last executing test programs: 8m20.878473362s ago: executing program 2 (id=86): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) 8m17.451776826s ago: executing program 2 (id=87): connect$rxrpc(0xffffffffffffffff, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(0xffffffffffffffff, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) 8m15.251374571s ago: executing program 3 (id=91): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) openat$rfkill(0xffffffffffffff9c, 0x0, 0x40e02, 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x3}}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000000c0)={0x6, 0xffff81a4, 0x40, 0x0, 0xf}) 8m11.707557881s ago: executing program 3 (id=93): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, 0x0, &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x8000000000000003, {0x0, 0x0, 0x2}, 0xfd}, 0x18) fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) fchdir(0xffffffffffffffff) close(r2) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x24, 0x0, 0x0) openat$comedi(0xffffff9c, 0x0, 0x101001, 0x0) 8m9.844042574s ago: executing program 0 (id=99): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000440)={0x2020}, 0x2020) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) read$FUSE(r0, &(0x7f0000003b80)={0x2020}, 0x2020) 8m9.556499837s ago: executing program 2 (id=101): bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x99e86f6a6737948, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1a"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffab, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) move_mount(0xffffffffffffffff, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 8m8.194573649s ago: executing program 0 (id=103): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x5437, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd/3\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r3, r3, 0x0, 0x7ff) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000000)=0xd, 0x4) 8m5.288011874s ago: executing program 2 (id=105): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="071101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000001a80)=[{0x1, 0x1800, 0x0, 0x0}, {0x6, 0x1811, 0x0, 0x0}, {0xdb8e, 0x4000, 0x0, 0x0}], 0x3}) 8m3.494422048s ago: executing program 0 (id=106): write(0xffffffffffffffff, &(0x7f0000000100), 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x4000000000001, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) memfd_create(0x0, 0x6) r1 = syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_RESUME(r1, 0x4147, 0x0) 8m3.451090308s ago: executing program 3 (id=107): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) 8m1.142526175s ago: executing program 3 (id=109): write$binfmt_register(0xffffffffffffffff, &(0x7f0000000300)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x8000011000000009, 0x3a, 'B\xd4GGI\x82\\4\xbb\xbb\xbb\xb3\xd4)\xed\x8f\xaa\xf4\xd2{\xc5\t\xa9\xed\xf8e\xaa\xb9\xf5\r\xe3T\x0e\x8a\xd6\x9a_?G\x05\x00\x00\x00\x00\x00\x00\x00\x1e\x9a\xce\xac&x3\x15\x14y\xbf\xc6)\xa8\b/\x01\x00\x00\f\x8e1\xc4\xa1\xb2]I\xa5\x13}9\x1b0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc142e00004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 8m0.93674042s ago: executing program 0 (id=111): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0x5, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b92c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 8m0.660364939s ago: executing program 2 (id=112): creat(&(0x7f00000002c0)='./file0\x00', 0x0) creat(0x0, 0x70) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, 0x0, 0x40000) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001b80)=ANY=[@ANYBLOB="12010000000000106161154d00000000000109022400010000000009040100010300000009210000800122f80409058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 7m58.680331338s ago: executing program 3 (id=115): syz_emit_ethernet(0x0, 0x0, 0x0) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x162281) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)=@usbdevfs_disconnect={0x0, 0x5517}) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) recvmmsg(r4, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x141041) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000001c0)={0x9, 0x0, 0x0, 'queue0\x00', 0xfffffffc}) write$sndseq(r5, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000009, 0x4082172, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) connect$x25(0xffffffffffffffff, &(0x7f0000000080)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) ioctl$VIDIOC_LOG_STATUS(0xffffffffffffffff, 0x5646, 0x0) read$char_usb(0xffffffffffffffff, &(0x7f00000000c0)=""/192, 0xc0) socket$inet6(0xa, 0x3, 0x3a) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r6, 0x4606, &(0x7f0000000000)) 7m58.445047687s ago: executing program 0 (id=116): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x5437, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd/3\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r3, r3, 0x0, 0x7ff) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000000)=0xd, 0x4) 7m57.357256567s ago: executing program 3 (id=117): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, 0x0, &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x8000000000000003, {0x0, 0x0, 0x2}, 0xfd}, 0x18) fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) fchdir(0xffffffffffffffff) close(r2) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x24, 0x0, 0x0) openat$comedi(0xffffff9c, 0x0, 0x101001, 0x0) 7m56.849188249s ago: executing program 0 (id=118): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) syz_create_resource$binfmt(0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @random="a547ae412132", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {0x12, 0x0, 0x0, @multicast1}}}}}, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) r2 = syz_clone(0x80200011, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setopts(0x4200, r2, 0x8, 0x100001) read$msr(r1, &(0x7f000001aa40)=""/102392, 0x18ff8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x1, @broadcast, 'tunl0\x00'}}, 0x1e) close(r3) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) 7m56.488034522s ago: executing program 2 (id=120): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x5dc, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 7m41.689361819s ago: executing program 32 (id=117): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, 0x0, &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x8000000000000003, {0x0, 0x0, 0x2}, 0xfd}, 0x18) fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) fchdir(0xffffffffffffffff) close(r2) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x24, 0x0, 0x0) openat$comedi(0xffffff9c, 0x0, 0x101001, 0x0) 7m41.530789086s ago: executing program 33 (id=118): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) syz_create_resource$binfmt(0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @random="a547ae412132", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {0x12, 0x0, 0x0, @multicast1}}}}}, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) r2 = syz_clone(0x80200011, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setopts(0x4200, r2, 0x8, 0x100001) read$msr(r1, &(0x7f000001aa40)=""/102392, 0x18ff8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x1, @broadcast, 'tunl0\x00'}}, 0x1e) close(r3) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) 7m41.33007733s ago: executing program 34 (id=120): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x5dc, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 13.456004687s ago: executing program 7 (id=740): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_KEY_TYPE={0x8}]}], {0x14}}, 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000180)={0x0, 0x34, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000150a03000000000000000000020000000900020073797a310000000008000340000000010900010073797a30"], 0x34}}, 0x0) 12.451952146s ago: executing program 7 (id=744): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x8, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x27}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 11.200361572s ago: executing program 7 (id=746): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x8, 0x12, r0, 0x0) ftruncate(r0, 0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee3, 0x8032, 0xffffffffffffffff, 0x28f41000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) iopl(0x3) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{}, {0x0, 0x3938700}}, &(0x7f0000000100)) 10.04013053s ago: executing program 4 (id=753): memfd_create(0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x694f840696960f3d) bind$inet(r1, 0x0, 0x0) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) 9.811599944s ago: executing program 7 (id=754): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_KEY_TYPE={0x8}]}], {0x14}}, 0x64}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x34, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000150a03000000000000000000020000000900020073797a310000000008000340000000010900010073797a30"], 0x34}}, 0x0) 9.685901093s ago: executing program 6 (id=755): r0 = socket(0x11, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_connect(0x4, 0x24, &(0x7f00000005c0)=ANY=[@ANYRES32=r0, @ANYRES64=r1, @ANYBLOB="f610d510755654781b29e3658c1f06a21a37b1a075733678fb83dada12935dac736f572f0ddb4cb0e498adcdcd82d9daef5bc33dbbf269f484c43dbc09c4660e73db7194a25b91bd93bd4f0aff2930d59d1e07a4324f56168085bcfa47b1fee370ff23202d488b54d8fbad0be7f2a384e89cb704fff5a49ffb", @ANYRES32=r1], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getpriority(0x0, r2) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x1, 0x2) ioctl$vim2m_VIDIOC_PREPARE_BUF(r5, 0xc058565d, 0x0) syz_emit_ethernet(0xaf, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa8100000086dd60f7d8ff00753c0020010000"], 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) creat(&(0x7f0000000180)='\x00', 0x40) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYRES32=r6, @ANYRESDEC=r4], 0x64}, 0x1, 0x0, 0x0, 0x44090}, 0x40008c4) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r1, 0x3b88, &(0x7f0000000280)={0xc, r8}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r1, 0x3b70, &(0x7f00000002c0)={0x10}) 8.05613811s ago: executing program 7 (id=758): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() ptrace$ARCH_SHSTK_LOCK(0x1e, r0, 0x0, 0x5003) sched_setscheduler(r0, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x35, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x94}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) gettid() r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001180)={0x38, r4, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) 7.992078851s ago: executing program 5 (id=759): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d40), r0) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000011c0)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44040}, 0x44000) 7.932073301s ago: executing program 4 (id=760): pselect6(0x40, &(0x7f0000000040)={0x0, 0x4, 0xfffffffffffffffa, 0x3, 0x10000, 0x8, 0x1ff, 0x9}, &(0x7f0000000080)={0x40, 0x0, 0x100000000, 0x3, 0x8, 0xfffffffffffffff7, 0x5, 0x2}, 0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120120007516b7108c0d0e008f8e0018030109021b00010000000d0904080001030000000905", @ANYBLOB="8fcf"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 6.755730248s ago: executing program 1 (id=761): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000040000701fefffff8ff000000017c0000040042800c00018006000600800a000014000280100014800c0016800800b6008847c1af"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc800) 6.634998732s ago: executing program 5 (id=762): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0x5, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b92c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xe}}}, 0x24}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 6.492044721s ago: executing program 1 (id=763): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000280)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r1, 0xc03064b7, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x7e3c, 0x4, 0x9, 0xfffffff9, 0xfffd, 0xfffffffd, 0x7, 0x1, 0xfefffffd}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x300, 0x1, &(0x7f0000000340)=[0x0], &(0x7f0000000040)=[0x1], &(0x7f0000000200), &(0x7f00000000c0), 0x0, 0x7f}) 6.135110345s ago: executing program 1 (id=764): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x8, 0x12, r0, 0x0) ftruncate(r0, 0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee3, 0x8032, 0xffffffffffffffff, 0x28f41000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) iopl(0x3) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{}, {0x0, 0x3938700}}, &(0x7f0000000100)) 5.355525612s ago: executing program 5 (id=765): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x58, r1, 0x101, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1}, @NL80211_ATTR_IE={0x20, 0x2a, [@link_id={0x65, 0x12, {@random="421ada68abdd", @device_a, @device_b}}, @mesh_id={0x72, 0x6}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4010}, 0x0) 5.152149959s ago: executing program 4 (id=766): unshare(0xe060400) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) 5.013709132s ago: executing program 6 (id=767): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000062c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2004a8c5}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="10"], 0x10, 0x200400c1}}], 0x2, 0x4000000) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0xfffffdf3) 4.945132924s ago: executing program 1 (id=768): r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') preadv(r2, &(0x7f0000000340)=[{&(0x7f0000000180)=""/112, 0x70}], 0x1, 0x0, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x3000, 0x2}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000200), 0xfffffd9d) 4.878669669s ago: executing program 5 (id=769): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_KEY_TYPE={0x8}]}], {0x14}}, 0x64}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x34, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000150a03000000000000000000020000000900020073797a310000000008000340000000010900010073797a30"], 0x34}}, 0x0) 4.647126589s ago: executing program 4 (id=770): memfd_create(0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x694f840696960f3d) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r1, 0x0, 0x0) 4.524425493s ago: executing program 5 (id=771): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r3, r3, 0x0, 0x7ff) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000000)=0xd, 0x4) 4.50650919s ago: executing program 6 (id=772): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000011c0)={0x1c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44040}, 0x44000) 4.401405983s ago: executing program 7 (id=773): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000200), r0) r1 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4f23, 0xfffc, 0x4e23, 0x6, 0xa, 0x2a11bad3d5f03f34, 0x30}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x6, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x4, 0x9}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in=@remote, 0x210000, 0x33}, 0x0, @in=@remote, 0xffffffff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1}}, 0xe8) sendmmsg(r1, 0x0, 0x0, 0xffe0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = getpgrp(0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x41, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, r3, 0x2, 0x0) r4 = getpid() openat$kvm(0xffffffffffffff9c, 0x0, 0x62040, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) unshare(0xa000080) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x7b9, &(0x7f0000000280)) 3.519237568s ago: executing program 6 (id=774): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000280)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r1, 0xc03064b7, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x7e3c, 0x4, 0x9, 0xfffffff9, 0xfffd, 0xfffffffd, 0x7, 0x1, 0xfefffffd}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x300, 0x1, &(0x7f0000000340)=[0x0], &(0x7f0000000040)=[0x1], &(0x7f0000000200), &(0x7f00000000c0), 0x0, 0x7f}) 3.444354805s ago: executing program 1 (id=775): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) fsopen(&(0x7f0000001340)='ntfs\x00', 0x0) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff, 0x0, 0xfffffffffffffefa}, &(0x7f0000000080)={&(0x7f0000000040)}) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00'}, 0x94) r5 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r4}, 0x8) close(r5) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r4, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$LINK_DETACH(0x22, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000), 0xc) waitid(0x0, r3, 0x0, 0x4, 0x0) 3.291547025s ago: executing program 4 (id=776): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) io_setup(0x3, &(0x7f0000000140)) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x8000, 0x2}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x7}, 0x10) socket$tipc(0x1e, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) 2.57014922s ago: executing program 6 (id=777): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r0, &(0x7f0000000900)=[{{&(0x7f0000007b00)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000180)="e6e0", 0x2}], 0x1}}, {{&(0x7f0000000140)={0x2, 0x4e20, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x50}}], 0x2, 0x800) 2.377788941s ago: executing program 5 (id=778): syz_emit_ethernet(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/vlan/vlan0\x00') r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2e0, 0x128, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x25}}, [0xff, 0xff000000, 0x0, 0xffffff00], [0xff000000, 0xff, 0xbfa6c1dfb8cc9f2d], 'wg2\x00', 'veth0_virt_wifi\x00', {}, {}, 0x29, 0x10, 0x0, 0x60}, 0x0, 0xa8, 0xf0, 0x60030000, {0x0, 0xff000000}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00', {0x8}}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, [0xff000000, 0xffffff00, 0xffffff00, 0xff], [0xff, 0xff, 0xffffffff, 0xff], 'ip6gre0\x00', '\x00', {0xff}, {}, 0x0, 0x2, 0x4}, 0x0, 0xf0, 0x120, 0x0, {}, [@common=@dst={{0x48}, {0x0, 0x7, 0x0, [0x1, 0xa2e8, 0x4, 0x0, 0x9, 0xc, 0x7, 0x6f, 0x3a, 0x489, 0x2c, 0x8, 0x8, 0xfffb, 0x5, 0x9], 0xb}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x8000002, 0x6, 0x9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r2) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r3, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x4f, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x2}, {0xffff, 0x5, 0x1, 0x46, 0x6, 0xfd}]}) write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250) 1.207666728s ago: executing program 1 (id=779): socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r3, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000000440)={0x2, 0x0, {&(0x7f0000000180)=""/123, 0x7b, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000000200)={0x2, 0x0, {0x0, 0xd, 0x0, 0x0, 0x3}}, 0x48) 1.206278948s ago: executing program 4 (id=780): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x5}}], {0x14}}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) 0s ago: executing program 6 (id=781): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r4, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0xb, 0x0, 0x0) recvfrom$inet(r4, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) r5 = userfaultfd(0x80001) kcmp(0x0, 0x0, 0x2, r5, r5) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100), 0x4) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0xfe, 0x0, 0x2, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) kernel console output (not intermixed with test programs): 7581][ T5910] syz.3.33 uses obsolete (PF_INET,SOCK_PACKET) [ 120.232937][ T5725] usb 1-1: Using ep0 maxpacket: 32 [ 120.233872][ T5725] usb 1-1: no configurations [ 120.233886][ T5725] usb 1-1: can't read configurations, error -22 [ 120.234352][ T5725] usb usb1-port1: attempt power cycle [ 120.273377][ T5813] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input5 [ 120.624920][ T5725] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 120.647362][ T5725] usb 1-1: Using ep0 maxpacket: 32 [ 120.648165][ T5725] usb 1-1: no configurations [ 120.648179][ T5725] usb 1-1: can't read configurations, error -22 [ 120.718290][ T5813] usb 5-1: USB disconnect, device number 2 [ 121.553904][ T5725] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 121.582766][ T5725] usb 1-1: Using ep0 maxpacket: 32 [ 121.583575][ T5725] usb 1-1: no configurations [ 121.583590][ T5725] usb 1-1: can't read configurations, error -22 [ 121.583919][ T5725] usb usb1-port1: unable to enumerate USB device [ 121.927940][ T5813] appletouch 5-1:1.0: input: appletouch disconnected [ 121.965078][ T5612] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 122.134023][ T5612] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.134052][ T5612] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.134084][ T5612] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 122.134096][ T5612] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.137529][ T5612] usb 3-1: config 0 descriptor?? [ 122.716205][ T5612] hid-led 0003:27B8:01ED.0001: unknown main item tag 0x0 [ 122.716315][ T5612] hid-led 0003:27B8:01ED.0001: unknown main item tag 0x0 [ 122.848121][ T5612] hid-led 0003:27B8:01ED.0001: probe with driver hid-led failed with error -71 [ 123.970848][ T5612] usb 3-1: USB disconnect, device number 4 [ 127.151723][ T5725] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 127.387955][ T5969] netlink: 8 bytes leftover after parsing attributes in process `syz.4.49'. [ 127.388083][ T5969] netlink: 12 bytes leftover after parsing attributes in process `syz.4.49'. [ 128.010514][ T5725] usb 2-1: Using ep0 maxpacket: 32 [ 128.039702][ T5725] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 128.039727][ T5725] usb 2-1: config 0 has no interfaces? [ 128.039755][ T5725] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 128.039775][ T5725] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.046477][ T5961] syz.2.47 (5961) used greatest stack depth: 18328 bytes left [ 128.090764][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.090873][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.095183][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.097884][ T5965] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 128.097920][ T5965] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 128.097956][ T5965] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 128.104113][ T5965] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 128.116701][ T5965] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 128.153815][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.155856][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.157262][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.158718][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.160077][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.161603][ T5965] wg1 speed is unknown, defaulting to 1000 [ 128.222890][ T5725] usb 2-1: config 0 descriptor?? [ 128.329658][ T5965] overlay: ./file0 is not a directory [ 131.427149][ T5839] usb 2-1: USB disconnect, device number 5 [ 132.912953][ T6006] netlink: 8 bytes leftover after parsing attributes in process `syz.3.60'. [ 132.912977][ T6006] netlink: 12 bytes leftover after parsing attributes in process `syz.3.60'. [ 134.100647][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 134.100736][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.891583][ T5612] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 135.061728][ T5612] usb 3-1: Using ep0 maxpacket: 32 [ 135.064779][ T5612] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 135.064803][ T5612] usb 3-1: config 0 has no interface number 0 [ 135.064845][ T5612] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.064868][ T5612] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 135.064902][ T5612] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 135.064923][ T5612] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.449080][ T5612] usb 3-1: config 0 descriptor?? [ 136.185538][ T5612] uclogic 0003:28BD:0094.0002: pen parameters not found [ 136.185566][ T5612] uclogic 0003:28BD:0094.0002: interface is invalid, ignoring [ 136.694016][ T6034] netlink: 24 bytes leftover after parsing attributes in process `syz.1.62'. [ 137.148522][ T5612] usb 3-1: USB disconnect, device number 5 [ 137.364301][ T5725] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 137.552393][ T5725] usb 4-1: Using ep0 maxpacket: 32 [ 137.557392][ T5725] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 137.557417][ T5725] usb 4-1: config 0 has no interfaces? [ 137.557445][ T5725] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 137.557464][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.606475][ T5725] usb 4-1: config 0 descriptor?? [ 140.198180][ T5839] usb 4-1: USB disconnect, device number 2 [ 140.418445][ T6062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.74'. [ 140.418586][ T6062] netlink: 12 bytes leftover after parsing attributes in process `syz.0.74'. [ 144.555182][ T6077] Zero length message leads to an empty skb [ 153.956855][ T5725] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 155.832159][ T5725] usb 1-1: Using ep0 maxpacket: 32 [ 155.991991][ T5725] usb 1-1: device descriptor read/all, error -71 [ 164.093416][ T5711] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 164.472882][ T5711] usb 3-1: Using ep0 maxpacket: 32 [ 164.994244][ T5711] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 164.994269][ T5711] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 164.994304][ T5711] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 164.994324][ T5711] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.045278][ T5711] usb 3-1: config 0 descriptor?? [ 166.184619][ T6146] syz.4.102 (6146) used greatest stack depth: 18208 bytes left [ 166.670818][ T9] usb 3-1: USB disconnect, device number 6 [ 168.115894][ T6183] syzkaller0: entered promiscuous mode [ 168.115912][ T6183] syzkaller0: entered allmulticast mode [ 168.154141][ T6183] tipc: Started in network mode [ 168.154170][ T6183] tipc: Node identity eeecd0731c48, cluster identity 4711 [ 168.196596][ T6183] tipc: Enabled bearer , priority 0 [ 168.266110][ T6182] tipc: Resetting bearer [ 168.312010][ T5732] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 168.511629][ T5711] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 168.541642][ T5732] usb 3-1: Using ep0 maxpacket: 16 [ 168.571188][ T6182] tipc: Disabling bearer [ 168.580441][ T5732] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 168.580466][ T5732] usb 3-1: config 0 has no interface number 0 [ 168.580508][ T5732] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 168.580530][ T5732] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 168.580564][ T5732] usb 3-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 168.580582][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.715686][ T5732] usb 3-1: config 0 descriptor?? [ 168.717853][ T5711] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 168.717929][ T5711] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.889966][ T5711] usb 2-1: config 0 descriptor?? [ 170.132882][ T5613] Bluetooth: hci0: command 0x0c20 tx timeout [ 170.138567][ T6187] Bluetooth: hci0: Opcode 0x0c20 failed: -110 [ 170.254601][ T5711] ath6kl: Failed to submit usb control message: -110 [ 170.254680][ T5711] ath6kl: unable to send the bmi data to the device: -110 [ 170.254688][ T5711] ath6kl: Unable to send get target info: -110 [ 170.287754][ T5711] ath6kl: Failed to init ath6kl core: -110 [ 170.289512][ T5711] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 170.417504][ T5732] usb 3-1: USB disconnect, device number 7 [ 170.529411][ T6188] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 170.529973][ T6188] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 170.707675][ T5813] usb 2-1: USB disconnect, device number 6 [ 188.480429][ T4917] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 188.513897][ T4917] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 188.519902][ T4917] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 188.529872][ T4917] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 188.530606][ T4917] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 188.701373][ T4917] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 188.738403][ T6241] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 188.770466][ T6241] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 188.819762][ T6249] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 188.820048][ T6249] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 188.823136][ T6249] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 188.856871][ T6249] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 188.873721][ T6249] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 188.875609][ T6249] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 188.923863][ T6249] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 189.179910][ T6250] tipc: Started in network mode [ 189.179937][ T6250] tipc: Node identity aeed66c3c4e5, cluster identity 4711 [ 189.180243][ T6250] tipc: Enabled bearer , priority 0 [ 190.249903][ T6245] tipc: Disabling bearer [ 190.489756][ T5725] tipc: Node number set to 1778935491 [ 190.604929][ T4917] Bluetooth: hci5: command tx timeout [ 191.003050][ T4917] Bluetooth: hci6: command tx timeout [ 191.188449][ T4917] Bluetooth: hci7: command tx timeout [ 192.682367][ T4917] Bluetooth: hci5: command tx timeout [ 194.161663][ T4917] Bluetooth: hci7: command tx timeout [ 194.472962][ T4917] Bluetooth: hci6: command tx timeout [ 194.476781][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.476851][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.757143][ T4917] Bluetooth: hci5: command tx timeout [ 195.260291][ T6240] wg1 speed is unknown, defaulting to 1000 [ 195.313290][ T6243] wg1 speed is unknown, defaulting to 1000 [ 196.201654][ T4917] Bluetooth: hci7: command tx timeout [ 196.347205][ T43] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.409288][ T6239] wg1 speed is unknown, defaulting to 1000 [ 196.522267][ T4917] Bluetooth: hci6: command tx timeout [ 196.831532][ T4917] Bluetooth: hci5: command tx timeout [ 197.618352][ T43] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 198.096716][ T43] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 198.271641][ T4917] Bluetooth: hci7: command tx timeout [ 198.604303][ T4917] Bluetooth: hci6: command tx timeout [ 199.139526][ T43] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.298460][ T6240] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.298679][ T6240] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.298863][ T6240] bridge_slave_0: entered allmulticast mode [ 203.311588][ T6240] bridge_slave_0: entered promiscuous mode [ 203.452292][ T6240] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.452946][ T6240] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.453161][ T6240] bridge_slave_1: entered allmulticast mode [ 203.459822][ T6240] bridge_slave_1: entered promiscuous mode [ 203.476053][ T6243] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.476166][ T6243] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.476389][ T6243] bridge_slave_0: entered allmulticast mode [ 203.478884][ T6243] bridge_slave_0: entered promiscuous mode [ 203.542869][ T6243] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.542965][ T6243] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.543133][ T6243] bridge_slave_1: entered allmulticast mode [ 203.544591][ T6243] bridge_slave_1: entered promiscuous mode [ 203.891356][ T6240] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.078542][ T5711] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 204.481617][ T5711] usb 2-1: Using ep0 maxpacket: 8 [ 204.485547][ T5711] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 204.485574][ T5711] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.485587][ T5711] usb 2-1: Product: syz [ 204.485594][ T5711] usb 2-1: Manufacturer: syz [ 204.485600][ T5711] usb 2-1: SerialNumber: syz [ 204.494148][ T5711] usb 2-1: config 0 descriptor?? [ 204.541165][ T5711] gspca_main: se401-2.14.0 probing 047d:5003 [ 205.143073][ T43] bridge_slave_1: left allmulticast mode [ 205.146439][ T43] bridge_slave_1: left promiscuous mode [ 205.162702][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.316084][ T5711] gspca_se401: write req failed req 0x57 val 0x00 error -71 [ 205.316194][ T5711] se401 2-1:0.0: probe with driver se401 failed with error -71 [ 205.420148][ T5711] usb 2-1: USB disconnect, device number 7 [ 205.485419][ T43] bridge_slave_0: left allmulticast mode [ 205.485451][ T43] bridge_slave_0: left promiscuous mode [ 205.487768][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.352737][ T6398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.154'. [ 209.682269][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 209.722547][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 209.756259][ T43] bond0 (unregistering): Released all slaves [ 209.937735][ T6240] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 210.030917][ T6239] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.030985][ T6239] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.031115][ T6239] bridge_slave_0: entered allmulticast mode [ 210.034336][ T6239] bridge_slave_0: entered promiscuous mode [ 210.072345][ T6243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.182972][ T6239] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.183165][ T6239] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.183390][ T6239] bridge_slave_1: entered allmulticast mode [ 210.194921][ T6239] bridge_slave_1: entered promiscuous mode [ 210.201150][ T6243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 211.208749][ T6240] team0: Port device team_slave_0 added [ 211.265440][ T6240] team0: Port device team_slave_1 added [ 211.267731][ T6243] team0: Port device team_slave_0 added [ 211.271922][ T6239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 211.317591][ T6243] team0: Port device team_slave_1 added [ 211.326270][ T6239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 211.793514][ T6240] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 211.793530][ T6240] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 211.793551][ T6240] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 211.873552][ T6249] Bluetooth: hci0: command 0x0c20 tx timeout [ 211.958171][ T6249] Bluetooth: hci4: command 0x0406 tx timeout [ 212.020948][ T6240] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.020963][ T6240] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.020981][ T6240] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 212.106022][ T6243] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.106040][ T6243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.106063][ T6243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 212.123713][ T6239] team0: Port device team_slave_0 added [ 212.225544][ T6243] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.225557][ T6243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.225577][ T6243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 212.260278][ T6239] team0: Port device team_slave_1 added [ 213.733157][ T6239] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 213.733168][ T6239] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 213.733181][ T6239] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 213.888604][ T6427] netlink: 36 bytes leftover after parsing attributes in process `syz.4.164'. [ 214.533847][ T6239] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.533861][ T6239] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.533884][ T6239] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.584634][ T6240] hsr_slave_0: entered promiscuous mode [ 214.585980][ T6240] hsr_slave_1: entered promiscuous mode [ 214.586835][ T6240] debugfs: 'hsr0' already exists in 'hsr' [ 214.586857][ T6240] Cannot create hsr debugfs directory [ 214.842902][ T6243] hsr_slave_0: entered promiscuous mode [ 214.845793][ T6243] hsr_slave_1: entered promiscuous mode [ 214.848401][ T6243] debugfs: 'hsr0' already exists in 'hsr' [ 214.848425][ T6243] Cannot create hsr debugfs directory [ 216.994330][ T43] hsr_slave_0: left promiscuous mode [ 217.163705][ T43] hsr_slave_1: left promiscuous mode [ 217.165087][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 217.206551][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 217.292062][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 217.292089][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.043654][ T43] veth1_macvtap: left promiscuous mode [ 218.043912][ T43] veth0_macvtap: left promiscuous mode [ 218.044195][ T43] veth1_vlan: left promiscuous mode [ 218.044510][ T43] veth0_vlan: left promiscuous mode [ 218.733071][ T43] team0 (unregistering): Port device team_slave_1 removed [ 218.772713][ T43] team0 (unregistering): Port device team_slave_0 removed [ 218.951928][ T6239] hsr_slave_0: entered promiscuous mode [ 218.955188][ T6239] hsr_slave_1: entered promiscuous mode [ 218.957619][ T6239] debugfs: 'hsr0' already exists in 'hsr' [ 218.957642][ T6239] Cannot create hsr debugfs directory [ 219.029614][ T5262] 8021q: adding VLAN 0 to HW filter on device eth1 [ 220.381685][ T6472] netlink: 36 bytes leftover after parsing attributes in process `syz.1.173'. [ 223.387080][ T6240] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 223.451081][ T6240] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 223.462509][ T6240] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 223.533645][ T6240] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 223.537869][ T6240] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 223.600559][ T6240] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 223.651405][ T6240] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 223.841186][ T6240] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 224.529120][ T5262] 8021q: adding VLAN 0 to HW filter on device eth2 [ 225.083362][ T6243] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 225.153602][ T6243] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 225.166527][ T6243] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 225.260603][ T6243] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 225.268295][ T6243] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 225.404704][ T6243] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 225.499515][ T6243] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 225.544752][ T6243] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 226.025241][ T6534] netlink: 36 bytes leftover after parsing attributes in process `syz.4.181'. [ 226.751316][ T5262] 8021q: adding VLAN 0 to HW filter on device eth3 [ 226.867728][ T6239] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 226.907688][ T6239] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 226.911264][ T6239] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 226.961149][ T6537] ======================================================= [ 226.961149][ T6537] WARNING: The mand mount option has been deprecated and [ 226.961149][ T6537] and is ignored by this kernel. Remove the mand [ 226.961149][ T6537] option from the mount to silence this warning. [ 226.961149][ T6537] ======================================================= [ 227.008658][ T6537] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 227.048971][ T6239] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 227.053513][ T6539] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 227.074026][ T6239] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 227.123702][ T6537] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 227.124266][ T6537] overlayfs: failed to look up (tracing) for ino (-66) [ 227.190563][ T4917] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 227.338286][ T6239] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 227.369707][ T6239] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 227.420924][ T6239] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 227.636184][ T6240] 8021q: adding VLAN 0 to HW filter on device bond0 [ 227.703036][ T6240] 8021q: adding VLAN 0 to HW filter on device team0 [ 227.752586][ T1025] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.754095][ T1025] bridge0: port 1(bridge_slave_0) entered forwarding state [ 227.808593][ T6243] 8021q: adding VLAN 0 to HW filter on device bond0 [ 227.827042][ T1025] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.827186][ T1025] bridge0: port 2(bridge_slave_1) entered forwarding state [ 230.725393][ T6243] 8021q: adding VLAN 0 to HW filter on device team0 [ 230.813502][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.813597][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 232.051756][ T4917] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 232.052346][ T4917] Bluetooth: hci4: Injecting HCI hardware error event [ 232.054950][ T5613] Bluetooth: hci4: hardware error 0x00 [ 232.081009][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.122986][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 232.272285][ T6239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 232.405148][ T5262] 8021q: adding VLAN 0 to HW filter on device eth4 [ 232.900136][ T6239] 8021q: adding VLAN 0 to HW filter on device team0 [ 232.999242][ T1025] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.999376][ T1025] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.222039][ T1509] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.222172][ T1509] bridge0: port 2(bridge_slave_1) entered forwarding state [ 234.297037][ T5613] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 235.483812][ T6240] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 235.531550][ T5711] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 235.661875][ T5711] usb 5-1: device descriptor read/64, error -71 [ 235.941573][ T5711] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 236.074550][ T5711] usb 5-1: device descriptor read/64, error -71 [ 236.193364][ T5711] usb usb5-port1: attempt power cycle [ 237.035847][ T6243] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 237.129194][ T6240] veth0_vlan: entered promiscuous mode [ 237.186637][ T6240] veth1_vlan: entered promiscuous mode [ 237.341649][ T5711] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 237.364404][ T5711] usb 5-1: device descriptor read/8, error -71 [ 237.396828][ T6239] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 237.470325][ T6240] veth0_macvtap: entered promiscuous mode [ 237.498269][ T6240] veth1_macvtap: entered promiscuous mode [ 237.580356][ T6240] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 237.601630][ T5711] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 237.605200][ T6240] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 237.628103][ T5711] usb 5-1: device descriptor read/8, error -71 [ 237.694357][ T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.694872][ T13] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.694912][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.694943][ T13] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.740813][ T5711] usb usb5-port1: unable to enumerate USB device [ 238.496839][ T6243] veth0_vlan: entered promiscuous mode [ 238.505215][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 238.505233][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 239.699447][ T6243] veth1_vlan: entered promiscuous mode [ 239.817719][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.817739][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 239.926937][ T6239] veth0_vlan: entered promiscuous mode [ 240.029701][ T6239] veth1_vlan: entered promiscuous mode [ 240.331469][ T6243] veth0_macvtap: entered promiscuous mode [ 241.166424][ T6243] veth1_macvtap: entered promiscuous mode [ 241.329326][ T6239] veth0_macvtap: entered promiscuous mode [ 242.555015][ T6243] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 242.603512][ T6243] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 243.689339][ T6239] veth1_macvtap: entered promiscuous mode [ 243.822604][ T1509] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.826123][ T1509] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.856306][ T1509] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.932806][ T1509] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.020214][ T6239] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 244.105033][ T6239] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 244.339482][ T3352] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.369752][ T3352] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.379424][ T3352] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.404682][ T3352] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.271272][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.271293][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.094433][ T4917] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 247.138290][ T4917] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 247.145161][ T4917] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 247.155586][ T4917] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 247.160379][ T4917] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 247.511211][ T4917] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 247.573420][ T4917] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 247.578700][ T4917] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 247.617514][ T4917] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 247.680342][ T4917] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 247.727454][ T820] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 247.851547][ T820] usb 8-1: device descriptor read/64, error -71 [ 248.105502][ T820] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 248.235178][ T820] usb 8-1: device descriptor read/64, error -71 [ 248.342179][ T820] usb usb8-port1: attempt power cycle [ 249.392761][ T4917] Bluetooth: hci1: command tx timeout [ 249.601603][ T820] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 249.622442][ T820] usb 8-1: device descriptor read/8, error -71 [ 249.792731][ T4917] Bluetooth: hci2: command tx timeout [ 249.896093][ T820] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 249.912349][ T820] usb 8-1: device descriptor read/8, error -71 [ 250.025813][ T820] usb usb8-port1: unable to enumerate USB device [ 252.507010][ T4917] Bluetooth: hci2: command tx timeout [ 252.507043][ T4917] Bluetooth: hci1: command tx timeout [ 254.520788][ T5613] Bluetooth: hci1: command tx timeout [ 254.520822][ T5613] Bluetooth: hci2: command tx timeout [ 255.656243][ T124] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.880103][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.880171][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.120324][ T6689] wg1 speed is unknown, defaulting to 1000 [ 256.389821][ T6690] wg1 speed is unknown, defaulting to 1000 [ 256.592161][ T4917] Bluetooth: hci2: command tx timeout [ 256.592192][ T4917] Bluetooth: hci1: command tx timeout [ 257.591116][ T124] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.681728][ T6642] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 258.426565][ T6642] usb 5-1: device descriptor read/64, error -71 [ 258.821582][ T6642] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 258.956748][ T6642] usb 5-1: device descriptor read/64, error -71 [ 259.202824][ T6642] usb usb5-port1: attempt power cycle [ 259.242986][ T124] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 262.765414][ T124] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.876297][ T124] bridge_slave_1: left allmulticast mode [ 265.876330][ T124] bridge_slave_1: left promiscuous mode [ 265.876575][ T124] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.220526][ T5732] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 267.014017][ T124] bridge_slave_0: left allmulticast mode [ 267.015586][ T124] bridge_slave_0: left promiscuous mode [ 267.015813][ T124] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.109151][ T5732] usb 8-1: device descriptor read/64, error -71 [ 269.687105][ T5732] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 273.978348][ T6890] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 274.337272][ T124] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 274.420063][ T124] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 274.466367][ T124] bond0 (unregistering): Released all slaves [ 274.589621][ T6690] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.589738][ T6690] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.589940][ T6690] bridge_slave_0: entered allmulticast mode [ 274.630514][ T6690] bridge_slave_0: entered promiscuous mode [ 274.713720][ T6689] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.713810][ T6689] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.714034][ T6689] bridge_slave_0: entered allmulticast mode [ 275.236650][ T6689] bridge_slave_0: entered promiscuous mode [ 275.297520][ T6690] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.297661][ T6690] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.297904][ T6690] bridge_slave_1: entered allmulticast mode [ 275.306440][ T6690] bridge_slave_1: entered promiscuous mode [ 275.344638][ T6689] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.344754][ T6689] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.344993][ T6689] bridge_slave_1: entered allmulticast mode [ 275.536715][ T6689] bridge_slave_1: entered promiscuous mode [ 275.615697][ T6903] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 276.591778][ T6893] Bluetooth: hci0: Opcode 0x0c20 failed: -110 [ 276.591791][ T5613] Bluetooth: hci0: command 0x0c20 tx timeout [ 276.781548][ T5725] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 276.820042][ T6690] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 276.909612][ T6689] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 276.934048][ T6690] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 276.946076][ T6689] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 276.977000][ T5725] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 276.977027][ T5725] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.004491][ T5590] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 277.029331][ T5725] usb 8-1: config 0 descriptor?? [ 277.137856][ T5590] usb 2-1: device descriptor read/64, error -71 [ 277.424468][ T6690] team0: Port device team_slave_0 added [ 277.428301][ T6689] team0: Port device team_slave_0 added [ 278.101048][ T5590] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 278.197871][ T5725] ath6kl: Failed to submit usb control message: -110 [ 278.197986][ T5725] ath6kl: unable to send the bmi data to the device: -110 [ 278.198000][ T5725] ath6kl: Unable to send get target info: -110 [ 278.251829][ T5590] usb 2-1: device descriptor read/64, error -71 [ 278.262178][ T5725] ath6kl: Failed to init ath6kl core: -110 [ 278.302811][ T5725] ath6kl_usb 8-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 278.366211][ T6893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.366841][ T6893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.370465][ T5590] usb usb2-port1: attempt power cycle [ 278.494730][ T5725] usb 8-1: USB disconnect, device number 8 [ 278.532755][ T124] hsr_slave_0: left promiscuous mode [ 278.576868][ T124] hsr_slave_1: left promiscuous mode [ 278.578008][ T124] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 278.578032][ T124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 278.626547][ T124] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 278.626573][ T124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 278.711599][ T5590] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 278.730959][ T124] veth1_macvtap: left promiscuous mode [ 278.746203][ T5590] usb 2-1: device descriptor read/8, error -71 [ 278.751329][ T124] veth0_macvtap: left promiscuous mode [ 278.754101][ T124] veth1_vlan: left promiscuous mode [ 278.754268][ T124] veth0_vlan: left promiscuous mode [ 279.001600][ T5590] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 279.038397][ T5590] usb 2-1: device descriptor read/8, error -71 [ 279.141978][ T5590] usb usb2-port1: unable to enumerate USB device [ 280.929249][ T6946] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 281.729946][ T6947] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 282.994641][ T124] team0 (unregistering): Port device team_slave_1 removed [ 283.085028][ T124] team0 (unregistering): Port device team_slave_0 removed [ 283.647420][ T6690] team0: Port device team_slave_1 added [ 283.650477][ T6689] team0: Port device team_slave_1 added [ 283.913059][ T5725] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 284.052982][ T5725] usb 5-1: device descriptor read/64, error -71 [ 284.159095][ T6973] netlink: 48 bytes leftover after parsing attributes in process `syz.1.253'. [ 284.603144][ T5725] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 284.834233][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 284.895045][ T5725] usb 5-1: device descriptor read/64, error -71 [ 284.992840][ T6690] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 284.992856][ T6690] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 284.992878][ T6690] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 284.998512][ T6689] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 284.998524][ T6689] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 284.998538][ T6689] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 285.000010][ T6690] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 285.000022][ T6690] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.000041][ T6690] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 285.002087][ T5725] usb usb5-port1: attempt power cycle [ 285.006204][ T6689] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 285.006221][ T6689] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.006243][ T6689] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 285.229117][ T6689] hsr_slave_0: entered promiscuous mode [ 285.229942][ T6689] hsr_slave_1: entered promiscuous mode [ 285.230485][ T6689] debugfs: 'hsr0' already exists in 'hsr' [ 285.230501][ T6689] Cannot create hsr debugfs directory [ 285.361764][ T5725] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 285.398991][ T6690] hsr_slave_0: entered promiscuous mode [ 285.403987][ T6690] hsr_slave_1: entered promiscuous mode [ 285.405421][ T6690] debugfs: 'hsr0' already exists in 'hsr' [ 285.405498][ T6690] Cannot create hsr debugfs directory [ 285.464515][ T5725] usb 5-1: device descriptor read/8, error -71 [ 285.705544][ T6979] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 286.602709][ T5725] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 286.623022][ T5725] usb 5-1: device descriptor read/8, error -71 [ 286.764676][ T5725] usb usb5-port1: unable to enumerate USB device [ 288.680864][ T5262] 8021q: adding VLAN 0 to HW filter on device eth6 [ 288.956978][ T7018] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 290.361517][ T7036] netlink: 48 bytes leftover after parsing attributes in process `syz.1.263'. [ 291.697147][ T6689] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.228991][ T5262] 8021q: adding VLAN 0 to HW filter on device eth7 [ 292.945265][ T6689] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.685963][ T6689] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.726063][ T5262] 8021q: adding VLAN 0 to HW filter on device eth8 [ 293.918733][ T7067] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 293.970805][ T7067] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 293.971026][ T7067] overlayfs: failed to look up (tracing) for ino (-66) [ 294.168560][ T6689] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.361607][ T5732] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 294.543672][ T5732] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 294.543698][ T5732] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 294.543730][ T5732] usb 8-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 294.543750][ T5732] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.608310][ T5732] usb 8-1: config 0 descriptor?? [ 294.941977][ T7082] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 295.905740][ T124] bridge_slave_1: left allmulticast mode [ 295.905773][ T124] bridge_slave_1: left promiscuous mode [ 295.912341][ T124] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.143760][ T7091] netlink: 48 bytes leftover after parsing attributes in process `syz.4.274'. [ 297.830031][ T6642] usb 8-1: USB disconnect, device number 9 [ 297.866072][ T124] bridge_slave_0: left allmulticast mode [ 297.866093][ T124] bridge_slave_0: left promiscuous mode [ 297.866260][ T124] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.705770][ T124] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 298.782243][ T124] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 298.823654][ T124] bond0 (unregistering): Released all slaves [ 300.383843][ T7118] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 300.410978][ T7118] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 300.411024][ T7118] overlayfs: failed to look up (tracing) for ino (-66) [ 302.306178][ T7132] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.642978][ T7162] netlink: 48 bytes leftover after parsing attributes in process `syz.7.288'. [ 306.129264][ T7171] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 306.174289][ T7171] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 306.174361][ T7171] overlayfs: failed to look up (tracing) for ino (-66) [ 308.348402][ T4917] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 308.390848][ T4917] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 308.401355][ T4917] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 308.430055][ T4917] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 308.430827][ T4917] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 308.856351][ T7202] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 309.900713][ T5613] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 309.944913][ T5613] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 309.969309][ T5613] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 309.998136][ T5613] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 309.999091][ T5613] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 311.545773][ T5613] Bluetooth: hci3: command tx timeout [ 312.287783][ T5613] Bluetooth: hci5: command tx timeout [ 312.398954][ T7244] netlink: 48 bytes leftover after parsing attributes in process `syz.4.299'. [ 313.299269][ T7249] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 313.499001][ T7250] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 313.499194][ T7250] overlayfs: failed to look up (tracing) for ino (-66) [ 313.551992][ T4917] Bluetooth: hci3: command tx timeout [ 314.361602][ T4917] Bluetooth: hci6: command 0x0406 tx timeout [ 314.585303][ T4917] Bluetooth: hci5: command tx timeout [ 315.644205][ T5613] Bluetooth: hci3: command tx timeout [ 317.294077][ T5613] Bluetooth: hci5: command tx timeout [ 317.317078][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.317136][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.571646][ T124] hsr_slave_0: left promiscuous mode [ 317.611728][ T124] hsr_slave_1: left promiscuous mode [ 317.612942][ T124] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 317.612990][ T124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 317.662935][ T124] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 317.662961][ T124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 317.973864][ T7292] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.432025][ T5613] Bluetooth: hci3: command tx timeout [ 318.928446][ T124] veth1_macvtap: left promiscuous mode [ 318.928541][ T124] veth0_macvtap: left promiscuous mode [ 318.928788][ T124] veth1_vlan: left promiscuous mode [ 318.928968][ T124] veth0_vlan: left promiscuous mode [ 319.926587][ T5613] Bluetooth: hci5: command tx timeout [ 323.699168][ T7314] netlink: 48 bytes leftover after parsing attributes in process `syz.4.312'. [ 326.102427][ T124] team0 (unregistering): Port device team_slave_1 removed [ 326.132676][ T124] team0 (unregistering): Port device team_slave_0 removed [ 326.310878][ T7191] wg1 speed is unknown, defaulting to 1000 [ 327.926118][ T7208] wg1 speed is unknown, defaulting to 1000 [ 329.134942][ T7354] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 334.449001][ T5590] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 334.616644][ T5590] usb 8-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 334.616672][ T5590] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.616690][ T5590] usb 8-1: Product: syz [ 334.616702][ T5590] usb 8-1: Manufacturer: syz [ 334.616714][ T5590] usb 8-1: SerialNumber: syz [ 335.160571][ T5590] rtl8150 8-1:1.0: couldn't reset the device [ 335.161150][ T5590] rtl8150 8-1:1.0: probe with driver rtl8150 failed with error -5 [ 335.269285][ T5590] usb 8-1: USB disconnect, device number 10 [ 335.645169][ T7420] netlink: 48 bytes leftover after parsing attributes in process `syz.4.324'. [ 336.471531][ T5732] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 336.802192][ T5732] usb 2-1: Using ep0 maxpacket: 16 [ 337.092795][ T5732] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 337.092820][ T5732] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.092836][ T5732] usb 2-1: config 0 has no interface number 0 [ 337.092876][ T5732] usb 2-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 337.092915][ T5732] usb 2-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 337.092934][ T5732] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.108830][ T5732] usb 2-1: config 0 descriptor?? [ 337.772493][ T7191] bridge0: port 1(bridge_slave_0) entered blocking state [ 337.774709][ T7191] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.774955][ T7191] bridge_slave_0: entered allmulticast mode [ 337.777907][ T7191] bridge_slave_0: entered promiscuous mode [ 337.863920][ T7191] bridge0: port 2(bridge_slave_1) entered blocking state [ 337.864121][ T7191] bridge0: port 2(bridge_slave_1) entered disabled state [ 337.864314][ T7191] bridge_slave_1: entered allmulticast mode [ 337.867407][ T7191] bridge_slave_1: entered promiscuous mode [ 337.958221][ T7208] bridge0: port 1(bridge_slave_0) entered blocking state [ 337.958342][ T7208] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.958863][ T7208] bridge_slave_0: entered allmulticast mode [ 337.983092][ T7208] bridge_slave_0: entered promiscuous mode [ 338.016418][ T7208] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.016631][ T7208] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.017135][ T7208] bridge_slave_1: entered allmulticast mode [ 338.021189][ T7208] bridge_slave_1: entered promiscuous mode [ 338.070071][ T7191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 338.086179][ T5732] usbhid 2-1:0.1: couldn't find an input interrupt endpoint [ 338.177162][ T7191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 339.461926][ T7208] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 339.500988][ T7208] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 339.756805][ T7191] team0: Port device team_slave_0 added [ 340.584714][ T7191] team0: Port device team_slave_1 added [ 340.768369][ T7208] team0: Port device team_slave_0 added [ 340.777449][ T5732] usb 2-1: USB disconnect, device number 12 [ 340.874687][ T7208] team0: Port device team_slave_1 added [ 340.881147][ T7191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 340.881158][ T7191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 340.881172][ T7191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 340.933858][ T7191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 340.933874][ T7191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 340.933895][ T7191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 340.936031][ T7208] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 340.936042][ T7208] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 340.936054][ T7208] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.040629][ T7208] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.040641][ T7208] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 341.040656][ T7208] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 341.606819][ T5725] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 342.323468][ T7191] hsr_slave_0: entered promiscuous mode [ 342.324884][ T7191] hsr_slave_1: entered promiscuous mode [ 342.325937][ T7191] debugfs: 'hsr0' already exists in 'hsr' [ 342.325961][ T7191] Cannot create hsr debugfs directory [ 342.414753][ T7208] hsr_slave_0: entered promiscuous mode [ 342.418909][ T7208] hsr_slave_1: entered promiscuous mode [ 342.419540][ T7208] debugfs: 'hsr0' already exists in 'hsr' [ 342.419561][ T7208] Cannot create hsr debugfs directory [ 342.485514][ T5725] usb 8-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 342.485541][ T5725] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.485551][ T5725] usb 8-1: Product: syz [ 342.485558][ T5725] usb 8-1: Manufacturer: syz [ 342.485564][ T5725] usb 8-1: SerialNumber: syz [ 342.679400][ T7477] overlayfs: missing 'lowerdir' [ 342.719055][ T7477] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 342.756828][ T7477] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 342.756902][ T7477] overlayfs: failed to look up (tracing) for ino (-66) [ 342.967592][ T5725] rtl8150 8-1:1.0: couldn't reset the device [ 342.968127][ T5725] rtl8150 8-1:1.0: probe with driver rtl8150 failed with error -5 [ 343.038260][ T5725] usb 8-1: USB disconnect, device number 11 [ 343.597563][ T7485] netlink: 'syz.1.339': attribute type 10 has an invalid length. [ 344.859086][ T7485] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 344.978393][ T7486] 8021q: adding VLAN 0 to HW filter on device bond1 [ 345.007016][ T7488] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 345.007817][ T7488] bond1: (slave macvlan4): unknown ethtool speed (30000) for port 1 (set it to 0) [ 345.007839][ T7488] bond1: (slave macvlan4): speed changed to 0 on port 1 [ 345.010124][ T7488] bond1: (slave macvlan4): Enslaving as a backup interface with an up link [ 345.368538][ T5725] bond_slave_0: entered promiscuous mode [ 345.368573][ T5725] bond_slave_1: entered promiscuous mode [ 345.368629][ T5725] syz_tun: entered promiscuous mode [ 346.731794][ T124] bridge_slave_1: left allmulticast mode [ 346.731834][ T124] bridge_slave_1: left promiscuous mode [ 346.732088][ T124] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.891620][ T5725] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 346.929197][ T124] bridge_slave_0: left allmulticast mode [ 346.929231][ T124] bridge_slave_0: left promiscuous mode [ 346.940833][ T124] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.061696][ T5725] usb 2-1: Using ep0 maxpacket: 16 [ 347.064198][ T5725] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 347.064223][ T5725] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 347.064240][ T5725] usb 2-1: config 0 has no interface number 0 [ 347.064281][ T5725] usb 2-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 347.064319][ T5725] usb 2-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 347.064339][ T5725] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.081829][ T5725] usb 2-1: config 0 descriptor?? [ 347.132431][ T5725] usbhid 2-1:0.1: couldn't find an input interrupt endpoint [ 348.311740][ T124] bridge_slave_1: left allmulticast mode [ 348.311767][ T124] bridge_slave_1: left promiscuous mode [ 348.311927][ T124] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.472654][ T124] bridge_slave_0: left allmulticast mode [ 348.472677][ T124] bridge_slave_0: left promiscuous mode [ 348.472828][ T124] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.891562][ T5612] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 349.061313][ T5612] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 349.061341][ T5612] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.064635][ T5612] usb 5-1: Product: syz [ 349.064656][ T5612] usb 5-1: Manufacturer: syz [ 349.064669][ T5612] usb 5-1: SerialNumber: syz [ 349.430519][ T5612] rtl8150 5-1:1.0: couldn't reset the device [ 349.430883][ T5612] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 349.470557][ T5612] usb 5-1: USB disconnect, device number 14 [ 349.972465][ T124] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 350.095118][ T124] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 350.450863][ T124] bond0 (unregistering): Released all slaves [ 350.543092][ T6642] usb 2-1: USB disconnect, device number 13 [ 350.912355][ T5590] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 351.076496][ T5590] usb 8-1: Using ep0 maxpacket: 16 [ 351.082009][ T5590] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 351.101512][ T5590] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 351.101540][ T5590] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.101555][ T5590] usb 8-1: Product: syz [ 351.101567][ T5590] usb 8-1: Manufacturer: syz [ 351.101578][ T5590] usb 8-1: SerialNumber: syz [ 351.107532][ T5590] usb 8-1: config 0 descriptor?? [ 352.152425][ T124] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 352.274218][ T124] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 352.355264][ T124] bond0 (unregistering): Released all slaves [ 352.767918][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 353.768758][ T820] usb 8-1: USB disconnect, device number 12 [ 354.442170][ T124] hsr_slave_0: left promiscuous mode [ 354.491655][ T124] hsr_slave_1: left promiscuous mode [ 354.492733][ T124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 354.536384][ T124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 354.853412][ T124] hsr_slave_0: left promiscuous mode [ 354.981461][ T124] hsr_slave_1: left promiscuous mode [ 354.982431][ T124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 355.005248][ T124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 355.271536][ T31] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 355.421475][ T31] usb 8-1: Using ep0 maxpacket: 16 [ 355.424194][ T31] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 355.424218][ T31] usb 8-1: config 0 has no interface number 0 [ 355.424259][ T31] usb 8-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 355.424312][ T31] usb 8-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 355.424332][ T31] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.540118][ T31] usb 8-1: config 0 descriptor?? [ 355.556369][ T31] usbhid 8-1:0.1: couldn't find an input interrupt endpoint [ 356.132314][ T124] team0 (unregistering): Port device team_slave_1 removed [ 357.064467][ T124] team0 (unregistering): Port device team_slave_0 removed [ 358.104933][ T31] usb 8-1: USB disconnect, device number 13 [ 358.243320][ T124] team0 (unregistering): Port device team_slave_1 removed [ 358.325978][ T124] team0 (unregistering): Port device team_slave_0 removed [ 359.871341][ T5262] 8021q: adding VLAN 0 to HW filter on device eth6 [ 360.151499][ T820] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 360.301550][ T820] usb 8-1: Using ep0 maxpacket: 16 [ 360.307208][ T820] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 360.382829][ T820] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 360.382857][ T820] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.382875][ T820] usb 8-1: Product: syz [ 360.382887][ T820] usb 8-1: Manufacturer: syz [ 360.382897][ T820] usb 8-1: SerialNumber: syz [ 360.389275][ T820] usb 8-1: config 0 descriptor?? [ 363.163045][ T31] usb 8-1: USB disconnect, device number 14 [ 367.236417][ T7191] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 367.508351][ T7191] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 367.697440][ T7191] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 367.765742][ T7191] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 367.841756][ T7191] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 367.962420][ T7191] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 369.426635][ T4917] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 369.483810][ T4917] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 369.490752][ T4917] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 369.525104][ T4917] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 369.527020][ T4917] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 370.149625][ T4917] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 370.182934][ T4917] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 370.188906][ T4917] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 370.235989][ T4917] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 370.246974][ T4917] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 372.119296][ T4917] Bluetooth: hci1: command tx timeout [ 372.358469][ T4917] Bluetooth: hci2: command tx timeout [ 374.195908][ T4917] Bluetooth: hci1: command tx timeout [ 374.451642][ T4917] Bluetooth: hci2: command tx timeout [ 376.075278][ T7686] wg1 speed is unknown, defaulting to 1000 [ 376.274468][ T4917] Bluetooth: hci1: command tx timeout [ 377.281805][ T4917] Bluetooth: hci2: command tx timeout [ 377.632040][ T7691] wg1 speed is unknown, defaulting to 1000 [ 378.792568][ T4917] Bluetooth: hci1: command tx timeout [ 378.793323][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.793390][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.324456][ T4917] Bluetooth: hci2: command tx timeout [ 380.582418][ T7763] netlink: 'syz.1.387': attribute type 1 has an invalid length. [ 380.583915][ T7686] bridge0: port 1(bridge_slave_0) entered blocking state [ 380.585188][ T7686] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.585340][ T7686] bridge_slave_0: entered allmulticast mode [ 380.623355][ T7686] bridge_slave_0: entered promiscuous mode [ 380.826607][ T7763] bond2: entered promiscuous mode [ 380.828466][ T7763] 8021q: adding VLAN 0 to HW filter on device bond2 [ 380.927511][ T7765] 8021q: adding VLAN 0 to HW filter on device bond3 [ 380.946375][ T7765] bond2: (slave bond3): making interface the new active one [ 380.946395][ T7765] bond3: entered promiscuous mode [ 380.954559][ T7765] bond2: (slave bond3): Enslaving as an active interface with an up link [ 380.974832][ T7686] bridge0: port 2(bridge_slave_1) entered blocking state [ 380.974929][ T7686] bridge0: port 2(bridge_slave_1) entered disabled state [ 380.975450][ T7686] bridge_slave_1: entered allmulticast mode [ 380.978326][ T7686] bridge_slave_1: entered promiscuous mode [ 381.774100][ T7686] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 381.847870][ T7686] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 381.933812][ T7691] bridge0: port 1(bridge_slave_0) entered blocking state [ 381.934429][ T7691] bridge0: port 1(bridge_slave_0) entered disabled state [ 381.934791][ T7691] bridge_slave_0: entered allmulticast mode [ 381.949479][ T7691] bridge_slave_0: entered promiscuous mode [ 382.060370][ T7691] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.060517][ T7691] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.060839][ T7691] bridge_slave_1: entered allmulticast mode [ 382.110893][ T7691] bridge_slave_1: entered promiscuous mode [ 383.114759][ T7686] team0: Port device team_slave_0 added [ 383.139236][ T7686] team0: Port device team_slave_1 added [ 383.179929][ T7691] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 383.226497][ T7691] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 384.633241][ T3399] bridge_slave_1: left allmulticast mode [ 384.633266][ T3399] bridge_slave_1: left promiscuous mode [ 384.633458][ T3399] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.917285][ T3399] bridge_slave_0: left allmulticast mode [ 384.917319][ T3399] bridge_slave_0: left promiscuous mode [ 384.917575][ T3399] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.222532][ T3399] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 387.322537][ T3399] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 387.385755][ T3399] bond0 (unregistering): Released all slaves [ 387.442884][ T7686] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 387.442898][ T7686] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.442919][ T7686] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.664603][ T7686] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.664619][ T7686] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.664642][ T7686] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.675578][ T7691] team0: Port device team_slave_0 added [ 387.762726][ T7691] team0: Port device team_slave_1 added [ 388.076243][ T7691] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 388.076269][ T7691] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.076293][ T7691] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 388.285411][ T3399] hsr_slave_0: left promiscuous mode [ 388.322349][ T3399] hsr_slave_1: left promiscuous mode [ 388.323461][ T3399] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 388.374513][ T3399] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 391.212545][ T3399] team0 (unregistering): Port device team_slave_1 removed [ 391.252150][ T3399] team0 (unregistering): Port device team_slave_0 removed [ 391.578601][ T7691] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.578617][ T7691] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.578640][ T7691] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 391.643912][ T7846] warning: `syz.4.405' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 392.351322][ T7686] hsr_slave_0: entered promiscuous mode [ 392.356834][ T7686] hsr_slave_1: entered promiscuous mode [ 392.358607][ T7686] debugfs: 'hsr0' already exists in 'hsr' [ 392.358632][ T7686] Cannot create hsr debugfs directory [ 392.798043][ T7691] hsr_slave_0: entered promiscuous mode [ 392.803739][ T7691] hsr_slave_1: entered promiscuous mode [ 392.804710][ T7691] debugfs: 'hsr0' already exists in 'hsr' [ 392.804734][ T7691] Cannot create hsr debugfs directory [ 395.650599][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 412.643311][ T3399] bridge_slave_1: left allmulticast mode [ 412.643333][ T3399] bridge_slave_1: left promiscuous mode [ 412.643521][ T3399] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.791720][ T8010] tipc: Failed to remove unknown binding: 66,0,0/0:498714946/498714947 [ 412.828507][ T3399] bridge_slave_0: left allmulticast mode [ 412.828531][ T3399] bridge_slave_0: left promiscuous mode [ 412.828751][ T3399] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.982214][ T3399] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.112368][ T3399] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.209453][ T3399] bond0 (unregistering): Released all slaves [ 417.523379][ T3399] hsr_slave_0: left promiscuous mode [ 417.548637][ T3399] hsr_slave_1: left promiscuous mode [ 417.549416][ T3399] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 417.597152][ T3399] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 418.271522][ T31] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 418.423833][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.423865][ T31] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 418.423876][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.542814][ T31] usb 5-1: config 0 descriptor?? [ 418.569651][ T31] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 418.714728][ T3399] team0 (unregistering): Port device team_slave_1 removed [ 418.773610][ T3399] team0 (unregistering): Port device team_slave_0 removed [ 420.479124][ T8076] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.547655][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 420.986554][ T5725] usb 5-1: USB disconnect, device number 15 [ 421.299400][ T8076] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.159208][ T8076] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.722774][ T8076] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.881196][ T7686] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 425.948994][ T7686] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 425.960773][ T7686] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 426.154049][ T7686] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 426.185129][ T7686] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 426.221035][ T7686] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 426.228365][ T7686] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 427.036759][ T7686] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 427.280142][ T1175] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.394095][ T1133] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.905617][ T7691] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 428.389459][ T7691] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 428.445429][ T7691] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 428.481605][ T5711] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 428.546196][ T7691] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 428.548755][ T7473] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.584866][ T7691] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 428.646326][ T5711] usb 5-1: Using ep0 maxpacket: 16 [ 428.647243][ T7691] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 428.648749][ T5711] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 428.650977][ T5711] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 428.650992][ T5711] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.651021][ T5711] usb 5-1: Product: syz [ 428.651028][ T5711] usb 5-1: Manufacturer: syz [ 428.651035][ T5711] usb 5-1: SerialNumber: syz [ 428.675351][ T5711] usb 5-1: config 0 descriptor?? [ 428.944878][ T7691] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 428.967488][ T5613] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 428.986389][ T7691] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 429.009295][ T1509] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.049352][ T5613] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 429.089794][ T5613] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 429.107915][ T5613] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 429.109371][ T5613] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 429.167724][ T5711] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 429.334779][ T5711] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 429.334820][ T5711] usb 2-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 429.334840][ T5711] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.425594][ T5711] usb 2-1: config 0 descriptor?? [ 429.506096][ T5711] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 429.671882][ T8162] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 429.810393][ T4917] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 429.844553][ T4917] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 429.847421][ T4917] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 429.849559][ T4917] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 429.850704][ T4917] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 429.911513][ T5724] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 430.108758][ T5724] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 430.108808][ T5724] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 430.108847][ T5724] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 430.108867][ T5724] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.166713][ T5724] usb 8-1: config 0 descriptor?? [ 430.365565][ T5711] usb 5-1: USB disconnect, device number 16 [ 430.397198][ T8159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.397860][ T8159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.233514][ T5724] ath6kl: Failed to submit usb control message: -110 [ 431.233636][ T5724] ath6kl: unable to send the bmi data to the device: -110 [ 431.233651][ T5724] ath6kl: Unable to send get target info: -110 [ 431.271753][ T5724] ath6kl: Failed to init ath6kl core: -110 [ 431.272331][ T5724] ath6kl_usb 8-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 431.551507][ T5613] Bluetooth: hci0: command 0x0c20 tx timeout [ 431.671531][ T8157] Bluetooth: hci0: Opcode 0x0c20 failed: -110 [ 432.256621][ T8145] wg1 speed is unknown, defaulting to 1000 [ 432.466261][ T5613] Bluetooth: hci3: command tx timeout [ 432.470396][ T5613] Bluetooth: hci1: command tx timeout [ 432.514959][ T5612] usb 2-1: USB disconnect, device number 14 [ 432.554129][ T5725] usb 8-1: USB disconnect, device number 15 [ 434.511754][ T5613] Bluetooth: hci1: command tx timeout [ 434.511786][ T5613] Bluetooth: hci3: command tx timeout [ 434.592209][ T8163] wg1 speed is unknown, defaulting to 1000 [ 436.591500][ T4917] Bluetooth: hci3: command tx timeout [ 436.591531][ T4917] Bluetooth: hci1: command tx timeout [ 438.631543][ T1509] batman_adv: batadv0: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 438.672175][ T5613] Bluetooth: hci1: command tx timeout [ 438.673790][ T4917] Bluetooth: hci3: command tx timeout [ 439.024477][ T8145] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.175793][ T8145] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.177047][ T8145] bridge_slave_0: entered allmulticast mode [ 439.326031][ T8145] bridge_slave_0: entered promiscuous mode [ 440.215977][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.216043][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.484205][ T8145] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.484921][ T8145] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.485108][ T8145] bridge_slave_1: entered allmulticast mode [ 440.526221][ T8145] bridge_slave_1: entered promiscuous mode [ 440.654245][ T8145] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 440.697154][ T8145] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 441.571015][ T5711] IPVS: starting estimator thread 0... [ 441.785217][ T8246] IPVS: using max 8 ests per chain, 19200 per kthread [ 441.916537][ T8163] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.916664][ T8163] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.916903][ T8163] bridge_slave_0: entered allmulticast mode [ 441.919633][ T8163] bridge_slave_0: entered promiscuous mode [ 442.006477][ T8145] team0: Port device team_slave_0 added [ 442.009320][ T8163] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.009439][ T8163] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.009695][ T8163] bridge_slave_1: entered allmulticast mode [ 442.013171][ T8163] bridge_slave_1: entered promiscuous mode [ 442.044660][ T8145] team0: Port device team_slave_1 added [ 442.515181][ T8163] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 442.518722][ T8145] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 442.518737][ T8145] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 442.518759][ T8145] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 442.561206][ T8163] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 442.564144][ T8145] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 442.564158][ T8145] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 442.564181][ T8145] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 442.771642][ T1175] bridge_slave_1: left allmulticast mode [ 442.771677][ T1175] bridge_slave_1: left promiscuous mode [ 442.771922][ T1175] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.532627][ T1175] bridge_slave_0: left allmulticast mode [ 446.532650][ T1175] bridge_slave_0: left promiscuous mode [ 446.532811][ T1175] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.233564][ T1175] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.365211][ T1175] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.466350][ T1175] bond0 (unregistering): Released all slaves [ 447.497999][ T8163] team0: Port device team_slave_0 added [ 447.655718][ T8163] team0: Port device team_slave_1 added [ 447.835154][ T8145] hsr_slave_0: entered promiscuous mode [ 447.836002][ T8145] hsr_slave_1: entered promiscuous mode [ 447.836543][ T8145] debugfs: 'hsr0' already exists in 'hsr' [ 447.836559][ T8145] Cannot create hsr debugfs directory [ 447.837532][ T8163] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 447.837543][ T8163] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 447.837562][ T8163] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 447.863427][ T8163] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 447.863441][ T8163] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 447.863464][ T8163] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 448.059386][ T8163] hsr_slave_0: entered promiscuous mode [ 448.067495][ T8163] hsr_slave_1: entered promiscuous mode [ 448.070486][ T8163] debugfs: 'hsr0' already exists in 'hsr' [ 448.070512][ T8163] Cannot create hsr debugfs directory [ 448.372205][ T8284] trusted_key: syz.4.478 sent an empty control message without MSG_MORE. [ 448.621588][ T1175] hsr_slave_0: left promiscuous mode [ 448.663790][ T1175] hsr_slave_1: left promiscuous mode [ 448.664778][ T1175] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 448.712489][ T1175] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 450.673938][ T1175] team0 (unregistering): Port device team_slave_1 removed [ 452.343742][ T1175] team0 (unregistering): Port device team_slave_0 removed [ 452.858755][ T8307] process 'syz.4.484' launched './file0' with NULL argv: empty string added [ 453.148202][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 456.277523][ T8317] Invalid logical block size (8192) [ 456.918040][ T8331] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 457.029389][ T8312] syz.7.486 (8312) used greatest stack depth: 16640 bytes left [ 460.369479][ T5262] 8021q: adding VLAN 0 to HW filter on device eth6 [ 462.087979][ T8389] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 466.529524][ T8391] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 466.529549][ T8391] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 466.529559][ T8391] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 468.691522][ T5732] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 469.509831][ T5732] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 469.509860][ T5732] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.509877][ T5732] usb 5-1: Product: syz [ 469.509889][ T5732] usb 5-1: Manufacturer: syz [ 469.509902][ T5732] usb 5-1: SerialNumber: syz [ 469.723253][ T36] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 469.846507][ T5732] rtl8150 5-1:1.0: couldn't reset the device [ 469.846871][ T5732] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 469.891439][ T36] usb 8-1: Using ep0 maxpacket: 8 [ 469.894080][ T36] usb 8-1: unable to get BOS descriptor or descriptor too short [ 469.895458][ T36] usb 8-1: config 4 has an invalid interface number: 203 but max is 0 [ 469.895480][ T36] usb 8-1: config 4 has no interface number 0 [ 469.895509][ T36] usb 8-1: config 4 interface 203 has no altsetting 0 [ 469.898896][ T36] usb 8-1: New USB device found, idVendor=2912, idProduct=0001, bcdDevice=f3.d0 [ 469.898922][ T36] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.898939][ T36] usb 8-1: Product: syz [ 469.898952][ T36] usb 8-1: Manufacturer: syz [ 469.898965][ T36] usb 8-1: SerialNumber: syz [ 469.971479][ T5732] usb 5-1: USB disconnect, device number 17 [ 470.040809][ T8439] netlink: 'syz.1.507': attribute type 1 has an invalid length. [ 470.249432][ T8442] bond4: (slave gretap1): making interface the new active one [ 470.377065][ T8442] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 470.641219][ T8439] macvlan5: entered promiscuous mode [ 470.641242][ T8439] macvlan5: entered allmulticast mode [ 470.644357][ T8439] bond4: entered promiscuous mode [ 470.644378][ T8439] gretap1: entered promiscuous mode [ 470.658246][ T8439] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 470.659128][ T8439] bond4: (slave macvlan5): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 470.664498][ T8439] bond4: left promiscuous mode [ 470.664517][ T8439] gretap1: left promiscuous mode [ 470.892021][ T8448] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 471.576356][ T36] cdc_acm 8-1:4.203: More than one union descriptor, skipping ... [ 471.581186][ T36] usb 8-1: USB disconnect, device number 16 [ 471.922384][ T1175] bridge_slave_1: left allmulticast mode [ 471.977382][ T1175] bridge_slave_1: left promiscuous mode [ 472.070774][ T1175] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.403708][ T1175] bridge_slave_0: left allmulticast mode [ 472.403742][ T1175] bridge_slave_0: left promiscuous mode [ 472.404033][ T1175] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.861893][ T5725] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 475.156304][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 475.156719][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 475.157386][ T5725] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 475.157533][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.503607][ T5725] usb 5-1: config 0 descriptor?? [ 475.604429][ T5725] usbhid 5-1:0.0: can't add hid device: -71 [ 475.604541][ T5725] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 475.656349][ T5725] usb 5-1: USB disconnect, device number 18 [ 476.072157][ T1175] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.204120][ T1175] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 477.923397][ T1175] bond0 (unregistering): Released all slaves [ 479.180617][ T6642] IPVS: starting estimator thread 0... [ 479.281605][ T8484] IPVS: using max 15 ests per chain, 36000 per kthread [ 479.753027][ T36] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 480.083027][ T36] usb 5-1: Using ep0 maxpacket: 8 [ 480.149507][ T36] usb 5-1: unable to get BOS descriptor or descriptor too short [ 480.150952][ T36] usb 5-1: config 4 has an invalid interface number: 203 but max is 0 [ 480.150974][ T36] usb 5-1: config 4 has no interface number 0 [ 480.151002][ T36] usb 5-1: config 4 interface 203 has no altsetting 0 [ 480.199698][ T36] usb 5-1: New USB device found, idVendor=2912, idProduct=0001, bcdDevice=f3.d0 [ 480.199715][ T36] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.199724][ T36] usb 5-1: Product: syz [ 480.199731][ T36] usb 5-1: Manufacturer: syz [ 480.199738][ T36] usb 5-1: SerialNumber: syz [ 480.671643][ T1175] hsr_slave_0: left promiscuous mode [ 480.913611][ T1175] hsr_slave_1: left promiscuous mode [ 480.920964][ T1175] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 481.070735][ T1175] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.232517][ T5725] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 482.233077][ C0] raw-gadget.1 gadget.1: ignoring, device is not running [ 482.585154][ T5725] usb 2-1: device descriptor read/64, error -32 [ 482.952037][ T5725] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 482.952521][ C0] raw-gadget.1 gadget.1: ignoring, device is not running [ 483.162022][ T5725] usb 2-1: device descriptor read/64, error -32 [ 483.357654][ T5725] usb usb2-port1: attempt power cycle [ 483.392726][ T36] cdc_acm 5-1:4.203: More than one union descriptor, skipping ... [ 483.681557][ T36] usb 5-1: USB disconnect, device number 19 [ 483.892713][ T5725] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 483.957800][ T5725] usb 2-1: device descriptor read/8, error -71 [ 484.492341][ T1175] team0 (unregistering): Port device team_slave_1 removed [ 485.414506][ T1175] team0 (unregistering): Port device team_slave_0 removed [ 486.144500][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 489.721524][ T820] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 490.112392][ T820] usb 5-1: Using ep0 maxpacket: 8 [ 490.250265][ T820] usb 5-1: device descriptor read/all, error -71 [ 492.295192][ T4917] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 492.366472][ T4917] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 492.369152][ T4917] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 492.426408][ T4917] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 492.452969][ T4917] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 492.591511][ T820] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 492.796040][ T820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 492.796072][ T820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 492.796109][ T820] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 492.796129][ T820] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.884570][ T820] usb 5-1: config 0 descriptor?? [ 493.114219][ T5613] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 493.190757][ T5613] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 493.203597][ T5613] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 493.219591][ T5613] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 493.234133][ T5613] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 493.720832][ T820] usbhid 5-1:0.0: can't add hid device: -71 [ 493.720935][ T820] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 493.754575][ T820] usb 5-1: USB disconnect, device number 22 [ 494.039309][ T8145] netdevsim netdevsim6: probe with driver netdevsim failed with error -12 [ 494.594851][ T4917] Bluetooth: hci2: command tx timeout [ 495.446980][ T5613] Bluetooth: hci5: command tx timeout [ 496.841488][ T5613] Bluetooth: hci2: command tx timeout [ 497.471542][ T4917] Bluetooth: hci5: command tx timeout [ 498.922362][ T4917] Bluetooth: hci2: command tx timeout [ 499.551534][ T4917] Bluetooth: hci5: command tx timeout [ 500.991648][ T4917] Bluetooth: hci2: command tx timeout [ 501.637632][ T4917] Bluetooth: hci5: command tx timeout [ 501.857145][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.857214][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.588864][ T8636] (syz.7.544,8636,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 502.588892][ T8636] (syz.7.544,8636,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 504.875672][ T8639] lo speed is unknown, defaulting to 1000 [ 505.734130][ T66] bridge_slave_1: left allmulticast mode [ 505.734162][ T66] bridge_slave_1: left promiscuous mode [ 505.734397][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.894546][ T66] bridge_slave_0: left allmulticast mode [ 505.894608][ T66] bridge_slave_0: left promiscuous mode [ 505.894983][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.091480][ T36] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 506.262412][ T36] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 506.262440][ T36] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 506.262464][ T36] usb 8-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 506.262475][ T36] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.287874][ T36] usb 8-1: config 0 descriptor?? [ 506.665093][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 507.694041][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 507.716689][ T36] usbhid 8-1:0.0: can't add hid device: -71 [ 507.732957][ T36] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 507.735393][ T36] usb 8-1: USB disconnect, device number 17 [ 507.774783][ T66] bond0 (unregistering): Released all slaves [ 507.812086][ T8639] lo speed is unknown, defaulting to 1000 [ 507.839911][ T8555] wg1 speed is unknown, defaulting to 1000 [ 507.840502][ T8639] lo speed is unknown, defaulting to 1000 [ 507.947929][ T8565] wg1 speed is unknown, defaulting to 1000 [ 507.959486][ T8639] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 507.959509][ T8639] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 507.959528][ T8639] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 508.075923][ T8639] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 508.458891][ T8639] lo speed is unknown, defaulting to 1000 [ 508.479857][ T8639] lo speed is unknown, defaulting to 1000 [ 508.495422][ T8639] lo speed is unknown, defaulting to 1000 [ 508.498241][ T8639] lo speed is unknown, defaulting to 1000 [ 508.739916][ T8639] lo speed is unknown, defaulting to 1000 [ 508.764242][ T8639] lo speed is unknown, defaulting to 1000 [ 510.509563][ T8639] lo speed is unknown, defaulting to 1000 [ 510.525157][ T8639] lo speed is unknown, defaulting to 1000 [ 510.530966][ T8639] lo speed is unknown, defaulting to 1000 [ 512.331564][ T66] hsr_slave_0: left promiscuous mode [ 512.372987][ T66] hsr_slave_1: left promiscuous mode [ 512.373996][ T66] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 512.564440][ T66] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 515.041683][ T36] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 515.202171][ T36] usb 5-1: Using ep0 maxpacket: 16 [ 515.208957][ T36] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 515.208976][ T36] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 515.211266][ T36] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 515.211281][ T36] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.211396][ T36] usb 5-1: Product: syz [ 515.211408][ T36] usb 5-1: Manufacturer: syz [ 515.211420][ T36] usb 5-1: SerialNumber: syz [ 515.282363][ T36] usb 5-1: config 0 descriptor?? [ 515.347064][ T36] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 515.347097][ T36] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 515.532331][ T66] team0 (unregistering): Port device team_slave_1 removed [ 515.602406][ T66] team0 (unregistering): Port device team_slave_0 removed [ 515.912860][ T36] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 515.914006][ T36] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 516.117794][ T36] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 516.117816][ T36] em28xx 5-1:0.0: No AC97 audio processor [ 516.925699][ T8555] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.925850][ T8555] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.926054][ T8555] bridge_slave_0: entered allmulticast mode [ 516.978671][ T8555] bridge_slave_0: entered promiscuous mode [ 517.013557][ T8555] bridge0: port 2(bridge_slave_1) entered blocking state [ 517.013665][ T8555] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.013870][ T8555] bridge_slave_1: entered allmulticast mode [ 517.016082][ T8555] bridge_slave_1: entered promiscuous mode [ 517.185164][ T36] usb 5-1: USB disconnect, device number 23 [ 517.189409][ T36] em28xx 5-1:0.0: Disconnecting em28xx [ 517.246786][ T8555] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 517.251196][ T8565] bridge0: port 1(bridge_slave_0) entered blocking state [ 517.253187][ T8565] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.253462][ T8565] bridge_slave_0: entered allmulticast mode [ 517.259575][ T8565] bridge_slave_0: entered promiscuous mode [ 517.306171][ T8555] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 517.306844][ T8565] bridge0: port 2(bridge_slave_1) entered blocking state [ 517.307073][ T8565] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.307248][ T8565] bridge_slave_1: entered allmulticast mode [ 517.322918][ T8565] bridge_slave_1: entered promiscuous mode [ 517.486339][ T36] em28xx 5-1:0.0: Freeing device [ 517.808221][ T8555] team0: Port device team_slave_0 added [ 517.831108][ T8565] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 517.850209][ T8555] team0: Port device team_slave_1 added [ 517.863564][ T8565] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 517.969403][ T8565] team0: Port device team_slave_0 added [ 517.985747][ T8555] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 517.985763][ T8555] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 517.985785][ T8555] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 518.038917][ T8565] team0: Port device team_slave_1 added [ 518.039851][ T8555] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 518.039864][ T8555] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 518.039885][ T8555] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 518.378245][ T8565] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 518.378262][ T8565] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 518.378286][ T8565] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 519.271615][ T66] bridge_slave_1: left allmulticast mode [ 519.271648][ T66] bridge_slave_1: left promiscuous mode [ 519.271887][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.353096][ T66] bridge_slave_0: left allmulticast mode [ 519.353132][ T66] bridge_slave_0: left promiscuous mode [ 519.353392][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.483080][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 521.553194][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 521.593491][ T66] bond0 (unregistering): Released all slaves [ 521.729132][ T8565] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 521.729148][ T8565] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 521.729172][ T8565] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 523.614883][ T8555] hsr_slave_0: entered promiscuous mode [ 523.617901][ T8555] hsr_slave_1: entered promiscuous mode [ 523.619979][ T8555] debugfs: 'hsr0' already exists in 'hsr' [ 523.620003][ T8555] Cannot create hsr debugfs directory [ 523.931510][ T66] hsr_slave_0: left promiscuous mode [ 523.971441][ T66] hsr_slave_1: left promiscuous mode [ 523.973393][ T66] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 524.014116][ T66] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 524.941609][ T5839] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 524.942742][ T66] team0 (unregistering): Port device team_slave_1 removed [ 525.002760][ T66] team0 (unregistering): Port device team_slave_0 removed [ 525.091398][ T5839] usb 5-1: Using ep0 maxpacket: 16 [ 525.098688][ T5839] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 525.098720][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 525.102402][ T5839] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 525.102428][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.102446][ T5839] usb 5-1: Product: syz [ 525.102458][ T5839] usb 5-1: Manufacturer: syz [ 525.102470][ T5839] usb 5-1: SerialNumber: syz [ 525.116178][ T5839] usb 5-1: config 0 descriptor?? [ 525.130356][ T5839] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 525.130387][ T5839] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 525.567281][ T8565] hsr_slave_0: entered promiscuous mode [ 525.568219][ T8565] hsr_slave_1: entered promiscuous mode [ 525.570345][ T8565] debugfs: 'hsr0' already exists in 'hsr' [ 525.570364][ T8565] Cannot create hsr debugfs directory [ 525.741210][ T5839] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 525.743913][ T5839] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 525.963203][ T5839] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 525.963225][ T5839] em28xx 5-1:0.0: No AC97 audio processor [ 528.117524][ T36] usb 5-1: USB disconnect, device number 24 [ 528.120280][ T36] em28xx 5-1:0.0: Disconnecting em28xx [ 528.433878][ T36] em28xx 5-1:0.0: Freeing device [ 528.747984][ T8785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.579'. [ 528.748019][ T8785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.579'. [ 528.868397][ T8555] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 528.908743][ T8555] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 528.920256][ T8555] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 528.966152][ T8555] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 529.002447][ T8555] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 529.057983][ T8555] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 529.416811][ T8555] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 529.445269][ T8555] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 530.056690][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.7.584'. [ 530.076347][ T1175] netdevsim netdevsim7 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.076854][ T1175] netdevsim netdevsim7 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.076893][ T1175] netdevsim netdevsim7 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.076925][ T1175] netdevsim netdevsim7 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.136813][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.7.584'. [ 530.147531][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.7.584'. [ 533.672629][ T8565] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 533.714801][ T8565] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 533.718301][ T8565] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 533.766324][ T8565] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 533.799552][ T8565] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 533.834349][ T8565] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 533.849145][ T8565] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 533.937406][ T8565] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 533.960898][ T8555] 8021q: adding VLAN 0 to HW filter on device bond0 [ 535.301668][ T8555] 8021q: adding VLAN 0 to HW filter on device team0 [ 535.321006][ T1509] bridge0: port 1(bridge_slave_0) entered blocking state [ 535.321103][ T1509] bridge0: port 1(bridge_slave_0) entered forwarding state [ 535.321584][ T10] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 535.387555][ T1509] bridge0: port 2(bridge_slave_1) entered blocking state [ 535.387631][ T1509] bridge0: port 2(bridge_slave_1) entered forwarding state [ 535.511868][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 535.513921][ T10] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 535.513939][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 535.515841][ T10] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 535.515865][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.515881][ T10] usb 8-1: Product: syz [ 535.515892][ T10] usb 8-1: Manufacturer: syz [ 535.515903][ T10] usb 8-1: SerialNumber: syz [ 535.615325][ T10] usb 8-1: config 0 descriptor?? [ 535.655667][ T10] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 535.655699][ T10] em28xx 8-1:0.0: Audio interface 0 found (Vendor Class) [ 536.772107][ T10] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 536.772604][ T10] em28xx 8-1:0.0: Config register raw data: 0xfffffffb [ 536.975957][ T10] em28xx 8-1:0.0: AC97 chip type couldn't be determined [ 536.975972][ T10] em28xx 8-1:0.0: No AC97 audio processor [ 537.061121][ T8565] 8021q: adding VLAN 0 to HW filter on device bond0 [ 537.139271][ T8565] 8021q: adding VLAN 0 to HW filter on device team0 [ 537.170842][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 537.171057][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 537.194037][ T8393] bridge0: port 2(bridge_slave_1) entered blocking state [ 537.194252][ T8393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 537.915707][ T8555] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 538.001392][ T10] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 538.043657][ T5839] usb 8-1: USB disconnect, device number 18 [ 538.048894][ T5839] em28xx 8-1:0.0: Disconnecting em28xx [ 538.114320][ T5839] em28xx 8-1:0.0: Freeing device [ 538.151482][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 538.153640][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 538.153664][ T10] usb 5-1: config 0 has no interface number 0 [ 538.153704][ T10] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 538.153726][ T10] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 538.153760][ T10] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 538.153781][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.192872][ T8859] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 538.243622][ T10] usb 5-1: config 0 descriptor?? [ 538.828281][ T8868] netlink: 8 bytes leftover after parsing attributes in process `syz.7.594'. [ 538.834722][ T8868] Cannot find del_set index 14804 as target [ 539.421518][ T10] usbhid 5-1:0.1: can't add hid device: -71 [ 539.421636][ T10] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 539.476874][ T10] usb 5-1: USB disconnect, device number 25 [ 539.506448][ T8565] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 539.613941][ T8555] veth0_vlan: entered promiscuous mode [ 539.630527][ T8555] veth1_vlan: entered promiscuous mode [ 539.773839][ T8555] veth0_macvtap: entered promiscuous mode [ 539.807977][ T8555] veth1_macvtap: entered promiscuous mode [ 539.863460][ T8555] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 539.913856][ T8555] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 540.019016][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.021028][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.039919][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.050902][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.938797][ T3280] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.938816][ T3280] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 542.172993][ T8565] veth0_vlan: entered promiscuous mode [ 543.113225][ T3280] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.113245][ T3280] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.189413][ T8565] veth1_vlan: entered promiscuous mode [ 543.256153][ T8894] smbdirect: ib_dev[syz0] removed [ 543.426881][ T8565] veth0_macvtap: entered promiscuous mode [ 543.442819][ T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 543.481889][ T8565] veth1_macvtap: entered promiscuous mode [ 543.568284][ T8565] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 543.592159][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 543.594669][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 543.594701][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 543.638013][ T9] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 543.638041][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.638059][ T9] usb 5-1: Product: syz [ 543.638072][ T9] usb 5-1: Manufacturer: syz [ 543.638085][ T9] usb 5-1: SerialNumber: syz [ 543.770105][ T8565] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 544.671626][ T9] usb 5-1: config 0 descriptor?? [ 544.764681][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.768575][ T3280] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.769098][ T3280] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.770648][ T3280] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.825618][ T9] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 544.825651][ T9] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 545.249860][ T8908] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 545.374413][ T9] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 545.375594][ T9] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 545.735993][ T9] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 545.736014][ T9] em28xx 5-1:0.0: No AC97 audio processor [ 545.842046][ T8913] netlink: 8 bytes leftover after parsing attributes in process `syz.7.604'. [ 545.845531][ T8913] Cannot find del_set index 14804 as target [ 547.005882][ T31] usb 5-1: USB disconnect, device number 26 [ 547.011005][ T31] em28xx 5-1:0.0: Disconnecting em28xx [ 547.070392][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 547.070412][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 547.167365][ T31] em28xx 5-1:0.0: Freeing device [ 547.228922][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 547.228943][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 549.511610][ T36] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 549.928200][ T36] usb 5-1: Using ep0 maxpacket: 8 [ 550.295283][ T36] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 550.295312][ T36] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 550.295335][ T36] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 550.295356][ T36] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 550.295394][ T36] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 550.295415][ T36] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.600082][ T36] usb 5-1: GET_CAPABILITIES returned 0 [ 550.600110][ T36] usbtmc 5-1:16.0: can't read capabilities [ 550.789193][ T8949] siw: device registration error -23 [ 553.461756][ T8961] netlink: 8 bytes leftover after parsing attributes in process `syz.6.616'. [ 553.467321][ T8961] Cannot find del_set index 14804 as target [ 554.245775][ T36] usb 5-1: USB disconnect, device number 27 [ 554.923551][ T820] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 555.261544][ T820] usb 6-1: Using ep0 maxpacket: 16 [ 555.263876][ T820] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 555.263907][ T820] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 556.173615][ T820] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 556.173644][ T820] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.173661][ T820] usb 6-1: Product: syz [ 556.173673][ T820] usb 6-1: Manufacturer: syz [ 556.173685][ T820] usb 6-1: SerialNumber: syz [ 556.181071][ T820] usb 6-1: config 0 descriptor?? [ 556.222181][ T820] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 556.224271][ T820] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 556.600216][ T820] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 556.608059][ T820] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 556.620479][ T820] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 556.620546][ T820] em28xx 6-1:0.0: No AC97 audio processor [ 557.218476][ T820] usb 6-1: USB disconnect, device number 2 [ 557.221245][ T820] em28xx 6-1:0.0: Disconnecting em28xx [ 557.384050][ T820] em28xx 6-1:0.0: Freeing device [ 563.091063][ T9017] netlink: 8 bytes leftover after parsing attributes in process `syz.5.631'. [ 563.094490][ T9017] Cannot find del_set index 14804 as target [ 563.418629][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.418698][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.420335][ T4917] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 563.420736][ T4917] Bluetooth: hci2: Injecting HCI hardware error event [ 563.438735][ T5613] Bluetooth: hci2: hardware error 0x00 [ 563.991594][ T10] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 564.141942][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 564.148295][ T10] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 564.264597][ T820] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 564.946870][ T820] usb 5-1: Using ep0 maxpacket: 16 [ 564.975303][ T820] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 564.975335][ T820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 564.990165][ T820] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 564.990192][ T820] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.990210][ T820] usb 5-1: Product: syz [ 564.990223][ T820] usb 5-1: Manufacturer: syz [ 564.990235][ T820] usb 5-1: SerialNumber: syz [ 565.048412][ T10] usb 8-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 565.048439][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.048456][ T10] usb 8-1: Product: syz [ 565.048467][ T10] usb 8-1: Manufacturer: syz [ 565.048478][ T10] usb 8-1: SerialNumber: syz [ 565.169631][ T10] usb 8-1: config 0 descriptor?? [ 565.210734][ T820] usb 5-1: config 0 descriptor?? [ 565.381175][ T820] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 565.381209][ T820] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 566.101823][ T5613] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 566.487808][ T820] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 566.488371][ T820] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 566.762824][ T820] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 566.762844][ T820] em28xx 5-1:0.0: No AC97 audio processor [ 567.839741][ T5839] usb 8-1: USB disconnect, device number 19 [ 567.934453][ T820] usb 5-1: USB disconnect, device number 28 [ 567.949908][ T820] em28xx 5-1:0.0: Disconnecting em28xx [ 567.985110][ T820] em28xx 5-1:0.0: Freeing device [ 568.441216][ T9057] netlink: 4 bytes leftover after parsing attributes in process `syz.7.644'. [ 568.690050][ T9057] netlink: 4 bytes leftover after parsing attributes in process `syz.7.644'. [ 568.694080][ T9057] netlink: 4 bytes leftover after parsing attributes in process `syz.7.644'. [ 569.743134][ T9068] siw: device registration error -23 [ 570.751781][ T9075] netlink: 8 bytes leftover after parsing attributes in process `syz.7.646'. [ 570.755432][ T9075] Cannot find del_set index 14804 as target [ 575.161502][ T6642] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 575.341427][ T6642] usb 7-1: Using ep0 maxpacket: 16 [ 575.343123][ T6642] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 575.343151][ T6642] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 575.345289][ T6642] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 575.345314][ T6642] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.345325][ T6642] usb 7-1: Product: syz [ 575.345332][ T6642] usb 7-1: Manufacturer: syz [ 575.345339][ T6642] usb 7-1: SerialNumber: syz [ 575.396227][ T6642] usb 7-1: config 0 descriptor?? [ 575.437897][ T6642] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 575.437917][ T6642] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 576.246908][ T6642] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 576.567681][ T6642] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 576.773706][ T6642] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 576.773726][ T6642] em28xx 7-1:0.0: No AC97 audio processor [ 577.068361][ T9118] siw: device registration error -23 [ 577.909658][ T10] usb 7-1: USB disconnect, device number 2 [ 577.911220][ T10] em28xx 7-1:0.0: Disconnecting em28xx [ 577.962784][ T10] em28xx 7-1:0.0: Freeing device [ 578.118260][ T9122] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 579.210972][ T9131] netlink: 8 bytes leftover after parsing attributes in process `syz.6.662'. [ 579.213956][ T9131] Cannot find del_set index 14804 as target [ 581.596923][ T9140] (syz.4.664,9140,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 581.596952][ T9140] (syz.4.664,9140,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 583.841910][ T9152] syz_tun: entered allmulticast mode [ 584.522244][ T5739] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 584.571523][ T6642] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 584.801395][ T6642] usb 7-1: Using ep0 maxpacket: 16 [ 587.701424][ T5739] usb 5-1: Using ep0 maxpacket: 8 [ 587.754216][ T9174] siw: device registration error -23 [ 587.757245][ T6642] usb 7-1: unable to read config index 0 descriptor/all [ 587.757297][ T6642] usb 7-1: can't read configurations, error -71 [ 587.927407][ T5739] usb 5-1: device descriptor read/all, error -71 [ 589.491750][ T9198] netlink: 8 bytes leftover after parsing attributes in process `syz.5.678'. [ 589.495004][ T9198] Cannot find del_set index 14804 as target [ 592.101558][ T5839] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 592.262441][ T9212] (syz.5.681,9212,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 592.262472][ T9212] (syz.5.681,9212,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 593.381470][ T5839] usb 7-1: Using ep0 maxpacket: 8 [ 595.044512][ T5839] usb 7-1: unable to read config index 0 descriptor/all [ 595.044557][ T5839] usb 7-1: can't read configurations, error -71 [ 599.927603][ T9245] siw: device registration error -23 [ 603.616843][ T9259] netlink: 8 bytes leftover after parsing attributes in process `syz.4.691'. [ 603.901869][ T9259] Cannot find del_set index 14804 as target [ 606.744636][ T9276] netlink: 24 bytes leftover after parsing attributes in process `syz.4.697'. [ 609.464913][ T9287] (syz.5.695,9287,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 609.464944][ T9287] (syz.5.695,9287,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 610.157979][ T9297] siw: device registration error -23 [ 615.944149][ T9324] netlink: 8 bytes leftover after parsing attributes in process `syz.7.707'. [ 615.950998][ T9324] Cannot find del_set index 14804 as target [ 616.512391][ T4917] Bluetooth: hci5: command 0x0406 tx timeout [ 618.713240][ T9341] netlink: 28 bytes leftover after parsing attributes in process `syz.7.714'. [ 620.320414][ T9350] syzkaller0: entered promiscuous mode [ 620.320438][ T9350] syzkaller0: entered allmulticast mode [ 620.376361][ T9350] tipc: Started in network mode [ 620.376390][ T9350] tipc: Node identity becaa718d24, cluster identity 4711 [ 620.376847][ T9350] tipc: Enabled bearer , priority 0 [ 620.414590][ T9349] tipc: Resetting bearer [ 620.441467][ T31] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 620.601531][ T31] usb 7-1: Using ep0 maxpacket: 32 [ 620.615138][ T31] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 620.615163][ T31] usb 7-1: config 0 has no interface number 0 [ 620.615204][ T31] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 620.615227][ T31] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 620.615261][ T31] usb 7-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 620.615281][ T31] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.618381][ T9349] tipc: Disabling bearer [ 620.645999][ T31] usb 7-1: config 0 descriptor?? [ 622.986706][ T31] uclogic 0003:28BD:0094.0004: pen parameters not found [ 622.986742][ T31] uclogic 0003:28BD:0094.0004: interface is invalid, ignoring [ 623.047778][ T31] usb 7-1: USB disconnect, device number 7 [ 624.720913][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.720985][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.078801][ T9391] (syz.1.725,9391,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 626.078820][ T9391] (syz.1.725,9391,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 629.540150][ T9410] syzkaller0: entered promiscuous mode [ 629.540176][ T9410] syzkaller0: entered allmulticast mode [ 629.550504][ T9410] tipc: Started in network mode [ 629.550531][ T9410] tipc: Node identity eeee44151a84, cluster identity 4711 [ 629.551129][ T9410] tipc: Enabled bearer , priority 0 [ 629.601761][ T9409] tipc: Resetting bearer [ 629.843445][ T9409] tipc: Disabling bearer [ 630.411701][ T9415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 632.421295][ T9424] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 636.468954][ T9458] syzkaller0: entered promiscuous mode [ 636.469129][ T9458] syzkaller0: entered allmulticast mode [ 636.692056][ T9459] tipc: Started in network mode [ 636.692084][ T9459] tipc: Node identity 16caf670c24d, cluster identity 4711 [ 636.692651][ T9459] tipc: Enabled bearer , priority 0 [ 636.763727][ T9457] tipc: Resetting bearer [ 637.093841][ T9457] tipc: Disabling bearer [ 637.301797][ T9466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 641.111405][ T9228] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 641.195088][ T9508] syzkaller0: entered promiscuous mode [ 641.195113][ T9508] syzkaller0: entered allmulticast mode [ 641.224979][ T9508] tipc: Enabled bearer , priority 0 [ 641.262762][ T9507] tipc: Resetting bearer [ 641.283827][ T9228] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 641.283851][ T9228] usb 5-1: config 0 has no interface number 0 [ 641.283902][ T9228] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 641.288683][ T9228] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 641.288711][ T9228] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 641.288728][ T9228] usb 5-1: Product: syz [ 641.288740][ T9228] usb 5-1: SerialNumber: syz [ 641.310082][ T9228] usb 5-1: config 0 descriptor?? [ 641.422762][ T9228] cm109 5-1:0.8: invalid payload size 8, expected 4 [ 641.428702][ T9228] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input6 [ 641.614183][ T9507] tipc: Disabling bearer [ 641.788145][ C1] cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71 [ 641.789380][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.789626][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.789864][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.790089][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.792776][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.793006][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.793212][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.793447][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.793669][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 641.793956][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 642.225603][ T9228] usb 5-1: USB disconnect, device number 31 [ 642.225732][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 642.273779][ T9228] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 648.691622][ T9556] ================================================================== [ 648.691636][ T9556] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60 [ 648.691657][ T9556] Read of size 1 at addr ffff88801af0e418 by task syz.5.778/9556 [ 648.691667][ T9556] [ 648.691686][ T9556] CPU: 0 UID: 0 PID: 9556 Comm: syz.5.778 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 648.691702][ T9556] Tainted: [L]=SOFTLOCKUP [ 648.691705][ T9556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 648.691715][ T9556] Call Trace: [ 648.691720][ T9556] [ 648.691725][ T9556] dump_stack_lvl+0xe8/0x150 [ 648.691739][ T9556] print_address_description+0x55/0x1e0 [ 648.691751][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.691762][ T9556] print_report+0x58/0x70 [ 648.691772][ T9556] kasan_report+0x117/0x150 [ 648.691784][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.691797][ T9556] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 648.691807][ T9556] __kasan_check_byte+0x2a/0x40 [ 648.691817][ T9556] lock_acquire+0x84/0x350 [ 648.691829][ T9556] ? preempt_schedule_thunk+0x16/0x30 [ 648.691843][ T9556] ? rcu_is_watching+0x15/0xb0 [ 648.691857][ T9556] _raw_spin_lock_irqsave+0x40/0x60 [ 648.691868][ T9556] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 648.691878][ T9556] rt_mutex_slowunlock+0xbf/0x8b0 [ 648.691887][ T9556] ? reacquire_held_locks+0x104/0x190 [ 648.691900][ T9556] ? rt_spin_lock+0x1e0/0x400 [ 648.691910][ T9556] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 648.691920][ T9556] ? rt_spin_unlock+0x14f/0x200 [ 648.691930][ T9556] ? rt_spin_unlock+0x160/0x200 [ 648.691940][ T9556] kbd_event+0x2f91/0x42f0 [ 648.691954][ T9556] ? __pfx_kbd_event+0x10/0x10 [ 648.691966][ T9556] ? try_to_take_rt_mutex+0x840/0xb00 [ 648.691978][ T9556] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 648.691990][ T9556] ? __lock_acquire+0x6b5/0x2cf0 [ 648.692004][ T9556] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 648.692015][ T9556] ? input_pass_values+0x8d/0x890 [ 648.692031][ T9556] input_handle_events_default+0xd4/0x1a0 [ 648.692042][ T9556] ? input_pass_values+0x8d/0x890 [ 648.692054][ T9556] input_pass_values+0x288/0x890 [ 648.692068][ T9556] ? input_handle_event+0x70c/0xf30 [ 648.692079][ T9556] input_event_dispose+0x330/0x6b0 [ 648.692092][ T9556] input_inject_event+0x1d7/0x320 [ 648.692104][ T9556] ? input_inject_event+0xb0/0x320 [ 648.692118][ T9556] evdev_write+0x328/0x4c0 [ 648.692131][ T9556] ? __lock_acquire+0x6b5/0x2cf0 [ 648.692144][ T9556] ? __pfx_evdev_write+0x10/0x10 [ 648.692158][ T9556] ? rw_verify_area+0x25b/0x4e0 [ 648.692168][ T9556] ? __pfx_evdev_write+0x10/0x10 [ 648.692182][ T9556] vfs_write+0x2a3/0xba0 [ 648.692193][ T9556] ? __pfx_vfs_write+0x10/0x10 [ 648.692203][ T9556] ? __fget_files+0x2a/0x420 [ 648.692213][ T9556] ? __fget_files+0x2a/0x420 [ 648.692220][ T9556] ? __fget_files+0x3a6/0x420 [ 648.692228][ T9556] ? __fget_files+0x2a/0x420 [ 648.692238][ T9556] ksys_write+0x156/0x270 [ 648.692248][ T9556] ? __pfx_ksys_write+0x10/0x10 [ 648.692260][ T9556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.692270][ T9556] do_syscall_64+0x15f/0xf80 [ 648.692282][ T9556] ? trace_irq_disable+0x3b/0x140 [ 648.692293][ T9556] ? clear_bhb_loop+0x40/0x90 [ 648.692303][ T9556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.692316][ T9556] RIP: 0033:0x7f6b1485ce59 [ 648.692330][ T9556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.692338][ T9556] RSP: 002b:00007f6b12aae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 648.692355][ T9556] RAX: ffffffffffffffda RBX: 00007f6b14ad5fa0 RCX: 00007f6b1485ce59 [ 648.692369][ T9556] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000009 [ 648.692376][ T9556] RBP: 00007f6b148f2d6f R08: 0000000000000000 R09: 0000000000000000 [ 648.692382][ T9556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 648.692388][ T9556] R13: 00007f6b14ad6038 R14: 00007f6b14ad5fa0 R15: 00007ffd83f540e8 [ 648.692400][ T9556] [ 648.692403][ T9556] [ 648.692408][ T9556] Allocated by task 9556: [ 648.692417][ T9556] kasan_save_track+0x3e/0x80 [ 648.692426][ T9556] __kasan_kmalloc+0x93/0xb0 [ 648.692434][ T9556] __kmalloc_cache_noprof+0x3a6/0x690 [ 648.692445][ T9556] alloc_tty_struct+0xa6/0x7b0 [ 648.692456][ T9556] tty_init_dev+0x59/0x4d0 [ 648.692469][ T9556] tty_open+0x86e/0xd80 [ 648.692485][ T9556] chrdev_open+0x4d0/0x5f0 [ 648.692502][ T9556] do_dentry_open+0x83d/0x13e0 [ 648.692520][ T9556] vfs_open+0x3b/0x350 [ 648.692538][ T9556] path_openat+0x2e43/0x38a0 [ 648.692553][ T9556] do_file_open+0x23e/0x4a0 [ 648.692568][ T9556] do_sys_openat2+0x113/0x200 [ 648.692587][ T9556] __x64_sys_openat+0x138/0x170 [ 648.692606][ T9556] do_syscall_64+0x15f/0xf80 [ 648.692624][ T9556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.692640][ T9556] [ 648.692644][ T9556] Freed by task 5739: [ 648.692651][ T9556] kasan_save_track+0x3e/0x80 [ 648.692661][ T9556] kasan_save_free_info+0x46/0x50 [ 648.692674][ T9556] __kasan_slab_free+0x5c/0x80 [ 648.692682][ T9556] kfree+0x1c5/0x6c0 [ 648.692691][ T9556] process_scheduled_works+0xb5d/0x1860 [ 648.692700][ T9556] worker_thread+0xa53/0xfc0 [ 648.692709][ T9556] kthread+0x388/0x470 [ 648.692720][ T9556] ret_from_fork+0x514/0xb70 [ 648.692730][ T9556] ret_from_fork_asm+0x1a/0x30 [ 648.692740][ T9556] [ 648.692743][ T9556] Last potentially related work creation: [ 648.692746][ T9556] kasan_save_stack+0x3e/0x60 [ 648.692754][ T9556] kasan_record_aux_stack+0xbd/0xd0 [ 648.692765][ T9556] insert_work+0x3d/0x330 [ 648.692772][ T9556] __queue_work+0xd1d/0x1090 [ 648.692782][ T9556] queue_work_on+0x106/0x1d0 [ 648.692790][ T9556] tty_release_struct+0xb8/0xd0 [ 648.692799][ T9556] tty_release+0xcb6/0x1710 [ 648.692808][ T9556] __fput+0x461/0xa70 [ 648.692820][ T9556] task_work_run+0x1d9/0x270 [ 648.692831][ T9556] exit_to_user_mode_loop+0xf3/0x4d0 [ 648.692842][ T9556] do_syscall_64+0x33e/0xf80 [ 648.692852][ T9556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.692861][ T9556] [ 648.692863][ T9556] The buggy address belongs to the object at ffff88801af0e000 [ 648.692863][ T9556] which belongs to the cache kmalloc-cg-2k of size 2048 [ 648.692871][ T9556] The buggy address is located 1048 bytes inside of [ 648.692871][ T9556] freed 2048-byte region [ffff88801af0e000, ffff88801af0e800) [ 648.692881][ T9556] [ 648.692884][ T9556] The buggy address belongs to the physical page: [ 648.692899][ T9556] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801af0b000 pfn:0x1af08 [ 648.692910][ T9556] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 648.692918][ T9556] memcg:ffff88801af08811 [ 648.692922][ T9556] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 648.692935][ T9556] page_type: f5(slab) [ 648.692944][ T9556] raw: 0080000000000240 ffff88801a0293c0 ffffea0000e71e10 ffffea0000ed7010 [ 648.692952][ T9556] raw: ffff88801af0b000 0000100000080005 00000000f5000000 ffff88801af08811 [ 648.692960][ T9556] head: 0080000000000240 ffff88801a0293c0 ffffea0000e71e10 ffffea0000ed7010 [ 648.692968][ T9556] head: ffff88801af0b000 0000100000080005 00000000f5000000 ffff88801af08811 [ 648.692977][ T9556] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 648.692984][ T9556] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 648.692990][ T9556] page dumped because: kasan: bad access detected [ 648.692998][ T9556] page_owner tracks the page as allocated [ 648.693002][ T9556] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7208, tgid 7208 (syz-executor), ts 343199812355, free_ts 343023810539 [ 648.693019][ T9556] post_alloc_hook+0x231/0x280 [ 648.693029][ T9556] get_page_from_freelist+0x27c8/0x2840 [ 648.693041][ T9556] __alloc_frozen_pages_noprof+0x18d/0x380 [ 648.693051][ T9556] allocate_slab+0x77/0x660 [ 648.693063][ T9556] refill_objects+0x33c/0x3d0 [ 648.693075][ T9556] __pcs_replace_empty_main+0x373/0x720 [ 648.693087][ T9556] __kmalloc_noprof+0x530/0x7b0 [ 648.693095][ T9556] __register_sysctl_table+0x72/0x1340 [ 648.693104][ T9556] __devinet_sysctl_register+0x386/0x490 [ 648.693118][ T9556] devinet_sysctl_register+0x187/0x200 [ 648.693127][ T9556] inetdev_init+0x2a4/0x4e0 [ 648.693136][ T9556] inetdev_event+0x30d/0x1610 [ 648.693146][ T9556] notifier_call_chain+0x1ad/0x3d0 [ 648.693158][ T9556] register_netdevice+0x18d5/0x1ed0 [ 648.693171][ T9556] macvlan_common_newlink+0x12af/0x1a40 [ 648.693181][ T9556] rtnl_newlink_create+0x329/0xb70 [ 648.693191][ T9556] page last free pid 5834 tgid 5834 stack trace: [ 648.693197][ T9556] __free_frozen_pages+0xfa6/0x10f0 [ 648.693206][ T9556] __slab_free+0x252/0x2a0 [ 648.693215][ T9556] qlist_free_all+0x99/0x100 [ 648.693222][ T9556] kasan_quarantine_reduce+0x148/0x160 [ 648.693230][ T9556] __kasan_slab_alloc+0x22/0x80 [ 648.693239][ T9556] kmem_cache_alloc_noprof+0x33b/0x680 [ 648.693247][ T9556] do_getname+0x2e/0x250 [ 648.693258][ T9556] vfs_fstatat+0x45/0x170 [ 648.693269][ T9556] __x64_sys_newfstatat+0x151/0x200 [ 648.693281][ T9556] do_syscall_64+0x15f/0xf80 [ 648.693291][ T9556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.693300][ T9556] [ 648.693303][ T9556] Memory state around the buggy address: [ 648.693308][ T9556] ffff88801af0e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 648.693314][ T9556] ffff88801af0e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 648.693320][ T9556] >ffff88801af0e400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 648.693325][ T9556] ^ [ 648.693330][ T9556] ffff88801af0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 648.693336][ T9556] ffff88801af0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 648.693340][ T9556] ================================================================== [ 648.693350][ T9556] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 648.693368][ T9556] CPU: 0 UID: 0 PID: 9556 Comm: syz.5.778 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 648.693383][ T9556] Tainted: [L]=SOFTLOCKUP [ 648.693386][ T9556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 648.693392][ T9556] Call Trace: [ 648.693396][ T9556] [ 648.693401][ T9556] vpanic+0x56c/0xa60 [ 648.693414][ T9556] ? __pfx_vpanic+0x10/0x10 [ 648.693427][ T9556] panic+0xc5/0xd0 [ 648.693439][ T9556] ? __pfx_panic+0x10/0x10 [ 648.693451][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.693463][ T9556] ? rcu_is_watching+0x15/0xb0 [ 648.693478][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.693490][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.693501][ T9556] check_panic_on_warn+0x89/0xb0 [ 648.693514][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.693525][ T9556] end_report+0x73/0x170 [ 648.693535][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.693546][ T9556] kasan_report+0x128/0x150 [ 648.693557][ T9556] ? _raw_spin_lock_irqsave+0x40/0x60 [ 648.693569][ T9556] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 648.693579][ T9556] __kasan_check_byte+0x2a/0x40 [ 648.693589][ T9556] lock_acquire+0x84/0x350 [ 648.693601][ T9556] ? preempt_schedule_thunk+0x16/0x30 [ 648.693615][ T9556] ? rcu_is_watching+0x15/0xb0 [ 648.693628][ T9556] _raw_spin_lock_irqsave+0x40/0x60 [ 648.693642][ T9556] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 648.693657][ T9556] rt_mutex_slowunlock+0xbf/0x8b0 [ 648.693672][ T9556] ? reacquire_held_locks+0x104/0x190 [ 648.693694][ T9556] ? rt_spin_lock+0x1e0/0x400 [ 648.693712][ T9556] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 648.693730][ T9556] ? rt_spin_unlock+0x14f/0x200 [ 648.693747][ T9556] ? rt_spin_unlock+0x160/0x200 [ 648.693764][ T9556] kbd_event+0x2f91/0x42f0 [ 648.693789][ T9556] ? __pfx_kbd_event+0x10/0x10 [ 648.693811][ T9556] ? try_to_take_rt_mutex+0x840/0xb00 [ 648.693829][ T9556] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 648.693843][ T9556] ? __lock_acquire+0x6b5/0x2cf0 [ 648.693857][ T9556] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 648.693870][ T9556] ? input_pass_values+0x8d/0x890 [ 648.693885][ T9556] input_handle_events_default+0xd4/0x1a0 [ 648.693896][ T9556] ? input_pass_values+0x8d/0x890 [ 648.693908][ T9556] input_pass_values+0x288/0x890 [ 648.693923][ T9556] ? input_handle_event+0x70c/0xf30 [ 648.693934][ T9556] input_event_dispose+0x330/0x6b0 [ 648.693946][ T9556] input_inject_event+0x1d7/0x320 [ 648.693959][ T9556] ? input_inject_event+0xb0/0x320 [ 648.693970][ T9556] evdev_write+0x328/0x4c0 [ 648.693983][ T9556] ? __lock_acquire+0x6b5/0x2cf0 [ 648.693996][ T9556] ? __pfx_evdev_write+0x10/0x10 [ 648.694011][ T9556] ? rw_verify_area+0x25b/0x4e0 [ 648.694021][ T9556] ? __pfx_evdev_write+0x10/0x10 [ 648.694034][ T9556] vfs_write+0x2a3/0xba0 [ 648.694046][ T9556] ? __pfx_vfs_write+0x10/0x10 [ 648.694056][ T9556] ? __fget_files+0x2a/0x420 [ 648.694065][ T9556] ? __fget_files+0x2a/0x420 [ 648.694073][ T9556] ? __fget_files+0x3a6/0x420 [ 648.694081][ T9556] ? __fget_files+0x2a/0x420 [ 648.694090][ T9556] ksys_write+0x156/0x270 [ 648.694101][ T9556] ? __pfx_ksys_write+0x10/0x10 [ 648.694116][ T9556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.694126][ T9556] do_syscall_64+0x15f/0xf80 [ 648.694137][ T9556] ? trace_irq_disable+0x3b/0x140 [ 648.694149][ T9556] ? clear_bhb_loop+0x40/0x90 [ 648.694159][ T9556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.694169][ T9556] RIP: 0033:0x7f6b1485ce59 [ 648.694179][ T9556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.694187][ T9556] RSP: 002b:00007f6b12aae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 648.694198][ T9556] RAX: ffffffffffffffda RBX: 00007f6b14ad5fa0 RCX: 00007f6b1485ce59 [ 648.694205][ T9556] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000009 [ 648.694211][ T9556] RBP: 00007f6b148f2d6f R08: 0000000000000000 R09: 0000000000000000 [ 648.694217][ T9556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 648.694223][ T9556] R13: 00007f6b14ad6038 R14: 00007f6b14ad5fa0 R15: 00007ffd83f540e8 [ 648.694233][ T9556] [ 648.694750][ T9556] Kernel Offset: disabled