last executing test programs: 19.028517436s ago: executing program 0 (id=2136): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000847fff)='X', 0xffe4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x3f, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r3, 0x5421, &(0x7f0000000140)=0x1) writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(r3) syz_open_dev$video4linux(&(0x7f0000000080), 0x100000008, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000180)=@id={0x1e, 0x3, 0x1, {0x4e24, 0x3}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x9, 0x0, 0x9, 0x5}) 17.526985689s ago: executing program 4 (id=2138): r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETPLANE(r1, 0xc03064b7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=r2, @ANYBLOB="0524060000000000300012800b0001006272696467650000200002800c002e00fffff6ffffffffff050007001f"], 0x6c}}, 0x840) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0x0, {0x7, r6}, [@MDBA_SET_ENTRY={0x20, 0x1, {r8, 0x1, 0x0, 0x0, {@ip4=@broadcast}}}]}, 0x38}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) sendmmsg$inet6(r0, &(0x7f0000000040)=[{{&(0x7f0000000a00)={0xa, 0x4e20, 0x7992, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x23}}, 0x8}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=ANY=[], 0x20}}], 0x1, 0x40010) 17.510589806s ago: executing program 0 (id=2139): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) madvise(&(0x7f00003c1000/0x1000)=nil, 0xdfc3efff, 0x8) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) close(r3) link(0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./bus/file0\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="e0c2033c8dbaae15662c0a9b9ab67ed30bd37fad608244a85d7d60a268bd858ac577d89797ee3275980f67b53aa0f2534c5cc8a88f141f23b388c1f2507c9f1af964ea24ce72efb66c5539f0dcb6c0916c40a4ace7e6ffee2d1da6ec18bc647dbc747bacd549fb9b0a616addf10ee78d21be203eb03e88017043c4b8af349b281b11d961b86b5e051c33823f86fa5e5d5d475f211674c6d90218031ecdfde6584687f41a579894dd982ffd40f5325258a92b7dd6ae5142ff25593d67bfdcfe5f32384268d898180d3e5b7cbdfd025b3de1fe7a6e080d"], 0x0, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000080)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x1, 0x2) fchdir(r7) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') 16.867956591s ago: executing program 4 (id=2141): r0 = socket$can_j1939(0x1d, 0x2, 0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x498, &(0x7f0000000400)={0x0, 0x7079, 0x4, 0x14, 0xc2}, &(0x7f0000000580)=0x0, &(0x7f0000000200)) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000040)="11da3cf44b1a8c3d8a39ccbd630e8ef9170ccf07ef1800322de53ae3b183ee66", 0x20) close(0x3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) r6 = socket(0x10, 0x2, 0x0) write(r6, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r6, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x18) recvmsg$can_j1939(r0, &(0x7f00000000c0)={&(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000400)=""/143, 0x2c}], 0x1, &(0x7f0000000000)=""/53, 0x35}, 0x40000000) memfd_create(&(0x7f0000000540)=':\x91!/\x00', 0x1) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400"], 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x3, 0x800) r7 = syz_io_uring_setup(0x1770, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x34f}, &(0x7f00000002c0)=0x0, &(0x7f0000000080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r7, 0x409, 0x734d, 0x69, &(0x7f0000000140)={[0x8, 0x6]}, 0x8) 16.808670708s ago: executing program 1 (id=2142): socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$KVM_CAP_DIRTY_LOG_RING(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000440)={0xc0, 0x0, 0x4000}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0x23, 0x0, &(0x7f0000000280)) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x13c, 0x10, 0x713, 0x70bd28, 0x0, {{@in=@local, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x2, 0x1, 0x0, 0x0, 0xa, 0x0, 0x0, 0x84, 0x0, 0xffffffffffffffff}, {@in6=@mcast1, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {0x0, 0x100000000, 0x8, 0x100000001, 0x6}, {0x0, 0x0, 0x2, 0x7}, {0xc}, 0x70bd29, 0x0, 0xa}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}]}, 0x13c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmmsg$inet6(r3, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001340)="fbf5bd1959d81aeeac3454fdc990f648f16f48c6bd4232bcba18dbc0f755e79fa071a979e36fceaad82b436111801308f7770a63e4af8720f362a3559335c80b0f28c7e01ead726228ef5a48b82c35dfe1e57921007e14cdcfc69e8cd9c03b8dff27b2f3d51fe535b9e051e2a0f0ecef9e06b0a57cbc87f684a08aa33abb5f9733caa9dabc3c55dd5be864ac0ecb7fcd0a7bed095a5dff80f811095086ab552e18e25379a87dea4e871ac2227eb855f2b4c5b49099c40cce3d29b6f67056712c5516e28720863f9665c33e23bcaff1b058e8dd3be2231d645c926d23945e1ff887828e49434210bd92a856f9183bda01232558bb9afcf711301734915f8bc5f007a72bf7543a389d89f3fa8ffb4397820adccc1841c410168fbb12d1a9f2c8032c268074345392e1b46fbbbeab52a0c1ab4448ebb9b19f8bd682224bdecf8d7741c96d2e189b18f9e922689c5633e29bca2bb0a13c15a92445f4685a30edd8bfca8d40fc3151933594a47547eefd2929020cffa9142cae147ad6559a1b394782b3b6e28a4e8af47c0a625a318997365b07ad7b6ddd765f76bee526044e1a0c69eb5e7b46d5a44874a5e88211b322dafabd91948e6fa35826cafa6d0495905f7e249288b7b2823a251d35ec3e6259e2abfafd6e7e98eb8b65fb7638dacf0fab435427a0563971066c60f7d91019439650d68d8f01bb040fe143e4b940f14cba2ebf841c71c9e7a9aac194d34f75598aa366283635ec6b673adf703ef425685e9a8f5e30306847368e0f4438b6d7c95f80886240a2602af66e5e3c5e45107e1fc68f6a3db2411d6d2500980c92c261903fb3cdbb981d9655e78630b4d16a3930de90874409795603565999f232ea2736c92e1353fe3f640d4e4d6f656d9dd59dc99aab86e318e3d68740be38671b2f413efabe1ac739d5aae7deadb8ed6651a34684ce8e991a50d88866192edf3183faed4e657f7bc5e971183b43755bd2eeafda22708469ad55d911061bdd0df48180fd84d43804733a78bfc6a8d927fac2f01675a4d82bbaedc8e74e602247a54fdcb5bf4130fbb438f2ff7d69475fbb6e72ae322a06377ea65397fc050737f9473e6ef37315b636d5b6e6d3788a44a5e686e0b948af57bc2b01ccfd1e93fba41719b7826d99125485ac93217d67cc15f7c1e60217ab84e570e78917b4357781ea8042ebe826d7ae382f9d3c35296b1d885198e6dfc510d25534dfdb81c0b01501bb3abb5ca086cd8a6d93126b6b9b25b22a63f0af878851d145c2be092d10bf3d97490de2973f94b86fac0a62091737a8a6830767ed326252cf940946490e2149ed6e723470caaec4741d7cce735fcd0a42c47a8e62b1cd591e05bdb18b6459fb17b2e6211999955c6953e85cb6f8473c0434b4665f868f67b6832221da62bf301df8c4f012b5a11a6487cd75657161b2b8c8133a88069ffcad98e8ff7afa8196692f3fc6b876dbd7cc1d9269099cc758c663017c2ac83871fbd41bc0b6ed9e879181de27c748424890fd4236f8630a4f5a6dde23c4d3845bf20c8bfa8d8110ab47987391186789f5522b6ed0f527c33b193fc7085aefbf57e2f13210849fc5a82bb7c01d15b17c3990144f1976e518739c4b98eb8d08ce04187dd74a2242648432b3c53151e7b24840a3fe1c4f3e8fdf0326b34b95d85d01dd6f4416f4cc78c7e85950c3000ac9b73955c5be18b34851277df5b63de921b21bcdb76e005d8604d371d7ce8da115dba76c75221e2839f7c4b25d6d04327c6ce3a91120c3d227887afef2ce2d995c3a4f9530da0e40b46377a1c6528a2d057aa2caa0fb5496f55c9f072d93b64df01115e8db5e5b4ce931708ba0c33066cbb4e8d3396f76fe1e47564a3739819e02b131c27cf5e8b0af8f9d0726b65381350b2fde5d657d9eb2e7051aaf0f1f780c775a6f75d25a48ef82597ac27ac9960edc8c4e307507ee6e02aa0cb2ddbe91c5763eb669bd542a854c89e4007074d1dd7e068d32e3141afc322a1fb832fde18e7a973afa3f163739266a35ca71b636589ad157583493d0280f21ee0fda2243118c9f19a46e821254c960ce3915d3d360fd9614d6866e2db5038be2da963c0b748f452d39220a2510b167c4205f56de735b9d6676a332de65d140d294f5ac98ebec19ee0b1b37fa7ace0c8266df0190eb2bce59dc7ae9308aa1d1e9d6361d38f27a981e99145a21a138211a96904484a70e17d29a66c2b54801e357adba5dc6c33407d02fef68bd3b227b0bb196c01006b93553e35657a7e1cc8762f8386cf49b9992fc53c2d6df506bb019543715be74b90f436ff0cddbde59b298417bf0a46ddaf91fb73a11cf473465ac89dca5f702c14a5a7720aaf2b216ce670cc8b8b7196d7b49c32a461f6a579f08437c05823d8086223488c026e281beddc7e2d93f2baac53f274d5b560c424fe9f669c9e29bf47ed229290e48bb7f8120eb4ec7500cf012e62e4d6c87a0524e23ce679e0b0f8c0c1c775b656faa43642cf671460927b3fe9c82c5e1c2bd68f8f41d29ce0a9ac85c5e0400e8afc262275c4566eacb4825819417f42e3181b11ec6a014203fea0d484f8d9972e12575a9f8e823315a5f4f7b8cf4b88efcac0cb341c4b2edda33a7de19f1f2c19046b5206edadf301c4a554e662df1970b0b596e4db48266716f3d6433f8", 0x769}], 0x1}}], 0x1, 0x11) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x12000, 0x0) 14.400950997s ago: executing program 0 (id=2145): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r2, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r2, &(0x7f0000000200), 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000140)={0x0, {0x1, 0x1, 0xb, 0x4, 0x5, 0x52}}) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000180)={0x8, {0xff, 0xffffffff, 0x35800, 0x3ff}}) shutdown(r2, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36"], 0x0) r4 = fsopen(&(0x7f0000000000)='befs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000080)='source', &(0x7f0000000240)='//\xf2/\x06\b///o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r3, r3, &(0x7f0000000000)=0x7, 0x4) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xa0000, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000240)=[@mss, @sack_perm, @timestamp, @mss={0x2, 0x1}, @window, @window={0x3, 0x0, 0xfffc}, @timestamp, @timestamp], 0x8) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r4, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r4, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) 12.419347701s ago: executing program 3 (id=2147): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7f1) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xa, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000380)=ANY=[@ANYBLOB="52010102000000106a0547004000010203eb8e0d15909e77e2300509040008010310054c4635663e6a0122af0b0905c103100002ba070905020340000d0c2f85414d"], 0x0) syz_io_uring_setup(0x2c0c, &(0x7f0000000400)={0x0, 0x0, 0x4002}, 0x0, 0x0) unshare(0x2c020400) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x8, 0xf, &(0x7f0000000480)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b74fcdc321000000b7030000030000008500000005000000bf09000000f0000055090100000000009500000000000000bf9800000000000056180000000000018500000007000000b70000000000000095000000000000004c08ab20b03a0997f4eaade630a63901155f8646d4969f03a1e9012e664ae6b835b9fdcaf2385700000000dd95c96d5b53f1304eda8bd1c6990a211edbcd79bc9b29866e07a5906e07705abb54e99397f921157fd818d95737b7f4456165510c9f73781527a4b7a71f7b4702dc41793257e1243a02f3b04481630516262ac0deeb74406dffa8d21673dab935e2a7a2199500c7adc34113000000000000004c53915078741f14d77f47ee0bf1eb"], &(0x7f0000000980)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, @void, @value}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80842, 0x0) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) r4 = memfd_create(&(0x7f0000000940)='y\x105\xfb\xf7u\x83%\b\x00\x00\x00\x00\x00\x00\x00\xea_\xccZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x10\x00\x00\x00\x04\x879\xa24\xa9a\b\x00\xb2\xd3\xcbZJ\x7fa\xc4\x1acB\xaa\xc1\xfb Q\x96\xd9xJ2\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea\b\x00\x00\x00\x00\x00\x00\x00\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9V\x01A\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\a\x00\x01vRk\xaabB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\x80\x81\xa0\xa2-g\b\x99\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecn\x02\xc8\xc4\f\x04\x99\xf6\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8L\xae\x1ff\xcf\xb3\xb65\x12\x89\x02\x82t\x0f\xb0\xe89\x16\fO\x19\x91\xfd\x10\x0e\xa7r\x12\xab\xd4\xd1d\xad\f\x11\xb3\xb3c\xe2\xfe\xcd\x9f7\xa1\x14\xfa\xe2\xdf\x7f\xf4NG\xe3\xeb\x18\xde|\xb3\xf5S\x9a\x04\xb4Lry\xa9\xd6\xfb\xbc\n+N\xf7\xf6\x87\x95\xd9+\xd2sc/\x06\xaa#K3,k\xf3(\xcc\xc7\xb47\xfa\xc3\x1c\x91!\xd3\xd2`-\xa2xrR\x1c\x81i\x87u|29Q\xdf\xed\x10\x9b\x930\xa8v\xa0\x88\xa4t\x17\xb2\xca9\x02\x03\xc9P\xcc\xe0\xb7\x9c\x82\xb4\x03\x83e\xee\x95\xccO\x1b\x83\f\n{\xf3\x12\x90\xcf\x10\xb5>\b3\x80\x8d\xb2%7\x10\xeee\xe4\xc3\xb2^\xad\xb6~\xa2\xbdE\xbf\x91\vqt\x81\xbd\x19\xde\x81\tw\xd4p\xd1\x8aNJ\xb3M\a\xc4\xfa\xb0,$\x81j\xb4Hs\x93>\x16U\xd0t\xe4\xca0T\xb7\xf7\x9d4\b\xd9\xdeps\xec\xa0\nJ\xa5\xfe\xda{(\xee\xb5\x11?\xc3I-\x8bc\xc9\xfb\a\xe5\xab\xf8v1\xdc\xc5\x8c\xebs1\x81\xca\x81l\xa12\xff<\xf5\x12\xcc+\xd4\xab\x84\x16\xa4+\x0e\xd4\x02\xe3\xaa1\xeam\x8ce\xb4r\x0eo&3wff\xe6\x91\x7f\xba\xad\x05\xdd\xc0+\"\xa5\x80\'#\xfd\x9dA&\xee \x18\xe5\x17\x1bd\xd0\xb9\x90\xde\xec\xe4M\xe5\x06\x03r\fc\x8c\x10\x99x\xec`e`\xc3F\xdf\xbc\xa8\xff\x05\xe6\xea\xc3u\xd7\t\x88<\"\xf7!\xd6\x0e\xbbE^\xcd\xb0\x15g\xe6\xf2?y1\x9f\xd3\x95\xc4E\xd0\xb4\x16`r\x14\xad\x02\x17\x9a\x86I]\x02f\xd3\xc9\xe1H\xd7c\xcaQ\x8cE7\xcc\xcf=\xf3\xf7\xb9\xf6s\x88\bZi\b*w\xc5;\x88\r\xab\xa1\t\xf1\x02)5\x00\x84', 0xb) ftruncate(r4, 0xffff) fcntl$addseals(r4, 0x409, 0x7) r5 = ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f00000002c0)={r4, 0x0, 0x0, 0x8000}) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r6}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x26, 0x200, 0x70bd28, 0x25dfdc00, {0x19}, [@typed={0x14, 0x142, 0x0, 0x0, @ipv6=@private1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24841}, 0x4000000) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r7) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01072cbd7010fcfff3"], 0x34}}, 0x20) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r8, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5b}]}, 0x24}, 0x1, 0x0, 0x0, 0x21}, 0x10840) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r10) 12.030866988s ago: executing program 2 (id=2148): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r0, 0x0, 0xd1, &(0x7f0000000000)=0x3, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000c80)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3, 0xa00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}]}, 0x34}}, 0x0) io_submit(0x0, 0x1, &(0x7f0000002900)=[0x0]) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r4 = openat$autofs(0xffffff9c, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, 0x0) sendto$inet(r1, 0x0, 0x0, 0x400c806, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r1, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000080)={0x1, 0x4, 0x3f, 0x3202, @vifc_lcl_addr=@private=0xa010101, @private=0xa010101}, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfb, 0x1000000}, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044081}, 0x0) 10.930944985s ago: executing program 1 (id=2149): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x10, r3, 0x1, 0x0, 0x6, @remote}, 0x14) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x499f, &(0x7f0000000380)={0x0, 0x1ffffa, 0x400, 0x0, 0x0, 0x0, r5}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r9 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r9, r8, &(0x7f0000002080)=0x64, 0x23b) socket$nl_xfrm(0x10, 0x3, 0x6) socket$pppl2tp(0x18, 0x1, 0x1) getpid() socket$nl_xfrm(0x10, 0x3, 0x6) r10 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in6=@dev, 0x40, 0x0, 0x3, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r10, &(0x7f0000000480), 0x2e9, 0x0) sendmmsg$sock(r2, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000040)=@qipcrtr={0x2a, 0x4, 0x2}, 0x80, 0x0}}], 0x3, 0x20004874) r11 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77", 0xa1) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f00000002c0)={[0x3c, 0xffffffffffffa3f1, 0x4, 0xd646, 0x7, 0xf, 0x120000, 0x1fe, 0x0, 0x2, 0x4, 0xc7, 0x7fff, 0x101, 0x392ad71a, 0x1], 0xdddd1000, 0x141a54}) ioctl$KVM_SET_VCPU_EVENTS(r11, 0x4400ae8f, &(0x7f0000000140)=@x86={0x1, 0x0, 0x3, 0x0, 0xb85f, 0x3, 0x6, 0x1, 0x0, 0x9, 0x8, 0x0, 0x0, 0x80000001, 0x81e, 0x8, 0xe, 0xb6, 0x61, '\x00', 0xe, 0x4}) 9.547689937s ago: executing program 0 (id=2150): socket$pppoe(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$key(0xf, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000340)={&(0x7f0000000200), 0x0, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r4, 0xc02064b6, &(0x7f00000001c0)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r4, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r4, 0xc03864bc, &(0x7f0000000380)={0x200, 0x1, &(0x7f0000000440)=[r6], &(0x7f0000000200), &(0x7f0000000300), &(0x7f0000000340)}) io_setup(0x58, &(0x7f0000000300)) write(r2, 0x0, 0x0) connect$unix(r3, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) io_setup(0xffff, 0x0) 9.107058761s ago: executing program 1 (id=2151): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r2 = socket$netlink(0x10, 0x3, 0x6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0x2b0, 0x3}) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0xa8202, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) socket$rxrpc(0x21, 0x2, 0x2) r6 = syz_io_uring_setup(0x6d8a, &(0x7f0000000300)={0x0, 0x37b2, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r4}) io_uring_enter(r6, 0x34fd, 0x285c, 0x20, 0x0, 0x0) r9 = socket(0x1e, 0x5, 0x0) listen(r9, 0x0) accept4$inet6(r9, 0x0, 0x0, 0x0) r10 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r10, 0xc01064bd, &(0x7f0000000280)={&(0x7f0000000380)="a8", 0x1}) close_range(r3, 0xffffffffffffffff, 0x0) r11 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x20, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r11, 0x40045701, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x4, 0x0, 0x0, 'queue0\x00', 0xfffffffa}) r12 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x8882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r12, 0x40605346, &(0x7f00000012c0)={0x0, 0x0, {0x3, 0x0, 0x0, 0x2}, 0xfffff045}) 9.071963855s ago: executing program 2 (id=2152): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(0x0, 0x7) socket$inet_sctp(0x2, 0x1, 0x84) socket$l2tp6(0xa, 0x2, 0x73) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0xfffffffffffffc9f) syz_open_dev$video4linux(&(0x7f0000000000), 0x4, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(0xffffffffffffffff, 0x3b87, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000280)={0x3}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/disk', 0x169a82, 0x18c) sendfile(r5, r5, 0x0, 0xb) 7.611620413s ago: executing program 1 (id=2153): socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0xffffffff}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) setsockopt(0xffffffffffffffff, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00', 0x4) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) r5 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0x6e93ebbbcc0884f2, 0x100, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r5, &(0x7f0000000180)=""/196, 0xc4, 0x8000000000000001, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, '\x00', 0x22}, 0xfffffeff}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f00000000c0)) writev(r6, &(0x7f0000000480)=[{&(0x7f0000000040)="062586c0d44dc999855a9d3cefd7768dfec2125480724340518100"/43, 0x2b}, {&(0x7f0000000400)="97", 0x1}], 0x2) writev(r6, &(0x7f0000000a40)=[{0x0}], 0x1) pipe(&(0x7f0000000200)) 7.611220243s ago: executing program 3 (id=2154): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$packet(0x11, 0x2, 0x300) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x80, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, @timestamp_reply={0x11, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x80000000}}}}}, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x8000, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSW2(r2, 0x5408, &(0x7f0000000300)={0xff, 0x3eb, 0xfffffffe, 0x7fffffef, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0x1002, 0xfffffffc}) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8c041}, 0x82) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, 0x0}, 0x0) sendto$inet(r6, &(0x7f0000000040), 0x0, 0x5, 0x0, 0x0) sendto$inet(r6, 0x0, 0x0, 0x12, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x3e4, 0x188, 0x2b8, 0x0, 0x188, 0x0, 0x31c, 0x3a8, 0x3a8, 0x31c, 0x3a8, 0x3, 0x0, {[{{@ipv6={@mcast1, @dev, [], [], 'veth0_to_batadv\x00', 'wg2\x00'}, 0x0, 0x120, 0x188, 0x0, {0xd2030000}, [@common=@unspec=@connbytes={{0x38}, {[{0xdac4}, {0x6}]}}, @common=@unspec=@helper={{0x44}, {0x0, 'irc-20000\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}, {{@ipv6={@empty, @private1, [], [0x0, 0x0, 0x0, 0xff000000], 'bond0\x00', 'pim6reg1\x00', {}, {0xff}}, 0x0, 0x154, 0x194, 0x0, {}, [@common=@srh1={{0x8c}, {0x62, 0x7, 0xd, 0xff, 0x62d6, @local, @empty, @dev={0xfe, 0x80, '\x00', 0x3e}, [0x0, 0xffff00, 0xff, 0xffffff00], [0xffffffff, 0xff, 0xffffffff, 0xffffff00], [0xffffff00, 0xff, 0xff, 0xff], 0x380}}, @inet=@rpfilter={{0x24}, {0x3}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x7, 0xd4bf, 0x3, 0x1, 0x6, 0x7, 0x2, 0x5]}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x440) 7.461813462s ago: executing program 4 (id=2155): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) madvise(&(0x7f00003c1000/0x1000)=nil, 0xdfc3efff, 0x8) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) close(r3) link(0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./bus/file0\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="e0c2033c8dbaae15662c0a9b9ab67ed30bd37fad608244a85d7d60a268bd858ac577d89797ee3275980f67b53aa0f2534c5cc8a88f141f23b388c1f2507c9f1af964ea24ce72efb66c5539f0dcb6c0916c40a4ace7e6ffee2d1da6ec18bc647dbc747bacd549fb9b0a616addf10ee78d21be203eb03e88017043c4b8af349b281b11d961b86b5e051c33823f86fa5e5d5d475f211674c6d90218031ecdfde6584687f41a579894dd982ffd40f5325258a92b7dd6ae5142ff25593d67bfdcfe5f32384268d898180d3e5b7cbdfd025b3de1fe7a6e080d"], 0x0, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000080)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x1, 0x2) fchdir(r7) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') 6.093743833s ago: executing program 2 (id=2156): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000000000)=0x54d00000) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000005480)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x3}, {}, {0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x40, 0x6, 0xffffffffffffffff, 0xea, 0x100004}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmmsg$inet(r3, 0x0, 0x0, 0xc0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, 0x0, 0x0) 6.060250201s ago: executing program 3 (id=2157): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r2, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r2, &(0x7f0000000200), 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000140)={0x0, {0x1, 0x1, 0xb, 0x4, 0x5, 0x52}}) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000180)={0x8, {0xff, 0xffffffff, 0x35800, 0x3ff}}) shutdown(r2, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36"], 0x0) r4 = fsopen(&(0x7f0000000000)='befs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000080)='source', &(0x7f0000000240)='//\xf2/\x06\b///o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000140)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) quotactl$Q_SETINFO(0xffffffff80000601, 0x0, 0x0, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x519741) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x8, 0x9, &(0x7f0000000080)=ANY=[@ANYBLOB="18060000000000000000000000000000181200", @ANYBLOB], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_pktinfo(r3, 0x0, 0x8, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x4004050}, 0x40000) getsockname$packet(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x28042, 0x102) r5 = fsopen(&(0x7f0000000000)='hfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000080)='iocharset', &(0x7f0000000340)='I\x86#h\xc6Iars\xcc8\x02\xd2\xce\x8e\tw\xd1\xb7}+\xd4\x19[S\x82\x93\x9a_. \xf4,\x83s$n\xa1F\xffBl\xffb\xc6\x7fSR,\xd0.R]^k\x8eR\x8f\xa5\x93L\xfd/\xad\xa0J}&\xc6\xeco9b6\x98\x8e\\w\xdcm\xa8$x\x12\x9a\b\xd9\xe7\xc5\b\xb3\xf1CdeO\xe9\xab\x02joc\xda\x85`\x1b1\xd2\x86\x9f\x1a\x82m\x89#C\x94X^\xdd\xbeO\xf8;;\xef\xa9\r\xef\xa6\x1c\xf3\xa3\xab\xadXp\xad!\xb0\xec\xb3+\xff\xa5\xc6\x87\xc7\x10K=\xcaA\x12\t\x87\xad\xd8a2H\x8b\xeeKA\xb5\x1d\xb2\x12 \x8a\xbbr\x05\xb7\x8bp\x8f\xe6', 0x0) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r6, 0xc0481273, 0x0) 5.572580286s ago: executing program 1 (id=2159): socket$kcm(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) sendto$inet(r3, &(0x7f00000002c0), 0x20, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) lstat(0x0, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000040)={0x0, @multicast1}, &(0x7f00000000c0)=0xc) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'veth0_to_batadv\x00'}) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @random="7c44a8d5ef31", @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x1, 0x6, 0x0, @rand_addr=0x64010101, @local, {[@ra={0x94, 0x4}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000011000100"/20], 0x20}}, 0x0) close(r0) 4.08672351s ago: executing program 4 (id=2160): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r2, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r2, &(0x7f0000000200), 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000140)={0x0, {0x1, 0x1, 0xb, 0x4, 0x5, 0x52}}) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000180)={0x8, {0xff, 0xffffffff, 0x35800, 0x3ff}}) shutdown(r2, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36"], 0x0) r4 = fsopen(&(0x7f0000000000)='befs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000080)='source', &(0x7f0000000240)='//\xf2/\x06\b///o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000140)={'bridge0\x00', &(0x7f0000000480)=@ethtool_perm_addr={0x20, 0x17, "33fcbb73a6ee696f2c9366b70a9f88cb00ced9746272b7"}}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) quotactl$Q_SETINFO(0xffffffff80000601, 0x0, 0x0, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, &(0x7f0000000000)={0x1, 0x1}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x8, 0x9, &(0x7f0000000080)=ANY=[@ANYBLOB="18060000000000000000000000000000181200e4", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000380)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000300)={0x0, @private, @private}, &(0x7f0000000340)=0xc) sendmsg$nl_route(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=@ipv6_deladdrlabel={0x38, 0x49, 0x4, 0x70bd26, 0x25dfdbfc, {0xa, 0x0, 0x18, 0x0, r5, 0x1}, [@IFAL_LABEL={0x8}, @IFAL_ADDRESS={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x40000) r6 = accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14, 0x80800) getsockname$packet(r6, &(0x7f0000000240), &(0x7f0000000280)=0x14) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x28042, 0x102) ioctl$FICLONERANGE(r7, 0x4020940d, &(0x7f00000000c0)={{r7}, 0x0, 0x0, 0x100000}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) 2.431897667s ago: executing program 3 (id=2162): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r0, 0x0, 0xd1, &(0x7f0000000000)=0x3, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000c80)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3, 0xa00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}]}, 0x34}}, 0x0) io_submit(0x0, 0x1, &(0x7f0000002900)=[0x0]) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r4 = openat$autofs(0xffffff9c, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, 0x0) sendto$inet(r1, 0x0, 0x0, 0x400c806, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r1, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000080)={0x1, 0x4, 0x3f, 0x3202, @vifc_lcl_addr=@private=0xa010101, @private=0xa010101}, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfb, 0x1000000}, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044081}, 0x0) 2.034041454s ago: executing program 0 (id=2163): add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000500)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000600)={@local, @random="0332b2aebdc5", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x0, 0x67, 0x0, @dev={0xfe, 0x80, '\x00', 0x15}, @local}}}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r4, 0x4038ae7a, &(0x7f0000000000)={0x0, 0x40000105, 0x0, 0x0}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) connect$inet(r0, &(0x7f0000000280)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x20, 0x4) listen(r0, 0x0) close(r0) 735.022705ms ago: executing program 1 (id=2164): socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000240)=0x9) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getuid() sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000200)={'bond0\x00', &(0x7f0000000640)=@ethtool_per_queue_op={0x4b, 0x1d, [0x4, 0x8, 0xfffffff1, 0x8, 0x0, 0x1, 0x3e9, 0x5, 0x9, 0x6, 0x5, 0x6, 0x7ff, 0x4, 0x4, 0x3ff, 0x4, 0x8, 0x2, 0x4, 0x9, 0x4, 0x8, 0x1, 0xfffffa0c, 0x7, 0x8, 0x9be, 0x3, 0x3ff, 0x6, 0x14dc, 0x147, 0x9, 0x1, 0x3, 0x1, 0x0, 0x9, 0x6, 0x7, 0x5, 0x4, 0xfffffffb, 0x8, 0x80000000, 0x9, 0x100, 0x5, 0x19dd, 0x7, 0x3ff, 0x586, 0x6, 0xf667, 0xfffffffc, 0x7, 0x8, 0x7f, 0x6, 0xc8, 0x6, 0x0, 0xc3, 0x4, 0x10, 0xffffffa8, 0x1, 0x9, 0x1, 0x1, 0x83, 0xe39, 0xcf, 0x10, 0x401, 0x7, 0x7, 0x2a, 0x71c9, 0x1, 0x321, 0xfffffeff, 0x7f, 0x66, 0x1c24, 0xff, 0x9, 0x4, 0x2, 0x3, 0xff, 0x100, 0x126, 0x6, 0x8, 0x40000000, 0xc, 0x4, 0x8, 0xffffffc0, 0x4, 0x10001, 0x5, 0x74a000, 0x4e27, 0x3ff, 0x0, 0x8356, 0x0, 0x6, 0x9b7, 0x1, 0x80000001, 0x7f, 0xea, 0x6, 0x80000000, 0xff, 0x7, 0x4da8e6f3, 0x5, 0x10001, 0x8, 0x69e4, 0x80000001, 0xfffffff4, 0x100]}}) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) write$sndseq(r5, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @result={0x1, 0x2}}, {0x0, 0x0, 0xff, 0x3, @tick=0xf27, {0x1}, {}, @addr={0x2a, 0x5}}], 0x38) ioctl$I2C_RDWR(r5, 0x707, &(0x7f00000001c0)={0x0}) socket$nl_route(0x10, 0x3, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0xb001, 0x4, 0x3b0, 0x0, 0x10c, 0x1f0, 0x2d0, 0x2d0, 0x2d0, 0x7fffffe, 0x0, {[{{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x1}}}, {{@uncond, 0xbc, 0xe4, 0x0, {0x0, 0x1e03}}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x46e, 0xfffc}}}, {{@uncond, 0xbc, 0xe0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 541.446919ms ago: executing program 4 (id=2165): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x10, r3, 0x1, 0x0, 0x6, @remote}, 0x14) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x499f, &(0x7f0000000380)={0x0, 0x1ffffa, 0x400, 0x0, 0x0, 0x0, r5}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r9 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r9, r8, &(0x7f0000002080)=0x64, 0x23b) socket$nl_xfrm(0x10, 0x3, 0x6) socket$pppl2tp(0x18, 0x1, 0x1) getpid() socket$nl_xfrm(0x10, 0x3, 0x6) r10 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in6=@dev, 0x40, 0x0, 0x3, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r10, &(0x7f0000000480), 0x2e9, 0x0) sendmmsg$sock(r2, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000040)=@qipcrtr={0x2a, 0x4, 0x2}, 0x80, 0x0}}], 0x3, 0x20004874) r11 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77", 0xa1) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f00000002c0)={[0x3c, 0xffffffffffffa3f1, 0x4, 0xd646, 0x7, 0xf, 0x120000, 0x1fe, 0x0, 0x2, 0x4, 0xc7, 0x7fff, 0x101, 0x392ad71a, 0x1], 0xdddd1000, 0x141a54}) ioctl$KVM_SET_VCPU_EVENTS(r11, 0x4400ae8f, &(0x7f0000000140)=@x86={0x1, 0x0, 0x3, 0x0, 0xb85f, 0x3, 0x6, 0x1, 0x0, 0x9, 0x8, 0x0, 0x0, 0x80000001, 0x81e, 0x8, 0xe, 0xb6, 0x61, '\x00', 0xe, 0x4}) 447.968406ms ago: executing program 3 (id=2166): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x10, r3, 0x1, 0x0, 0x6, @remote}, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = dup(0xffffffffffffffff) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x499f, &(0x7f0000000380)={0x0, 0x1ffffa, 0x400, 0x0, 0x0, 0x0, r4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r8, r7, &(0x7f0000002080)=0x64, 0x23b) socket$nl_xfrm(0x10, 0x3, 0x6) socket$pppl2tp(0x18, 0x1, 0x1) getpid() socket$nl_xfrm(0x10, 0x3, 0x6) r9 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r9, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in6=@dev, 0x40, 0x0, 0x3, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r9, &(0x7f0000000480), 0x2e9, 0x0) sendmmsg$sock(r2, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000040)=@qipcrtr={0x2a, 0x4, 0x2}, 0x80, 0x0}}], 0x3, 0x20004874) r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77", 0xa1) ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f00000002c0)={[0x3c, 0xffffffffffffa3f1, 0x4, 0xd646, 0x7, 0xf, 0x120000, 0x1fe, 0x0, 0x2, 0x4, 0xc7, 0x7fff, 0x101, 0x392ad71a, 0x1], 0xdddd1000, 0x141a54}) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f0000000140)=@x86={0x1, 0x0, 0x3, 0x0, 0xb85f, 0x3, 0x6, 0x1, 0x0, 0x9, 0x8, 0x0, 0x0, 0x80000001, 0x81e, 0x8, 0xe, 0xb6, 0x61, '\x00', 0xe, 0x4}) 367.333309ms ago: executing program 2 (id=2167): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xfbc6, 0x10100, 0x8000003}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0x21, 0x3, 0x80000000002) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r5 = syz_io_uring_setup(0xca5, &(0x7f0000000100)={0x0, 0x8de0, 0x10310, 0xfffffffe, 0x252}, &(0x7f0000000180)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r5, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, 0x0, 0x4000000) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r8, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) setsockopt$inet6_tcp_TLS_TX(r8, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc85eb51b0ace6a", "4617a9f6040839230fb7fead776dd8dc", "3f4051c4", "a44a889722b66244"}, 0x28) recvfrom$inet6(r8, 0x0, 0x1000000, 0x300, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) write$UHID_SET_REPORT_REPLY(r1, 0x0, 0xc) 35.004558ms ago: executing program 2 (id=2168): userfaultfd(0x801) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0900000007000000000001"], 0x50) r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x862b01) r1 = syz_open_dev$evdev(&(0x7f0000000280), 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x800) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250) r2 = syz_io_uring_setup(0x239, &(0x7f0000001080)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) r5 = gettid() r6 = syz_open_procfs(r5, &(0x7f0000000000)='sched\x00') r7 = socket$tipc(0x1e, 0x5, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r7, 0x10f, 0x82, &(0x7f0000000500), &(0x7f0000000fc0)=0xfffffe6b) exit(0x2) writev(r6, &(0x7f00000001c0)=[{&(0x7f0000000240)="e869", 0x2}], 0x1) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x1, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x2def, 0x1a38, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r8, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r9 = socket(0x2, 0x80805, 0x0) r10 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xc, &(0x7f0000000180)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) syz_open_procfs$namespace(0x0, &(0x7f00000005c0)='ns/pid_for_children\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r9, 0x84, 0x18, &(0x7f00000002c0)={r11, 0x6}, 0x8) futex(&(0x7f000000cffc), 0x5, 0x1, 0x0, &(0x7f0000000000), 0x80000000) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f0000000180)=@req3={0x1003, 0x3a, 0x1000, 0x3a, 0x7fe, 0xf83, 0x7}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f00000002c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x1, 0x2, 0x1c, 0x64, 0x0, 0x8, 0x11, 0x0, @local, @remote}, {0x4e21, 0x4e20, 0x8}}}}}, 0x0) 0s ago: executing program 3 (id=2169): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x103840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$sndseq(0xffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000000)={{0x0, 0x1}, {0x19}, 0x0, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x218, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x1) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=@newsa={0x1b4, 0x10, 0x713, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@mcast1, 0x8, 0xffff, 0xfffe, 0x0, 0x2}, {@in6=@private2, 0x0, 0xff}, @in=@rand_addr=0x64010101, {0x4, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x8}, {0x0, 0x2, 0x0, 0x9}, {}, 0x2, 0x3506, 0x2, 0x1, 0x0, 0x8}, [@sec_ctx={0xa5, 0x8, {0xa1, 0x8, 0x0, 0x9e, 0x99, "c2433ecf33fa9e19b123f040e86040601915dca9f02ed4f215980b9c50120478f667a06f2a34dc31216a15f94bf18c3391cd46532b65a892b9a823b4f805843f018216cc39447edc4436161cbeb6277bda16fd3ad1eca36f09e6b0abedd4c39c543e075618be8482fc70297c0890075a38aff52b198e9ad555a0434122c719e7178808fcdd4242923dc263cbc2d1b50215f0dc39a103f95dfb"}}, @encap={0x1c, 0x4, {0x7, 0x4e24, 0x0, @in6=@remote}}]}, 0x1b4}}, 0x40) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00"], 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13101 comm="syz.3.1869" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf702e558 code=0x7ffc0000 [ 776.268476][ T30] audit: type=1326 audit(1746048350.103:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13101 comm="syz.3.1869" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf702e558 code=0x7ffc0000 [ 776.413461][ T30] audit: type=1326 audit(1746048350.103:491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13101 comm="syz.3.1869" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf702e558 code=0x7ffc0000 [ 776.495759][T13121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 776.523908][ T30] audit: type=1326 audit(1746048350.103:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13101 comm="syz.3.1869" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf702e558 code=0x7ffc0000 [ 776.554025][T13121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.662711][ T30] audit: type=1326 audit(1746048350.103:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13101 comm="syz.3.1869" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf702e558 code=0x7ffc0000 [ 776.810452][T13127] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1877'. [ 777.363139][T13121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.386601][T13121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 778.177628][T13134] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1881'. [ 778.197136][ T5828] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 778.368291][ T5828] usb 3-1: Using ep0 maxpacket: 32 [ 778.377950][ T12] net_ratelimit: 22 callbacks suppressed [ 778.377970][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 778.391607][ T5828] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 778.399211][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 778.419483][ T5828] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 778.428169][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 778.443563][ T5828] usb 3-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 778.453441][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 778.472735][ T5828] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.513160][ T5828] usb 3-1: Product: syz [ 778.528760][ T5828] usb 3-1: Manufacturer: syz [ 778.546414][ T5828] usb 3-1: SerialNumber: syz [ 778.582229][ T5828] usb 3-1: config 0 descriptor?? [ 778.599626][ T5828] usb 3-1: no audio or video endpoints found [ 778.970990][ T9944] usb 3-1: USB disconnect, device number 99 [ 779.021131][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 779.036461][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 779.051593][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 779.066555][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 779.081894][ T5828] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 779.308973][T13153] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1887'. [ 779.321618][T13153] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1887'. [ 779.418833][ T5828] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 779.441248][ T5828] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 779.475473][ T5828] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 779.492378][T13159] netlink: 'syz.4.1889': attribute type 4 has an invalid length. [ 779.500945][ T5828] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 779.500976][ T5828] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.565750][T13159] netlink: 'syz.4.1889': attribute type 4 has an invalid length. [ 779.591502][ T5828] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 779.718188][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 779.733337][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 779.801724][T13146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 779.811801][T13146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 779.840528][ T7914] udevd[7914]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 779.884838][ T5828] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 779.887755][T13161] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1890'. [ 780.492274][T13168] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1891'. [ 781.161184][T13172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1893'. [ 781.735030][T13184] dns_resolver: Unsupported content type (4) [ 781.855485][ T5906] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 782.017214][ T5906] usb 5-1: device descriptor read/64, error -71 [ 782.257455][ T5906] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 782.289364][ T5828] usb 4-1: USB disconnect, device number 84 [ 782.396274][T13192] vlan0: entered promiscuous mode [ 782.402406][ T5906] usb 5-1: device descriptor read/64, error -71 [ 782.416239][T13192] team0: entered promiscuous mode [ 782.423605][T13192] bridge1: entered promiscuous mode [ 782.518458][ T5906] usb usb5-port1: attempt power cycle [ 782.880115][ T5906] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 782.917954][ T5906] usb 5-1: device descriptor read/8, error -71 [ 783.267317][ T5906] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 783.307477][ T5906] usb 5-1: device descriptor read/8, error -71 [ 783.419108][ T5906] usb usb5-port1: unable to enumerate USB device [ 783.868030][ T12] net_ratelimit: 26 callbacks suppressed [ 783.868047][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 783.888626][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 783.903363][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 783.918254][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 784.479104][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 784.494248][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 784.509927][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 784.525241][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 784.755434][T13229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 784.835737][T13229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 784.856070][T13229] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1907'. [ 785.125181][T13229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 785.160084][ T1106] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 785.175020][ T1106] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 785.254854][T13229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 785.759678][T13246] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1912'. [ 785.992377][T13242] syz.1.1910 (13242): drop_caches: 2 [ 785.999609][T13242] syz.1.1910 (13242): drop_caches: 2 [ 786.274722][T13254] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 786.298898][T13254] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1914'. [ 789.178220][ T6642] net_ratelimit: 26 callbacks suppressed [ 789.178237][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 789.187494][ T5906] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 789.199096][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 789.221543][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 789.236290][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 789.348754][ T5879] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 789.517189][ T5879] usb 4-1: Using ep0 maxpacket: 32 [ 789.527112][ T5906] usb 2-1: Using ep0 maxpacket: 16 [ 789.533434][ T5879] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 789.544282][ T5879] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.553523][ T5879] usb 4-1: Product: syz [ 789.559120][ T5879] usb 4-1: Manufacturer: syz [ 789.565262][ T5906] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 789.575464][ T5906] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 789.592779][ T5879] usb 4-1: SerialNumber: syz [ 789.604000][ T5906] usb 2-1: Product: syz [ 789.617561][ T5879] usb 4-1: config 0 descriptor?? [ 789.622801][ T5906] usb 2-1: Manufacturer: syz [ 789.663771][ T5906] usb 2-1: SerialNumber: syz [ 789.858264][ T5879] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 789.877622][ T5906] usb 2-1: config 0 descriptor?? [ 789.996216][T13292] syzkaller0: entered promiscuous mode [ 790.026020][T13292] syzkaller0: entered allmulticast mode [ 790.128049][ T5906] usb 2-1: USB disconnect, device number 83 [ 790.187245][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 790.202619][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 790.217530][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 790.232410][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 790.578705][T13299] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 790.595873][T13299] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 790.843352][T13304] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1928'. [ 790.879266][T13304] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1928'. [ 790.893306][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 790.908446][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 790.951379][T13304] unsupported nlmsg_type 40 [ 791.115421][ T5828] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 791.300267][ T5828] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 791.320295][ T5828] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 791.368350][ T5828] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 791.429181][ T5828] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 791.465282][ T5828] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.632133][ T5828] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 791.896732][T13305] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.907821][T13305] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.065916][ T5828] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 792.568834][ T5879] gspca_stk1135: reg_w 0x351 err -71 [ 792.575234][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.583058][ T5879] gspca_stk1135: Sensor write failed [ 792.589854][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.602889][ T5879] gspca_stk1135: Sensor write failed [ 792.612415][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.619722][ T5879] gspca_stk1135: Sensor read failed [ 792.626279][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.663634][ T5879] gspca_stk1135: Sensor read failed [ 792.684570][ T5879] gspca_stk1135: Detected sensor type unknown (0x0) [ 792.705786][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.714764][ T5879] gspca_stk1135: Sensor read failed [ 792.725064][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.733904][ T5879] gspca_stk1135: Sensor read failed [ 792.743989][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.752981][ T5879] gspca_stk1135: Sensor write failed [ 792.761564][ T5879] gspca_stk1135: serial bus timeout: status=0x00 [ 792.773421][ T5879] gspca_stk1135: Sensor write failed [ 792.783115][ T5879] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 792.809542][ T5879] usb 4-1: USB disconnect, device number 85 [ 794.369538][ T5879] usb 3-1: USB disconnect, device number 100 [ 794.606140][ T9575] net_ratelimit: 26 callbacks suppressed [ 794.606160][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 794.629169][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 794.644322][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 794.659382][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 795.138101][T13304] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 795.187136][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 795.202534][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 795.217897][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 795.232873][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 795.687061][ T5828] usb 5-1: new full-speed USB device number 85 using dummy_hcd [ 795.906870][T13329] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1934'. [ 795.925096][ T5828] usb 5-1: unable to get BOS descriptor or descriptor too short [ 795.936694][ T5828] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 795.939570][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 795.944496][ T5828] usb 5-1: can't read configurations, error -71 [ 795.959397][ T6642] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 796.761525][T13344] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1937'. [ 797.165696][T13344] team1: entered promiscuous mode [ 797.177135][ T5879] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 797.239855][T13344] 8021q: adding VLAN 0 to HW filter on device team1 [ 797.408116][ T5879] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 797.518008][ T5879] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 797.545686][ T5879] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 797.589102][ T5879] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 797.626163][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.798020][ T5879] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 798.084690][T13361] syz.1.1942 (13361): drop_caches: 2 [ 798.289686][T13361] syz.1.1942 (13361): drop_caches: 2 [ 798.362138][T13365] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 798.442534][ T7946] udevd[7946]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 798.654509][T13365] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 798.691084][ T5879] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 799.728463][ T13] net_ratelimit: 26 callbacks suppressed [ 799.728486][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 799.749203][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 799.764114][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 799.779024][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 800.202614][ T5828] usb 4-1: USB disconnect, device number 86 [ 800.308371][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 800.323551][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 800.338293][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 800.353493][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 800.852417][ T30] kauditd_printk_skb: 848 callbacks suppressed [ 800.852436][ T30] audit: type=1326 audit(1746048375.603:1342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 800.885633][ T30] audit: type=1326 audit(1746048375.603:1343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=365 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 800.916145][ T30] audit: type=1326 audit(1746048375.613:1344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.037293][ T5828] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 801.047549][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 801.062617][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 801.093239][ T30] audit: type=1326 audit(1746048375.613:1345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.189142][ T30] audit: type=1326 audit(1746048375.613:1346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.241132][ T30] audit: type=1326 audit(1746048375.613:1347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.264170][ T5828] usb 3-1: Using ep0 maxpacket: 32 [ 801.284206][ T5828] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 801.295465][ T5828] usb 3-1: config 0 has no interface number 0 [ 801.302228][ T5828] usb 3-1: config 0 interface 184 has no altsetting 0 [ 801.316732][ T30] audit: type=1326 audit(1746048375.613:1348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.359072][ T5828] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 801.377409][ T5828] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.385576][ T5828] usb 3-1: Product: syz [ 801.393435][ T5828] usb 3-1: Manufacturer: syz [ 801.400052][ T5828] usb 3-1: SerialNumber: syz [ 801.406743][ T30] audit: type=1326 audit(1746048375.613:1349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.437471][ T5828] usb 3-1: config 0 descriptor?? [ 801.450945][ T5828] smsc75xx v1.0.0 [ 801.462682][ T30] audit: type=1326 audit(1746048375.613:1350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=19 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 801.499391][ T30] audit: type=1326 audit(1746048375.613:1351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13383 comm="syz.4.1950" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 802.977757][ T5828] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 802.989031][ T5828] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 803.933432][T13410] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1952'. [ 803.943775][T13410] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1952'. [ 803.953935][T13410] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1952'. [ 805.166167][ T6640] net_ratelimit: 26 callbacks suppressed [ 805.166189][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 805.187385][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 805.202250][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 805.217234][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 805.497192][ T5828] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 805.520702][ T5828] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 805.574493][ T5828] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 805.651132][ T5828] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 805.682055][ T5828] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 805.753846][ T5828] usb 3-1: USB disconnect, device number 101 [ 805.820084][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 805.835000][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 805.849789][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 805.864527][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 806.037150][ T5879] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 806.047594][ T5906] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 806.228806][ T5879] usb 5-1: Using ep0 maxpacket: 16 [ 806.419399][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 806.433784][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 806.499748][ T5906] usb 2-1: Using ep0 maxpacket: 8 [ 806.511349][ T5879] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 806.523841][ T5879] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 806.563757][T13427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 806.582947][T13427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 806.615097][ T5879] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 806.645440][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.751320][ T5879] usb 5-1: Product: syz [ 806.777367][ T5879] usb 5-1: Manufacturer: syz [ 806.799963][ T5879] usb 5-1: SerialNumber: syz [ 806.873924][ T5879] usb 5-1: config 0 descriptor?? [ 806.887333][ T5879] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 806.912698][ T5879] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 807.517123][ T5883] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 807.552878][ T5879] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 807.568434][ T5879] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 807.683933][ T5883] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 807.695738][ T5883] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 807.737179][ T5883] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 807.773426][T13450] tipc: Started in network mode [ 807.778541][T13450] tipc: Node identity 080211000001, cluster identity 4711 [ 807.786195][T13450] tipc: Enabled bearer , priority 0 [ 807.824589][ T5883] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 807.838735][ T5883] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 807.876326][ T5883] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 808.260427][ T5883] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 808.292859][ T5879] em28xx 5-1:0.0: Unknown AC97 audio processor detected! [ 808.304722][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 2 [ 808.320646][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 4 [ 808.330437][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 6 [ 808.343428][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 54 [ 808.352013][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 56 [ 808.364653][T13444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 808.382810][T13444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 808.610725][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.617949][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.897101][ T5883] tipc: Node number set to 134418688 [ 809.007107][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 20 [ 809.021508][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 16 [ 809.045329][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 12 [ 809.110351][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 14 [ 809.118348][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 18 [ 809.133041][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 22 [ 809.168402][ T5879] em28xx 5-1:0.0: couldn't setup AC97 register 24 [ 809.193093][ T5879] em28xx 5-1:0.0: Binding audio extension [ 809.200829][ T5879] em28xx 5-1:0.0: em28xx-audio.c: Copyright (C) 2006 Markus Rechberger [ 809.213475][ T5879] em28xx 5-1:0.0: em28xx-audio.c: Copyright (C) 2007-2016 Mauro Carvalho Chehab [ 809.477662][ T5879] em28xx 5-1:0.0: alt 0 doesn't exist on interface 7 [ 809.607219][ T5828] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 809.659443][ T5879] usb 5-1: USB disconnect, device number 87 [ 809.723858][ T5906] usb 2-1: unable to get BOS descriptor or descriptor too short [ 809.749996][ T5906] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 809.771856][ T5879] em28xx 5-1:0.0: Disconnecting em28xx [ 809.785839][ T5906] usb 2-1: can't read configurations, error -71 [ 809.801421][ T5879] em28xx 5-1:0.0: Closing audio extension [ 809.834537][ T5879] em28xx 5-1:0.0: Freeing device [ 810.057712][ T5828] usb 4-1: Using ep0 maxpacket: 32 [ 810.071867][ T5828] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 810.100899][ T5828] usb 4-1: config 0 has no interface number 0 [ 810.173961][ T5828] usb 4-1: config 0 interface 184 has no altsetting 0 [ 810.217602][ T6638] net_ratelimit: 26 callbacks suppressed [ 810.217626][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 810.238380][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 810.253101][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 810.267987][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 810.338663][ T5879] usb 3-1: USB disconnect, device number 102 [ 810.393526][ T5828] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 810.428517][ T5828] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.457136][ T5828] usb 4-1: Product: syz [ 810.485848][ T5828] usb 4-1: Manufacturer: syz [ 810.491888][ T5828] usb 4-1: SerialNumber: syz [ 810.572533][ T5828] usb 4-1: config 0 descriptor?? [ 810.637253][ T5828] smsc75xx v1.0.0 [ 810.979049][T13488] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 811.057339][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 811.072291][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 811.087386][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 811.102194][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 811.246175][T13491] netlink: 'syz.0.1974': attribute type 1 has an invalid length. [ 811.310819][T13494] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1974'. [ 811.335746][T13491] 8021q: adding VLAN 0 to HW filter on device bond3 [ 811.465024][T13488] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 811.597696][T13488] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 811.727228][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 811.741591][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 811.757369][ T5828] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 811.770884][ T5828] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 811.835014][T13499] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1976'. [ 811.848892][T13499] raw_sendmsg: syz.1.1976 forgot to set AF_INET. Fix it! [ 811.855909][ T9944] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 812.216500][ T9944] usb 5-1: config 0 has no interfaces? [ 812.265705][ T9944] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 812.355520][ T9944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.384801][ T9944] usb 5-1: Product: syz [ 812.402299][ T9944] usb 5-1: Manufacturer: syz [ 812.415408][ T9944] usb 5-1: SerialNumber: syz [ 812.501865][ T9944] usb 5-1: config 0 descriptor?? [ 813.571207][T13494] bond3 (unregistering): Released all slaves [ 813.613127][ T5828] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 813.644330][ T5828] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 813.661095][ T5828] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 813.684689][ T5828] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 813.769854][ T5828] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 813.859236][ T5828] usb 4-1: USB disconnect, device number 87 [ 814.967579][ T5906] usb 5-1: USB disconnect, device number 88 [ 815.078328][T13528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 815.088112][T13528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 815.328035][ T6638] net_ratelimit: 22 callbacks suppressed [ 815.328053][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 815.348842][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 815.363554][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 815.378320][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 816.103852][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 816.118993][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 816.133904][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 816.148940][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 816.164619][ T9944] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 816.191926][ T5828] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 816.877151][ T5828] usb 3-1: Using ep0 maxpacket: 32 [ 816.882869][ T9944] usb 2-1: Using ep0 maxpacket: 16 [ 816.940725][T13532] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 816.996080][T13532] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.063005][ T9944] usb 2-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 817.077828][T13532] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1986'. [ 817.098650][T13532] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 817.140437][ T9944] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 817.164416][ T9944] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 817.175160][ T9944] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.186329][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 817.201894][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 817.224797][ T9944] usb 2-1: Product: syz [ 817.255255][ T9944] usb 2-1: Manufacturer: syz [ 817.268214][ T9944] usb 2-1: SerialNumber: syz [ 817.301112][ T5828] usb 3-1: unable to get BOS descriptor or descriptor too short [ 817.310265][ T5828] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 817.336441][ T5828] usb 3-1: can't read configurations, error -71 [ 817.568253][ T9944] usb 2-1: 0:2 : does not exist [ 817.627811][ T9944] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 817.672632][ T9944] usb 2-1: USB disconnect, device number 86 [ 817.829984][ T7946] udevd[7946]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 818.147230][T13546] macsec1: entered promiscuous mode [ 818.157478][T13546] macsec1: entered allmulticast mode [ 818.163198][T13546] team0: entered allmulticast mode [ 818.183136][T13546] bridge1: entered allmulticast mode [ 818.245649][T13545] delete_channel: no stack [ 819.287222][ T9944] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 819.441036][ T9944] usb 2-1: Using ep0 maxpacket: 16 [ 819.469201][ T9944] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 819.517070][ T9944] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 819.562814][ T9944] usb 2-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 819.582265][ T9944] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 819.604148][ T9944] usb 2-1: Product: syz [ 819.614328][ T9944] usb 2-1: Manufacturer: syz [ 819.634402][ T9944] usb 2-1: SerialNumber: syz [ 819.672351][ T9944] usb 2-1: config 0 descriptor?? [ 820.257217][ T5906] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 820.377694][ T6644] net_ratelimit: 22 callbacks suppressed [ 820.377712][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 820.398414][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 820.413477][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 820.428419][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 820.577368][ T5906] usb 3-1: device descriptor read/64, error -71 [ 820.826958][ T5906] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 821.063172][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 821.078124][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 821.092971][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 821.107827][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 821.122599][ T5906] usb 3-1: device descriptor read/64, error -71 [ 821.237764][ T5906] usb usb3-port1: attempt power cycle [ 821.287278][ T5879] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 821.488229][T13584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 821.501822][T13584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 821.555198][T13584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 821.638263][ T5906] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 821.664119][T13584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 821.749899][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 821.764864][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 821.827733][ T5879] usb 4-1: config 0 has no interfaces? [ 821.837114][ T5906] usb 3-1: device descriptor read/8, error -71 [ 821.959423][ T9944] usb 2-1: USB disconnect, device number 87 [ 822.078738][ T5879] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 822.088733][ T5879] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.119148][ T5906] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 822.188149][ T5879] usb 4-1: Product: syz [ 822.211135][ T5879] usb 4-1: Manufacturer: syz [ 822.218351][ T5906] usb 3-1: device descriptor read/8, error -71 [ 822.244265][ T5879] usb 4-1: SerialNumber: syz [ 822.274853][ T5879] usb 4-1: config 0 descriptor?? [ 822.331298][ T5906] usb usb3-port1: unable to enumerate USB device [ 822.587818][T13580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 822.598555][T13580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 824.227867][ T9944] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 824.257115][ T5828] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 824.441538][ T5828] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 824.472300][ T9944] usb 3-1: config 0 interface 0 has no altsetting 0 [ 824.491099][ T9944] usb 3-1: New USB device found, idVendor=077b, idProduct=2226, bcdDevice=ca.8b [ 824.536414][ T5828] usb 5-1: config 0 has no interfaces? [ 824.549860][ T9944] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 824.558563][ T5828] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 824.581182][ T5828] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 824.593649][ T9944] usb 3-1: config 0 descriptor?? [ 824.623585][ T5828] usb 5-1: config 0 descriptor?? [ 824.781560][ T5828] usb 4-1: USB disconnect, device number 88 [ 825.278328][T13599] syz.0.2002 (13599): drop_caches: 2 [ 825.395574][T13599] syz.0.2002 (13599): drop_caches: 2 [ 825.585645][ T6640] net_ratelimit: 26 callbacks suppressed [ 825.585667][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 825.606907][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 825.621659][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 825.636373][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 825.676648][ T9944] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 825.759137][ T9944] asix 3-1:0.0: probe with driver asix failed with error -71 [ 825.804958][ T9944] usb 3-1: USB disconnect, device number 109 [ 826.371970][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 826.387191][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 826.402086][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 826.417116][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 827.619074][T13621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 827.644785][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 827.659888][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 827.685265][T13621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.251571][T13611] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2004'. [ 829.005850][ T5879] usb 5-1: USB disconnect, device number 89 [ 830.097292][ T5906] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 830.758340][ T5906] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 830.779336][ T5906] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 830.797121][ T5906] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 830.817208][ T5906] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 830.830791][ T5906] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.909256][ T5906] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 830.979050][ T6638] net_ratelimit: 22 callbacks suppressed [ 830.979065][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 830.999724][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 831.014723][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 831.029449][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 831.372836][ T5906] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 831.489703][T13648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 831.500415][T13648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 831.716024][T13663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 831.727815][T13663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 831.740931][T13666] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(10) [ 831.747551][T13666] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 831.779438][T13664] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(13) [ 831.786080][T13664] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 831.806216][T13660] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 831.812783][T13660] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 831.834659][T13666] vhci_hcd vhci_hcd.0: Device attached [ 831.909205][T13660] vhci_hcd vhci_hcd.0: Device attached [ 831.947733][T13664] vhci_hcd vhci_hcd.0: Device attached [ 831.962116][T13660] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 832.007281][ T5906] vhci_hcd: vhci_device speed not set [ 832.024191][T13673] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(12) [ 832.030848][T13673] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 832.061510][T13664] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 832.080224][ T5906] usb 41-2: new low-speed USB device number 3 using vhci_hcd [ 832.105358][T13673] vhci_hcd vhci_hcd.0: Device attached [ 832.183743][T13674] vhci_hcd: connection closed [ 832.183964][ T9575] vhci_hcd: stop threads [ 832.195784][T13667] vhci_hcd: connection reset by peer [ 832.204220][T13669] vhci_hcd: connection closed [ 832.207526][T13661] vhci_hcd: connection closed [ 832.235316][ T9575] vhci_hcd: release socket [ 832.235544][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 832.242454][ T9575] vhci_hcd: disconnect device [ 832.244724][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 832.244753][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 832.244776][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 832.310081][ T5879] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 832.407237][ T9575] vhci_hcd: stop threads [ 832.411824][ T9575] vhci_hcd: release socket [ 832.421030][ T9575] vhci_hcd: disconnect device [ 832.452944][ T9575] vhci_hcd: stop threads [ 832.468353][ T9575] vhci_hcd: release socket [ 832.473876][ T9575] vhci_hcd: disconnect device [ 832.480768][ T9575] vhci_hcd: stop threads [ 832.485218][ T9575] vhci_hcd: release socket [ 832.491103][ T9575] vhci_hcd: disconnect device [ 832.507499][ T5879] usb 3-1: config 0 has no interfaces? [ 832.518785][ T5879] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 832.528948][ T5879] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.540865][ T5879] usb 3-1: Product: syz [ 832.541653][T13678] loop8: detected capacity change from 0 to 8 [ 832.545276][ T5879] usb 3-1: Manufacturer: syz [ 832.561197][T13678] Dev loop8: unable to read RDB block 8 [ 832.566981][ T5879] usb 3-1: SerialNumber: syz [ 832.592590][T13678] loop8: unable to read partition table [ 832.659175][ T9944] usb 2-1: USB disconnect, device number 88 [ 832.674107][T13678] loop8: partition table beyond EOD, truncated [ 832.685468][T13678] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 832.702398][ T5879] usb 3-1: config 0 descriptor?? [ 832.813221][T13682] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2019'. [ 832.909081][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 832.923718][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 832.998575][T13676] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2017'. [ 833.107091][ T5879] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 833.187784][T13676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 833.203153][T13676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.653868][ T5879] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 833.663939][ T5879] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 833.676029][ T5879] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 833.709114][ T5879] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 833.723973][ T5879] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 833.739547][ T5879] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 833.782830][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 833.793747][ T5879] usb 5-1: Product: syz [ 833.804223][ T5879] usb 5-1: Manufacturer: syz [ 833.970191][ T5879] cdc_wdm 5-1:1.0: skipping garbage [ 833.994990][ T5879] cdc_wdm 5-1:1.0: skipping garbage [ 834.030789][ T5879] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 834.057197][ T5879] cdc_wdm 5-1:1.0: Unknown control protocol [ 834.914350][ T5828] usb 5-1: USB disconnect, device number 90 [ 834.922966][ T5879] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 834.991267][ T5883] usb 3-1: USB disconnect, device number 110 [ 835.110367][ T5879] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 835.163576][ T5879] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 835.184764][ T5879] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 835.205897][ T5879] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 835.239416][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 835.281335][ T5879] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 835.383619][ T7914] udevd[7914]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 835.414210][ T5879] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 835.496280][T13698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 835.508555][T13698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 835.577445][ T5883] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 835.725403][ T30] kauditd_printk_skb: 43 callbacks suppressed [ 835.725423][ T30] audit: type=1326 audit(1746048410.483:1395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13709 comm="syz.2.2026" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa1539 code=0x0 [ 835.879870][ T5883] usb 2-1: config 0 has an invalid interface number: 9 but max is 0 [ 835.895074][ T5883] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 835.910512][ T5883] usb 2-1: config 0 has no interface number 0 [ 835.922067][ T5883] usb 2-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=45.e8 [ 835.940966][ T5883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 835.977610][ T5883] usb 2-1: config 0 descriptor?? [ 835.993885][ T5883] usb 2-1: bad CDC descriptors [ 836.087273][ T5879] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 836.253906][ T5879] usb 5-1: Using ep0 maxpacket: 32 [ 836.304227][ T5879] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 836.313556][ T5879] usb 5-1: config 0 has no interface number 0 [ 836.320933][ T13] net_ratelimit: 22 callbacks suppressed [ 836.320946][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 836.342199][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 836.357053][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 836.371814][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 836.386759][ T5879] usb 5-1: config 0 interface 184 has no altsetting 0 [ 836.543063][ T5879] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 836.560796][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.571122][ T5879] usb 5-1: Product: syz [ 836.575419][ T5879] usb 5-1: Manufacturer: syz [ 836.581415][ T5879] usb 5-1: SerialNumber: syz [ 836.594096][ T5879] usb 5-1: config 0 descriptor?? [ 837.155731][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 837.170772][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 837.185510][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 837.200205][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 837.231653][ T5879] smsc75xx v1.0.0 [ 837.276986][ T5906] vhci_hcd: vhci_device speed not set [ 837.769994][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 837.785499][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 838.324101][ T5879] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 838.341463][ T5879] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 838.477205][ T9944] usb 4-1: USB disconnect, device number 89 [ 839.095802][T13732] tipc: Enabled bearer , priority 10 [ 839.629464][T13734] macvlan0: entered promiscuous mode [ 839.644174][T13734] bond0: entered promiscuous mode [ 839.658313][T13734] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 839.700786][T13734] macvlan0: entered allmulticast mode [ 839.720614][T13734] bond0: entered allmulticast mode [ 839.752395][T13734] team0: Port device macvlan0 added [ 839.893629][T13734] syz.2.2030 (13734) used greatest stack depth: 19720 bytes left [ 840.171205][ T9944] usb 2-1: USB disconnect, device number 89 [ 840.199975][ T5879] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 840.222855][T13742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.232190][T13742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.260720][ T5879] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 840.415876][ T5879] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 840.593533][ T5879] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 840.633547][ T5879] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 840.647493][ T5879] usb 5-1: USB disconnect, device number 91 [ 840.757360][ T5906] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 840.933959][ T5906] usb 2-1: config 0 has no interfaces? [ 841.274805][ T5906] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 841.297666][ T5906] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.306283][ T5906] usb 2-1: Product: syz [ 841.316024][ T5906] usb 2-1: Manufacturer: syz [ 841.324347][ T5906] usb 2-1: SerialNumber: syz [ 841.345241][ T5906] usb 2-1: config 0 descriptor?? [ 841.571822][T13747] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2034'. [ 841.589838][T13747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.613584][T13747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.814960][T13761] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2037'. [ 841.817114][ T5906] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 841.883457][ T13] net_ratelimit: 26 callbacks suppressed [ 841.883472][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 841.904927][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 841.920028][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 841.935026][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 842.135823][ T5906] usb 5-1: config 0 has no interfaces? [ 842.181183][ T5906] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 842.335748][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 842.427084][ T5906] usb 5-1: Product: syz [ 842.471659][ T5906] usb 5-1: Manufacturer: syz [ 842.480327][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 842.495198][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 842.510154][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 842.525024][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 842.539983][ T5906] usb 5-1: SerialNumber: syz [ 842.549431][ T5906] usb 5-1: config 0 descriptor?? [ 843.259242][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 843.274103][ T9575] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 843.295107][T13756] misc userio: Invalid payload size [ 843.831932][ T24] usb 2-1: USB disconnect, device number 90 [ 844.417144][ T10] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 844.789961][ T10] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 844.815104][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 844.870926][ T10] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 844.934846][T13755] delete_channel: no stack [ 844.967710][ T5879] usb 5-1: USB disconnect, device number 92 [ 845.026397][ T10] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 845.062077][ T10] usb 2-1: Manufacturer: syz [ 845.142547][ T24] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 845.275319][ T10] usb 2-1: config 0 descriptor?? [ 845.302646][ T24] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 845.329797][ T24] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 845.349859][ T24] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 845.391697][ T24] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 845.497469][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.572929][ T24] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 845.810616][T13799] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2041'. [ 845.859807][ T10] rc_core: IR keymap rc-hauppauge not found [ 845.865926][ T10] Registered IR keymap rc-empty [ 845.873771][T13786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.882890][ T10] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 846.113751][T13786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 846.122241][ T5879] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 846.294830][ T5906] hid-generic 0000:0000:0000.001A: unknown main item tag 0x0 [ 846.307487][ T5879] usb 3-1: Using ep0 maxpacket: 32 [ 846.367455][ T10] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input81 [ 846.390442][ T5906] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 846.404794][T13805] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 846.425925][ T24] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 846.462220][ T5879] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 846.501735][ T5879] usb 3-1: config 0 has no interface number 0 [ 846.522704][ T5879] usb 3-1: config 0 interface 184 has no altsetting 0 [ 846.559598][ T5879] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 846.580764][ T5879] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.605576][ T5879] usb 3-1: Product: syz [ 846.619769][ T5879] usb 3-1: Manufacturer: syz [ 846.631341][ T5879] usb 3-1: SerialNumber: syz [ 846.791451][T13805] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 846.823453][T13799] bond1: entered allmulticast mode [ 846.898368][ T6638] net_ratelimit: 22 callbacks suppressed [ 846.898388][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 846.918936][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 846.934106][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 846.948790][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 846.991411][ T5879] usb 3-1: config 0 descriptor?? [ 847.101874][ T5879] smsc75xx v1.0.0 [ 847.264872][T13809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 847.292844][T13809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 847.638988][ T24] usb 2-1: USB disconnect, device number 91 [ 847.673531][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 847.688691][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 847.703138][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 847.718507][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 848.145474][ T5879] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 848.261271][T13820] netlink: 'syz.4.2047': attribute type 12 has an invalid length. [ 848.307328][ T5879] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 848.489995][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 848.504844][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 848.767784][ T24] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 849.413862][ T24] usb 2-1: config 0 has no interfaces? [ 849.497136][ T24] usb 2-1: New USB device found, idVendor=ac09, idProduct=0a0f, bcdDevice= c.3e [ 849.678311][ T24] usb 2-1: New USB device strings: Mfr=199, Product=92, SerialNumber=3 [ 849.717079][ T24] usb 2-1: Product: syz [ 849.721330][ T24] usb 2-1: Manufacturer: syz [ 849.759086][ T24] usb 2-1: SerialNumber: syz [ 849.784420][ T24] usb 2-1: config 0 descriptor?? [ 849.886208][ T5828] usb 4-1: USB disconnect, device number 90 [ 850.073443][ T5879] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 850.085641][ T5879] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 850.182995][ T5879] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 850.214155][ T5879] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 850.237277][T13821] random: crng reseeded on system resumption [ 850.420665][ T5879] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 850.512969][ T5879] usb 3-1: USB disconnect, device number 111 [ 851.077831][T13830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.097796][T13830] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.397150][ T5879] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 851.581885][ T5879] usb 5-1: config 0 has no interfaces? [ 851.600655][ T5879] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 851.623453][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.674685][ T5879] usb 5-1: Product: syz [ 851.689758][ T5879] usb 5-1: Manufacturer: syz [ 851.716901][ T5879] usb 5-1: SerialNumber: syz [ 851.763940][ T5879] usb 5-1: config 0 descriptor?? [ 851.982447][T13836] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2051'. [ 851.998512][T13836] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 852.016767][T13836] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 852.345667][ T10] usb 2-1: USB disconnect, device number 92 [ 852.410411][ T6638] net_ratelimit: 22 callbacks suppressed [ 852.410433][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 852.431054][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 852.445743][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 852.461176][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 852.882091][T13843] syz.3.2053 (13843): drop_caches: 2 [ 852.891085][T13843] syz.3.2053 (13843): drop_caches: 2 [ 852.997185][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 853.012345][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 853.027401][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 853.042107][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 853.832890][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 853.847838][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 853.936174][ T5879] usb 5-1: USB disconnect, device number 93 [ 854.040459][T13862] input: syz1 as /devices/virtual/input/input82 [ 854.687583][ T5828] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 854.869229][ T5828] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 854.897202][ T5879] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 854.970442][ T5828] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 855.057094][ T5828] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 855.110377][ T5879] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 855.131510][ T5828] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 855.351436][ T5879] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 855.366882][ T5828] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 855.407073][ T5828] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 855.424778][ T5879] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 855.463585][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 855.488769][ T5879] usb 2-1: config 0 descriptor?? [ 855.667935][T13868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 855.677712][T13868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 855.757664][ T5828] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 855.796617][ T7946] udevd[7946]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 856.462939][T13885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 856.482379][T13877] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2060'. [ 856.553179][T13885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 857.067126][ T5879] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 857.217035][ T5879] usb 5-1: Using ep0 maxpacket: 32 [ 857.595665][ T5828] usb 2-1: USB disconnect, device number 93 [ 857.602775][ T5879] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 857.629438][ T6638] net_ratelimit: 26 callbacks suppressed [ 857.629496][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 857.650391][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 857.665145][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 857.679917][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 857.694915][ T5879] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 857.705439][ T5879] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 857.715303][ T5879] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 857.757232][ T5879] usb 5-1: config 0 descriptor?? [ 858.068934][ T24] usb 4-1: USB disconnect, device number 91 [ 858.191154][ T5879] ft260 0003:0403:6030.001B: unknown main item tag 0x0 [ 858.494992][ T5879] ft260 0003:0403:6030.001B: chip code: 0000 0000 [ 858.645370][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 858.660220][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 858.674959][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 858.689784][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 858.849158][ T5879] ft260 0003:0403:6030.001B: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 859.050404][T13888] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2063'. [ 859.080109][T13888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.089623][T13888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.118816][T13888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.216686][T13888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.319363][T13888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.381226][T13888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.446902][ T24] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 859.526530][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 859.541042][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 859.611503][ T24] usb 2-1: config 0 has no interfaces? [ 859.628745][ T24] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 859.653553][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.663648][ T5879] ft260 0003:0403:6030.001B: failed to retrieve status: -71 [ 859.672325][ T5879] ft260 0003:0403:6030.001B: failed to reset I2C controller: -71 [ 859.781652][ T24] usb 2-1: Product: syz [ 859.789086][ T24] usb 2-1: Manufacturer: syz [ 859.800891][ T24] usb 2-1: SerialNumber: syz [ 859.806110][ T5879] usb 5-1: USB disconnect, device number 94 [ 859.828308][ T24] usb 2-1: config 0 descriptor?? [ 860.062969][T13916] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2069'. [ 860.113470][T13916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 860.123975][T13916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 862.109984][ T5879] usb 2-1: USB disconnect, device number 94 [ 862.782066][ T6638] net_ratelimit: 22 callbacks suppressed [ 862.782083][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 862.802597][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 862.817663][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 862.832545][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 863.012354][ T5828] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 863.288929][ T5828] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 863.340843][ T5828] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 863.369012][ T5828] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 863.381065][ T5828] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 863.397169][ T5828] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 863.433919][ T5828] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 863.582209][ T7922] udevd[7922]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 863.602732][ T5828] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 863.655074][T13946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 863.666014][T13946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 863.792539][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 863.807500][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 863.822372][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 863.837748][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 864.268724][T13961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.278349][T13961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.471168][T13955] syz.4.2079 (13955): drop_caches: 2 [ 864.585527][T13955] syz.4.2079 (13955): drop_caches: 2 [ 864.599558][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 864.614434][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 865.624963][ T5879] usb 2-1: USB disconnect, device number 95 [ 866.378332][T13983] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2084'. [ 866.399505][T13983] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2084'. [ 867.453724][T13983] bond0: (slave team0): Releasing backup interface [ 867.498237][T13983] team0 (unregistering): Port device team_slave_0 removed [ 867.530421][T13983] team0 (unregistering): Port device team_slave_1 removed [ 867.574130][T13983] team0 (unregistering): Port device bridge2 removed [ 868.218943][ T13] net_ratelimit: 22 callbacks suppressed [ 868.218962][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 868.239485][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 868.254210][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 868.268968][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 868.827989][T13996] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2089'. [ 868.907829][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 868.922584][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 868.937601][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 868.952415][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 869.126921][ T5906] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 869.336262][ T5906] usb 5-1: config 0 has no interfaces? [ 869.353882][ T5906] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 869.597259][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.605482][ T5906] usb 5-1: Product: syz [ 869.658157][ T5906] usb 5-1: Manufacturer: syz [ 869.662820][ T5906] usb 5-1: SerialNumber: syz [ 869.681715][ T5906] usb 5-1: config 0 descriptor?? [ 870.027669][T13997] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2086'. [ 870.043853][T13997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.071497][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.078406][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.092323][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 870.107635][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 870.127705][T13997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.406977][ T5906] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 870.583958][ T5906] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 870.651631][ T5906] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 870.700510][ T5906] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 870.759127][ T5906] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 870.773616][ T5906] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 870.869577][ T5906] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 870.923543][T14010] syz.0.2091 (14010): drop_caches: 2 [ 871.463525][T14007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 871.474496][T14007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 871.544831][T14010] syz.0.2091 (14010): drop_caches: 2 [ 871.835794][ T7914] udevd[7914]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 871.891765][ T5906] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 872.247544][ T5906] usb 5-1: USB disconnect, device number 95 [ 872.440948][T14033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.475100][T14033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.497852][T14033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.518444][T14033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.597121][ T10] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 872.832204][ T10] usb 4-1: config 0 has no interfaces? [ 872.921244][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 872.940880][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 872.951221][ T10] usb 4-1: Product: syz [ 872.957441][ T10] usb 4-1: Manufacturer: syz [ 872.962237][ T10] usb 4-1: SerialNumber: syz [ 872.970440][ T10] usb 4-1: config 0 descriptor?? [ 873.282090][T14029] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 873.331715][ T6644] net_ratelimit: 18 callbacks suppressed [ 873.331734][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 873.353174][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 873.368274][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 873.383055][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 873.519711][ T10] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 873.860426][ T5906] usb 3-1: USB disconnect, device number 112 [ 874.042485][ T10] usb 5-1: config 0 has no interfaces? [ 874.058780][ T10] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 874.187328][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.203249][ T10] usb 5-1: Product: syz [ 874.240065][ T10] usb 5-1: Manufacturer: syz [ 874.247084][ T10] usb 5-1: SerialNumber: syz [ 874.279839][ T10] usb 5-1: config 0 descriptor?? [ 874.777023][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 874.792084][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 874.807034][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 874.822392][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 875.162838][T14047] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(13) [ 875.170008][T14047] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 875.190014][T14047] vhci_hcd vhci_hcd.0: Device attached [ 875.221994][T14047] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(15) [ 875.228629][T14047] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 875.240430][T14047] vhci_hcd vhci_hcd.0: Device attached [ 875.251118][T14047] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 875.271095][T14047] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(19) [ 875.277722][T14047] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 875.289300][T14047] vhci_hcd vhci_hcd.0: Device attached [ 875.309618][T14047] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(21) [ 875.316535][T14047] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 875.373666][T14047] vhci_hcd vhci_hcd.0: Device attached [ 875.392662][ T10] vhci_hcd: vhci_device speed not set [ 875.466449][ T10] usb 35-1: new full-speed USB device number 3 using vhci_hcd [ 875.531859][T14047] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 875.549608][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 875.564678][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 875.590119][T14047] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 875.675925][T14054] vhci_hcd: connection closed [ 875.680347][ T6638] vhci_hcd: stop threads [ 875.690380][T14048] vhci_hcd: connection reset by peer [ 875.720809][T14050] vhci_hcd: connection closed [ 875.727469][T14052] vhci_hcd: connection closed [ 875.755343][ T6638] vhci_hcd: release socket [ 875.837614][ T6638] vhci_hcd: disconnect device [ 875.856146][ T5906] usb 4-1: USB disconnect, device number 92 [ 875.867407][ T6638] vhci_hcd: stop threads [ 875.873278][ T6638] vhci_hcd: release socket [ 875.891556][ T6638] vhci_hcd: disconnect device [ 875.933619][ T6638] vhci_hcd: stop threads [ 875.945961][ T6638] vhci_hcd: release socket [ 875.946181][ T6638] vhci_hcd: disconnect device [ 875.983364][ T6638] vhci_hcd: stop threads [ 875.983388][ T6638] vhci_hcd: release socket [ 875.983449][ T6638] vhci_hcd: disconnect device [ 876.264150][T14064] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2101'. [ 876.665885][ T5906] usb 5-1: USB disconnect, device number 96 [ 877.207900][ T5828] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 877.231458][T14082] syz.0.2105 (14082): drop_caches: 2 [ 877.299454][T14082] syz.0.2105 (14082): drop_caches: 2 [ 877.450992][ T5828] usb 2-1: Using ep0 maxpacket: 32 [ 877.481524][ T5828] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 877.490735][ T5828] usb 2-1: config 0 has no interface number 0 [ 877.524408][ T5828] usb 2-1: config 0 interface 184 has no altsetting 0 [ 877.598888][ T5828] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 877.610065][ T5828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.621023][ T5828] usb 2-1: Product: syz [ 877.684260][ T5828] usb 2-1: Manufacturer: syz [ 877.697326][ T5906] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 877.727327][ T5828] usb 2-1: SerialNumber: syz [ 877.872242][ T5906] usb 5-1: config 0 has no interfaces? [ 877.892354][ T5828] usb 2-1: config 0 descriptor?? [ 877.901494][ T5906] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 877.911736][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.953359][ T5906] usb 5-1: Product: syz [ 877.958867][ T5828] smsc75xx v1.0.0 [ 878.013968][ T5906] usb 5-1: Manufacturer: syz [ 878.029837][ T5906] usb 5-1: SerialNumber: syz [ 878.101901][ T5906] usb 5-1: config 0 descriptor?? [ 878.393976][ T6638] net_ratelimit: 18 callbacks suppressed [ 878.393997][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 878.416897][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 878.431893][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 878.447359][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 878.461879][ T5906] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 878.674697][ T5906] usb 3-1: config 0 has no interfaces? [ 878.685819][ T5906] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 878.700281][ T5906] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.709332][ T5906] usb 3-1: Product: syz [ 878.714214][ T5906] usb 3-1: Manufacturer: syz [ 878.723391][ T5906] usb 3-1: SerialNumber: syz [ 878.918977][ T5906] usb 3-1: config 0 descriptor?? [ 879.095392][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 879.110611][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 879.125590][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 879.141047][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 879.181013][ T5828] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 879.204403][ T5828] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 879.359996][T14091] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2106'. [ 879.379574][T14091] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.443533][T14091] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.873149][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 879.888207][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 880.617427][ T10] vhci_hcd: vhci_device speed not set [ 881.007730][ T5882] usb 5-1: USB disconnect, device number 97 [ 881.204650][ T5828] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 881.218839][ T5828] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 881.257980][ T5828] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 881.460097][ T5882] usb 3-1: USB disconnect, device number 113 [ 881.634591][ T5828] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 881.935768][ T5828] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 881.978774][ T9944] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 882.060404][ T5828] usb 2-1: USB disconnect, device number 96 [ 882.289275][ T9944] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 882.308189][ T9944] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 882.346396][ T9944] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 882.364986][ T9944] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 882.407293][ T5828] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 882.427424][T14104] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 882.435089][ T5882] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 882.464419][ T9944] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.516085][ T9944] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 882.589468][ T5828] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 882.601310][T14104] usb 5-1: Using ep0 maxpacket: 16 [ 882.619521][T14104] usb 5-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 882.632945][ T5882] usb 3-1: Using ep0 maxpacket: 32 [ 882.642717][ T5882] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 882.661082][ T5828] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 882.677119][T14104] usb 5-1: config 1 interface 0 has no altsetting 0 [ 882.685378][ T5882] usb 3-1: config 0 has no interface number 0 [ 882.703664][ T5882] usb 3-1: config 0 interface 12 has no altsetting 0 [ 882.767166][ T5828] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 882.788842][T14104] usb 5-1: string descriptor 0 read error: -22 [ 882.795197][T14104] usb 5-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 882.806039][T14112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 882.818445][T14112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 882.855782][ T5828] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 882.875090][ T5882] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 882.894099][T14104] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.910560][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.922306][ T5828] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.953535][ T5882] usb 3-1: Product: syz [ 882.971034][ T9944] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 883.007229][ T5882] usb 3-1: Manufacturer: syz [ 883.023388][ T5882] usb 3-1: SerialNumber: syz [ 883.086290][ T5828] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 883.153946][ T5882] usb 3-1: config 0 descriptor?? [ 883.665404][ T6644] net_ratelimit: 26 callbacks suppressed [ 883.665426][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 883.687233][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 883.702114][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 883.717043][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 883.970652][T14126] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 883.972932][T14126] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 884.343177][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 884.358395][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 884.373833][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 884.388231][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 884.543573][ T5828] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 885.241825][T14104] usbhid 5-1:1.0: can't add hid device: -71 [ 885.309049][T14104] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 885.359389][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 885.376582][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 885.444530][T14123] gtp0: entered promiscuous mode [ 885.471343][ T5882] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 885.511803][ T5882] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 885.524274][T14104] usb 5-1: USB disconnect, device number 98 [ 885.532534][ T5882] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 885.565166][ T5828] usb 2-1: USB disconnect, device number 97 [ 885.580814][ T5882] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 885.674769][ T5882] usb 3-1: USB disconnect, device number 114 [ 885.925851][ T9944] usb 4-1: USB disconnect, device number 93 [ 886.118596][T14104] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 886.200663][ T5828] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 886.304148][T14104] usb 5-1: config 0 has no interfaces? [ 886.331821][T14104] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 886.344098][T14104] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.353821][T14104] usb 5-1: Product: syz [ 886.359085][T14104] usb 5-1: Manufacturer: syz [ 886.365095][T14104] usb 5-1: SerialNumber: syz [ 886.373461][ T5828] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 886.386261][ T5828] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 886.408797][T14104] usb 5-1: config 0 descriptor?? [ 886.417261][ T5828] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 886.440636][ T5828] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.501030][T14150] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 886.514258][ T5828] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 886.619383][T14154] syz.2.2119 (14154): drop_caches: 2 [ 886.629742][T14154] syz.2.2119 (14154): drop_caches: 2 [ 886.678184][T14148] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2116'. [ 886.721007][ T5828] usb 2-1: USB disconnect, device number 98 [ 886.863365][T14148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 886.873058][T14148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 887.051351][T14149] hsr0: entered promiscuous mode [ 887.077903][ T5828] usb 5-1: USB disconnect, device number 99 [ 887.084448][T14149] macvtap1: entered promiscuous mode [ 887.116119][T14149] macvtap1: entered allmulticast mode [ 887.137092][T14149] hsr0: entered allmulticast mode [ 887.184146][T14149] hsr_slave_0: entered allmulticast mode [ 887.232151][T14149] hsr_slave_1: entered allmulticast mode [ 887.325022][T14149] hsr0: left allmulticast mode [ 887.338181][T14149] hsr_slave_0: left allmulticast mode [ 887.343731][T14149] hsr_slave_1: left allmulticast mode [ 888.863228][ T13] net_ratelimit: 22 callbacks suppressed [ 888.863245][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 888.884894][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 888.899934][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 888.914901][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 889.187031][ T24] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 889.414466][T14191] xt_CT: You must specify a L4 protocol and not use inversions on it [ 889.604604][ T24] usb 2-1: config 0 has no interfaces? [ 889.641140][ T24] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 889.665026][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.682404][ T24] usb 2-1: Product: syz [ 889.687729][ T24] usb 2-1: Manufacturer: syz [ 889.692483][ T24] usb 2-1: SerialNumber: syz [ 889.703686][ T24] usb 2-1: config 0 descriptor?? [ 889.741162][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 889.755590][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 889.770675][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 889.785508][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 889.928416][T14185] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2123'. [ 890.041621][T14185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.122256][T14185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.509903][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 890.524816][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 891.345684][ T24] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 891.596090][ T24] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 891.831759][T14104] usb 2-1: USB disconnect, device number 99 [ 891.968250][ T24] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 892.047959][ T5828] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 892.096173][ T24] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 892.162771][ T24] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 892.191360][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.280809][ T5828] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 892.320847][ T24] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 892.332440][ T5828] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 892.343232][T14104] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 892.399848][ T5828] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 892.422664][ T5828] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 892.459518][ T5828] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.543289][T14205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.562274][T14205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.581163][T14104] usb 2-1: Using ep0 maxpacket: 8 [ 892.612938][T14104] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 892.646516][T14104] usb 2-1: config 0 has no interface number 0 [ 892.663575][T14104] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 892.682909][T14211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.702046][T14211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.742192][T14104] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 892.885706][T14219] hfs: unable to load iocharset "I#hIars8Ύ wѷ}+[S_. ,s$nFBlbSR,.R]^kRL/J}&o9b6\wm$xCdeOjocڅ`1҆m#CX^ݾO;;󣫭Xp!+ƇK=A a2HKA rp" [ 892.923724][T14104] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 892.954288][T14104] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 892.978191][T14104] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.985272][ T24] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 893.021887][ T5828] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 893.088340][T14104] usb 2-1: config 0 descriptor?? [ 893.098833][T14104] ldusb 2-1:0.55: Interrupt in endpoint not found [ 893.212506][ T5828] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 893.320309][T14214] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2129'. [ 893.605714][ T5828] usb 2-1: USB disconnect, device number 100 [ 893.699117][ T7914] udevd[7914]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 894.202758][ T12] net_ratelimit: 22 callbacks suppressed [ 894.202775][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 894.223807][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 894.238530][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 894.253482][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 894.440867][T14104] usb 3-1: USB disconnect, device number 115 [ 894.803472][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 894.818852][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 894.833826][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 894.848594][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 895.427557][ T24] usb 4-1: USB disconnect, device number 94 [ 895.790724][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 895.805653][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 896.007004][ T24] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 896.647199][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 896.657793][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 896.690624][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 896.730343][ T24] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 896.740917][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.750466][ T24] usb 4-1: Product: syz [ 896.754888][ T24] usb 4-1: Manufacturer: syz [ 896.765551][ T24] usb 4-1: SerialNumber: syz [ 896.926401][ T24] usb 4-1: config 0 descriptor?? [ 896.954747][ T24] streamzap 4-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 897.220578][T14253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 897.255292][T14253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 897.390375][T14254] xt_CT: You must specify a L4 protocol and not use inversions on it [ 897.450070][T14257] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2138'. [ 897.475013][T14257] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2138'. [ 897.513324][T14257] team0: left allmulticast mode [ 897.527474][T14257] team_slave_1: left allmulticast mode [ 897.543218][T14257] bridge0: port 4(team0) entered disabled state [ 897.585488][T14257] batman_adv: batadv0: Interface deactivated: dummy0 [ 897.603316][T14257] batman_adv: batadv0: Removing interface: dummy0 [ 897.622652][T14257] bridge0: port 3(batadv0) entered disabled state [ 897.644814][T14257] bridge_slave_0: left allmulticast mode [ 897.658146][T14257] bridge_slave_0: left promiscuous mode [ 897.665820][T14257] bridge0: port 1(bridge_slave_0) entered disabled state [ 897.690674][T14257] bridge_slave_1: left allmulticast mode [ 897.700198][T14257] bridge_slave_1: left promiscuous mode [ 897.708428][T14257] bridge0: port 2(bridge_slave_1) entered disabled state [ 897.740700][T14257] team_slave_1: left promiscuous mode [ 897.752798][T14257] team0: Port device team_slave_1 removed [ 897.760602][T14257] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 897.772337][T14257] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 897.782601][T14257] bond0: left allmulticast mode [ 897.792161][T14257] bond0: left promiscuous mode [ 897.802415][T14257] bridge0: port 5(bond0) entered disabled state [ 898.232605][T14266] syz.2.2140 (14266): drop_caches: 2 [ 898.791097][T14266] syz.2.2140 (14266): drop_caches: 2 [ 898.887062][ T5906] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 898.938979][T14104] usb 4-1: USB disconnect, device number 95 [ 899.110694][ T5906] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 899.240897][ T5906] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 899.272694][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 899.296282][ T6638] net_ratelimit: 22 callbacks suppressed [ 899.303389][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 899.309297][ T5906] usb 5-1: Product: syz [ 899.318836][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 899.337971][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 899.352875][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 899.446642][ T5906] usb 5-1: Manufacturer: syz [ 899.555447][ T5906] usb 5-1: SerialNumber: syz [ 899.647174][T14104] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 899.732927][ T5906] usb 5-1: config 0 descriptor?? [ 899.747044][T14130] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 899.837837][T14104] usb 3-1: Using ep0 maxpacket: 16 [ 899.848125][T14104] usb 3-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice=80.f2 [ 899.861570][T14104] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.887293][T14104] usb 3-1: Product: syz [ 899.897434][T14104] usb 3-1: Manufacturer: syz [ 899.904587][T14104] usb 3-1: SerialNumber: syz [ 899.940537][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 899.955563][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 899.970577][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 899.985486][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 900.017749][T14104] usb 3-1: config 0 descriptor?? [ 900.044620][T14130] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 900.077441][T14130] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 900.090325][T14130] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 900.108728][T14130] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 900.191250][ T5906] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 900.191920][T14104] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 900.243995][T14130] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.354449][T14291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 900.366295][T14291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 900.591737][ T7946] udevd[7946]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 900.677346][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 900.692211][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 900.723597][T14296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 900.734379][T14296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 900.757397][T14296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 900.768652][T14296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 900.790183][T14104] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 900.814919][T14284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 900.825545][T14130] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 900.843097][T14284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 900.873204][ T7914] udevd[7914]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 900.962733][T14297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2142'. [ 901.153505][T14130] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 901.740738][T14130] usb 5-1: USB disconnect, device number 100 [ 902.329184][T14130] usb 4-1: USB disconnect, device number 96 [ 902.799070][T14130] usb 3-1: USB disconnect, device number 116 [ 903.290834][T14104] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 903.477350][T14104] usb 4-1: Using ep0 maxpacket: 16 [ 904.784907][T14316] syz.1.2149 (14316): drop_caches: 2 [ 904.944388][T14316] syz.1.2149 (14316): drop_caches: 2 [ 905.104960][T10220] net_ratelimit: 26 callbacks suppressed [ 905.104991][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 905.126639][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 905.141397][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 905.156095][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 905.690440][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 905.705715][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 905.721097][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 905.736222][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 905.758004][T14325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 905.809994][T14325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 906.190499][T14104] usb 4-1: unable to get BOS descriptor or descriptor too short [ 906.202006][T14104] usb 4-1: too many configurations: 235, using maximum allowed: 8 [ 906.212163][T14104] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 906.236070][T14104] usb 4-1: can't read configurations, error -71 [ 906.471343][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 906.486288][T10220] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 908.217637][T14349] xt_CT: You must specify a L4 protocol and not use inversions on it [ 909.487091][T14104] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 909.693715][T14104] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 909.713462][T14104] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 909.927099][ T5828] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 909.977160][T14374] hfs: unable to load iocharset "I#hIars8Ύ wѷ}+[S_. ,s$nFBlbSR,.R]^kRL/J}&o9b6\wm$xCdeOjocڅ`1҆m#CX^ݾO;;󣫭Xp!+ƇK=A a2HKA rp" [ 910.028635][T14104] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 910.042909][T14104] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 910.053383][T14104] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 910.151392][T14104] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 910.433735][T14363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 910.445399][T14363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 910.465481][ T5828] usb 2-1: config 0 has no interfaces? [ 910.482488][ T6638] net_ratelimit: 22 callbacks suppressed [ 910.482503][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 910.504293][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 910.519367][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 910.534495][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 910.626040][ T5828] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 910.644475][ T5828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.656357][ T5828] usb 2-1: Product: syz [ 910.741630][ T5828] usb 2-1: Manufacturer: syz [ 911.009503][ T5828] usb 2-1: SerialNumber: syz [ 911.158411][ T5828] usb 2-1: config 0 descriptor?? [ 911.278683][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 911.294038][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 911.308953][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 911.323952][ T6638] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 911.339204][ T24] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 911.432993][T14104] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 911.673144][ T24] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 911.743337][ T24] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 911.771731][ T24] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 911.796004][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 911.817727][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.858018][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 912.054700][ T7946] udevd[7946]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 912.098853][T14378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 912.113220][ T24] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 912.198386][T14378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 912.348957][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 912.363889][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 912.396207][ T5906] usb 4-1: USB disconnect, device number 99 [ 912.620286][T14386] usb usb8: usbfs: process 14386 (syz.2.2161) did not claim interface 0 before use [ 914.110332][ T5906] usb 2-1: USB disconnect, device number 101 [ 914.293832][ T5828] usb 5-1: USB disconnect, device number 101 [ 914.726276][T14403] syz.4.2165 (14403): drop_caches: 2 [ 914.767132][T14104] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 914.832111][T14403] syz.4.2165 (14403): drop_caches: 2 [ 914.953947][T14414] [ 914.956317][T14414] ===================================================== [ 914.963257][T14414] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 914.970719][T14414] 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 Not tainted [ 914.977826][T14414] ----------------------------------------------------- [ 914.984767][T14414] syz.2.2168/14414 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 914.992496][T14414] ffff8880338372b8 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 915.001223][T14414] [ 915.001223][T14414] and this task is already holding: [ 915.008592][T14414] ffff8880414bc028 (&client->buffer_lock){....}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 915.018358][T14414] which would create a new lock dependency: [ 915.024258][T14414] (&client->buffer_lock){....}-{3:3} -> (&new->fa_lock){....}-{3:3} [ 915.032365][T14414] [ 915.032365][T14414] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 915.041820][T14414] (&dev->event_lock#2){..-.}-{3:3} [ 915.041853][T14414] [ 915.041853][T14414] ... which became SOFTIRQ-irq-safe at: [ 915.054762][T14414] lock_acquire+0x120/0x360 [ 915.059387][T14414] _raw_spin_lock_irqsave+0xa7/0xf0 [ 915.064687][T14414] input_event+0x7a/0xc0 [ 915.069015][T14414] hidinput_report_event+0xa1/0x100 [ 915.074304][T14414] hid_report_raw_event+0x148b/0x16d0 [ 915.079763][T14414] hid_input_report+0x43e/0x520 [ 915.084713][T14414] hid_irq_in+0x47e/0x6d0 [ 915.089130][T14414] __usb_hcd_giveback_urb+0x417/0x690 [ 915.094600][T14414] dummy_timer+0x862/0x4550 [ 915.099199][T14414] __hrtimer_run_queues+0x529/0xc60 [ 915.104754][T14414] hrtimer_run_softirq+0x187/0x2b0 [ 915.109965][T14414] handle_softirqs+0x283/0x870 [ 915.114831][T14414] __irq_exit_rcu+0xca/0x1f0 [ 915.119528][T14414] irq_exit_rcu+0x9/0x30 [ 915.123863][T14414] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 915.129616][T14414] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 915.135705][T14414] pv_native_safe_halt+0x13/0x20 [ 915.140734][T14414] default_idle+0x13/0x20 [ 915.145154][T14414] default_idle_call+0x74/0xb0 [ 915.150004][T14414] do_idle+0x1e8/0x510 [ 915.154161][T14414] cpu_startup_entry+0x44/0x60 [ 915.159014][T14414] start_secondary+0x101/0x110 [ 915.163868][T14414] common_startup_64+0x13e/0x147 [ 915.168902][T14414] [ 915.168902][T14414] to a SOFTIRQ-irq-unsafe lock: [ 915.175922][T14414] (tasklist_lock){.+.+}-{3:3} [ 915.175961][T14414] [ 915.175961][T14414] ... which became SOFTIRQ-irq-unsafe at: [ 915.188595][T14414] ... [ 915.188605][T14414] lock_acquire+0x120/0x360 [ 915.195770][T14414] _raw_read_lock+0x36/0x50 [ 915.200377][T14414] __do_wait+0xde/0x740 [ 915.204626][T14414] do_wait+0x1f8/0x520 [ 915.208785][T14414] kernel_wait+0xab/0x170 [ 915.213206][T14414] call_usermodehelper_exec_work+0xbe/0x230 [ 915.219208][T14414] process_scheduled_works+0xadb/0x17a0 [ 915.224867][T14414] worker_thread+0x8a0/0xda0 [ 915.229544][T14414] kthread+0x70e/0x8a0 [ 915.233704][T14414] ret_from_fork+0x4b/0x80 [ 915.238215][T14414] ret_from_fork_asm+0x1a/0x30 [ 915.243087][T14414] [ 915.243087][T14414] other info that might help us debug this: [ 915.243087][T14414] [ 915.253327][T14414] Chain exists of: [ 915.253327][T14414] &dev->event_lock#2 --> &client->buffer_lock --> tasklist_lock [ 915.253327][T14414] [ 915.266914][T14414] Possible interrupt unsafe locking scenario: [ 915.266914][T14414] [ 915.275270][T14414] CPU0 CPU1 [ 915.280639][T14414] ---- ---- [ 915.286009][T14414] lock(tasklist_lock); [ 915.290255][T14414] local_irq_disable(); [ 915.297015][T14414] lock(&dev->event_lock#2); [ 915.304242][T14414] lock(&client->buffer_lock); [ 915.311617][T14414] [ 915.315075][T14414] lock(&dev->event_lock#2); [ 915.319941][T14414] [ 915.319941][T14414] *** DEADLOCK *** [ 915.319941][T14414] [ 915.328088][T14414] 7 locks held by syz.2.2168/14414: [ 915.333281][T14414] #0: ffff88802988e118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480 [ 915.342445][T14414] #1: ffff888146ee6230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xab/0x320 [ 915.352573][T14414] #2: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xbc/0x320 [ 915.362879][T14414] #3: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 915.372522][T14414] #4: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 915.381688][T14414] #5: ffff8880414bc028 (&client->buffer_lock){....}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 915.391887][T14414] #6: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 915.400957][T14414] [ 915.400957][T14414] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 915.411363][T14414] -> (&dev->event_lock#2){..-.}-{3:3} { [ 915.417030][T14414] IN-SOFTIRQ-W at: [ 915.421110][T14414] lock_acquire+0x120/0x360 [ 915.427445][T14414] _raw_spin_lock_irqsave+0xa7/0xf0 [ 915.434470][T14414] input_event+0x7a/0xc0 [ 915.440542][T14414] hidinput_report_event+0xa1/0x100 [ 915.447584][T14414] hid_report_raw_event+0x148b/0x16d0 [ 915.454791][T14414] hid_input_report+0x43e/0x520 [ 915.461899][T14414] hid_irq_in+0x47e/0x6d0 [ 915.468491][T14414] __usb_hcd_giveback_urb+0x417/0x690 [ 915.475697][T14414] dummy_timer+0x862/0x4550 [ 915.482028][T14414] __hrtimer_run_queues+0x529/0xc60 [ 915.489058][T14414] hrtimer_run_softirq+0x187/0x2b0 [ 915.496007][T14414] handle_softirqs+0x283/0x870 [ 915.502608][T14414] __irq_exit_rcu+0xca/0x1f0 [ 915.509019][T14414] irq_exit_rcu+0x9/0x30 [ 915.515088][T14414] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 915.522550][T14414] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 915.530376][T14414] pv_native_safe_halt+0x13/0x20 [ 915.537323][T14414] default_idle+0x13/0x20 [ 915.543492][T14414] default_idle_call+0x74/0xb0 [ 915.550083][T14414] do_idle+0x1e8/0x510 [ 915.555973][T14414] cpu_startup_entry+0x44/0x60 [ 915.562560][T14414] start_secondary+0x101/0x110 [ 915.569150][T14414] common_startup_64+0x13e/0x147 [ 915.575924][T14414] INITIAL USE at: [ 915.580004][T14414] lock_acquire+0x120/0x360 [ 915.586267][T14414] _raw_spin_lock_irqsave+0xa7/0xf0 [ 915.593559][T14414] input_inject_event+0xab/0x320 [ 915.600241][T14414] kbd_led_trigger_activate+0xbc/0x100 [ 915.607445][T14414] led_trigger_set+0x52a/0x950 [ 915.613968][T14414] led_trigger_set_default+0x215/0x250 [ 915.621180][T14414] led_classdev_register_ext+0x73d/0x930 [ 915.628555][T14414] input_leds_connect+0x517/0x790 [ 915.635317][T14414] input_register_device+0xceb/0x10b0 [ 915.642434][T14414] atkbd_connect+0x70e/0x9c0 [ 915.648797][T14414] serio_driver_probe+0x7f/0xa0 [ 915.655409][T14414] really_probe+0x26a/0x9a0 [ 915.661672][T14414] __driver_probe_device+0x18c/0x2f0 [ 915.668705][T14414] driver_probe_device+0x4f/0x430 [ 915.675468][T14414] __driver_attach+0x452/0x700 [ 915.681973][T14414] bus_for_each_dev+0x230/0x2b0 [ 915.688609][T14414] serio_handle_event+0x1a2/0x860 [ 915.695376][T14414] process_scheduled_works+0xadb/0x17a0 [ 915.702666][T14414] worker_thread+0x8a0/0xda0 [ 915.708992][T14414] kthread+0x70e/0x8a0 [ 915.714802][T14414] ret_from_fork+0x4b/0x80 [ 915.720955][T14414] ret_from_fork_asm+0x1a/0x30 [ 915.727453][T14414] } [ 915.730047][T14414] ... key at: [] input_allocate_device.__key.5+0x0/0x20 [ 915.739196][T14414] -> (&client->buffer_lock){....}-{3:3} { [ 915.744963][T14414] INITIAL USE at: [ 915.748854][T14414] lock_acquire+0x120/0x360 [ 915.754922][T14414] _raw_spin_lock_irqsave+0xa7/0xf0 [ 915.761683][T14414] evdev_ioctl_handler+0x1969/0x1f10 [ 915.768536][T14414] __ia32_compat_sys_ioctl+0x551/0x840 [ 915.775593][T14414] __do_fast_syscall_32+0xb4/0x110 [ 915.782279][T14414] do_fast_syscall_32+0x34/0x80 [ 915.788697][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 915.796597][T14414] } [ 915.799100][T14414] ... key at: [] evdev_open.__key.25+0x0/0x20 [ 915.807284][T14414] ... acquired at: [ 915.811079][T14414] lock_acquire+0x120/0x360 [ 915.815758][T14414] _raw_spin_lock+0x2e/0x40 [ 915.820909][T14414] evdev_pass_values+0xb9/0xbd0 [ 915.825952][T14414] evdev_events+0x1e6/0x340 [ 915.830663][T14414] input_pass_values+0x285/0x890 [ 915.835777][T14414] input_event_dispose+0x330/0x6b0 [ 915.841058][T14414] input_inject_event+0x1fe/0x320 [ 915.846253][T14414] evdev_write+0x2fc/0x480 [ 915.850848][T14414] vfs_write+0x27b/0xa90 [ 915.855262][T14414] ksys_write+0x145/0x250 [ 915.859765][T14414] __do_fast_syscall_32+0xb4/0x110 [ 915.865051][T14414] do_fast_syscall_32+0x34/0x80 [ 915.870075][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 915.876586][T14414] [ 915.878915][T14414] [ 915.878915][T14414] the dependencies between the lock to be acquired [ 915.878925][T14414] and SOFTIRQ-irq-unsafe lock: [ 915.892430][T14414] -> (tasklist_lock){.+.+}-{3:3} { [ 915.897736][T14414] HARDIRQ-ON-R at: [ 915.901885][T14414] lock_acquire+0x120/0x360 [ 915.908392][T14414] _raw_read_lock+0x36/0x50 [ 915.914901][T14414] __do_wait+0xde/0x740 [ 915.921058][T14414] do_wait+0x1f8/0x520 [ 915.927131][T14414] kernel_wait+0xab/0x170 [ 915.933461][T14414] call_usermodehelper_exec_work+0xbe/0x230 [ 915.941378][T14414] process_scheduled_works+0xadb/0x17a0 [ 915.948928][T14414] worker_thread+0x8a0/0xda0 [ 915.955514][T14414] kthread+0x70e/0x8a0 [ 915.961579][T14414] ret_from_fork+0x4b/0x80 [ 915.967992][T14414] ret_from_fork_asm+0x1a/0x30 [ 915.974747][T14414] SOFTIRQ-ON-R at: [ 915.979001][T14414] lock_acquire+0x120/0x360 [ 915.985499][T14414] _raw_read_lock+0x36/0x50 [ 915.991994][T14414] __do_wait+0xde/0x740 [ 915.998145][T14414] do_wait+0x1f8/0x520 [ 916.004207][T14414] kernel_wait+0xab/0x170 [ 916.010533][T14414] call_usermodehelper_exec_work+0xbe/0x230 [ 916.018429][T14414] process_scheduled_works+0xadb/0x17a0 [ 916.025974][T14414] worker_thread+0x8a0/0xda0 [ 916.032558][T14414] kthread+0x70e/0x8a0 [ 916.039142][T14414] ret_from_fork+0x4b/0x80 [ 916.045550][T14414] ret_from_fork_asm+0x1a/0x30 [ 916.052323][T14414] INITIAL USE at: [ 916.056394][T14414] lock_acquire+0x120/0x360 [ 916.062821][T14414] _raw_write_lock_irq+0xa2/0xf0 [ 916.069668][T14414] copy_process+0x21d5/0x3b80 [ 916.076251][T14414] kernel_clone+0x21e/0x870 [ 916.082671][T14414] user_mode_thread+0xdd/0x140 [ 916.089360][T14414] rest_init+0x23/0x300 [ 916.095432][T14414] start_kernel+0x470/0x4f0 [ 916.101858][T14414] x86_64_start_reservations+0x2a/0x30 [ 916.109235][T14414] x86_64_start_kernel+0x66/0x70 [ 916.116084][T14414] common_startup_64+0x13e/0x147 [ 916.122956][T14414] INITIAL READ USE at: [ 916.127479][T14414] lock_acquire+0x120/0x360 [ 916.134331][T14414] _raw_read_lock+0x36/0x50 [ 916.141193][T14414] __do_wait+0xde/0x740 [ 916.147697][T14414] do_wait+0x1f8/0x520 [ 916.154125][T14414] kernel_wait+0xab/0x170 [ 916.160810][T14414] call_usermodehelper_exec_work+0xbe/0x230 [ 916.169062][T14414] process_scheduled_works+0xadb/0x17a0 [ 916.176966][T14414] worker_thread+0x8a0/0xda0 [ 916.183911][T14414] kthread+0x70e/0x8a0 [ 916.190342][T14414] ret_from_fork+0x4b/0x80 [ 916.197279][T14414] ret_from_fork_asm+0x1a/0x30 [ 916.204380][T14414] } [ 916.207670][T14414] ... key at: [] tasklist_lock+0x18/0x40 [ 916.215573][T14414] ... acquired at: [ 916.219546][T14414] lock_acquire+0x120/0x360 [ 916.224229][T14414] _raw_read_lock+0x36/0x50 [ 916.228901][T14414] send_sigurg+0x12b/0x420 [ 916.233495][T14414] sk_send_sigurg+0x6c/0x2e0 [ 916.238264][T14414] queue_oob+0x3d9/0x4e0 [ 916.242701][T14414] unix_stream_sendmsg+0xa41/0xb60 [ 916.248077][T14414] __sock_sendmsg+0x219/0x270 [ 916.252930][T14414] ____sys_sendmsg+0x505/0x830 [ 916.257864][T14414] ___sys_sendmsg+0x21f/0x2a0 [ 916.262712][T14414] __sys_sendmsg+0x164/0x220 [ 916.267472][T14414] __do_fast_syscall_32+0xb4/0x110 [ 916.272755][T14414] do_fast_syscall_32+0x34/0x80 [ 916.277779][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.284275][T14414] [ 916.286598][T14414] -> (&f_owner->lock){....}-{3:3} { [ 916.291919][T14414] INITIAL USE at: [ 916.295894][T14414] lock_acquire+0x120/0x360 [ 916.302223][T14414] _raw_write_lock_irq+0xa2/0xf0 [ 916.308892][T14414] __f_setown+0x67/0x370 [ 916.314870][T14414] f_setown+0x23a/0x300 [ 916.320763][T14414] do_fcntl+0x11d/0x1910 [ 916.326743][T14414] do_compat_fcntl64+0x484/0x720 [ 916.333427][T14414] __do_fast_syscall_32+0xb4/0x110 [ 916.340294][T14414] do_fast_syscall_32+0x34/0x80 [ 916.346889][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.354965][T14414] INITIAL READ USE at: [ 916.359376][T14414] lock_acquire+0x120/0x360 [ 916.366075][T14414] _raw_read_lock_irqsave+0xaf/0x100 [ 916.373529][T14414] send_sigio+0x38/0x370 [ 916.379950][T14414] kill_fasync+0x24d/0x4d0 [ 916.386552][T14414] sock_wake_async+0x137/0x160 [ 916.393493][T14414] sk_wake_async+0x184/0x280 [ 916.400252][T14414] unix_release_sock+0x6d4/0xc60 [ 916.407361][T14414] unix_release+0x92/0xd0 [ 916.413851][T14414] sock_close+0xc0/0x240 [ 916.420265][T14414] __fput+0x449/0xa70 [ 916.426427][T14414] task_work_run+0x1d1/0x260 [ 916.433202][T14414] get_signal+0x11c5/0x1310 [ 916.439877][T14414] arch_do_signal_or_restart+0x95/0x780 [ 916.447589][T14414] syscall_exit_to_user_mode+0x8b/0x120 [ 916.455301][T14414] __do_fast_syscall_32+0xc1/0x110 [ 916.462587][T14414] do_fast_syscall_32+0x34/0x80 [ 916.469605][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.478103][T14414] } [ 916.480680][T14414] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 916.489615][T14414] ... acquired at: [ 916.493494][T14414] lock_acquire+0x120/0x360 [ 916.498174][T14414] _raw_read_lock_irqsave+0xaf/0x100 [ 916.503625][T14414] send_sigio+0x38/0x370 [ 916.508044][T14414] kill_fasync+0x24d/0x4d0 [ 916.512632][T14414] sock_wake_async+0x137/0x160 [ 916.517565][T14414] sk_wake_async+0x184/0x280 [ 916.522324][T14414] unix_release_sock+0x6d4/0xc60 [ 916.527464][T14414] unix_release+0x92/0xd0 [ 916.531962][T14414] sock_close+0xc0/0x240 [ 916.536388][T14414] __fput+0x449/0xa70 [ 916.540562][T14414] task_work_run+0x1d1/0x260 [ 916.545323][T14414] get_signal+0x11c5/0x1310 [ 916.550007][T14414] arch_do_signal_or_restart+0x95/0x780 [ 916.555719][T14414] syscall_exit_to_user_mode+0x8b/0x120 [ 916.561438][T14414] __do_fast_syscall_32+0xc1/0x110 [ 916.566730][T14414] do_fast_syscall_32+0x34/0x80 [ 916.571765][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.578267][T14414] [ 916.580581][T14414] -> (&new->fa_lock){....}-{3:3} { [ 916.585706][T14414] INITIAL USE at: [ 916.589590][T14414] lock_acquire+0x120/0x360 [ 916.595667][T14414] _raw_write_lock_irq+0xa2/0xf0 [ 916.602163][T14414] fasync_remove_entry+0xf1/0x1c0 [ 916.608761][T14414] sock_fasync+0x85/0xf0 [ 916.614570][T14414] __fput+0x89f/0xa70 [ 916.620115][T14414] task_work_run+0x1d1/0x260 [ 916.626269][T14414] resume_user_mode_work+0x5e/0x80 [ 916.632953][T14414] syscall_exit_to_user_mode+0x9a/0x120 [ 916.640060][T14414] __do_fast_syscall_32+0xc1/0x110 [ 916.646928][T14414] do_fast_syscall_32+0x34/0x80 [ 916.653361][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.661255][T14414] INITIAL READ USE at: [ 916.665577][T14414] lock_acquire+0x120/0x360 [ 916.672081][T14414] _raw_read_lock_irqsave+0xaf/0x100 [ 916.679388][T14414] kill_fasync+0x199/0x4d0 [ 916.686253][T14414] sock_wake_async+0x137/0x160 [ 916.693028][T14414] sk_wake_async+0x184/0x280 [ 916.699612][T14414] unix_release_sock+0x6d4/0xc60 [ 916.706549][T14414] unix_release+0x92/0xd0 [ 916.712910][T14414] sock_close+0xc0/0x240 [ 916.719174][T14414] __fput+0x449/0xa70 [ 916.725159][T14414] task_work_run+0x1d1/0x260 [ 916.731747][T14414] get_signal+0x11c5/0x1310 [ 916.738250][T14414] arch_do_signal_or_restart+0x95/0x780 [ 916.745799][T14414] syscall_exit_to_user_mode+0x8b/0x120 [ 916.753342][T14414] __do_fast_syscall_32+0xc1/0x110 [ 916.760449][T14414] do_fast_syscall_32+0x34/0x80 [ 916.767298][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.775624][T14414] } [ 916.778118][T14414] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 916.786797][T14414] ... acquired at: [ 916.790602][T14414] lock_acquire+0x120/0x360 [ 916.795277][T14414] _raw_read_lock_irqsave+0xaf/0x100 [ 916.800733][T14414] kill_fasync+0x199/0x4d0 [ 916.805327][T14414] evdev_pass_values+0x627/0xbd0 [ 916.810439][T14414] evdev_events+0x1e6/0x340 [ 916.815132][T14414] input_pass_values+0x285/0x890 [ 916.820274][T14414] input_event_dispose+0x330/0x6b0 [ 916.825585][T14414] input_inject_event+0x1fe/0x320 [ 916.830794][T14414] evdev_write+0x2fc/0x480 [ 916.835393][T14414] vfs_write+0x27b/0xa90 [ 916.839805][T14414] ksys_write+0x145/0x250 [ 916.844326][T14414] __do_fast_syscall_32+0xb4/0x110 [ 916.849629][T14414] do_fast_syscall_32+0x34/0x80 [ 916.854650][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.861148][T14414] [ 916.863552][T14414] [ 916.863552][T14414] stack backtrace: [ 916.869434][T14414] CPU: 0 UID: 0 PID: 14414 Comm: syz.2.2168 Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 916.869454][T14414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 916.869465][T14414] Call Trace: [ 916.869474][T14414] [ 916.869482][T14414] dump_stack_lvl+0x189/0x250 [ 916.869508][T14414] ? __pfx_dump_stack_lvl+0x10/0x10 [ 916.869530][T14414] ? __pfx__printk+0x10/0x10 [ 916.869548][T14414] validate_chain+0x1f05/0x2140 [ 916.869571][T14414] __lock_acquire+0xaac/0xd20 [ 916.869594][T14414] ? kill_fasync+0x199/0x4d0 [ 916.869617][T14414] lock_acquire+0x120/0x360 [ 916.869636][T14414] ? kill_fasync+0x199/0x4d0 [ 916.869660][T14414] ? __lock_acquire+0xaac/0xd20 [ 916.869683][T14414] _raw_read_lock_irqsave+0xaf/0x100 [ 916.869698][T14414] ? kill_fasync+0x199/0x4d0 [ 916.869721][T14414] ? __pfx__raw_read_lock_irqsave+0x10/0x10 [ 916.869735][T14414] ? do_raw_spin_lock+0x121/0x290 [ 916.869754][T14414] kill_fasync+0x199/0x4d0 [ 916.869777][T14414] ? kill_fasync+0x53/0x4d0 [ 916.869800][T14414] evdev_pass_values+0x627/0xbd0 [ 916.869825][T14414] ? evdev_pass_values+0x601/0xbd0 [ 916.869848][T14414] evdev_events+0x1e6/0x340 [ 916.869867][T14414] ? evdev_events+0x79/0x340 [ 916.869887][T14414] ? input_pass_values+0x8d/0x890 [ 916.869906][T14414] input_pass_values+0x285/0x890 [ 916.869929][T14414] ? input_handle_event+0x70c/0xf30 [ 916.869946][T14414] input_event_dispose+0x330/0x6b0 [ 916.869964][T14414] input_inject_event+0x1fe/0x320 [ 916.869980][T14414] ? input_inject_event+0xbc/0x320 [ 916.869997][T14414] evdev_write+0x2fc/0x480 [ 916.870020][T14414] ? __pfx_evdev_write+0x10/0x10 [ 916.870041][T14414] ? bpf_lsm_file_permission+0x9/0x20 [ 916.870060][T14414] ? security_file_permission+0x75/0x290 [ 916.870083][T14414] ? rw_verify_area+0x258/0x650 [ 916.870098][T14414] ? __pfx_evdev_write+0x10/0x10 [ 916.870119][T14414] vfs_write+0x27b/0xa90 [ 916.870138][T14414] ? __pfx_vfs_write+0x10/0x10 [ 916.870154][T14414] ? __fget_files+0x2a/0x420 [ 916.870174][T14414] ? __fget_files+0x2a/0x420 [ 916.870192][T14414] ? __fget_files+0x3a0/0x420 [ 916.870210][T14414] ? __fget_files+0x2a/0x420 [ 916.870232][T14414] ksys_write+0x145/0x250 [ 916.870248][T14414] ? rcu_is_watching+0x15/0xb0 [ 916.870271][T14414] ? __pfx_ksys_write+0x10/0x10 [ 916.870288][T14414] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 916.870307][T14414] ? lockdep_hardirqs_on+0x9c/0x150 [ 916.870328][T14414] __do_fast_syscall_32+0xb4/0x110 [ 916.870349][T14414] do_fast_syscall_32+0x34/0x80 [ 916.870367][T14414] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 916.870386][T14414] RIP: 0023:0xf7fa1539 [ 916.870400][T14414] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 916.870413][T14414] RSP: 002b:00000000f50c655c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 916.870429][T14414] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000040 [ 916.870440][T14414] RDX: 0000000000002250 RSI: 0000000000000000 RDI: 0000000000000000 [ 916.870449][T14414] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 916.870458][T14414] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 916.870467][T14414] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 916.870481][T14414] [ 917.215924][ T13] net_ratelimit: 18 callbacks suppressed [ 917.215944][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 917.236627][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 917.252146][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 917.267167][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 917.565334][T14104] usb 2-1: config 0 has no interfaces? [ 917.826253][T14104] usb 2-1: string descriptor 0 read error: -71 [ 917.878780][T14104] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 917.898273][T14104] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.928756][T14104] usb 2-1: config 0 descriptor?? [ 917.939314][T14104] usb 2-1: can't set config #0, error -71 [ 917.954628][T14104] usb 2-1: USB disconnect, device number 102 [ 918.077010][ T24] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 918.229510][ T24] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 918.240303][ T24] usb 4-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 918.250028][ T24] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 918.250207][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 918.259843][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.274722][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 918.274751][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 918.313121][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 918.847641][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 918.862467][ T6640] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 919.558219][ T24] usb 4-1: USB disconnect, device number 100 [ 922.457120][ T6644] net_ratelimit: 26 callbacks suppressed [ 922.457142][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 922.477961][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 922.492870][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 922.507868][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 923.026841][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 923.041772][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 923.056694][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 923.071565][ T6644] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 923.596877][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 923.611704][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a