error: Failed to read block 0x0: -5 [ 549.983868][T11687] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1915'. [ 549.999461][T11687] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1915'. [ 550.014612][T11675] unable to read squashfs_super_block [ 551.058960][ T5956] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 551.091095][T11697] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1917'. [ 551.388324][ T5956] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 551.464826][ T5956] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 551.537847][ T5956] usb 5-1: config 1 has no interface number 0 [ 551.597219][ T5956] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 551.715908][ T5956] usb 5-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 551.844382][ T5956] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 552.093450][ T5956] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.109564][ T5956] usb 5-1: Product: syz [ 552.114107][ T5956] usb 5-1: Manufacturer: syz [ 552.128743][ T5956] usb 5-1: SerialNumber: syz [ 552.980831][ T5956] cdc_ncm 5-1:1.1: failed GET_NTB_PARAMETERS [ 552.987141][ T5956] cdc_ncm 5-1:1.1: bind() failure [ 553.019294][ T5956] usb 5-1: USB disconnect, device number 14 [ 554.148116][T11728] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1925'. [ 555.195166][T11739] netlink: 'syz.2.1930': attribute type 1 has an invalid length. [ 555.927773][T11746] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1931'. [ 557.573655][ T5835] IPVS: starting estimator thread 0... [ 557.769597][T11764] IPVS: using max 31 ests per chain, 74400 per kthread [ 557.783276][T11767] syz.4.1938: attempt to access beyond end of device [ 557.783276][T11767] nbd4: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 557.808789][T11767] SQUASHFS error: Failed to read block 0x0: -5 [ 557.815135][T11767] unable to read squashfs_super_block [ 557.943069][T11767] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 558.369096][T11787] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1945'. [ 558.422774][T11787] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1945'. [ 558.642338][T11791] netlink: 'syz.3.1944': attribute type 1 has an invalid length. [ 562.079634][ T6155] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 562.312715][ T6155] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 562.331363][ T6155] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.393082][ T6155] usb 4-1: config 0 descriptor?? [ 562.417447][ T6155] cp210x 4-1:0.0: cp210x converter detected [ 562.884264][T11833] netlink: 'syz.2.1958': attribute type 1 has an invalid length. [ 563.005887][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.012622][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.460849][ T6155] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 563.466034][T11831] xt_bpf: check failed: parse error [ 563.492578][ T6155] cp210x 4-1:0.0: failed to get vendor val 0x370c size 73: -32 [ 563.500725][ T6155] cp210x 4-1:0.0: GPIO initialisation failed: -32 [ 563.820760][ T6155] usb 4-1: cp210x converter now attached to ttyUSB0 [ 563.873666][ T6155] usb 4-1: USB disconnect, device number 13 [ 563.899741][ T6155] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 563.919577][ T6155] cp210x 4-1:0.0: device disconnected [ 566.522023][T11864] syz.3.1967: attempt to access beyond end of device [ 566.522023][T11864] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 566.645939][T11864] SQUASHFS error: Failed to read block 0x0: -5 [ 566.668254][T11864] unable to read squashfs_super_block [ 566.695838][T11865] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 566.968921][ T93] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 567.081839][T11877] netlink: 'syz.2.1972': attribute type 1 has an invalid length. [ 567.692323][ T93] usb 2-1: Using ep0 maxpacket: 16 [ 567.710632][ T93] usb 2-1: config 0 has no interfaces? [ 567.745414][ T93] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 567.785098][ T93] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 567.818233][ T93] usb 2-1: SerialNumber: syz [ 567.837236][ T93] usb 2-1: config 0 descriptor?? [ 568.087512][T11867] vlan2: entered promiscuous mode [ 569.380739][T10870] usb 2-1: USB disconnect, device number 20 [ 572.502608][ T24] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 572.659900][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 572.677785][ T24] usb 1-1: config 0 has no interfaces? [ 572.685187][ T24] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 572.698466][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 572.707512][ T24] usb 1-1: SerialNumber: syz [ 572.716256][ T24] usb 1-1: config 0 descriptor?? [ 572.909336][T11967] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2008'. [ 572.948157][T11942] bond_slave_0: entered promiscuous mode [ 572.954318][T11942] bond_slave_1: entered promiscuous mode [ 572.974579][T11942] vlan2: entered promiscuous mode [ 572.985496][T11942] bond0: entered promiscuous mode [ 573.277480][ T24] usb 1-1: USB disconnect, device number 28 [ 574.545781][T11980] netlink: 'syz.2.2010': attribute type 10 has an invalid length. [ 574.590515][T11980] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 576.109034][T12010] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2018'. [ 576.379035][T10870] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 576.622300][T10870] usb 1-1: Using ep0 maxpacket: 32 [ 576.703795][T10870] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 576.852624][T10870] usb 1-1: config 0 has no interface number 0 [ 576.967455][T10870] usb 1-1: config 0 interface 12 has no altsetting 0 [ 577.045331][T10870] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 577.074936][T10870] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.214582][T12026] NILFS (nullb0): couldn't find nilfs on the device [ 577.259281][T10870] usb 1-1: Product: syz [ 577.311144][T10870] usb 1-1: Manufacturer: syz [ 577.562334][T10870] usb 1-1: SerialNumber: syz [ 577.737195][T10870] usb 1-1: config 0 descriptor?? [ 578.378544][T12039] netlink: 'syz.4.2029': attribute type 1 has an invalid length. [ 579.335412][T10870] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 579.381219][T10870] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 579.408597][T10870] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 579.426622][T10870] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 579.488697][T10870] usb 1-1: USB disconnect, device number 29 [ 579.677904][T12051] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2034'. [ 579.715314][ T24] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 580.947757][ T24] usb 4-1: device descriptor read/all, error -71 [ 582.367091][T12074] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2039'. [ 583.970357][ T24] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 584.245953][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 584.282568][ T24] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 584.313101][ T24] usb 2-1: config 0 has no interface number 0 [ 584.337444][ T24] usb 2-1: config 0 interface 12 has no altsetting 0 [ 584.359436][ T24] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 584.383967][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.426407][ T24] usb 2-1: Product: syz [ 584.440932][ T24] usb 2-1: Manufacturer: syz [ 584.455920][ T24] usb 2-1: SerialNumber: syz [ 584.470537][ T24] usb 2-1: config 0 descriptor?? [ 584.504561][T12108] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2051'. [ 584.528611][ T93] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 585.373084][ T93] usb 1-1: Using ep0 maxpacket: 16 [ 585.385886][ T93] usb 1-1: config 0 has no interfaces? [ 585.394364][ T93] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 585.404370][ T93] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 585.413013][ T93] usb 1-1: SerialNumber: syz [ 585.426060][ T93] usb 1-1: config 0 descriptor?? [ 585.632864][ T24] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 585.719983][T12104] vlan2: entered promiscuous mode [ 585.765844][ T24] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 585.822454][ T24] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 585.891778][ T24] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 585.897409][ T5956] usb 1-1: USB disconnect, device number 30 [ 586.121136][ T24] usb 2-1: USB disconnect, device number 21 [ 588.214912][T12149] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2063'. [ 588.770406][ T5956] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 588.778506][ T24] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 588.928612][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 588.948984][ T5956] usb 5-1: Using ep0 maxpacket: 32 [ 588.977409][ T5956] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 589.015488][ T5956] usb 5-1: config 0 has no interface number 0 [ 589.058987][ T5956] usb 5-1: config 0 interface 12 has no altsetting 0 [ 589.116895][ T5956] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 589.169894][ T5956] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.221042][ T5956] usb 5-1: Product: syz [ 589.247767][ T5956] usb 5-1: Manufacturer: syz [ 589.278214][ T5956] usb 5-1: SerialNumber: syz [ 589.426958][ T5956] usb 5-1: config 0 descriptor?? [ 589.624376][ T24] usb 4-1: config 0 has no interfaces? [ 589.634824][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 589.650216][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 589.675057][ T24] usb 4-1: SerialNumber: syz [ 589.689361][ T24] usb 4-1: config 0 descriptor?? [ 589.920662][T12162] bond_slave_0: entered promiscuous mode [ 589.926631][T12162] bond_slave_1: entered promiscuous mode [ 589.971292][T12162] vlan2: entered promiscuous mode [ 589.990443][T12162] bond0: entered promiscuous mode [ 590.563811][ T5956] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 590.664549][T12127] usb 4-1: USB disconnect, device number 16 [ 590.757917][ T5956] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 590.766217][ T5956] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 590.774605][ T5956] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 590.787568][ T5956] usb 5-1: USB disconnect, device number 15 [ 591.278772][ T5956] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 592.650813][ T5956] usb 1-1: config 0 has no interfaces? [ 592.670287][ T5956] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 592.688399][ T5956] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.696466][ T5956] usb 1-1: Product: syz [ 593.283099][ T5956] usb 1-1: Manufacturer: syz [ 593.289464][ T5956] usb 1-1: SerialNumber: syz [ 593.308446][ T5956] usb 1-1: config 0 descriptor?? [ 593.503223][T12202] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2084'. [ 593.542409][T12202] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2084'. [ 593.659403][ T9] usb 1-1: USB disconnect, device number 31 [ 595.153610][T12216] tipc: Started in network mode [ 595.192290][T12216] tipc: Node identity 4, cluster identity 4711 [ 595.216207][T12216] tipc: Node number set to 4 [ 595.260088][T12221] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2090'. [ 595.296798][T12221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2090'. [ 596.218458][ T9] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 596.328555][ T5911] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 596.713011][T12240] overlayfs: failed to clone upperpath [ 597.208805][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 597.229496][ T9] usb 4-1: config 0 has no interfaces? [ 597.250846][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 597.290653][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 597.347899][ T9] usb 4-1: SerialNumber: syz [ 597.358479][ T5911] usb 1-1: Using ep0 maxpacket: 32 [ 597.367316][ T9] usb 4-1: config 0 descriptor?? [ 597.604318][T12225] vlan2: entered promiscuous mode [ 597.782528][T12250] overlayfs: failed to clone upperpath [ 598.426263][ T5911] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 598.448476][ T5911] usb 1-1: config 0 has no interface number 0 [ 598.454763][ T5911] usb 1-1: config 0 interface 12 has no altsetting 0 [ 598.610465][T10870] usb 4-1: USB disconnect, device number 17 [ 599.188483][ T5911] usb 1-1: string descriptor 0 read error: -71 [ 599.290662][ T5911] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 599.300018][ T5911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.320881][ T5911] usb 1-1: config 0 descriptor?? [ 599.326573][ T5911] usb 1-1: can't set config #0, error -71 [ 599.348779][ T5911] usb 1-1: USB disconnect, device number 32 [ 599.512858][T12272] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2104'. [ 599.523759][T12269] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2104'. [ 600.653842][T12279] syz.0.2106: attempt to access beyond end of device [ 600.653842][T12279] nbd0: rw=0, sector=16, nr_sectors = 1 limit=0 [ 600.667395][T12279] qnx6: unable to read the first superblock [ 600.674817][T12279] syz.0.2106: attempt to access beyond end of device [ 600.674817][T12279] nbd0: rw=0, sector=0, nr_sectors = 1 limit=0 [ 600.687799][T12279] qnx6: unable to read the first superblock [ 600.694103][T12279] qnx6: unable to read the first superblock [ 602.491702][T12302] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 605.120025][T12319] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2119'. [ 605.209240][T12319] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2119'. [ 618.523024][T12463] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 623.749153][T12524] hub 9-0:1.0: USB hub found [ 623.755388][T12524] hub 9-0:1.0: 1 port detected [ 623.838499][T10870] usb 5-1: new low-speed USB device number 16 using dummy_hcd [ 623.970584][T12539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2188'. [ 623.983845][T12539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2188'. [ 624.000695][T10870] usb 5-1: unable to get BOS descriptor or descriptor too short [ 624.017043][T12539] syz_tun: entered promiscuous mode [ 624.043143][T10870] usb 5-1: config 2 has an invalid interface number: 224 but max is 0 [ 624.056196][T10870] usb 5-1: config 2 has no interface number 0 [ 624.066885][T12539] syz_tun: left promiscuous mode [ 624.076710][T10870] usb 5-1: string descriptor 0 read error: -22 [ 624.086065][T10870] usb 5-1: New USB device found, idVendor=046d, idProduct=0850, bcdDevice=f7.48 [ 624.097104][T10870] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.117691][T10870] gspca_main: STV06xx-2.14.0 probing 046d:0850 [ 624.453267][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.459967][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.501864][T10870] usb 5-1: USB disconnect, device number 16 [ 627.758837][T12602] netlink: 'syz.0.2210': attribute type 4 has an invalid length. [ 627.884024][T12577] lo speed is unknown, defaulting to 1000 [ 633.600535][T12644] 9pnet: Could not find request transport: fd0x0000000000000004 [ 635.909126][T12655] fuse: Unknown parameter 'group_id00000000000000000000' [ 640.448433][ T93] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 640.658391][ T93] usb 2-1: Using ep0 maxpacket: 8 [ 641.087520][ T93] usb 2-1: unable to get BOS descriptor or descriptor too short [ 641.105424][ T93] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 113, changing to 10 [ 641.153405][ T93] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 641.158920][T12707] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2242'. [ 641.199438][ T93] usb 2-1: config 1 interface 0 has no altsetting 0 [ 641.225752][ T93] usb 2-1: New USB device found, idVendor=05ac, idProduct=0237, bcdDevice= 0.40 [ 641.257582][ T93] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.288454][ T93] usb 2-1: Product: syz [ 641.302942][ T93] usb 2-1: Manufacturer: syz [ 642.004507][ T93] usb 2-1: SerialNumber: syz [ 642.279133][T12720] No such timeout policy "syz1" [ 642.913480][ T93] usb 2-1: can't set config #1, error -71 [ 642.941177][ T93] usb 2-1: USB disconnect, device number 22 [ 644.018068][T12729] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 645.980153][T12751] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2256'. [ 646.084667][T12751] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2256'. [ 647.477524][T12767] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2259'. [ 648.819076][T12749] could not allocate digest TFM handle cryptd(blake2b-160) [ 649.163168][ T5854] Bluetooth: hci2: command 0x0405 tx timeout [ 650.618193][ T979] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 651.028451][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 651.042124][ T979] usb 1-1: config 0 has no interfaces? [ 651.048245][T12806] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2272'. [ 651.063070][ T979] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 651.073099][ T979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 651.081657][ T979] usb 1-1: SerialNumber: syz [ 651.086739][T12806] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2272'. [ 651.099601][ T979] usb 1-1: config 0 descriptor?? [ 651.284140][T12809] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 651.546718][T12809] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2273'. [ 652.513560][ T5854] Bluetooth: hci2: command 0x0405 tx timeout [ 652.601314][T12809] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 652.969186][T12787] vlan2: entered promiscuous mode [ 653.020526][T12809] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 653.251514][ T5956] usb 1-1: USB disconnect, device number 33 [ 654.867545][T12835] IPVS: length: 8 != 446622349272 [ 656.038892][T12848] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2284'. [ 656.089170][T12848] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2284'. [ 659.004705][T12879] Invalid source name [ 659.008925][T12879] UBIFS error (pid: 12879): cannot open "./file0", error -22 [ 661.692963][T12900] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2299'. [ 663.275204][T10870] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 663.378580][T12921] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2307'. [ 663.388642][T12921] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2307'. [ 663.567092][T12921] syz_tun: entered promiscuous mode [ 663.567167][T10870] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 663.602336][T10870] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 663.779125][T12927] netlink: 236 bytes leftover after parsing attributes in process `syz.1.2309'. [ 664.312892][T10870] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 664.322163][T10870] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 664.333332][T10870] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 664.333406][T12921] syz_tun: left promiscuous mode [ 664.346670][T10870] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 664.380401][T10870] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 664.408841][T10870] usb 1-1: Product: syz [ 664.419220][T10870] usb 1-1: Manufacturer: syz [ 664.447309][T10870] cdc_wdm 1-1:1.0: skipping garbage [ 664.531469][T10870] cdc_wdm 1-1:1.0: skipping garbage [ 664.541224][T10870] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 664.547211][T10870] cdc_wdm 1-1:1.0: Unknown control protocol [ 664.650960][T10870] usb 1-1: USB disconnect, device number 34 [ 664.796297][T12938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2314'. [ 664.873775][T12936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 666.382879][T12963] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2321'. [ 667.179243][T12967] fuse: Unknown parameter 'grou00000000000000000000' [ 668.077744][T12973] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2323'. [ 668.087466][T12973] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2323'. [ 668.103987][T12973] syz_tun: entered promiscuous mode [ 668.134552][T12973] syz_tun: left promiscuous mode [ 668.191462][T12979] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2327'. [ 670.599230][T12999] ubi: mtd0 is already attached to ubi31 [ 671.950870][T13008] fuse: Unknown parameter 'grou00000000000000000000' [ 672.029113][T13010] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2336'. [ 673.225231][T13021] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2342'. [ 673.404011][T13027] netlink: 'syz.0.2341': attribute type 1 has an invalid length. [ 673.412026][T13027] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2341'. [ 675.573827][T13050] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 675.776542][T13053] input: syz1 as /devices/virtual/input/input19 [ 681.581636][T13072] netlink: 'syz.1.2355': attribute type 1 has an invalid length. [ 681.589609][T13072] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2355'. [ 682.562974][T13079] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2357'. [ 685.916798][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.933263][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.109747][ T6598] vivid-001: reconnect [ 691.163274][T13158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2383'. [ 691.250354][ T5854] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 691.266408][ T5854] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 691.275545][ T5854] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 691.292487][ T5854] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 691.302441][ T5854] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 691.390998][T13159] lo speed is unknown, defaulting to 1000 [ 691.471902][T13166] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2384'. [ 693.427142][ T5854] Bluetooth: hci5: command tx timeout [ 694.570963][T13159] chnl_net:caif_netlink_parms(): no params data found [ 695.548436][ T5854] Bluetooth: hci5: command tx timeout [ 696.334151][T13212] netlink: 'syz.1.2397': attribute type 1 has an invalid length. [ 696.396937][T13216] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2398'. [ 696.466397][T13212] 8021q: adding VLAN 0 to HW filter on device bond1 [ 696.501823][T13217] 8021q: adding VLAN 0 to HW filter on device bond1 [ 696.529746][T13217] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 696.550938][T13217] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 696.611907][T13159] bridge0: port 1(bridge_slave_0) entered blocking state [ 696.638009][T13159] bridge0: port 1(bridge_slave_0) entered disabled state [ 696.668814][T13159] bridge_slave_0: entered allmulticast mode [ 696.697769][T13159] bridge_slave_0: entered promiscuous mode [ 696.737549][T13212] gretap1: entered promiscuous mode [ 696.762268][T13212] bond1: (slave gretap1): making interface the new active one [ 697.165068][T13212] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 697.558894][ T5854] Bluetooth: hci5: command tx timeout [ 697.585762][T13159] bridge0: port 2(bridge_slave_1) entered blocking state [ 697.608568][T13159] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.632983][T13159] bridge_slave_1: entered allmulticast mode [ 697.654354][T13159] bridge_slave_1: entered promiscuous mode [ 697.926036][T13223] macvlan2: entered promiscuous mode [ 698.629126][T13223] macvlan2: entered allmulticast mode [ 698.700956][T13223] bond1: entered promiscuous mode [ 698.706647][T13223] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 698.781103][T13223] bond1: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 698.892466][T13223] bond1: left promiscuous mode [ 699.034348][T13159] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 699.098530][T13241] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2407'. [ 699.127072][T13159] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 699.169129][T13245] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2408'. [ 699.373625][T13247] vxcan3: entered promiscuous mode [ 699.378950][T13247] vxcan3: entered allmulticast mode [ 699.429677][T13159] team0: Port device team_slave_0 added [ 699.445241][T13159] team0: Port device team_slave_1 added [ 699.585031][T13159] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 699.604184][T13159] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 699.638486][ T5854] Bluetooth: hci5: command tx timeout [ 699.647945][T13212] syz.1.2397 (13212) used greatest stack depth: 19704 bytes left [ 699.665255][T13159] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 699.688768][T13159] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 699.695862][T13159] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 699.734695][T13159] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 701.145862][T13159] hsr_slave_0: entered promiscuous mode [ 701.162370][T13159] hsr_slave_1: entered promiscuous mode [ 701.212437][T13159] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 701.255811][T13159] Cannot create hsr debugfs directory [ 702.547552][T13277] process 'syz.4.2418' launched './file0' with NULL argv: empty string added [ 702.590251][T13280] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2419'. [ 702.787489][T13159] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 703.085927][ T5854] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 703.807716][T13159] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 703.867808][T13159] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 704.236587][T13159] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 706.245978][T13159] 8021q: adding VLAN 0 to HW filter on device bond0 [ 707.109351][T13159] 8021q: adding VLAN 0 to HW filter on device team0 [ 707.156782][T13159] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 707.167406][T13159] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 707.203531][T13333] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2433'. [ 707.260566][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 707.267832][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 707.321206][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 707.328576][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 707.757784][T13159] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 707.996036][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 707.996057][ T30] audit: type=1800 audit(1751669674.696:151): pid=13357 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.2439" name="SYSV798dd818" dev="tmpfs" ino=0 res=0 errno=0 [ 708.067543][T13362] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2439'. [ 708.738596][T13372] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2445'. [ 710.164046][T13159] veth0_vlan: entered promiscuous mode [ 710.224867][T13159] veth1_vlan: entered promiscuous mode [ 710.562450][T13159] veth0_macvtap: entered promiscuous mode [ 710.589287][T13159] veth1_macvtap: entered promiscuous mode [ 710.651851][T13159] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 710.676805][T13396] tipc: Started in network mode [ 710.683256][T13396] tipc: Node identity e0000001, cluster identity 4711 [ 710.695392][T13396] tipc: Enabling of bearer rejected, failed to enable media [ 710.716373][T13159] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 711.251891][T13159] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 711.275045][T13159] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 711.435259][T13159] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 711.455504][T13159] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.359453][T13408] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2458'. [ 712.500233][ T3471] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 712.508151][ T3471] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 713.477716][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 713.534145][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 713.633745][ T30] audit: type=1326 audit(1751669680.336:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13417 comm="syz.1.2463" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f820178e929 code=0x0 [ 714.242989][T13432] fuse: Unknown parameter 'group_id00000000000000000000' [ 714.585955][T13441] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2470'. [ 717.005983][ T30] audit: type=1326 audit(1751669683.706:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13466 comm="syz.2.2480" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1e9b98e929 code=0x0 [ 717.014161][T13464] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2478'. [ 717.064273][T13464] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2478'. [ 717.093077][T13464] syz_tun: entered promiscuous mode [ 717.105449][T13464] syz_tun: left promiscuous mode [ 717.169378][T13471] syzkaller1: entered promiscuous mode [ 717.176139][T13471] syzkaller1: entered allmulticast mode [ 717.362763][T13478] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2483'. [ 720.239728][ T30] audit: type=1326 audit(1751669686.946:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13516 comm="syz.2.2498" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1e9b98e929 code=0x0 [ 720.330254][ T5911] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 720.511288][ T5911] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 721.202943][ T5911] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 721.220962][ T5911] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 721.235929][ T5911] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 721.247686][ T5911] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 721.339673][ T5911] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 721.400344][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 721.468903][ T5911] usb 5-1: Product: syz [ 721.489223][ T5911] usb 5-1: Manufacturer: syz [ 721.518071][ T5911] cdc_wdm 5-1:1.0: skipping garbage [ 721.532861][ T5911] cdc_wdm 5-1:1.0: skipping garbage [ 721.597576][ T5911] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 722.040772][ T5911] cdc_wdm 5-1:1.0: Unknown control protocol [ 722.198925][ T5911] usb 5-1: USB disconnect, device number 17 [ 722.602194][T13547] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2508'. [ 722.630799][T13547] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2508'. [ 722.719362][T13547] syz_tun: entered promiscuous mode [ 722.858737][T13547] syz_tun: left promiscuous mode [ 724.491167][T13570] netlink: 'syz.1.2514': attribute type 1 has an invalid length. [ 725.378928][T10870] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 725.618748][T10870] usb 6-1: Using ep0 maxpacket: 32 [ 725.755396][T10870] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 725.796637][T10870] usb 6-1: config 0 has no interface number 0 [ 725.827386][T10870] usb 6-1: config 0 interface 184 has no altsetting 0 [ 726.011261][T10870] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 726.504366][T10870] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.555152][T10870] usb 6-1: Product: syz [ 726.586167][T10870] usb 6-1: Manufacturer: syz [ 726.616365][T10870] usb 6-1: SerialNumber: syz [ 726.664222][T10870] usb 6-1: config 0 descriptor?? [ 727.015955][T10870] smsc75xx v1.0.0 [ 727.096219][T10870] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 727.385255][T10870] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -22 [ 728.700245][T13609] netlink: 'syz.1.2528': attribute type 1 has an invalid length. [ 729.604941][T12127] usb 6-1: USB disconnect, device number 2 [ 731.044638][T13643] netlink: 'syz.4.2540': attribute type 1 has an invalid length. [ 733.505346][T13668] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2551'. [ 733.973821][ T30] audit: type=1326 audit(1751669700.676:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13680 comm="syz.4.2556" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f111bd8e929 code=0x0 [ 734.348478][ T5911] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 734.528424][ T5911] usb 2-1: Using ep0 maxpacket: 32 [ 734.540302][ T5911] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 734.558407][ T5911] usb 2-1: config 0 has no interface number 0 [ 734.578390][ T5911] usb 2-1: config 0 interface 12 has no altsetting 0 [ 734.623350][ T5911] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 734.665436][ T5911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.794754][ T5911] usb 2-1: Product: syz [ 734.799402][ T5911] usb 2-1: Manufacturer: syz [ 734.804108][ T5911] usb 2-1: SerialNumber: syz [ 734.818027][ T5911] usb 2-1: config 0 descriptor?? [ 735.592389][T13687] 9pnet_fd: Insufficient options for proto=fd [ 735.653033][ T5911] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 735.665717][ T5911] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 735.674768][ T5911] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 735.737808][ T5911] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 735.783407][ T5911] usb 2-1: USB disconnect, device number 23 [ 735.933974][T13709] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2563'. [ 737.848371][ T979] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 738.881045][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 738.927544][ T979] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 738.996635][ T979] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 739.629199][T12127] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 739.647480][ T979] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 739.754498][ T979] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.826113][ T979] usb 1-1: Product: syz [ 739.854820][ T979] usb 1-1: Manufacturer: syz [ 739.878835][T12127] usb 2-1: Using ep0 maxpacket: 32 [ 739.912817][ T979] usb 1-1: SerialNumber: syz [ 739.919703][T12127] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 739.927944][T12127] usb 2-1: config 0 has no interface number 0 [ 739.989377][ T979] usb 1-1: config 0 descriptor?? [ 740.114309][T12127] usb 2-1: config 0 interface 12 has no altsetting 0 [ 740.143505][ T979] usb 1-1: USB disconnect, device number 35 [ 740.192186][T12127] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 740.399968][T12127] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.118432][T12127] usb 2-1: Product: syz [ 741.143201][T12127] usb 2-1: Manufacturer: syz [ 741.147887][T12127] usb 2-1: SerialNumber: syz [ 741.234372][T12127] usb 2-1: config 0 descriptor?? [ 741.661719][T13757] 9pnet_fd: Insufficient options for proto=fd [ 742.733261][T12127] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 742.745762][T12127] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 742.771486][T12127] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 742.780539][T12127] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 742.800545][T12127] usb 2-1: USB disconnect, device number 24 [ 744.859783][T13799] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2589'. [ 745.398884][T13812] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 745.410986][T13812] ubi: mtd0 is already attached to ubi31 [ 745.977808][T13809] ip6gretap0: entered promiscuous mode [ 747.338228][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.344714][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.000654][T13809] vivid-000: ================= START STATUS ================= [ 748.036581][ T30] audit: type=1326 audit(1751669714.736:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.058744][T13809] vivid-000: RDS Tx I/O Mode: Controls [ 748.082927][ T30] audit: type=1326 audit(1751669714.736:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.110739][T13809] [ 748.113390][T13809] vivid-000: RDS Program ID: 32904 [ 748.184095][T13809] vivid-000: RDS Program Type: 3 [ 748.202980][T13809] vivid-000: RDS PS Name: VIVID-TX [ 748.218668][T13809] vivid-000: RDS Radio Text: [ 748.218718][ T30] audit: type=1326 audit(1751669714.826:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.245225][T13809] This is a VIVID default Radio Text template text, change at will [ 748.254057][T13809] vivid-000: RDS Stereo: true [ 748.266587][T13809] vivid-000: RDS Artificial Head: false [ 748.276240][ T30] audit: type=1326 audit(1751669714.826:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.305369][T13809] vivid-000: RDS Compressed: false [ 748.321259][T13809] vivid-000: RDS Dynamic PTY: false [ 748.327349][T13809] vivid-000: RDS Traffic Announcement: false [ 748.334855][T13809] vivid-000: RDS Traffic Program: true [ 748.341070][T13809] vivid-000: RDS Music: true [ 748.346187][T13809] vivid-000: ================== END STATUS ================== [ 748.355546][ T30] audit: type=1326 audit(1751669714.826:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.424730][ T30] audit: type=1326 audit(1751669714.826:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.447350][T13835] fuse: Bad value for 'rootmode' [ 748.508385][ T24] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 748.526968][ T30] audit: type=1326 audit(1751669714.826:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.588140][ T30] audit: type=1326 audit(1751669715.086:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.629581][ T30] audit: type=1326 audit(1751669715.196:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13810 comm="syz.1.2593" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x7ffc0000 [ 748.772007][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 749.000982][ T24] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 749.597313][ T24] usb 5-1: config 0 has no interface number 0 [ 749.841554][ T24] usb 5-1: config 0 interface 12 has no altsetting 0 [ 749.856997][ T24] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 749.868941][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.877710][ T24] usb 5-1: Product: syz [ 749.882150][ T24] usb 5-1: Manufacturer: syz [ 749.886873][ T24] usb 5-1: SerialNumber: syz [ 749.901547][ T24] usb 5-1: config 0 descriptor?? [ 750.080057][T13854] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2607'. [ 752.047411][ T24] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 752.055218][ T24] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 752.066367][ T24] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 752.078542][ T24] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 752.093306][ T24] usb 5-1: USB disconnect, device number 18 [ 752.489006][T13871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2615'. [ 752.640646][T13872] fuse: Unknown parameter 'use00000000000000000000' [ 753.427541][T13879] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2615'. [ 753.539824][ T30] audit: type=1326 audit(1751669720.246:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13870 comm="syz.0.2615" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff525f8e929 code=0x0 [ 753.593557][T13884] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.2615' resets device [ 753.678081][T13885] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2617'. [ 754.607524][ T5911] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 754.964533][ T5911] usb 1-1: Using ep0 maxpacket: 32 [ 755.005768][ T5911] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 755.028610][ T5911] usb 1-1: config 0 has no interface number 0 [ 755.034927][ T5911] usb 1-1: config 0 interface 12 has no altsetting 0 [ 756.311912][ T5911] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 756.367974][ T5911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.413719][ T5911] usb 1-1: Product: syz [ 756.554081][ T5911] usb 1-1: Manufacturer: syz [ 756.572661][ T5911] usb 1-1: SerialNumber: syz [ 756.632547][ T5911] usb 1-1: config 0 descriptor?? [ 756.891460][T13905] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2622'. [ 757.203637][T13894] 9pnet_fd: Insufficient options for proto=fd [ 757.219004][ T5911] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 757.228195][ T5911] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 757.243796][ T5911] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 757.275132][ T5911] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 757.321130][ T5911] usb 1-1: USB disconnect, device number 36 [ 758.779495][T13923] fuse: Unknown parameter 'use00000000000000000000' [ 759.042788][T13933] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2634'. [ 760.102402][T13931] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 760.181278][T12127] IPVS: starting estimator thread 0... [ 761.191162][T13940] IPVS: using max 24 ests per chain, 57600 per kthread [ 761.593183][T13927] netlink: 'syz.4.2631': attribute type 3 has an invalid length. [ 761.860902][T13953] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2637'. [ 763.405083][T13965] fuse: Unknown parameter 'use00000000000000000000' [ 763.551277][T13972] tipc: Can't bind to reserved service type 2 [ 766.027016][T13999] fuse: Unknown parameter 'user_i00000000000000000000' [ 766.028562][T12127] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 766.674929][T12127] usb 1-1: config 0 has no interfaces? [ 766.850374][T12127] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 766.944679][T12127] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 767.062220][T12127] usb 1-1: Product: syz [ 767.227382][T12127] usb 1-1: Manufacturer: syz [ 767.284619][T12127] usb 1-1: SerialNumber: syz [ 767.308478][T12127] usb 1-1: config 0 descriptor?? [ 770.097248][T12127] usb 1-1: USB disconnect, device number 37 [ 770.217836][T14033] fuse: Unknown parameter 'user_i00000000000000000000' [ 772.355349][ T5834] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 772.368711][ T5834] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 772.378353][ T5834] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 772.394899][ T5834] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 772.403524][ T5834] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 774.356517][T14057] lo speed is unknown, defaulting to 1000 [ 774.438737][ T5834] Bluetooth: hci1: command tx timeout [ 774.532087][T14073] fuse: Unknown parameter 'user_i00000000000000000000' [ 775.932393][T14057] chnl_net:caif_netlink_parms(): no params data found [ 776.529639][ T5834] Bluetooth: hci1: command tx timeout [ 776.640907][T14098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2684'. [ 778.119171][T14107] syzkaller1: entered promiscuous mode [ 778.124763][T14107] syzkaller1: entered allmulticast mode [ 778.197651][T14111] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2688'. [ 778.217946][T14057] bridge0: port 1(bridge_slave_0) entered blocking state [ 778.236897][T14057] bridge0: port 1(bridge_slave_0) entered disabled state [ 778.256049][T14057] bridge_slave_0: entered allmulticast mode [ 778.285619][T14057] bridge_slave_0: entered promiscuous mode [ 778.307958][T14057] bridge0: port 2(bridge_slave_1) entered blocking state [ 778.315644][T14057] bridge0: port 2(bridge_slave_1) entered disabled state [ 778.332007][T14057] bridge_slave_1: entered allmulticast mode [ 778.359486][T14057] bridge_slave_1: entered promiscuous mode [ 778.408850][ T5956] usb 1-1: new full-speed USB device number 38 using dummy_hcd [ 778.583802][ T5956] usb 1-1: too many configurations: 227, using maximum allowed: 8 [ 778.608658][ T5834] Bluetooth: hci1: command tx timeout [ 778.767639][ T5956] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 778.856298][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.080032][ T5956] usb 1-1: config 0 descriptor?? [ 779.117161][T14057] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 779.294086][ T5956] pwc: Samsung MPC-C10 USB webcam detected. [ 779.353574][T14057] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 779.363878][ T5956] pwc: Warning: more than 1 configuration available. [ 779.424734][ T5956] pwc: send_video_command error -71 [ 779.445219][ T5956] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 779.489050][ T5956] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 779.545806][T14129] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2696'. [ 779.548795][ T5956] usb 1-1: USB disconnect, device number 38 [ 779.646845][T14057] team0: Port device team_slave_0 added [ 779.665339][T14057] team0: Port device team_slave_1 added [ 779.735787][T14057] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 779.748047][T14057] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 779.776275][T14057] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 779.788993][T14136] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2699'. [ 779.796305][T14057] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 779.807533][T14057] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 779.839749][T14057] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 779.936838][T14057] hsr_slave_0: entered promiscuous mode [ 779.947194][T14057] hsr_slave_1: entered promiscuous mode [ 779.962834][T14057] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 779.983059][T14057] Cannot create hsr debugfs directory [ 780.228995][ T5956] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 780.482004][ T5956] usb 6-1: too many configurations: 151, using maximum allowed: 8 [ 780.688613][ T5834] Bluetooth: hci1: command tx timeout [ 780.763188][ T5956] usb 6-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice=ce.b7 [ 780.854796][ T5956] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=130 [ 780.924294][ T5956] usb 6-1: Product: syz [ 780.958584][ T5956] usb 6-1: Manufacturer: syz [ 781.000639][ T5956] usb 6-1: SerialNumber: syz [ 781.105797][ T5956] usb 6-1: config 0 descriptor?? [ 781.362802][T14152] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 781.371185][T14145] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2698'. [ 781.381563][T14152] netlink: 'syz.4.2702': attribute type 3 has an invalid length. [ 781.484627][ T5957] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 781.661224][ T5957] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 781.685212][ T5957] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 781.705268][ T5957] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 781.722041][T14057] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 781.734036][ T5957] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 781.758762][ T5957] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 781.767923][ T5957] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 781.811929][ T5957] usb 1-1: Product: syz [ 781.816206][ T5957] usb 1-1: Manufacturer: syz [ 781.830162][ T5957] usb 1-1: SerialNumber: syz [ 781.847382][ T5957] usb 1-1: config 0 descriptor?? [ 781.857002][T14151] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 781.860044][T14057] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 781.876076][ T5957] usb 1-1: ucan: probing device on interface #0 [ 781.883895][ T5957] usb 1-1: ucan: invalid in_ep MaxPacketSize [ 781.910678][ T5957] usb 1-1: ucan: probe failed; try to update the device firmware [ 781.983347][T14169] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2707'. [ 781.994451][T14057] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.086480][T14057] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.113492][T14169] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.127327][T14151] input: syz0 as /devices/virtual/input/input20 [ 782.138179][T14151] input: failed to attach handler leds to device input20, error: -6 [ 782.182094][T14151] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2701'. [ 782.261585][T14174] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2709'. [ 782.319846][T14057] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 782.343246][T14057] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 782.363052][T14057] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 782.375442][T14057] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 782.388101][T14176] binder: 14175:14176 ioctl c0306201 0 returned -14 [ 782.501282][T14183] binder: 14175:14183 ioctl c0306201 0 returned -14 [ 782.749583][T14057] 8021q: adding VLAN 0 to HW filter on device bond0 [ 782.881678][T14057] 8021q: adding VLAN 0 to HW filter on device team0 [ 782.930998][ T5956] usb 6-1: USB disconnect, device number 3 [ 783.001719][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 783.009083][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 783.104795][T12649] bridge0: port 2(bridge_slave_1) entered blocking state [ 783.112041][T12649] bridge0: port 2(bridge_slave_1) entered forwarding state [ 783.361876][T14057] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 783.793744][ T30] audit: type=1326 audit(1751669750.486:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14193 comm="syz.5.2714" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7a4bd8e929 code=0x0 [ 784.246797][T14057] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 784.430229][T12127] usb 1-1: USB disconnect, device number 39 [ 784.442075][T14057] veth0_vlan: entered promiscuous mode [ 784.461999][T14057] veth1_vlan: entered promiscuous mode [ 784.493814][T14211] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2719'. [ 784.510651][T14211] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 784.566301][T14211] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 784.656010][T14057] veth0_macvtap: entered promiscuous mode [ 784.670086][T14057] veth1_macvtap: entered promiscuous mode [ 784.702690][T14057] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 784.727121][T14057] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 784.748663][T14057] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 784.757548][T14057] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 784.767878][T14057] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 784.787939][T14057] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 784.813626][T14218] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2722'. [ 784.899435][T14218] : entered promiscuous mode [ 784.942251][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 784.953416][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 784.986392][T12649] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 784.995223][T12649] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 785.134016][T14222] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2671'. [ 785.157494][T14222] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2671'. [ 785.186505][T14222] syz_tun: entered promiscuous mode [ 785.200067][T14222] syz_tun: left promiscuous mode [ 785.570714][T14239] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2731'. [ 785.598471][T14239] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 785.637586][ T30] audit: type=1326 audit(1751669752.336:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14241 comm="syz.0.2732" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff525f8e929 code=0x0 [ 785.714348][T14239] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 786.777728][T14265] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2738'. [ 786.808668][T14265] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2738'. [ 786.826542][T14265] syz_tun: entered promiscuous mode [ 786.834496][T14265] syz_tun: left promiscuous mode [ 787.056212][T14273] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2743'. [ 787.088142][T14273] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.192716][ T30] audit: type=1326 audit(1751669754.896:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14291 comm="syz.2.2748" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8ea1d8e929 code=0x0 [ 788.442836][T14300] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2751'. [ 788.973669][T14307] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2754'. [ 789.026693][T14307] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2754'. [ 789.087100][T14307] syz_tun: entered promiscuous mode [ 789.114754][T14307] syz_tun: left promiscuous mode [ 789.834781][T14336] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2765'. [ 791.590829][T14355] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2770'. [ 791.605680][T14355] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2770'. [ 791.663346][T14355] syz_tun: entered promiscuous mode [ 791.687314][T14355] syz_tun: left promiscuous mode [ 792.330168][T14376] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2777'. [ 792.534827][T14376] bridge0: port 2(bridge_slave_1) entered disabled state [ 794.347859][T14409] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2787'. [ 794.358008][T14409] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2787'. [ 794.372801][T14409] syz_tun: entered promiscuous mode [ 794.446748][T14409] syz_tun: left promiscuous mode [ 794.511156][T14413] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2788'. [ 796.302737][T14424] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2791'. [ 796.785960][T14447] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2801'. [ 797.337769][T14446] usb usb8: usbfs: process 14446 (syz.4.2799) did not claim interface 0 before use [ 799.037720][T14468] netlink: 'syz.2.2804': attribute type 3 has an invalid length. [ 799.053732][T14464] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 799.067680][ T10] IPVS: starting estimator thread 0... [ 799.088361][ T24] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 799.171662][T14469] IPVS: using max 29 ests per chain, 69600 per kthread [ 799.254692][ T24] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 799.269915][ T24] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 799.325290][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 801.515821][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.711602][T14480] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2810'. [ 801.758460][T14480] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2810'. [ 801.846322][T14480] bridge0: entered promiscuous mode [ 801.918932][T14480] syz_tun: entered promiscuous mode [ 801.943866][T14480] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 801.951708][T14480] Cannot create hsr debugfs directory [ 801.968986][T14482] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2807'. [ 802.013836][T14482] bridge0: port 2(bridge_slave_1) entered disabled state [ 802.047464][T14489] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2813'. [ 803.448699][ T24] usb 2-1: can't set config #27, error -71 [ 803.470440][ T24] usb 2-1: USB disconnect, device number 25 [ 803.921477][T12127] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 804.108395][T12127] usb 3-1: Using ep0 maxpacket: 16 [ 805.093584][ T30] audit: type=1326 audit(1751669771.796:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14521 comm="syz.1.2824" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f820178e929 code=0x0 [ 805.957900][T14529] netlink: 'syz.4.2825': attribute type 10 has an invalid length. [ 805.969926][T14529] netlink: 55 bytes leftover after parsing attributes in process `syz.4.2825'. [ 807.071657][T12127] usb 3-1: unable to get BOS descriptor or descriptor too short [ 807.097148][T12127] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 807.123143][T12127] usb 3-1: can't read configurations, error -71 [ 807.218451][ T30] audit: type=1326 audit(1751669773.916:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14535 comm="syz.2.2829" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8ea1d8e929 code=0x0 [ 808.274427][T14564] nvme_fabrics: unknown parameter or missing value 'V' in ctrl creation request [ 808.598731][T14570] vivid-000: disconnect [ 808.762090][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.768620][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 811.752071][ T30] audit: type=1326 audit(1751669778.456:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14595 comm="syz.1.2847" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f820178e929 code=0x0 [ 811.888915][ T5957] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 812.058992][ T5957] usb 3-1: Using ep0 maxpacket: 32 [ 812.073777][ T5957] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 812.083244][ T5957] usb 3-1: config 0 has no interface number 0 [ 812.094906][ T5957] usb 3-1: config 0 interface 184 has no altsetting 0 [ 812.112577][ T5957] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 812.122311][ T5957] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.131052][ T5957] usb 3-1: Product: syz [ 812.135342][ T5957] usb 3-1: Manufacturer: syz [ 812.144187][ T5957] usb 3-1: SerialNumber: syz [ 812.159063][ T5957] usb 3-1: config 0 descriptor?? [ 812.177279][ T5957] smsc75xx v1.0.0 [ 812.181902][ T5957] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 812.196041][ T5957] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -22 [ 812.771297][T14619] netlink: 'syz.5.2852': attribute type 8 has an invalid length. [ 812.786463][T14619] bridge0: port 3(syz_tun) entered blocking state [ 812.795346][T14619] bridge0: port 3(syz_tun) entered disabled state [ 812.802547][T14619] syz_tun: entered allmulticast mode [ 812.820062][T14618] fuse: Bad value for 'fd' [ 813.036106][T14619] syz_tun: left allmulticast mode [ 815.597398][T14650] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2859'. [ 815.971649][ T9600] vivid-003: reconnect [ 816.222977][ T5854] Bluetooth: hci5: command 0x0406 tx timeout [ 816.251706][T14653] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2862'. [ 816.853226][ T5854] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 816.875065][T12127] usb 3-1: USB disconnect, device number 26 [ 816.885785][ T5854] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 816.894273][ T5854] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 816.903692][ T5854] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 816.913083][ T5854] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 816.979350][T14659] lo speed is unknown, defaulting to 1000 [ 818.677648][T14659] chnl_net:caif_netlink_parms(): no params data found [ 819.008382][ T5854] Bluetooth: hci3: command tx timeout [ 819.838944][T14688] netlink: 'syz.2.2872': attribute type 5 has an invalid length. [ 819.846765][T14688] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2872'. [ 820.014384][ T37] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 820.241521][ T37] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 820.317133][T14705] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2878'. [ 820.344550][T14705] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2878'. [ 820.384449][ T37] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 821.078802][ T5854] Bluetooth: hci3: command tx timeout [ 821.562551][ T37] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.457447][T14659] bridge0: port 1(bridge_slave_0) entered blocking state [ 822.475516][T14659] bridge0: port 1(bridge_slave_0) entered disabled state [ 822.483444][T14659] bridge_slave_0: entered allmulticast mode [ 822.494806][T14659] bridge_slave_0: entered promiscuous mode [ 822.548443][T14659] bridge0: port 2(bridge_slave_1) entered blocking state [ 822.565690][T14659] bridge0: port 2(bridge_slave_1) entered disabled state [ 822.579291][T14659] bridge_slave_1: entered allmulticast mode [ 822.669672][T14659] bridge_slave_1: entered promiscuous mode [ 822.694012][T14739] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2887'. [ 823.274220][ T5854] Bluetooth: hci3: command tx timeout [ 823.680120][T14659] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 823.736778][T14659] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 824.938857][T14659] team0: Port device team_slave_0 added [ 824.991298][T14659] team0: Port device team_slave_1 added [ 825.321127][ T5854] Bluetooth: hci3: command tx timeout [ 825.384740][T14659] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 825.418591][T14659] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 825.551099][T14659] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 825.801499][T14659] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 825.828359][T14659] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 825.875587][T14659] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 825.918031][ T37] bridge_slave_1: left allmulticast mode [ 825.926745][ T37] bridge_slave_1: left promiscuous mode [ 825.941208][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 825.990385][ T37] bridge_slave_0: left allmulticast mode [ 825.997896][ T37] bridge_slave_0: left promiscuous mode [ 826.006604][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 826.594801][T14789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 826.635096][T14789] netlink: 'syz.2.2906': attribute type 10 has an invalid length. [ 826.665325][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 826.682591][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 826.693659][ T37] bond0 (unregistering): Released all slaves [ 826.875575][T14789] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 827.137622][T14659] hsr_slave_0: entered promiscuous mode [ 827.147326][T14659] hsr_slave_1: entered promiscuous mode [ 827.329699][T14659] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 827.337340][T14659] Cannot create hsr debugfs directory [ 829.646400][ T37] hsr_slave_0: left promiscuous mode [ 829.658526][ T37] hsr_slave_1: left promiscuous mode [ 829.692620][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 829.716407][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 829.790087][ T37] veth1_macvtap: left promiscuous mode [ 829.805648][ T37] veth0_macvtap: left promiscuous mode [ 830.357949][ T37] team0 (unregistering): Port device team_slave_1 removed [ 830.424159][ T37] team0 (unregistering): Port device team_slave_0 removed [ 830.971765][T14829] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 831.058756][ T5956] lo speed is unknown, defaulting to 1000 [ 831.064845][ T5956] infiniband syz0: ib_query_port failed (-19) [ 831.572062][ T5956] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 831.715443][ T37] IPVS: stop unused estimator thread 0... [ 831.748419][ T5956] usb 2-1: Using ep0 maxpacket: 8 [ 831.775679][ T5956] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 831.788398][ T5956] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 831.828607][ T5956] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 831.838707][ T5956] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 831.851858][ T5956] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 832.098168][T14877] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 832.114817][ T5956] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 832.124147][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.452721][ T5956] usb 2-1: GET_CAPABILITIES returned 0 [ 832.527008][ T5956] usbtmc 2-1:16.0: can't read capabilities [ 833.481845][ T10] usb 2-1: USB disconnect, device number 26 [ 833.603950][T14659] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 833.621443][T14659] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 833.677136][T14659] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 833.712910][T14659] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 834.109894][T14659] 8021q: adding VLAN 0 to HW filter on device bond0 [ 834.149766][T14659] 8021q: adding VLAN 0 to HW filter on device team0 [ 834.172488][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 834.179850][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 834.205799][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 834.213192][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 834.605773][T14926] delete_channel: no stack [ 835.273244][ T24] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 835.519177][T14659] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 835.709122][ T24] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 835.729354][ T24] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 835.752661][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 835.776506][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 835.848975][T14932] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 835.863490][ T24] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 837.499211][T14958] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2954'. [ 837.620489][T14659] veth0_vlan: entered promiscuous mode [ 837.733963][T14659] veth1_vlan: entered promiscuous mode [ 838.000611][T14659] veth0_macvtap: entered promiscuous mode [ 838.021403][T14659] veth1_macvtap: entered promiscuous mode [ 838.393295][ T979] usb 2-1: USB disconnect, device number 27 [ 838.547879][T14659] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 838.659038][ T30] audit: type=1326 audit(1751669805.366:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14967 comm="syz.1.2956" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f820178e929 code=0x0 [ 838.747444][T14659] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 838.766965][T14659] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.786719][T14659] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.802875][T14659] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.812158][T14659] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.040229][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 839.049534][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 839.133957][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 839.145804][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 843.596024][T15004] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2968'. [ 843.676537][T15007] netdevsim netdevsim5: Direct firmware load for . [ 843.676537][T15007] failed with error -2 [ 843.738600][T15007] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 843.738600][T15007] [ 845.378350][ T24] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 846.519696][ T24] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 846.577477][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 846.598640][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 846.618385][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 846.632250][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 846.647737][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.660123][ T24] usb 3-1: config 0 descriptor?? [ 846.665768][T15018] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 847.602752][ T5834] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 847.615803][ T5834] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 847.626106][ T5834] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 847.638164][ T5834] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 847.647307][ T5834] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 849.289709][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 849.307615][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 849.530318][ T24] usb 3-1: USB disconnect, device number 27 [ 849.543582][T15050] chnl_net:caif_netlink_parms(): no params data found [ 849.723919][ T5854] Bluetooth: hci4: command tx timeout [ 850.026818][T15050] bridge0: port 1(bridge_slave_0) entered blocking state [ 850.036449][T15050] bridge0: port 1(bridge_slave_0) entered disabled state [ 850.159984][T15050] bridge_slave_0: entered allmulticast mode [ 850.178207][T15050] bridge_slave_0: entered promiscuous mode [ 850.679292][T15050] bridge0: port 2(bridge_slave_1) entered blocking state [ 850.746764][T15091] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2994'. [ 850.758933][T15050] bridge0: port 2(bridge_slave_1) entered disabled state [ 850.766310][T15050] bridge_slave_1: entered allmulticast mode [ 850.798439][T15050] bridge_slave_1: entered promiscuous mode [ 850.930765][T15050] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 851.798433][ T5854] Bluetooth: hci4: command tx timeout [ 851.868847][T15050] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 852.060461][T15050] team0: Port device team_slave_0 added [ 852.084066][T15109] fuse: Unknown parameter 'grou00000000000000000000' [ 852.096724][T15050] team0: Port device team_slave_1 added [ 852.236176][T15050] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 852.276910][T15050] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 852.331251][T15050] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 852.357168][T15050] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 852.370669][T15050] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 852.409190][T15050] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 852.563419][T15121] input: syz0 as /devices/virtual/input/input21 [ 853.469695][T15126] IPv6: sit1: Disabled Multicast RS [ 853.507174][T15050] hsr_slave_0: entered promiscuous mode [ 853.557932][T15050] hsr_slave_1: entered promiscuous mode [ 853.595778][T15050] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 853.618359][T15050] Cannot create hsr debugfs directory [ 853.888653][ T5854] Bluetooth: hci4: command tx timeout [ 855.054466][T15050] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.078184][T15142] fuse: Unknown parameter 'grou00000000000000000000' [ 855.129676][T15138] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 855.177809][T15143] syz_tun: entered allmulticast mode [ 855.206234][T15050] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.250719][T15139] syz_tun: left allmulticast mode [ 855.500009][T15050] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.702507][T15050] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.970643][ T5854] Bluetooth: hci4: command tx timeout [ 857.068475][T15050] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 857.197133][T15050] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 857.245872][T15050] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 857.302618][T15050] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 857.318942][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 857.360678][T15189] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 857.474930][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 857.496357][ T10] usb 6-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 857.523092][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 857.549739][ T10] usb 6-1: config 0 descriptor?? [ 857.864776][T15050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 857.953539][T15050] 8021q: adding VLAN 0 to HW filter on device team0 [ 857.985664][ T10] lenovo 0003:17EF:6047.0004: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.5-1/input0 [ 858.035742][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 858.043059][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 858.123133][ T5982] bridge0: port 2(bridge_slave_1) entered blocking state [ 858.130440][ T5982] bridge0: port 2(bridge_slave_1) entered forwarding state [ 859.097110][T15050] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 859.168314][T15050] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 859.754067][T12127] usb 6-1: USB disconnect, device number 4 [ 860.426333][T15050] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 860.599991][T15237] overlayfs: missing 'lowerdir' [ 860.625619][T15050] veth0_vlan: entered promiscuous mode [ 860.755212][T15050] veth1_vlan: entered promiscuous mode [ 861.077589][T15050] veth0_macvtap: entered promiscuous mode [ 861.979831][T15050] veth1_macvtap: entered promiscuous mode [ 862.035508][T15050] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 862.072956][T15243] kexec: Could not allocate control_code_buffer [ 862.137230][T15050] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 862.158050][T15243] Process accounting resumed [ 862.187866][T15050] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.238119][T15050] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.258316][T15050] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.275267][T15050] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.485234][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 862.494964][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 862.656651][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 862.771155][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 865.339539][T15288] fuse: Unknown parameter 'group_i00000000000000000000' [ 865.349626][T15289] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3057'. [ 865.550529][T15296] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3061'. [ 869.162874][T15325] netlink: 'syz.1.3068': attribute type 72 has an invalid length. [ 869.238622][T15325] netlink: 'syz.1.3068': attribute type 8 has an invalid length. [ 870.309265][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 872.824365][T15374] loop6: detected capacity change from 0 to 524287999 [ 873.133087][T15377] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3083'. [ 874.028767][T15378] wireguard0: entered promiscuous mode [ 874.034390][T15378] wireguard0: entered allmulticast mode [ 874.386313][T15389] netlink: 'syz.0.3085': attribute type 72 has an invalid length. [ 874.412052][T15389] netlink: 'syz.0.3085': attribute type 8 has an invalid length. [ 874.478194][T15388] gtp0: entered promiscuous mode [ 874.545935][T15390] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3086'. [ 877.392005][T15423] netlink: 'syz.2.3098': attribute type 72 has an invalid length. [ 877.433257][T15423] netlink: 'syz.2.3098': attribute type 8 has an invalid length. [ 877.470150][T15427] netlink: 5364 bytes leftover after parsing attributes in process `syz.0.3097'. [ 877.507618][T15428] netlink: 5364 bytes leftover after parsing attributes in process `syz.4.3099'. [ 879.006374][T15437] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 879.025571][T15437] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 880.511374][T15437] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 880.639818][T15437] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 882.372687][T15467] netlink: 892 bytes leftover after parsing attributes in process `syz.2.3111'. [ 882.968377][ T979] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 884.080468][ T979] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 884.091211][ T979] usb 3-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 884.104465][ T979] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 884.113906][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.182646][ T979] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 884.325967][ T979] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 885.434884][T15501] netlink: 892 bytes leftover after parsing attributes in process `syz.4.3126'. [ 886.124023][ T93] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 886.938359][ T93] usb 5-1: Using ep0 maxpacket: 16 [ 886.946469][ T93] usb 5-1: config 0 has no interfaces? [ 886.977282][ T93] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 887.042297][ T93] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 887.076739][ T93] usb 5-1: SerialNumber: syz [ 887.118557][ T93] usb 5-1: config 0 descriptor?? [ 887.357360][ T10] usb 5-1: USB disconnect, device number 19 [ 887.461503][T15524] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3133'. [ 887.471073][T15524] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3133'. [ 887.573934][ T979] Process accounting resumed [ 888.557301][ T10] usb 3-1: USB disconnect, device number 28 [ 888.845359][T15539] sctp: [Deprecated]: syz.0.3135 (pid 15539) Use of struct sctp_assoc_value in delayed_ack socket option. [ 888.845359][T15539] Use struct sctp_sack_info instead [ 888.961780][T15539] wlaf0: renamed from batadv_slave_1 (while UP) [ 889.203028][T15539] batman_adv: batadv0: Interface deactivated: wlaf0 [ 890.083631][T15539] wlaf0: entered allmulticast mode [ 890.183507][T15549] netlink: 892 bytes leftover after parsing attributes in process `syz.5.3138'. [ 890.447271][T15545] bridge1: entered promiscuous mode [ 892.023673][T15567] sctp: [Deprecated]: syz.4.3143 (pid 15567) Use of struct sctp_assoc_value in delayed_ack socket option. [ 892.023673][T15567] Use struct sctp_sack_info instead [ 892.348349][ T979] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 892.532591][ T979] usb 3-1: Using ep0 maxpacket: 16 [ 892.548894][ T979] usb 3-1: config 0 has no interfaces? [ 892.563087][ T979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 892.572490][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 892.596070][ T979] usb 3-1: SerialNumber: syz [ 892.612612][ T979] usb 3-1: config 0 descriptor?? [ 892.829699][ T10] usb 3-1: USB disconnect, device number 29 [ 895.716257][T15612] fuse: Bad value for 'fd' [ 895.725295][T15611] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 895.745532][T15608] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input23 [ 897.208615][ T5956] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 897.894499][ T5834] Bluetooth: hci1: command 0x0406 tx timeout [ 898.096682][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 898.145188][ T5956] usb 2-1: config 0 has no interfaces? [ 898.153865][ T5956] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 898.167444][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 898.313684][ T5956] usb 2-1: SerialNumber: syz [ 898.321335][ T5956] usb 2-1: config 0 descriptor?? [ 899.001089][ T24] usb 2-1: USB disconnect, device number 28 [ 900.493293][T15670] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3177'. [ 902.330729][T15685] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3183'. [ 903.408443][ T10] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 903.727302][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 903.763497][ T10] usb 1-1: config 0 has no interfaces? [ 903.769225][T15701] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3186'. [ 903.803982][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 903.823153][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 903.833185][ T10] usb 1-1: SerialNumber: syz [ 903.842250][ T10] usb 1-1: config 0 descriptor?? [ 904.180309][ T5956] usb 1-1: USB disconnect, device number 40 [ 905.278002][T15712] loop6: detected capacity change from 0 to 524287999 [ 907.488517][ T93] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 907.688857][ T5956] usb 3-1: new low-speed USB device number 30 using dummy_hcd [ 908.318646][ T5956] usb 3-1: device descriptor read/64, error -71 [ 908.335126][ T93] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 908.371119][ T93] usb 2-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 908.458469][ T93] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 908.467595][ T93] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.550911][T15604] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 908.568470][ T5956] usb 3-1: new low-speed USB device number 31 using dummy_hcd [ 908.618878][ T93] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 908.718463][T15604] usb 1-1: Using ep0 maxpacket: 16 [ 908.723856][ T5956] usb 3-1: device descriptor read/64, error -71 [ 908.734638][T15604] usb 1-1: config 0 has no interfaces? [ 908.741342][T15604] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 908.750857][T15604] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 908.768517][ T5911] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 908.797121][T15604] usb 1-1: SerialNumber: syz [ 908.797731][ T93] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 908.899659][ T5956] usb usb3-port1: attempt power cycle [ 908.913196][T15604] usb 1-1: config 0 descriptor?? [ 909.048324][ T5911] usb 6-1: device descriptor read/64, error -71 [ 909.124711][T15604] usb 1-1: USB disconnect, device number 41 [ 909.269255][ T5956] usb 3-1: new low-speed USB device number 32 using dummy_hcd [ 909.288366][ T5911] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 909.296792][ T5956] usb 3-1: device descriptor read/8, error -71 [ 909.438488][ T5911] usb 6-1: device descriptor read/64, error -71 [ 910.330077][ T5911] usb usb6-port1: attempt power cycle [ 910.331660][ T5956] usb 3-1: new low-speed USB device number 33 using dummy_hcd [ 910.380290][ T5956] usb 3-1: device descriptor read/8, error -71 [ 910.498607][ T5956] usb usb3-port1: unable to enumerate USB device [ 910.708426][ T5911] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 910.756018][ T5911] usb 6-1: device descriptor read/8, error -71 [ 911.574132][T15765] kthread_run failed with err -4 [ 911.820752][ T5911] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 911.859737][ T5956] usb 2-1: USB disconnect, device number 29 [ 914.824758][ T5911] usb 6-1: device descriptor read/8, error -71 [ 914.916480][T15787] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3212'. [ 914.959004][T15787] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3212'. [ 914.978751][ T5911] usb usb6-port1: unable to enumerate USB device [ 915.318378][ T5956] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 916.323411][T15801] block device autoloading is deprecated and will be removed. [ 916.342670][T15801] syz.4.3216: attempt to access beyond end of device [ 916.342670][T15801] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 916.355913][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 916.366437][ T5956] usb 2-1: config 0 has no interfaces? [ 916.378414][ T5956] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 916.398317][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 916.423853][ T5956] usb 2-1: SerialNumber: syz [ 916.476714][ T5956] usb 2-1: config 0 descriptor?? [ 916.726081][ T5956] usb 2-1: USB disconnect, device number 30 [ 919.679051][T15833] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3227'. [ 919.688148][T15833] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3227'. [ 922.061582][T15860] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3232'. [ 923.328988][ T24] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 923.548535][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 923.580733][ T24] usb 2-1: config 0 has no interfaces? [ 923.601000][ T24] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 923.624081][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 923.659164][ T24] usb 2-1: SerialNumber: syz [ 923.682206][ T24] usb 2-1: config 0 descriptor?? [ 923.738892][T15870] netlink: 'syz.5.3237': attribute type 8 has an invalid length. [ 923.917270][ T24] usb 2-1: USB disconnect, device number 31 [ 927.624059][T15920] sctp: [Deprecated]: syz.1.3251 (pid 15920) Use of struct sctp_assoc_value in delayed_ack socket option. [ 927.624059][T15920] Use struct sctp_sack_info instead [ 928.483575][T15604] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 929.448278][T15604] usb 5-1: Using ep0 maxpacket: 16 [ 929.459028][T15604] usb 5-1: config 0 has no interfaces? [ 929.481508][T15604] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 929.493020][T15604] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 929.501249][T15604] usb 5-1: SerialNumber: syz [ 929.512625][T15604] usb 5-1: config 0 descriptor?? [ 929.744389][T15604] usb 5-1: USB disconnect, device number 20 [ 931.223391][T15963] netlink: 'syz.1.3265': attribute type 8 has an invalid length. [ 931.641860][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 933.233511][ T5956] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 933.448357][ T5956] usb 6-1: Using ep0 maxpacket: 16 [ 933.475361][ T5956] usb 6-1: config 0 has no interfaces? [ 933.523826][ T5956] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 934.269132][ T5956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 934.277205][ T5956] usb 6-1: SerialNumber: syz [ 934.450164][ T5956] usb 6-1: config 0 descriptor?? [ 934.733873][T15604] usb 6-1: USB disconnect, device number 9 [ 935.207739][ T5911] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 935.409060][ T5911] usb 2-1: Using ep0 maxpacket: 16 [ 935.549923][ T5911] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 936.174588][ T5911] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 936.208478][ T5911] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 936.219829][ T5911] usb 2-1: Manufacturer: syz [ 936.265379][ T5911] usb 2-1: config 0 descriptor?? [ 936.477231][ T5911] usb 2-1: USB disconnect, device number 32 [ 937.081235][ T5956] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 937.639501][ T5956] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 937.689803][ T5956] usb 5-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 937.704413][T16034] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3289'. [ 937.728436][T16034] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3289'. [ 937.757992][ T5956] usb 5-1: config 0 interface 0 has no altsetting 0 [ 937.798088][ T5956] usb 5-1: New USB device found, idVendor=047f, idProduct=c055, bcdDevice= 0.00 [ 937.835872][ T5956] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.868412][ T5956] usb 5-1: config 0 descriptor?? [ 937.877947][T16029] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 938.104563][ T5911] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 938.134856][ T5956] usbhid 5-1:0.0: can't add hid device: -71 [ 938.152466][ T5956] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 938.172231][ T5956] usb 5-1: USB disconnect, device number 21 [ 938.288365][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 938.296458][ T5911] usb 3-1: config 0 has no interfaces? [ 938.446462][ T5911] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 938.455873][ T5911] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 938.468626][ T5911] usb 3-1: SerialNumber: syz [ 938.484747][ T5911] usb 3-1: config 0 descriptor?? [ 938.731867][T16041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3292'. [ 938.746531][T16041] vlan2: entered promiscuous mode [ 938.751828][T16041] team0: entered promiscuous mode [ 938.757069][T16041] team_slave_0: entered promiscuous mode [ 938.768684][T16041] team_slave_1: entered promiscuous mode [ 938.915798][ T5911] usb 3-1: USB disconnect, device number 34 [ 938.935062][T16060] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3298'. [ 938.944981][T16060] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3298'. [ 938.987339][T16061] SET target dimension over the limit! [ 940.012688][ T93] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 940.196241][ T93] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 940.212468][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.221779][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.241694][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.258923][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.268344][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.308409][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.365014][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.382003][T10870] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 940.407668][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.431967][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.456225][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.466307][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.482801][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.491751][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.501092][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.558610][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.571852][T10870] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 940.588633][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.608779][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.624188][T10870] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 940.647660][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.664739][T10870] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 940.867213][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.878407][T10870] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 940.891634][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.923781][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 940.924040][T10870] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 940.945056][ T93] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 940.957361][ T93] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 940.968897][T10870] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 941.002073][T10870] usb 5-1: Manufacturer: syz [ 941.030173][ T93] usb 3-1: config 0 interface 0 has no altsetting 0 [ 941.043413][T10870] usb 5-1: config 0 descriptor?? [ 941.091129][ T93] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 941.110568][ T93] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 941.153178][ T93] usb 3-1: Product: syz [ 941.160652][ T93] usb 3-1: Manufacturer: syz [ 941.166097][ T93] usb 3-1: SerialNumber: syz [ 941.197953][ T93] usb 3-1: config 0 descriptor?? [ 941.215521][ T93] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 941.358401][T10870] rc_core: IR keymap rc-hauppauge not found [ 941.374524][T10870] Registered IR keymap rc-empty [ 941.568944][T15604] usb 3-1: USB disconnect, device number 35 [ 941.622793][ T93] hid-generic 00A0:0008:0003.0005: unknown main item tag 0x0 [ 941.630752][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 941.638019][ T93] hid-generic 00A0:0008:0003.0005: unknown main item tag 0x0 [ 941.651717][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 941.668595][ T93] hid-generic 00A0:0008:0003.0005: unknown main item tag 0x0 [ 941.674016][T15604] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 941.682799][T16086] netlink: 'syz.5.3307': attribute type 8 has an invalid length. [ 941.775490][ T93] hid-generic 00A0:0008:0003.0005: unknown main item tag 0x0 [ 941.785390][ T93] hid-generic 00A0:0008:0003.0005: item fetching failed at offset 6/15 [ 941.797286][T10870] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 941.819160][ T93] hid-generic 00A0:0008:0003.0005: probe with driver hid-generic failed with error -22 [ 941.831151][T10870] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input25 [ 941.856990][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 941.897456][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 941.918467][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 941.939725][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 941.980220][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 942.004650][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 942.108374][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 942.128768][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 942.149236][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 942.168502][T10870] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 942.232926][T10870] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 942.543468][T10870] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 943.652597][T10870] usb 5-1: USB disconnect, device number 22 [ 943.753700][ T24] libceph: connect (1)[c::]:6789 error -101 [ 943.782028][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 943.788449][T16100] ceph: No mds server is up or the cluster is laggy [ 943.969660][ T5834] Bluetooth: hci3: command 0x0406 tx timeout [ 945.343635][ T30] audit: type=1326 audit(1751669912.046:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16106 comm="syz.4.3312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fd5e5f858e7 code=0x7ffc0000 [ 945.365257][ C1] vkms_vblank_simulate: vblank timer overrun [ 945.384320][T16126] netlink: 'syz.1.3319': attribute type 8 has an invalid length. [ 945.458623][ T30] audit: type=1326 audit(1751669912.076:174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16106 comm="syz.4.3312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fd5e5f2ab19 code=0x7ffc0000 [ 945.579500][T16125] page: refcount:3 mapcount:0 mapping:ffff888148d413f8 index:0x2 pfn:0x5f2e2 [ 945.588522][T16125] memcg:ffff888044363200 [ 945.592798][T16125] aops:def_blk_aops ino:fa00000 [ 945.597666][T16125] flags: 0xfff00000000139(locked|uptodate|dirty|lru|active|node=0|zone=1|lastcpupid=0x7ff) [ 945.607700][T16125] raw: 00fff00000000139 ffffea00017cb8c8 ffff88801ba890f8 ffff888148d413f8 [ 945.616336][T16125] raw: 0000000000000002 0000000000000000 00000003ffffffff ffff888044363200 [ 945.624975][T16125] page dumped because: VM_BUG_ON_FOLIO(!folio_contains(folio, index)) [ 945.633223][T16125] page_owner tracks the page as allocated [ 945.638985][T16125] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 16127, tgid 16123 (syz.5.3320), ts 945496584231, free_ts 945449842909 [ 945.660707][T16125] post_alloc_hook+0x240/0x2a0 [ 945.665511][T16125] get_page_from_freelist+0x21d5/0x22b0 [ 945.671177][T16125] __alloc_frozen_pages_noprof+0x181/0x370 [ 945.676998][T16125] alloc_pages_mpol+0x232/0x4a0 [ 945.681928][T16125] alloc_pages_noprof+0xa9/0x190 [ 945.686884][T16125] folio_alloc_noprof+0x1e/0x30 [ 945.691806][T16125] filemap_alloc_folio_noprof+0xdf/0x470 [ 945.697452][T16125] page_cache_ra_order+0x5e5/0xc70 [ 945.702650][T16125] do_sync_mmap_readahead+0x4b5/0x5f0 [ 945.708043][T16125] filemap_fault+0x62a/0x1200 [ 945.712822][T16125] __do_fault+0x135/0x390 [ 945.717169][T16125] __handle_mm_fault+0x198b/0x5620 [ 945.722561][T16125] handle_mm_fault+0x2d5/0x7f0 [ 945.727339][T16125] __get_user_pages+0x1af4/0x30b0 [ 945.732418][T16125] faultin_page_range+0x257/0x890 [ 945.737455][T16125] madvise_do_behavior+0x232/0x2e70 [ 945.742727][T16125] page last free pid 16107 tgid 16106 stack trace: [ 945.749289][T16125] __free_frozen_pages+0xc65/0xe60 [ 945.754408][T16125] __put_partials+0x161/0x1c0 [ 945.759132][T16125] put_cpu_partial+0x17c/0x250 [ 945.764868][T16125] __slab_free+0x2f7/0x400 [ 945.769354][T16125] qlist_free_all+0x97/0x140 [ 945.774044][T16125] kasan_quarantine_reduce+0x148/0x160 [ 945.779569][T16125] __kasan_slab_alloc+0x22/0x80 [ 945.784434][T16125] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 945.790018][T16125] audit_log_start+0x126/0x870 [ 945.794806][T16125] audit_seccomp+0x64/0x190 [ 945.799511][T16125] __seccomp_filter+0x9aa/0x1a40 [ 945.804549][T16125] syscall_trace_enter+0xaa/0x160 [ 945.809792][T16125] do_syscall_64+0xd3/0x3b0 [ 945.814357][T16125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.820442][T16125] ------------[ cut here ]------------ [ 945.825905][T16125] kernel BUG at mm/filemap.c:3442! [ 945.831116][T16125] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 945.837372][T16125] CPU: 0 UID: 0 PID: 16125 Comm: syz.5.3320 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 945.849447][T16125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 945.859509][T16125] RIP: 0010:filemap_fault+0x117d/0x1200 [ 945.865070][T16125] Code: 38 c1 0f 8c 8e fc ff ff 4c 89 e7 e8 8d 6b 29 00 e9 81 fc ff ff e8 a3 13 c8 ff 48 89 df 48 c7 c6 20 33 94 8b e8 d4 ae 0d 00 90 <0f> 0b e8 8c 13 c8 ff 48 8b 3c 24 48 c7 c6 a0 39 94 8b e8 bc ae 0d [ 945.884694][T16125] RSP: 0018:ffffc9000d9573c0 EFLAGS: 00010246 [ 945.890772][T16125] RAX: fb3e9be4c460a100 RBX: ffffea00017cb880 RCX: fb3e9be4c460a100 [ 945.898755][T16125] RDX: 0000000000000000 RSI: ffffffff8db6feb2 RDI: ffff88802f8b0000 [ 945.906738][T16125] RBP: ffffc9000d9574f8 R08: 0000000000000003 R09: 0000000000000004 [ 945.914722][T16125] R10: dffffc0000000000 R11: fffffbfff1bfa9fc R12: dffffc0000000000 [ 945.922703][T16125] R13: 1ffffd40002f9711 R14: ffffea00017cb898 R15: ffffea00017cb888 [ 945.930690][T16125] FS: 00007f7a4cba86c0(0000) GS:ffff888125c51000(0000) knlGS:0000000000000000 [ 945.939635][T16125] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 945.946220][T16125] CR2: 0000200000001a87 CR3: 0000000034a32000 CR4: 00000000003526f0 [ 945.954197][T16125] Call Trace: [ 945.957481][T16125] [ 945.960432][T16125] ? __pfx_filemap_fault+0x10/0x10 [ 945.965560][T16125] ? __handle_mm_fault+0x296f/0x5620 [ 945.970866][T16125] __do_fault+0x135/0x390 [ 945.975202][T16125] __handle_mm_fault+0x37ed/0x5620 [ 945.980331][T16125] ? __pfx___handle_mm_fault+0x10/0x10 [ 945.985816][T16125] ? find_vma+0xe7/0x160 [ 945.990066][T16125] ? __pfx_find_vma+0x10/0x10 [ 945.994841][T16125] handle_mm_fault+0x2d5/0x7f0 [ 945.999619][T16125] do_user_addr_fault+0x764/0x1390 [ 946.004745][T16125] exc_page_fault+0x76/0xf0 [ 946.009283][T16125] asm_exc_page_fault+0x26/0x30 [ 946.014142][T16125] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 946.019872][T16125] Code: c4 10 c3 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 00 04 00 66 2e [ 946.039499][T16125] RSP: 0018:ffffc9000d957978 EFLAGS: 00050202 [ 946.045585][T16125] RAX: 00007ffffffff001 RBX: 0000000000000001 RCX: 0000000000000001 [ 946.053570][T16125] RDX: 0000000000000001 RSI: 0000200000001a87 RDI: ffff888053c607c7 [ 946.061549][T16125] RBP: 000000000000d839 R08: ffff888053c607c7 R09: 1ffff1100a78c0f8 [ 946.069538][T16125] R10: dffffc0000000000 R11: ffffed100a78c0f9 R12: 0000000000000000 [ 946.077515][T16125] R13: 0000000000000001 R14: ffff888053c607c7 R15: 0000200000001a87 [ 946.085497][T16125] _copy_from_user+0x7a/0xb0 [ 946.090116][T16125] snd_rawmidi_kernel_write1+0x3ab/0x650 [ 946.095772][T16125] snd_rawmidi_write+0x5ad/0xbd0 [ 946.100741][T16125] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 946.106206][T16125] ? __pfx_default_wake_function+0x10/0x10 [ 946.112036][T16125] ? __import_iovec+0x40e/0x7f0 [ 946.116895][T16125] ? bpf_lsm_file_permission+0x9/0x20 [ 946.122271][T16125] ? security_file_permission+0x75/0x290 [ 946.127918][T16125] ? rw_verify_area+0x258/0x650 [ 946.132783][T16125] vfs_writev+0x4b6/0x960 [ 946.137127][T16125] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 946.142597][T16125] ? __pfx_vfs_writev+0x10/0x10 [ 946.147461][T16125] ? __fget_files+0x2a/0x420 [ 946.152055][T16125] ? __fget_files+0x3a0/0x420 [ 946.156739][T16125] ? __fget_files+0x2a/0x420 [ 946.161342][T16125] do_writev+0x14d/0x2d0 [ 946.165600][T16125] ? __pfx_do_writev+0x10/0x10 [ 946.170369][T16125] ? rcu_is_watching+0x15/0xb0 [ 946.175146][T16125] ? do_syscall_64+0xbe/0x3b0 [ 946.179828][T16125] do_syscall_64+0xfa/0x3b0 [ 946.184338][T16125] ? lockdep_hardirqs_on+0x9c/0x150 [ 946.189555][T16125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.195627][T16125] ? clear_bhb_loop+0x60/0xb0 [ 946.200311][T16125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.206219][T16125] RIP: 0033:0x7f7a4bd8e929 [ 946.210660][T16125] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 946.230276][T16125] RSP: 002b:00007f7a4cba8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 946.238702][T16125] RAX: ffffffffffffffda RBX: 00007f7a4bfb5fa0 RCX: 00007f7a4bd8e929 [ 946.246766][T16125] RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000005 [ 946.254789][T16125] RBP: 00007f7a4be10b39 R08: 0000000000000000 R09: 0000000000000000 [ 946.262775][T16125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 946.270754][T16125] R13: 0000000000000000 R14: 00007f7a4bfb5fa0 R15: 00007ffe75ba58b8 [ 946.278751][T16125] [ 946.281793][T16125] Modules linked in: [ 946.287014][T16125] ---[ end trace 0000000000000000 ]--- [ 946.292546][T16125] RIP: 0010:filemap_fault+0x117d/0x1200 [ 946.298117][T16125] Code: 38 c1 0f 8c 8e fc ff ff 4c 89 e7 e8 8d 6b 29 00 e9 81 fc ff ff e8 a3 13 c8 ff 48 89 df 48 c7 c6 20 33 94 8b e8 d4 ae 0d 00 90 <0f> 0b e8 8c 13 c8 ff 48 8b 3c 24 48 c7 c6 a0 39 94 8b e8 bc ae 0d [ 946.317862][T16125] RSP: 0018:ffffc9000d9573c0 EFLAGS: 00010246 [ 946.323977][T16125] RAX: fb3e9be4c460a100 RBX: ffffea00017cb880 RCX: fb3e9be4c460a100 [ 946.331984][T16125] RDX: 0000000000000000 RSI: ffffffff8db6feb2 RDI: ffff88802f8b0000 [ 946.339991][T16125] RBP: ffffc9000d9574f8 R08: 0000000000000003 R09: 0000000000000004 [ 946.347965][T16125] R10: dffffc0000000000 R11: fffffbfff1bfa9fc R12: dffffc0000000000 [ 946.356026][T16125] R13: 1ffffd40002f9711 R14: ffffea00017cb898 R15: ffffea00017cb888 [ 946.364222][T16125] FS: 00007f7a4cba86c0(0000) GS:ffff888125c51000(0000) knlGS:0000000000000000 [ 946.373213][T16125] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 946.380483][T16125] CR2: 0000200000001a87 CR3: 0000000034a32000 CR4: 00000000003526f0 [ 946.388534][T16125] Kernel panic - not syncing: Fatal exception [ 946.394931][T16125] Kernel Offset: disabled [ 946.399303][T16125] Rebooting in 86400 seconds..