last executing test programs: 1m1.263916323s ago: executing program 1 (id=1966): getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x28, 0x0, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) close(r0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaa94f0c5d4e81686dd607a3f0000102100fc000000000000000000000000000000ff020000000000000000000000000001400000000401907804dba2"], 0x0) syz_emit_ethernet(0x4d0, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000008100000086dd60ea382704962f0000000000000000000000000000000001fe8000000000000000000000000000000420880b0000000000000800000086dd34a09e4e79e717a4d0dcb9770f59945aade78d9549b1fd990f232f0619197b747fcdeb83f586ba83e523dbc6ba5b1cba9a691d80c041011c9e0bc642f47934a1747b59ba8a263ed7e283d281b37aea191356851bad789eeb8b63b2c5b91373bc8f1166154c91a44f02bb2d87db08904c06ccc3496458ace4040ed4fe9916f748e363f4e71ff815b74521a1405beb319af9c5b775bbea787c7b9e68933cb4909aa409fd009a78e45ffdaa5ce6ad5e3ca26e0fee664967dbbe7ad84728d4d36b47082f0d01d0f16daae177f6d81094164d07dc1297d00d42608a8f5ac750917745588b6aca183bb2f6245db83226bd859ea3d64d053a15ac9cdf894f2fa4b4b126feca95d58e4bbbe6be1c4bb522ff4ba11ef6c63478813cc2e103ea351d475b81ed1603fb2f485c10d6f8bc2deec37e906af542b4eced6b80c86ee9740eb2f2007b3e98728ca966fca6a9ac551298e996452f4861db2309a30d1cdf58ec08f78971398cc73c85cab220121d18e5f17a8e5c2211e29cd5be11d064ef42a196865a9f9692de67cfa270760fae0ded908defefabb0b87e9aacc7b78479b3f33715ad7794dc77345afc4869168e5d5ee44c88cd675b60a500bfc4b035cf4c4ac779a1ff59f2881f3dcc553e2aa22b584f0d454b69f5633b6936ef4fc45f0a572608004fcd099e2b6b373b4c4da1966c1b37396a93634a235a9f8b9b5939f142370e9b297e3fe4ccda6682bef23aa4b0b395516d0b24e2e6e252f5ff82bace9b6c3d9fb9a874cb42fc913fa5d64d585b066006902e3dab367b9735ffd92af78b9d684bcbdeab4908074be627f5fbc5aba3d226a11a8c125aa44d36d96020bbafa6f396"], 0x0) setgroups(0x400000000000026f, &(0x7f0000000080)=[0x0, 0xee00]) lseek(r2, 0x9, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000002400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000e00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00'}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) syz_emit_ethernet(0xda, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000cf13f56000000000a4110000000000000000000000000000000000ff020000000000000000000000000001000004000000000000000000009c90780100000000000000b0575c7b4df2bdda0000000000000080ba6a5d5d0d170fca692c77733846860829accf2af44c0e1aaaaf532417a91cadd9e65f82310f80cf64f46c761191fda0a250498ce1b5c603debf9e05d8de03dc3d73abde0d0700c3001000000000496b31143860dbd10000000000006cde9c5018586db672628c1415233979ba3df3d8a8490bce9cafc2ab6acde477"], 0x0) 54.090079688s ago: executing program 1 (id=1976): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x1000000, '\x00', 0x0, 0x0, 0x0, 0x21, 0x4}, 0x48) syz_open_dev$MSR(&(0x7f0000000040), 0x8, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) ptrace$ARCH_GET_GS(0x1e, r0, 0x0, 0x1004) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) chdir(0x0) semget$private(0x0, 0x4, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[], 0x18}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) (async) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) 53.815384948s ago: executing program 1 (id=1978): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4, '\x00', 0x0, 0x0, 0x0, 0x3, 0x40000}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffcb2, &(0x7f0000000800)=0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) open(0x0, 0x400141042, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='xdp_exception\x00', r2}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000480)={[0xfffffffffffffffd]}, 0x0, 0x8) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000005304b70000000000000000"], 0x14}}, 0x0) 46.04214434s ago: executing program 1 (id=1985): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r3 = syz_open_dev$video4linux(&(0x7f0000000000), 0x2004, 0x0) r4 = socket$inet6(0xa, 0x805, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f0000000000)={&(0x7f00000000c0)={0x1d, r6}, 0x10, &(0x7f0000000140)={&(0x7f0000000180)=@can={{0x0, 0x0, 0x1}, 0x0, 0x0, 0x4, 0x0, "1b2bc764c7ed2890"}, 0x10}, 0x2}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@gettaction={0x28, 0x32, 0x6dd711a25f4cb68b, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x28}}, 0x0) r8 = syz_usb_connect(0x0, 0x24, &(0x7f00000003c0)=ANY=[@ANYRES16=r3, @ANYBLOB="ab5a279d2326f99488f32c44f81e75d7f9c326a582732678d30123203ee1ca43bcb0900641ade130359b0266ed9a1c942255bcd8d01d2ec5cc37ec86337cac0f30a7ce2a0bb1a0ba5fbe399c87a4f86c5f11b980c3d1aacd6bf3775f7d8b2620b00f9d27c8f7fcc794a65431db78b13414b183aaac29227d8c5d8b49509ba8d0d0a35c0c304f6fbe30f441b70bdcba97cca5447b4080261c8ffe60aa11a771d0b95a61553564e9554817359adca5ff", @ANYRESOCT=r5, @ANYRES64=r6, @ANYRESOCT], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f0000000180)={0x2c, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x8, 0x1}, 0x0, 0x0}) syz_usb_control_io$uac1(r8, 0x0, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000140)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read(r7, &(0x7f00000007c0)=""/4096, 0x1000) 44.14348168s ago: executing program 3 (id=1987): syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/time\x00') socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x10000101, 0x5, 0x6f, 0x307, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x3}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2, 0xffffffffffffffff}, 0xffffffffffffff65) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000007c0)={{r1}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x18, 0x19, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000080000000000000000000000181100", @ANYRESOCT=r3, @ANYBLOB="000000000000000000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000cdbba73393fc74925b72bfcf9bb7040000000000008500000003000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f00c8cffff9436c881f8bebe58a9ce649c13e7fb6d30554b3ca4e9", @ANYRES16=r3, @ANYRES16=r0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r4}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000510700140000000000000001b7080000000000007b8af8ff00000000b7080000fcffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRESOCT=r3, @ANYRESDEC=r5], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000100)=0x5, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x804, &(0x7f0000000080)={0xa, 0x4621, 0x7, @local}, 0x1c) ptrace$ARCH_SHSTK_UNLOCK(0x1e, 0x0, 0x1, 0x5004) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="0000008008000000080000001600000095000000000000004d70ebf2effa5eedc0e427d65091eed159568999119c1f5175aeab43300ed2687278e606d0270689b4d50b469e776375bbfea10eeaa2fae5c5a89db69a5fecbd1d6019"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r8}, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) close(r9) r10 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r10, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000140)=0x1, r11, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r10, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r11}}, 0x10) socket$rds(0x15, 0x5, 0x0) r12 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_ENUMINPUT(r12, 0xc050561a, &(0x7f0000000100)={0x1, "249e0b45c0d8e7063f9839f36aeef67e326a9cc65e4079ff17065af8b09d78dc"}) 42.005782078s ago: executing program 1 (id=1989): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.dequeue\x00', 0x26e1, 0x0) (async) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004001) (async) setsockopt$sock_attach_bpf(r4, 0x6, 0x6, &(0x7f0000000040)=r3, 0x4) (async) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000500)={@in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0x0, 0x20, 0x0, "433fc26f55a99c53195a8824f5b0ffb32e95b7ef8fd66a484c4c2df5dcc4d043f782ece589e8583555855b26f79bb6b00a73b87a300784ac1d8e44146272da584c77ae2177d2b56280de0d2fb68fc2bd"}, 0xd8) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000ed000095"], &(0x7f00000000c0)='syzkaller\x00'}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) (async) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_DEL(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r2, 0x1}, 0x14}}, 0x0) 41.642990568s ago: executing program 1 (id=1992): socket$kcm(0x10, 0x3, 0x10) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xec}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f00000001c0), 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x20000149) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='io.stat\x00', 0x275a, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000000c0)={0x0, 0x1, 0x6, @local}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106}}, 0x20) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000700)={0x0, 0x0, 0x0, &(0x7f0000000480), 0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000280), 0x1, 0x0, &(0x7f00000006c0)=[{}]}) r7 = fcntl$dupfd(r0, 0x0, r0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000040)={0x53, 0x0, 0x6, 0x0, @buffer={0x17, 0x45c00, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 41.599712939s ago: executing program 3 (id=1993): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "a05c7b5d00008023e9c5bcf5ff7700"}) socket$alg(0x26, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000001040)) close(0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x6) r1 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x148, 0x24, 0xf09, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_PARMS={0x14}, @TCA_RED_STAB={0x104, 0x2, "1fc3aad2a437370d6d097ebfd52aedbb1655a58f2aa0af35cd00195caa3e3d0b98a32e2639261316f0985a29d96c82106a94f123296f511e69f7085723a7388c5e88fc0a24bef98af5c922f2bc9c7c3400bbfff5445bada28d3909cf31e78b902254ba8b9bea56ab331a79c37588e84cab1940a713b016f641a36624ce7a39038b8205d648a6ba37ea07ba06eef4ffe1ff5ac5bbef85af149841d9d71f626ed2ad93e0dda0e3b3e4a19b3a4c46bacd966ad0c6cf56bd217c3ddf1882fbb53a6b3ccf10804087607838843f3cd4470de33d27e2d2dc582633cdc76ab229ee387e2c5a9b6b7fd7d13c27d35533b22845c884bf0746cd84b0fb06e31f80dce1386d"}]}}]}, 0x148}}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xa, &(0x7f0000001100), 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000f6f000), 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x0, 0x0, @empty}, 0x1c) syslog(0x2, 0x0, 0x0) syslog(0xa, 0x0, 0x0) syslog(0x4, &(0x7f0000001300)=""/95, 0x5f) socket$key(0xf, 0x3, 0x2) 39.89146815s ago: executing program 3 (id=1997): gettid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000004900000000000000"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="12", 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x38, r4, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'rose0\x00'}, @NL80211_ATTR_IFTYPE={0x8}]}, 0x38}}, 0x0) listen(0xffffffffffffffff, 0x20000005) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r8 = add_key$keyring(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, r8) r9 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg$inet6(r9, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000100)=""/254, 0xfffffc47}, {&(0x7f0000000200)=""/171, 0xab}, {&(0x7f00000002c0)=""/243, 0xe2}], 0x50, 0x0, 0x0) 36.97881093s ago: executing program 3 (id=1998): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="78000000000101040000000000000000020000002400018014000180080001000000000008000200ac1414bb0c0002800500010000000000240002800c000280050001000000000014000180080001007f0000010800020000000000080007400000000014000580080001"], 0x78}}, 0x0) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES16, @ANYRES32=r4, @ANYBLOB="0c00990001000000160000005100450048431caa9c6527e82d24e160b9256ffc3a79578a9c148f3d6dfa640ab44c2034de9431697e6918e02116548a903e8771636f315337c4a17fcd59bae7ebbb1017839c3b571fadf55e4126bed06f00000004104500298eb5e731e52ca38239d62bbad84c85ac7b7dfb1661f0b0d2a3d438f5f27bb5f30077054000cafcfdf737e4653df693f7767a2cd1a41d0d2b86ea9e2dc4ba797cbbb8625bf1dc8db8b5452e2a741b08048ec108cef6e4fac3371c2d31e5c0021caceeeb84159599b073950a423d39100d51fcdf9145bd19ea65a7b45823c0754abc15a97272f6d9dc8361693d294ba89b8b5ee84e07afb686091c6175e144ec82a02abd0a87c8b213ed52317c9ef5670f3bf5264915ad26c623b09754c63305f35303621a068f44ad71d89bf886061184c4df2f09b0177ee926bc69049ec03d26d66336d7a9937c282ed7805920a19308214fe908a3208a143d8585426c9b6abfb9e8700f2050415754c0d322eae0dadc99eb00a7df3227bb67addc82c4121bb106c8a1f3524acc3577e8a928fd6c9e3dee44ff8e3252cc5f8093dfd1e4ee0e216ecd1fd109c85909f471a294828d28ccea75a709b9a654baab6a742c9b87b3816988fac277405f8c8400a2e4adac511b91afb16c0e3dcc6e1aaef9ed351a4035a6c00e8a17832f05d608424a5573f2b9e205ea16a2076b1301c5eead46bb691eeee807a5332ab5b9548231635be548d40d94f3c68a5b63361dfd853613216bc6325b069e8c33db75566bb1d41ca1511c4b7f3e301dd46e40f0861517f8690edc8d9d9e1b29073dca56e25ee6a84fc9f094a5061754d5c5c46e57bedc6d106941239061c149719522313cd2ce8589460725e1d19d3301b1fa7cc4bc0d9c416b76f029286da2443ddb0887e2ba16f57b9a1a1fa9c30aa6d55d73fe590d972ebfd5028fc3cde8ec39b71b91ab626e20462dcf632c61f7c899c96b25533961a8b7b782d1a78d355d298d90d7244d7920342fff649e5cb327120260bcf6945f629f529396f0b2360a3ac3a6ff1336e4c812b6afd292b3a824aeb5ef75360705cff0ae714460dcf230c021582ff063c84ebff7dff6b6fe8a2dedecd681b417245e01f5c3f919085b240bd6cc2840c36f232ebdc212ed4b5ca61e401c0ac3d49591ec0d31f4f1b127f6b1f2a259c43f62a105993a76eca5cae08e47e7b8573f2a95d26a1b51b08ee007e8b2179fd35cd1d41fa53649d9776e7037b9d2c99199018b7d990a88fbd72c78ae22d318bc4314adc62f562033d984202d6398718c817a531b51fe50f7535787ce0335f45879af2b36e025ec9867ed7201763ca1d318fed9df00163f734cb23920ed893e473d193c8451a2827887bf5c19903b6d59e95f94d23bf8a058f0a77f5c8aea0ae4f301fea08d9692242204036aba5785d0f824f2ea8084cfa49b7c022ea326920ab8952e9cda24194d1a8346eb6c8bcd5b8bea7bd02880dab82d3fe9ba72ed786662c3757a92a57465284527932685c51676deaf59d57ed19c04ce8babf4495f551947884ace121c0a94b99309b2b791060afacbc0f381421b1fcf809ae2ca191cb3257369e0ff0e183ae9433e06b09dd6e77d3d9a52003ce866ab4ae58d24849dad3a53a7c81949b919ac9ab99ea9e92fb5ad228a53cdf43b5de1c2eb8446f65834d04444b0f704684b281c4c3d5af3d0c58a196c597087ade2d8829532b20f6f59a144e005e2e7dca74d63349db1454ce37f84b2757acbf01bcbfd3822181e276fdedb2fed5ba16463977cddd08944187c22c1d3a21d59600d0f3eba854b02e83f186b20b9e4b0319c6415cb9ac87acb6c614ce61eabcba68378add47c43b01ad4ac1fabcf8d1e366b5451ec1b2ee40dc6c563c70d2995279c337feb392699fbfa3ef16609a7108545297d419a697f675ae83736bc1373f9fdc579b462e1a7f4ce59b9c39fe93840a64dbd6d70647e31401227692cd91817735ef51a0a2ef161450aacfa5d64ed88450cc98a0298e759333e2760d8bc0bfae0105d8d5cf76e289156b2bcc4c9b999053d6f09d33d9e3682caa3ae6002a793485211cf64dd2e4fa299aabea3a34afe1c520f3c67fb43a971e41edeea8dddbf091ffc8607b56e89619145b40995aea5753bf961d093a49fa2c3fa2d2d3d52f5bbea667f12c4e1bec7a759a1f98eb5c04d8010b4f7261f1ae618f86b36f957fce3d6840254d810b8e4a8e59d89a1245366e0913d10e99c9979697e5ba36fe50fdeebb1dcd72613d80ec465f05ea04db82c9f9d3a42bef79220ec2972ead84cab01475721672d7338fc8984125bd5608d7c43b0e6402f3c33df4a29e2437aa2667f90082f5ae9cae1f4b68cba0ea13e405c9bf11c9fd044673ff56481782f01f156d1b8bdd461ed00a1bb89f573f5c7a0b3731a0f44eefe78225c16a63e06e5d96986d752d3ed5a525cf63383ad6f1ae27c8b90178002b315cde034fcbfdf8cb1a966389d60ec99f1e3c48ce6f73346f76ba4d99a2ff1e42436831b9982fed00b8637277ea7c7ecd970e708aa2432a69e1dd737a3da0595a648e014b312803c9798d0154367079678bb2af8fe4d1dd6fe4a460a21b39a25f337695b5b185491401e6318b4562e110c7854986bb645d449a65ac881651b3e8ffacf98080eb7015bc76a5a238644a736aa8b0de2569a09e9101612f2e9e2f8df99486fa3be277ce40529182c29f04911dffff5f86f61b10dbad17c235e3ff791a6587e9ae3a4c9da73dc862b4338cc3ea6305c6d2988b4461bd312532753c848e9d9f14508e7eec4652d287cf1ece2ccd1dc20b68f76468c2626f348b6521e9a64835f605cc5868e4172a59b467163f92079da9260ac67d2be73f13a364845cc2f0b2565a3032e2607c93135929e19757ae940e0623b97d649f641fbbb46fe6ea4139568acccc5eef02ea79b8009553840f29fb7565d7f58eaa80c7c3fabb0075dda09e38b2bdddf1e46cc12d6222386857c1e64f0c6fa077c18c4e948fbceb4cf7281c6a9093a8f330ddada4546d9063753719197c4774edbd81e5249a55e8d4ea3f643dcae97ecbf941867caf99add887fe5f845e27ae2c497672815c68ac27a5e5a996855718ff96cad5349711705550b48dc3b315df57a1117c9ea3acaec2bcfa247467534b58d73f57a809b8bc4d16eeb4d1b69746a08151368ab2e1fc216fabe633031dcc51c2e564e3181331351f13d6e029b06e329338f456b8ad9a2ef84fa52c1629ebea37631c59b2349e687b900995a6aa3e19a21d9752490163cd2918f7ee64814015c204815e815985a65d79742d8c6ae427a8146279d331e221875ee5e97e30f29bf22466d69d89c94cce9c10116d2224983f8e1fc04bb465a09a115a062c1d2803ea3966cb134d53f9bd81ca6f84fa758676bb0b4e0dbed22e74c068412d35b101ff01b8659e01e1ab847a14461b2ade133cab6cc02f0edd147e3dafd4cd7239946dd4bbe5727d2021713ca11de3c9e18e9c1ed126f880111d5ee1357933c8c255fd4349e0e9171757838b2f9e24f5f44cba065de5c797b240d4111a974974d7a9420423d59f43fffc10bf22ec5e13f97969952b48d2813d96bcf8c2013cb767ac0b05ed27d38c980d34bf223db75a8b992b5ca5919646c32c079fe0980482e080fc29eca62065de818f2481ff52dd43b285068ff6706b0fdddc438f4085e55efb4201d8c99012d3f9bf2074f0bffb5cd9cb15c7cb5aea5cc9ff14f640444f82a12b42e749a1d30c1434a8178dcfa971b77809e52b3afa379533040c973bd3d98870e0631be36132d1486035de2912c46b82b6d5a310ae87bf4c12a2d6f3e91cc2700dd8dee2576734e6647cbc447de9fb10bc693b925dba27499da731a19cbd225c49c3359498f3865477fab1b0b8b68fd7e267e436d1ec0196e7c8ea7793c1fd9e4072fd8f75603a3f239578cee7a1111fc495803e3b7ba5e1ca55b843671380444ed9c25a42e69e5b4abc75170c0f18bd879480d4824f54f759338990f2b362c87304af4a4283ea0abc61a72f5b3371e232a49f882c973e3d7567950d2f2f16a7e9e9a819b1902ee1a333a900f427e234465891772a31cc49645c8b1a9bd5844cd77f7a0fe952d85a08ba9cfa726934cec2a5204b1590353d2c867c1f0fbf43bc09586684c090851ea73189022ffb81acd35a465dd582ba203e49a41f1baec68fe99d633ce9fb465b6c341ff918715c408fde148358080146406aa8c96c71d42487877c78e64767a9140d2c3c271333ed5797d0f466b76846ccc917e771baa581804805e6287d707bbb2dd41545b70ea90b00a1fc6c99ee67ef0862eaf87c0ee5cbaa07fd6e6cfce282e8397234e5bfaf1565c2527b60457f90b3f04dd961fc5c07687da7fbd9c2d026e7588f854f6d691668cc470c9367fb2553ab1bf6f47576060833d38818b7fd6061b5b9069898abc322bc2957584d17b3a46050689022f8117e3c1e1f27767b6b9203e5a63500e0e27905b0c3155a783a90bf2fdb03655eab68c59619972f69bf1be94952c2444a4bffd8c1949e6cd89de7b77e511b4d8375acfa5921cf41eaa53f099f6be569dc47b4f85d89a3ea6b41ac785f8bc9ac9f27c98ff79f6c3ca95dce2a423b13f9de19b2b276a08b7a7bb5bb38f015af841440737b322747ffd88caaf23abbdd4d6c673368a47dd7c9831e8221cd3208271c71d9f30963917042e49b4cd0c4e39cbb5ef73c65a785b68a89b499c63f5731f9625b0a5b4601b4cd7a4264a8f45939dec3ebaf5f83fd70baa9016efc4182ddadec13f841a736d28b809e2292bd18043a0b86467f4f2dfa824318a51ccc86dce785958d0f1fe5a387d428bb7c5f715dba9ca252be6d642ecfaee5330699090d73e591b35844bd2016e9d1b01a534ce598033af0e22d57c4a4c144290878796a2e23e4199a61b380100c36e8aba6435f93dc1714249aee18a63730599574f032414bc1b4e1b061fdf325de96fac8b0886f4448149597d499693fc9dd3a017edff33680378307259a21ad4ebd58fb974c577e96c140c4d1783e2230ba0dd9725d36f9da6052afc43325c72e8b3a4e8e58b6ea966d4b0164d7b0bd9d54a95299181432db7022ad0f3eca97b5f0b0d963349981434f6112ae5881968239d66399eaca26d9d1c7ccf4792be88d26a4a3502bd8be8e1054db95aeb193f3792b0ecc0dcfe41373a4dc3c108d6a8c8aea027c35f25d47e7f86f5555343bc47694ee5bdd55131a4a4e98204445b70774b846067223ecb1d8cfebbca8457a84fdb70ed8c2eba0370e790ae5552506770d2fa111253d50e00d60e2aecb33c47c97514bd94b61020835234c016984484b15ffda85e114ba518287f71ada3883e50e71fe3e1f23d809ee3e3cb73e588519133ffc45c91be30f51dc11740e281954bd1e74491ac20478fff31006bc1d6d2bc025f3435ea4ebe237f9f68a3f74d23f8e16f3eb2d70806a8e0ca73e0e358ee7ef9fcd4c7731c6f54210ae278ae485d0a606506d87851d0c7576b90286d52c88bce5a3a0f651fd9f8e4faf968797be0a5a58bcda6c9db2a18773f64bd8935cd0c44e1e9b776cc710791b3a82c69a41f442ba414475985d57a32dfa2422cf86907d6afe183aa130b269ce3c08eaed5715f3b63b23b46e47d4f38006ce3838e39d27badf0312de61e6a65da70567983dbb93c9b68df8aac2edef2d468636af6c8ff8f6d29983d80354c692977ad118797b41bf08d809d6a67da9d7351721b41a43ff61ced3d6125ec8fc0b96016c0f9cae118bb96673ecf00c99b38fa1841a6f02005361c3dce6e9289d9ad128bcf35dc6c145162594aa7690c3e85bf48d5553793a56d78c5a61c8a50015d140a73dff6c11f11e9d3fadb20"], 0x1088}, 0x1, 0x0, 0x0, 0x800}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f00000004c0), 0x208e24b) cachestat(r6, &(0x7f0000000040), &(0x7f0000000080), 0x0) 32.101483508s ago: executing program 3 (id=2002): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$llc_int(r0, 0x10c, 0x2, &(0x7f0000000040), &(0x7f0000000000)=0x4) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0x0, 0x100}}) openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x220000, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) gettid() futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$EXT4_IOC_GET_ES_CACHE(r2, 0xc020662a, &(0x7f0000000780)={0x9, 0x3, 0x6, 0x1, 0x8, [{0x0, 0x9, 0x0, '\x00', 0x1200}, {0x0, 0x0, 0x9}, {0x9, 0x0, 0x2}, {0x7ff, 0x0, 0xff, '\x00', 0x200}, {0x5, 0x0, 0x0, '\x00', 0x80a}, {0x0, 0x7700cfa4, 0x7ff, '\x00', 0x316}, {0x7d1, 0x6, 0x5}, {0x6, 0x1, 0x1, '\x00', 0x4}]}) socket$key(0xf, 0x3, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000a80)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@loopback}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSBRK(r3, 0x5427) ioctl$TCXONC(r3, 0x540a, 0x2) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) ioctl$FBIO_WAITFORVSYNC(r1, 0x40044620, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x80000001}}, './file0\x00'}) 22.432693002s ago: executing program 3 (id=2019): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x14, 0x2f, 0xb, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$notify(r2, 0x402, 0x8000003b) sendmsg$unix(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {0x0}], 0x2}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpu.stat\x00', 0x26e1, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000000a300)) ioctl$SIOCSIFHWADDR(r3, 0x8b19, &(0x7f0000000040)={'wlan1\x00', @random='\rh\x00 \x00'}) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r4, 0x8b2a, &(0x7f0000000040)) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x3c1, 0x3, 0x4f8, 0x0, 0x5802, 0x294, 0x0, 0x294, 0x428, 0x325, 0x378, 0x428, 0x378, 0x3, 0x0, {[{{@ipv6={@loopback, @empty, [], [], 'macvtap0\x00', 'macsec0\x00'}, 0x0, 0x230, 0x298, 0x52020000, {}, [@common=@inet=@hashlimit2={{0x150}, {'gre0\x00', {0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x7fffffff}}}, @common=@unspec=@quota={{0x38}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0xd, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x120, 0x190, 0x0, {}, [@common=@hbh={{0x48}}, @common=@frag={{0x30}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "9b5c49840af1fa47a964238f259b3c5a1d2900368cf3205b20e30e9ab14af5e8d982e899c853fa77c236d1e982bfd274b6f14caf6af1961c67b2212bdf53463b"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x5437, 0x0) 4.57839207s ago: executing program 2 (id=2058): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='lp\x00', 0x3) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@window, @timestamp, @window, @window, @sack_perm, @mss, @timestamp, @sack_perm], 0x2d0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendmmsg$inet(r0, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000680)="49bbe4121f35be052595bd4892ad64d5c5d7f7a0c4527f09933c2e0d24eedb4089682bc3ea3a3a7ab2287b19ddcf0a00af4a5e8aceb906108d7808583160bbb357cfb3082802cbdcb5ebe6510c2702cb810cff8832a329248be6b6cbcef4ada8b9ce53db70062896046d3dca0b0079f6fc5be3df6a471d1d31f4f2a9cfd5e780454efac19884ccf5551961a5f3deef651b180cc6c25930ebc384ec6b78b262ed9f33c3aeba5e912c1e058bf02a32baf147db03cab8116210a79de0d9e1b1d5fa96dc21ccd8097a4d9a834a3e744d8b80050d5e7776115b5789d52ca8a1d813719935b7db239b23f72056a0b2db59b0651eb64ebf8a32dbe8c3eb9bb8acfe3ed1959e4a59146fbd23f9d33a14ddb7402dfd6e5d4d57120059780f9581980d9989282e482a8bd96aea75f697e8cff77af8ad5c007b8f54c460054fc78446265613d04cf67c62eb969b11741351f17a79bb9f9d3fe46d94f3bd7d2b4cd96ce426f7410df4a752b8d056fcb648396f75212906c69a73165acd1e1227202f", 0x17c}], 0x1}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001980)="d7", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000280)="a5", 0x1}], 0x1}}], 0x3, 0x4008095) 4.28924554s ago: executing program 2 (id=2059): mkdir(&(0x7f00000001c0)='./file0\x00', 0x1c2) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100), 0x210011, &(0x7f0000000000)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0xa0d061, 0x0) 4.038913399s ago: executing program 2 (id=2060): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000480)={0x1c, &(0x7f0000000240)=ANY=[@ANYBLOB="00018800000020"], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000980)={0x10, &(0x7f0000000340)={0x0, 0xe, 0x3, "14386e"}, 0x0, 0x0}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) 3.034363808s ago: executing program 0 (id=2066): msgctl$MSG_STAT(0x0, 0xb, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1000000}, 0x48) prctl$PR_SET_MM(0x41555856, 0xf7354000, &(0x7f0000ffa000/0x4000)=nil) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000780)=0x3) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x90) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r3, 0x4004743a, &(0x7f0000000300)) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) pwritev(r1, &(0x7f0000000600)=[{&(0x7f00000010c0)="aabf", 0x2}], 0x1, 0x0, 0x0) 2.963750522s ago: executing program 4 (id=2067): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b700000017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff0000000015040000000002000f030000000000003404000001ed0a0014040000170000800f400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0x81009431, &(0x7f0000000080)) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000100)=0x80000) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_elf64(r3, 0x0, 0x978) close(r3) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = fcntl$dupfd(r2, 0x0, r4) syz_io_uring_setup(0x24f9, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000140), &(0x7f0000000380)=0x0) r7 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r8 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r8, 0xffff) fcntl$addseals(r8, 0x409, 0x7) r9 = ioctl$UDMABUF_CREATE(r7, 0x40187542, &(0x7f0000000000)={r8, 0x0, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0xc0086202, &(0x7f0000000440)=0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, r6, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r5, 0x84, 0x65, &(0x7f0000000000), 0x0) r10 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x22301, 0x0) ioctl$SNDCTL_DSP_SETFMT(r10, 0xc0045005, &(0x7f0000000080)=0x100) ioctl$SNDCTL_DSP_SPEED(r10, 0xc0045002, 0x0) write$binfmt_script(r10, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '\":/k!\xc0~\xdb\x01\xf1\x13\x17\xf8\x8a\x14\x13$2\x1fA\xf9\x8d%\xca\xfd\v\xc8'}], 0xa, "b7ef1c3e568656655c186e4e60a4215394a5e5b7d866178878c05fa87a33827f49f06be514c801ff3d10e24e53081d5b8e7790cd94560779d1952b90e4d3ffc9e829494aa707b13b6cab38f20af5dc90d6ab615fecbdb3e432a6cd672f28a81d7a6ffc21b0bb34b4dc92fc87513ef736366c"}, 0x99) ioctl$SNDCTL_DSP_SYNC(r10, 0x5001, 0x0) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000640)=0x4e8) 2.592452142s ago: executing program 0 (id=2068): socket$alg(0x26, 0x5, 0x0) syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x2}, &(0x7f0000000000), &(0x7f0000000140)) r0 = socket$pppoe(0x18, 0x1, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a300000000008000240000000"], 0x1e4}}, 0x4040000) r4 = epoll_create1(0x0) r5 = epoll_create1(0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e22, @multicast2}}, 0xfffffff6, 0xff, 0x2, 0xd782, 0x3}, &(0x7f0000000180)=0x98) setsockopt$inet_sctp_SCTP_ASSOCINFO(r6, 0x84, 0x1, &(0x7f0000000240)={r7, 0x2, 0x80, 0x1, 0x0, 0x1ff}, 0x14) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f00000002c0)={0x0, @hci={0x1f, 0x2, 0x4}, @rc={0x1f, @none, 0x8}, @can, 0xbc13, 0x0, 0x0, 0x0, 0xffff, &(0x7f0000000080)='batadv_slave_0\x00', 0x2, 0x1, 0x7ff}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r5, &(0x7f00000001c0)={0x30000004}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r9, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r9, 0x0, 0x0, 0x200c8004, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c) sendto$inet6(r9, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) sendmmsg$inet6(r9, &(0x7f0000004840)=[{{&(0x7f0000002340)={0xa, 0x4e20, 0x0, @loopback}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r9, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000800}, 0x44000) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="2400000019000100000000000000000500130000000000"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x7fff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x0, @broadcast, 'bridge0\x00'}}, 0x1e) bpf$MAP_CREATE(0x0, 0x0, 0x0) 2.279558712s ago: executing program 4 (id=2069): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x144000, 0x7fe2, 0x1}, 0x48) bpf$MAP_LOOKUP_ELEM(0x3, &(0x7f0000000000)={r0, 0x0, 0x0}, 0x28) 2.06772291s ago: executing program 4 (id=2070): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000002c0000002c00000002000000000000000000000203000000000000000100000d0000000000000000010000000000000000000002"], &(0x7f0000000140)=""/227, 0x46, 0xe3, 0x1}, 0x20) 1.979911577s ago: executing program 4 (id=2071): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8924, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000580)={'veth0_to_batadv\x00', 0x400}) close(0x3) 1.938999808s ago: executing program 2 (id=2072): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x203, 0x8401) fcntl$dupfd(r1, 0x406, r0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f00000001c0)={0x0, 0x0, "ec59dc5d72795ee9711e26a702d4e7a14019d24773a7cefe76e263a443e8c0ad0c73c049796fef70bf76dd7dcc21c3556810a6e989f2a694d414cbf13171724b7f5432e86cb60a905f573c876f6ee7def7b164bb812e29b3f0ba51303cbbd51d0eee700bf6419114c322503b8d339b4b9f809ecb0ccc3d9c1e6a0ddd9df6e1244716541137654482d00241999f6426641feca790e79c4b977b83b3f39c4269be09c492ad17d173206b7e5517a742348e5a41ad0f25c77c8cb2b73de92781ba2290b0b2415e0544caac3b12866b27fbeae2f8b22e164a177da1bc6991d38725b36f2e028d9bd91dad315ec97ba2cb7f9383afce6894cb56535bca0c970263bbcb"}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6}]}) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x0, 0x20}, 0xc) sendto$inet(r3, &(0x7f00000000c0)='}', 0x1, 0x20000811, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r3, &(0x7f0000000280)='p', 0x1, 0x0, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000100)='\\', 0x1, 0x0, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000300)="ab", 0x14078, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @loopback}}) socket$netlink(0x10, 0x3, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) tee(r5, r4, 0xff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="22003300d0000000ffffffffffff080211000080505050505050000004"], 0x40}}, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = socket(0x10, 0x2, 0x0) write(r9, &(0x7f0000000100)="240000001e005f0014f9f407faac470002000000010000000000080008000100000000ff", 0x24) close_range(r2, 0xffffffffffffffff, 0x0) socket(0x11, 0x80a, 0x0) r10 = syz_open_dev$vbi(&(0x7f0000000f40), 0x0, 0x2) ioctl$VIDIOC_DQBUF(r10, 0xc044560f, &(0x7f0000000fc0)=@multiplanar_fd={0x0, 0x9, 0x4, 0x0, 0x0, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "1769732f"}, 0x0, 0x4, {&(0x7f0000000380)}, 0x8}) 1.655746779s ago: executing program 0 (id=2073): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000366000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r0, 0x0) accept4(r0, 0x0, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) rt_sigreturn() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x36f040, 0x0) unlinkat(r3, &(0x7f0000000140)='./file0\x00', 0x0) prlimit64(0x0, 0x7, &(0x7f0000002040), 0x0) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 1.486495396s ago: executing program 0 (id=2074): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) syz_emit_ethernet(0x176, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaa48847000000000000000000000000603f599001340600fe8000000000000000000000000000aafe8000000000000000000000000000000000000000000000c204000000000000000c000000000000fc02000000000000000000000000000000000000000000000000ffff00000000fe800000000000000000000000000000fe80000000000000000000000000000000000000000000000000000000000000fc00"/190, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50000000907800006c3e4af6e95497a4e1f23137ae5d9ab0d6a6a3ff1ff52b15b109af0f93abe7bddfe72723968479f91c26bda6d7d589fb8cb68c4f8760051117d27ab8434eb2818254ab55825a80ba277e953c42c3e3a34d6f1998abd85935442e96e25dc77ffb0469578ffae16aa69caf18e96b08085370c0c242147969cf393604407755c55c4b539a2e36241dc73a3d65b8b2585660c1365e7ec6c7a536a08d21e53aa4e60cad0bd8eb60a00943"], 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="8b"], 0x53) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000008c0)={0xe, 0x18, 0xfa00, @ib_path={0x0}}, 0x20) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x0, 0xb00, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc}]}], {0x14, 0x10}}, 0xa0}}, 0x0) write$binfmt_elf64(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000800000003003c02ffffffef3501"], 0x7c8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000680)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) 827.982976ms ago: executing program 4 (id=2075): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000f80), 0x402, 0x0) lseek(r0, 0x4, 0x4) 711.074798ms ago: executing program 2 (id=2076): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000840)={0x3, 0x0, [{0x40000001, 0x324a, 0x2, 0x0, 0x0, 0xc, 0xd819}, {0x0, 0x7, 0x5, 0x7, 0x4, 0xc0c, 0xdb}, {0xd, 0x6, 0x5, 0x7, 0x2, 0xc732, 0x6}]}) 583.885415ms ago: executing program 4 (id=2077): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000ad90000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, r2, 0x0, 0x4004) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r5, 0x29, 0x36, &(0x7f0000000080), 0x8) 537.414818ms ago: executing program 2 (id=2078): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x2006}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000001000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008180000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000300)='sched_switch\x00', r4}, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r5}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0}, 0x90) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r6}, 0x10) getcwd(&(0x7f0000000340)=""/70, 0x46) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r7, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) 517.701082ms ago: executing program 0 (id=2079): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000021c0)=@delchain={0x2d0, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x290, 0x2, [@TCA_ROUTE4_POLICE={0x24, 0x5, [@TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_PEAKRATE64={0xc}, @TCA_POLICE_RATE64={0xc}]}, @TCA_ROUTE4_TO={0x8}, @TCA_ROUTE4_ACT={0xfc, 0x6, [@m_nat={0xcc, 0x0, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @multicast2, @loopback}}]}, {0x79, 0x6, "17a3a496e0b06ed4b17c112d919b00b3961dacbd47d9dd716cb9e3eeb2118c01ec30dc86f8f94756684ff97abdf1a26ea4833cb4d10d78455e1ae1bcb85f22df4cc4cb4f849aee90332523256a7f1b96a6c6d060ee09f14645fc28bd05cca953cb4705ee5fdd6950f43ec843b0e8335d3f2f1e0027"}, {0xc}, {0xc}}}, @m_nat={0x2c, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}, @TCA_ROUTE4_CLASSID={0x8}, @TCA_ROUTE4_CLASSID={0x8}, @TCA_ROUTE4_ACT={0x154, 0x6, [@m_mpls={0x64, 0x0, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5}]}, {0x2d, 0x6, "79f577e01ae240bd65a8d89d2537f5496c0a88fb52bc502a7af545da7e1c52ef4dae165fc3df9c739d"}, {0xc}, {0xc}}}, @m_connmark={0x40, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0xd, 0x6, "25e3c0c965c7f29e5a"}, {0xc}, {0xc}}}, @m_simple={0x5c, 0x0, 0x0, 0x0, {{0xb}, {0x30, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x12, 0x3, 'lb_hash_stats\x00'}, @TCA_DEF_DATA={0x17, 0x3, 'mcast_rejoin_count\x00'}]}, {0x4}, {0xc}, {0xc}}}, @m_connmark={0x50, 0x0, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x2d0}}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 0s ago: executing program 0 (id=2080): bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) getpid() getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000004c0)="e0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) kernel console output (not intermixed with test programs): 586.535253][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1586.642917][ T5292] usb 5-1: USB disconnect, device number 57 [ 1586.827113][ T25] usb 1-1: Product: syz [ 1586.831322][ T25] usb 1-1: Manufacturer: syz [ 1586.835917][ T25] usb 1-1: SerialNumber: syz [ 1587.079535][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1794'. [ 1589.729586][ T25] usb 1-1: config 0 descriptor?? [ 1589.742900][ T25] usb 1-1: can't set config #0, error -71 [ 1589.789057][ T25] usb 1-1: USB disconnect, device number 44 [ 1589.923891][T16628] udevd[16628]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1590.361076][ T5292] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1590.987357][ T9] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 1591.417469][ T5292] usb 2-1: Using ep0 maxpacket: 16 [ 1591.422604][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 1591.460325][ T5292] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1591.463108][ T9] usb 1-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1591.512648][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1591.519013][ T5292] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1591.541247][ T5292] usb 2-1: Product: syz [ 1591.546878][ T5292] usb 2-1: Manufacturer: syz [ 1591.552021][ T9] usb 1-1: Product: syz [ 1591.557406][ T9] usb 1-1: Manufacturer: syz [ 1591.562125][ T9] usb 1-1: SerialNumber: syz [ 1591.578801][ T5292] usb 2-1: SerialNumber: syz [ 1591.583154][ T9] usb 1-1: config 0 descriptor?? [ 1591.596290][ T9] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1591.607183][T14593] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 1591.611744][ T5292] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1592.483852][ T5292] r8152-cfgselector 2-1: config 0 descriptor?? [ 1592.502681][ T9] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1592.617255][T14593] usb 3-1: Using ep0 maxpacket: 16 [ 1594.466686][ T5276] usb 1-1: USB disconnect, device number 45 [ 1596.692358][T16628] udevd[16628]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1597.107594][T14593] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1597.116684][T14593] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1597.195801][T14593] usb 3-1: Product: syz [ 1597.227151][ T5292] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1597.243290][T14593] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1597.264303][T14593] r8152-cfgselector 3-1: config 0 descriptor?? [ 1597.275040][ T5292] r8152-cfgselector 2-1: bad CDC descriptors [ 1597.328659][T14593] r8152-cfgselector 3-1: can't set config #0, error -71 [ 1597.359582][ T5292] r8152-cfgselector 2-1: USB disconnect, device number 41 [ 1597.397670][T14593] r8152-cfgselector 3-1: USB disconnect, device number 53 [ 1598.497386][T14593] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 1598.757121][T14593] usb 3-1: Using ep0 maxpacket: 8 [ 1598.813884][T14593] usb 3-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1598.826125][T14593] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1598.842596][T14593] usb 3-1: Product: syz [ 1598.846921][T14593] usb 3-1: Manufacturer: syz [ 1598.853011][T14593] usb 3-1: SerialNumber: syz [ 1598.873577][T14593] usb 3-1: config 0 descriptor?? [ 1598.911309][T14593] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1599.006084][T14593] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1599.357327][T16628] udevd[16628]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1599.393663][ T29] audit: type=1326 audit(1723351081.187:1133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17153 comm="syz.3.1809" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f90f779f9 code=0x0 [ 1599.663353][T13726] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1599.673705][T13726] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1599.685843][T13726] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1599.707913][T13726] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1599.721240][ T7726] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1599.735103][T13726] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1599.754009][T13726] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1600.944643][ T940] usb 3-1: USB disconnect, device number 54 [ 1600.994015][ T7726] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1601.335801][ T29] audit: type=1107 audit(1723351083.137:1134): pid=17170 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1601.403210][ T7726] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1601.497087][T17181] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1601.514261][T17173] dccp_v6_rcv: dropped packet with invalid checksum [ 1601.525396][T17175] netlink: 'syz.3.1812': attribute type 4 has an invalid length. [ 1601.633625][T17177] netlink: 'syz.3.1812': attribute type 4 has an invalid length. [ 1601.651024][T17169] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1601.754256][ T7726] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1601.855745][T17186] netlink: 'syz.0.1814': attribute type 2 has an invalid length. [ 1601.883713][T13719] Bluetooth: hci0: command tx timeout [ 1602.407285][ T940] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 1602.649257][ T940] usb 1-1: Using ep0 maxpacket: 8 [ 1602.675220][ T940] usb 1-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice=b4.99 [ 1602.701100][ T940] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.712590][ T940] usb 1-1: Product: syz [ 1602.717157][ T940] usb 1-1: Manufacturer: syz [ 1602.724416][ T940] usb 1-1: SerialNumber: syz [ 1602.779937][ T940] usb 1-1: config 0 descriptor?? [ 1602.917732][ T940] rtsx_usb 1-1:0.0: probe with driver rtsx_usb failed with error -22 [ 1604.001849][T13726] Bluetooth: hci0: command tx timeout [ 1604.485194][ T7726] bridge_slave_1: left allmulticast mode [ 1604.492234][ T7726] bridge_slave_1: left promiscuous mode [ 1604.499210][ T7726] bridge0: port 2(bridge_slave_1) entered disabled state [ 1604.527382][T14593] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1604.540821][ T7726] bridge_slave_0: left allmulticast mode [ 1604.564132][ T7726] bridge_slave_0: left promiscuous mode [ 1604.584240][ T7726] bridge0: port 1(bridge_slave_0) entered disabled state [ 1604.672756][ T5292] usb 1-1: USB disconnect, device number 46 [ 1604.767264][T14593] usb 3-1: Using ep0 maxpacket: 16 [ 1604.835836][T14593] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1604.855604][T14593] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1604.874719][T14593] usb 3-1: Product: syz [ 1604.914961][T14593] usb 3-1: Manufacturer: syz [ 1604.921484][T14593] usb 3-1: SerialNumber: syz [ 1604.949684][T14593] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1604.967703][T14593] r8152-cfgselector 3-1: config 0 descriptor?? [ 1605.039061][T13726] Bluetooth: hci5: command 0x0406 tx timeout [ 1605.419937][T17210] libceph: resolve '. [ 1605.419937][T17210] #)|.fǝa2sow?'%ЏKAqfCzeSb3L)HyoǤYMhE$ [ 1605.419937][T17210] ' (ret=-3): failed [ 1606.078425][T13719] Bluetooth: hci0: command tx timeout [ 1606.080903][T17205] dlm: no locking on control device [ 1606.091750][ T29] audit: type=1400 audit(1723351087.877:1135): avc: denied { append } for pid=17200 comm="syz.0.1818" name="dlm-control" dev="devtmpfs" ino=94 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1606.813085][ T7726] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1606.869242][ T7726] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1606.887238][ T7726] bond0 (unregistering): Released all slaves [ 1607.052301][T17158] chnl_net:caif_netlink_parms(): no params data found [ 1607.901500][T17221] fuse: Bad value for 'fd' [ 1608.090291][ T1264] ieee802154 phy0 wpan0: encryption failed: -22 [ 1608.096629][ T1264] ieee802154 phy1 wpan1: encryption failed: -22 [ 1608.158540][T13719] Bluetooth: hci0: command tx timeout [ 1608.564548][ T29] audit: type=1326 audit(1723351090.347:1136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17226 comm="syz.1.1821" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa54d3779f9 code=0x0 [ 1608.676716][T14593] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1608.710281][T14593] r8152-cfgselector 3-1: bad CDC descriptors [ 1608.742979][ T7726] hsr_slave_0: left promiscuous mode [ 1608.764332][ T7726] hsr_slave_1: left promiscuous mode [ 1608.804011][T14593] r8152-cfgselector 3-1: USB disconnect, device number 55 [ 1608.834027][ T7726] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1609.024505][ T7726] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1609.529187][ T7726] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1609.766551][ T7726] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1609.989667][ T7726] veth1_macvtap: left promiscuous mode [ 1610.017896][ T7726] veth0_macvtap: left promiscuous mode [ 1610.039713][ T7726] veth1_vlan: left promiscuous mode [ 1610.050348][ T7726] veth0_vlan: left promiscuous mode [ 1611.122478][ T7726] team0 (unregistering): Port device team_slave_1 removed [ 1611.190846][ T7726] team0 (unregistering): Port device team_slave_0 removed [ 1611.436852][T17256] orangefs_mount: mount request failed with -4 [ 1611.990632][T17266] FAULT_INJECTION: forcing a failure. [ 1611.990632][T17266] name failslab, interval 1, probability 0, space 0, times 0 [ 1612.004995][T17266] CPU: 0 UID: 0 PID: 17266 Comm: syz.0.1827 Not tainted 6.11.0-rc2-syzkaller-00257-g5189dafa4cf9 #0 [ 1612.015778][T17266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 1612.025822][T17266] Call Trace: [ 1612.029108][T17266] [ 1612.032042][T17266] dump_stack_lvl+0x16c/0x1f0 [ 1612.036720][T17266] should_fail_ex+0x497/0x5b0 [ 1612.041402][T17266] should_failslab+0xc2/0x120 [ 1612.046088][T17266] kmem_cache_alloc_noprof+0x6e/0x2f0 [ 1612.051464][T17266] ? skb_clone+0x190/0x3f0 [ 1612.055882][T17266] skb_clone+0x190/0x3f0 [ 1612.060125][T17266] netlink_deliver_tap+0xab3/0xd90 [ 1612.065239][T17266] netlink_unicast+0x606/0x830 [ 1612.070004][T17266] ? __pfx_netlink_unicast+0x10/0x10 [ 1612.075292][T17266] netlink_sendmsg+0x8b8/0xd70 [ 1612.080060][T17266] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1612.085346][T17266] sock_sendmsg+0x3cb/0x470 [ 1612.089853][T17266] ? pipe_lock+0x64/0x80 [ 1612.094098][T17266] ? __pfx_sock_sendmsg+0x10/0x10 [ 1612.099126][T17266] ? __pfx_lock_release+0x10/0x10 [ 1612.104153][T17266] splice_to_socket+0xab2/0x1040 [ 1612.109095][T17266] ? __pfx_splice_to_socket+0x10/0x10 [ 1612.114467][T17266] ? mark_lock+0xb5/0xc60 [ 1612.118809][T17266] ? inode_has_perm+0x16f/0x1d0 [ 1612.123668][T17266] ? security_file_permission+0x98/0xc0 [ 1612.129223][T17266] ? __pfx_splice_to_socket+0x10/0x10 [ 1612.134595][T17266] do_splice+0x148c/0x1f90 [ 1612.139029][T17266] ? find_held_lock+0x2d/0x110 [ 1612.143806][T17266] ? __pfx_do_splice+0x10/0x10 [ 1612.148583][T17266] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1612.154047][T17266] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1612.160062][T17266] __do_splice+0x327/0x360 [ 1612.164628][T17266] ? __pfx___do_splice+0x10/0x10 [ 1612.169575][T17266] __x64_sys_splice+0x1d2/0x260 [ 1612.174429][T17266] do_syscall_64+0xcd/0x250 [ 1612.178940][T17266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1612.184850][T17266] RIP: 0033:0x7fc4925779f9 [ 1612.189261][T17266] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1612.208874][T17266] RSP: 002b:00007fc4933c2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 1612.217295][T17266] RAX: ffffffffffffffda RBX: 00007fc492706058 RCX: 00007fc4925779f9 [ 1612.225263][T17266] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 1612.233230][T17266] RBP: 00007fc4933c2090 R08: 00000000000083b1 R09: 0000000000000000 [ 1612.241198][T17266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1612.249168][T17266] R13: 0000000000000001 R14: 00007fc492706058 R15: 00007fff3b4c2158 [ 1612.257145][T17266] [ 1612.404047][T17266] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1827'. [ 1612.425255][T17266] tipc: Invalid UDP bearer configuration [ 1612.425376][T17266] tipc: Enabling of bearer rejected, failed to enable media [ 1613.554635][T17158] bridge0: port 1(bridge_slave_0) entered blocking state [ 1613.572374][T17158] bridge0: port 1(bridge_slave_0) entered disabled state [ 1613.581863][T17158] bridge_slave_0: entered allmulticast mode [ 1613.615808][T17158] bridge_slave_0: entered promiscuous mode [ 1613.656896][T17158] bridge0: port 2(bridge_slave_1) entered blocking state [ 1613.697992][T17158] bridge0: port 2(bridge_slave_1) entered disabled state [ 1613.718802][T17158] bridge_slave_1: entered allmulticast mode [ 1613.736118][T17158] bridge_slave_1: entered promiscuous mode [ 1614.017808][ T1171] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1614.030735][T17158] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1614.036053][ T5292] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 1614.055042][T17158] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1614.247293][ T1171] usb 4-1: Using ep0 maxpacket: 16 [ 1614.386637][ T1171] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1614.619222][T17158] team0: Port device team_slave_0 added [ 1614.638042][ T1171] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1614.686599][ T1171] usb 4-1: Product: syz [ 1614.724235][ T1171] usb 4-1: Manufacturer: syz [ 1614.749342][ T1171] usb 4-1: SerialNumber: syz [ 1614.791832][T17158] team0: Port device team_slave_1 added [ 1614.832420][ T1171] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1614.851437][ T1171] r8152-cfgselector 4-1: config 0 descriptor?? [ 1614.903072][ T47] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1614.936343][T17158] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1614.947238][ T5292] usb 1-1: Using ep0 maxpacket: 8 [ 1614.961066][T17158] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1614.988383][ T5292] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1614.998475][T17158] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1615.032938][ T5292] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1615.118418][ T47] usb 3-1: Using ep0 maxpacket: 32 [ 1615.166902][ T5292] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 1615.199924][T17158] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1615.298038][ T47] usb 3-1: config 0 has no interfaces? [ 1615.355127][T17158] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1615.419552][ T5292] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1615.527029][ T47] usb 3-1: New USB device found, idVendor=413c, idProduct=819b, bcdDevice=a7.c0 [ 1615.887286][ T5292] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1615.907048][T17158] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1615.907152][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.945694][T17306] libceph: resolve '. [ 1615.945694][T17306] #)|.fǝa2sow?'%ЏKAqfCzeSb3L)HyoǤYMhE$ [ 1615.945694][T17306] ' (ret=-3): failed [ 1615.957030][ T5292] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1615.974242][ T47] usb 3-1: Product: syz [ 1615.995424][ T47] usb 3-1: Manufacturer: syz [ 1616.007641][ T47] usb 3-1: SerialNumber: syz [ 1616.014081][ T5292] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1616.049606][ T47] usb 3-1: config 0 descriptor?? [ 1616.231475][T17158] hsr_slave_0: entered promiscuous mode [ 1616.285284][T17158] hsr_slave_1: entered promiscuous mode [ 1616.287177][ T5292] usb 1-1: GET_CAPABILITIES returned 0 [ 1616.320100][ T5292] usbtmc 1-1:16.0: can't read capabilities [ 1616.623733][ T5276] usb 1-1: USB disconnect, device number 47 [ 1617.467271][ T5292] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1617.939628][T17132] usb 3-1: USB disconnect, device number 56 [ 1617.967951][ T5292] usb 2-1: Using ep0 maxpacket: 8 [ 1618.024580][ T5292] usb 2-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1618.067130][ T5292] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1618.075157][ T5292] usb 2-1: Product: syz [ 1618.145898][ T5292] usb 2-1: Manufacturer: syz [ 1618.159769][ T5292] usb 2-1: SerialNumber: syz [ 1618.390526][ T5292] usb 2-1: config 0 descriptor?? [ 1618.985074][T17330] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1837'. [ 1620.429876][ T1171] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1620.436382][ T1171] r8152-cfgselector 4-1: bad CDC descriptors [ 1620.495836][ T5292] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1620.660083][ T5292] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1620.788463][ T5292] usb 2-1: USB disconnect, device number 42 [ 1621.022164][T16628] udevd[16628]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1621.575680][ T940] r8152-cfgselector 4-1: USB disconnect, device number 58 [ 1621.703695][T17347] fuse: Bad value for 'fd' [ 1621.765362][ T29] audit: type=1400 audit(1723351103.567:1137): avc: denied { accept } for pid=17356 comm="syz.3.1842" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1621.837689][T17339] orangefs_mount: mount request failed with -4 [ 1623.125652][T17158] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1623.292584][T17158] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1623.531822][T17158] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1623.886345][T17158] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1624.417489][ T29] audit: type=1400 audit(1723351106.187:1138): avc: denied { connect } for pid=17372 comm="syz.2.1845" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1624.511381][ T29] audit: type=1326 audit(1723351106.248:1139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17372 comm="syz.2.1845" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f26621779f9 code=0x0 [ 1624.677572][ T940] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 1624.773018][T17387] binder: BINDER_SET_CONTEXT_MGR already set [ 1624.784011][T17387] binder: 17383:17387 ioctl 4018620d 20000100 returned -16 [ 1624.830666][T17158] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1624.855101][ T29] audit: type=1326 audit(1723351106.688:1140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f90f779f9 code=0x7ffc0000 [ 1624.887138][ T940] usb 1-1: Using ep0 maxpacket: 32 [ 1624.894940][ T940] usb 1-1: config 0 has no interfaces? [ 1624.906757][T17158] 8021q: adding VLAN 0 to HW filter on device team0 [ 1624.931890][ T940] usb 1-1: New USB device found, idVendor=413c, idProduct=819b, bcdDevice=a7.c0 [ 1624.957634][ T7726] bridge0: port 1(bridge_slave_0) entered blocking state [ 1624.964752][ T7726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1624.979840][ T29] audit: type=1326 audit(1723351106.718:1141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f90f779f9 code=0x7ffc0000 [ 1625.014112][ T940] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.055450][ T940] usb 1-1: Product: syz [ 1625.057066][ T29] audit: type=1326 audit(1723351106.728:1142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7f90f779f9 code=0x7ffc0000 [ 1625.063177][ T940] usb 1-1: Manufacturer: syz [ 1625.096330][ T1056] bridge0: port 2(bridge_slave_1) entered blocking state [ 1625.103465][ T1056] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1625.135125][ T29] audit: type=1326 audit(1723351106.748:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f90f779f9 code=0x7ffc0000 [ 1625.202806][ T940] usb 1-1: SerialNumber: syz [ 1625.222249][T17390] netlink: 'syz.1.1848': attribute type 4 has an invalid length. [ 1625.248044][ T940] usb 1-1: config 0 descriptor?? [ 1625.323979][ T29] audit: type=1326 audit(1723351106.748:1144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f90f779f9 code=0x7ffc0000 [ 1625.552741][ T29] audit: type=1326 audit(1723351106.758:1145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7f90f76390 code=0x7ffc0000 [ 1625.585780][ T29] audit: type=1326 audit(1723351106.758:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17383 comm="syz.3.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f7f90f79187 code=0x7ffc0000 [ 1625.830562][T17158] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1625.864629][T17158] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1626.047294][ T47] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1626.461861][T17390] netlink: 'syz.1.1848': attribute type 4 has an invalid length. [ 1626.507367][ T940] usb 1-1: USB disconnect, device number 48 [ 1626.558651][ T47] usb 3-1: Using ep0 maxpacket: 8 [ 1626.569070][ T47] usb 3-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1626.644279][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1626.688645][ T47] usb 3-1: Product: syz [ 1626.713641][ T47] usb 3-1: Manufacturer: syz [ 1626.729475][ T47] usb 3-1: SerialNumber: syz [ 1626.778576][ T47] usb 3-1: config 0 descriptor?? [ 1626.804900][ T47] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1627.662482][ T47] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1627.892893][T16628] udevd[16628]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1627.972477][T17158] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1629.006790][T17132] usb 3-1: USB disconnect, device number 57 [ 1630.941089][T13719] Bluetooth: hci2: command 0x0406 tx timeout [ 1631.229425][ T47] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1631.267236][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 1631.267256][ T29] audit: type=1326 audit(1723351113.098:1156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17440 comm="syz.1.1857" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa54d3779f9 code=0x0 [ 1631.477203][ T47] usb 3-1: Using ep0 maxpacket: 16 [ 1631.487883][ T47] usb 3-1: config 0 has an invalid descriptor of length 13, skipping remainder of the config [ 1631.508589][ T47] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1631.550572][ T47] usb 3-1: New USB device found, idVendor=110a, idProduct=1653, bcdDevice=5e.a7 [ 1631.571072][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1631.609758][ T47] usb 3-1: Product: syz [ 1631.614038][ T47] usb 3-1: Manufacturer: syz [ 1631.635136][ T47] usb 3-1: SerialNumber: syz [ 1631.678405][ T47] usb 3-1: config 0 descriptor?? [ 1631.825971][T17158] veth0_vlan: entered promiscuous mode [ 1632.592248][T17158] veth1_vlan: entered promiscuous mode [ 1632.736099][ T940] usb 3-1: USB disconnect, device number 58 [ 1632.843286][T17158] veth0_macvtap: entered promiscuous mode [ 1632.909450][T17158] veth1_macvtap: entered promiscuous mode [ 1633.014317][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1633.047095][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.077450][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1633.102002][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.126996][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1633.157108][ T5228] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 1633.167008][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.188112][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1633.250508][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.299469][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1633.350397][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.367324][ T5228] usb 1-1: Using ep0 maxpacket: 32 [ 1633.386024][ T5228] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1633.394974][T17158] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1633.447535][ T5228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1633.485079][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1633.502928][ T5228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1633.529767][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.543738][ T5228] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1633.577153][ T5228] usb 1-1: New USB device found, idVendor=1b96, idProduct=9f0a, bcdDevice= 0.15 [ 1633.599232][ T5228] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1633.602412][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1633.625285][ T5228] usb 1-1: config 0 descriptor?? [ 1633.689775][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.702401][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1633.713170][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.726520][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1633.737381][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.761963][T17158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1633.786754][T17158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1633.800324][T17158] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1633.903656][T17158] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1633.944291][T17158] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1633.973859][T17158] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1634.012335][T17158] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1634.142767][ T5228] hid-generic 0003:1B96:9F0A.000E: hidraw0: USB HID v0.00 Device [HID 1b96:9f0a] on usb-dummy_hcd.0-1/input0 [ 1634.345606][T17465] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1634.382011][ T6603] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1634.437776][T17465] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1634.445595][ T6603] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1634.593836][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1634.614148][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1634.727058][ T940] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1635.124510][ T940] usb 4-1: Using ep0 maxpacket: 32 [ 1635.125809][ T5276] usb 1-1: USB disconnect, device number 49 [ 1635.139022][ T940] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 1635.461258][T17510] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1866'. [ 1635.664090][ T940] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1635.679644][ T940] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1635.698270][ T940] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1635.713791][ T940] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1635.724679][ T940] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1635.745752][ T940] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1635.757722][T13726] Bluetooth: hci6: command 0x0406 tx timeout [ 1635.895268][T17513] dccp_v6_rcv: dropped packet with invalid checksum [ 1635.902146][ T940] usb 4-1: Product: syz [ 1635.927362][ T940] usb 4-1: Manufacturer: syz [ 1635.932006][ T940] usb 4-1: SerialNumber: syz [ 1635.993313][ T940] usb 4-1: config 0 descriptor?? [ 1636.090473][ T940] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1636.150204][ T940] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1636.516411][ T5228] usb 4-1: USB disconnect, device number 59 [ 1636.530096][ T29] audit: type=1107 audit(1723351118.368:1157): pid=17518 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1636.551226][T17524] netlink: 'syz.2.1867': attribute type 4 has an invalid length. [ 1636.798161][ T5228] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 1637.469819][T17534] netlink: 'syz.2.1867': attribute type 4 has an invalid length. [ 1638.781389][ T5228] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1638.999349][ T5228] usb 2-1: device descriptor read/64, error -71 [ 1639.290300][ T5228] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1639.468041][ T5228] usb 2-1: device descriptor read/64, error -71 [ 1639.482927][ T29] audit: type=1107 audit(1723351121.318:1158): pid=17563 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1639.503098][T17567] netlink: 'syz.2.1874': attribute type 4 has an invalid length. [ 1639.589026][ T5228] usb usb2-port1: attempt power cycle [ 1639.651998][T17567] netlink: 'syz.2.1874': attribute type 4 has an invalid length. [ 1640.067096][ T5228] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 1640.268146][ T5228] usb 2-1: device descriptor read/8, error -71 [ 1641.867176][ T940] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1642.898623][ T940] usb 5-1: Using ep0 maxpacket: 8 [ 1642.934623][ T940] usb 5-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1642.955722][ T940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1643.120631][ T940] usb 5-1: Product: syz [ 1643.124897][ T940] usb 5-1: Manufacturer: syz [ 1643.139815][ T940] usb 5-1: SerialNumber: syz [ 1643.167114][ T5228] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1643.175820][ T940] usb 5-1: config 0 descriptor?? [ 1643.357958][ T5228] usb 2-1: Using ep0 maxpacket: 8 [ 1643.369319][ T5228] usb 2-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1643.377426][ T940] usb 5-1: can't set config #0, error -71 [ 1643.378846][ T5228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1644.035724][ T5228] usb 2-1: Product: syz [ 1644.047059][ T5228] usb 2-1: Manufacturer: syz [ 1644.056007][ T5228] usb 2-1: SerialNumber: syz [ 1644.064639][ T5228] usb 2-1: config 0 descriptor?? [ 1644.076494][ T5228] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1644.128449][ T940] usb 5-1: USB disconnect, device number 58 [ 1644.333197][ T5228] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1644.559743][T16628] udevd[16628]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1644.703185][T17612] dccp_v6_rcv: dropped packet with invalid checksum [ 1648.733376][ T5228] usb 2-1: USB disconnect, device number 46 [ 1650.863778][ T29] audit: type=1400 audit(1723351132.668:1159): avc: denied { write } for pid=17629 comm="syz.4.1889" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1651.448808][ T1171] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1651.817129][ T1171] usb 2-1: device descriptor read/64, error -71 [ 1652.107929][ T1171] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 1652.297077][ T1171] usb 2-1: device descriptor read/64, error -71 [ 1652.456388][ T1171] usb usb2-port1: attempt power cycle [ 1653.430185][T13726] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1653.447812][T13726] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1653.456082][T13726] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1653.464203][T13726] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1653.472363][T13726] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1653.502535][ T29] audit: type=1107 audit(1723351135.328:1160): pid=17644 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1653.561912][T13726] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1653.619227][T17647] netlink: 'syz.4.1891': attribute type 4 has an invalid length. [ 1653.677055][ T1171] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1653.728875][ T1171] usb 2-1: device descriptor read/8, error -71 [ 1653.742076][T17659] netlink: 'syz.4.1891': attribute type 4 has an invalid length. [ 1653.797267][T14593] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1653.798399][T17662] FAULT_INJECTION: forcing a failure. [ 1653.798399][T17662] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1653.818023][T17662] CPU: 0 UID: 0 PID: 17662 Comm: syz.3.1894 Not tainted 6.11.0-rc2-syzkaller-00257-g5189dafa4cf9 #0 [ 1653.828813][T17662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 1653.838883][T17662] Call Trace: [ 1653.842177][T17662] [ 1653.845123][T17662] dump_stack_lvl+0x16c/0x1f0 [ 1653.849840][T17662] should_fail_ex+0x497/0x5b0 [ 1653.854561][T17662] _copy_to_user+0x30/0xc0 [ 1653.859011][T17662] simple_read_from_buffer+0xd0/0x160 [ 1653.864412][T17662] proc_fail_nth_read+0x1b0/0x290 [ 1653.869468][T17662] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1653.875042][T17662] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1653.880612][T17662] vfs_read+0x1d4/0xbd0 [ 1653.884804][T17662] ? ioctl_has_perm.constprop.0.isra.0+0x2f0/0x470 [ 1653.891328][T17662] ? __fdget_pos+0xeb/0x180 [ 1653.895852][T17662] ? __pfx_vfs_read+0x10/0x10 [ 1653.900562][T17662] ? __pfx___mutex_lock+0x10/0x10 [ 1653.905617][T17662] ? __fget_files+0x256/0x400 [ 1653.910326][T17662] ksys_read+0x12f/0x260 [ 1653.914589][T17662] ? __pfx_ksys_read+0x10/0x10 [ 1653.919380][T17662] do_syscall_64+0xcd/0x250 [ 1653.923915][T17662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1653.929852][T17662] RIP: 0033:0x7f7f90f7643c [ 1653.934289][T17662] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 69 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 bf 8d 02 00 48 [ 1653.953908][T17662] RSP: 002b:00007f7f91ddc030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1653.962331][T17662] RAX: ffffffffffffffda RBX: 00007f7f91105f80 RCX: 00007f7f90f7643c [ 1653.970314][T17662] RDX: 000000000000000f RSI: 00007f7f91ddc0a0 RDI: 0000000000000005 [ 1653.978287][T17662] RBP: 00007f7f91ddc090 R08: 0000000000000000 R09: 0000000000000000 [ 1653.986255][T17662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1653.994224][T17662] R13: 0000000000000000 R14: 00007f7f91105f80 R15: 00007ffcb0763648 [ 1654.002207][T17662] [ 1654.198876][T14593] usb 3-1: Using ep0 maxpacket: 32 [ 1654.213671][T14593] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 1654.218288][ T1056] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1654.228789][T14593] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1654.253286][T14593] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1654.371844][T14593] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1654.541040][T14593] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1654.703310][T14593] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1654.738684][T14593] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1654.796813][T14593] usb 3-1: Product: syz [ 1654.864060][T14593] usb 3-1: Manufacturer: syz [ 1654.924207][T14593] usb 3-1: SerialNumber: syz [ 1655.037594][T14593] usb 3-1: config 0 descriptor?? [ 1655.072412][T14593] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1655.096449][T14593] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1655.134658][T17673] dccp_v6_rcv: dropped packet with invalid checksum [ 1655.280987][ T1056] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1655.349518][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 1655.370506][ T1171] usb 3-1: USB disconnect, device number 59 [ 1655.442163][ T1171] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1655.690674][T13726] Bluetooth: hci2: command tx timeout [ 1656.031246][ T29] audit: type=1400 audit(1723351137.638:1161): avc: denied { write } for pid=17677 comm="syz.1.1898" name="nullb0" dev="devtmpfs" ino=682 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1656.056862][ T1056] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1656.298575][ T1056] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1656.342887][ T29] audit: type=1326 audit(1723351138.178:1162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17684 comm="syz.1.1899" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa54d3779f9 code=0x0 [ 1656.365944][ C0] vkms_vblank_simulate: vblank timer overrun [ 1656.401985][ T1171] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1656.607835][ T1171] usb 3-1: Using ep0 maxpacket: 8 [ 1656.632638][ T1171] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1656.650875][ T1171] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1656.720706][ T1171] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 42157, setting to 1024 [ 1656.759537][ T1171] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1656.774785][ T1171] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1656.813992][ T1171] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1656.846559][ T1171] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1656.868919][ T1171] usb 3-1: can't set config #16, error -71 [ 1656.894598][ T1171] usb 3-1: USB disconnect, device number 60 [ 1657.119251][ T1056] bridge_slave_1: left allmulticast mode [ 1657.124904][ T1056] bridge_slave_1: left promiscuous mode [ 1657.144620][ T1056] bridge0: port 2(bridge_slave_1) entered disabled state [ 1657.971289][ T1056] bridge_slave_0: left allmulticast mode [ 1658.032126][ T1056] bridge_slave_0: left promiscuous mode [ 1658.077347][T13726] Bluetooth: hci2: command tx timeout [ 1658.107492][ T1056] bridge0: port 1(bridge_slave_0) entered disabled state [ 1658.326324][T17693] xt_cluster: you have exceeded the maximum number of cluster nodes (16128 > 32) [ 1658.565819][T17708] sock: sock_timestamping_bind_phc: sock not bind to device [ 1660.150190][ T5228] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1660.159472][T13719] Bluetooth: hci2: command tx timeout [ 1660.332653][ T5228] usb 2-1: device descriptor read/64, error -71 [ 1660.701989][ T5228] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1660.887086][ T5228] usb 2-1: device descriptor read/64, error -71 [ 1661.018223][ T5228] usb usb2-port1: attempt power cycle [ 1661.320919][T17735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1906'. [ 1661.357319][T13719] Bluetooth: hci3: command 0x0406 tx timeout [ 1661.383840][ T29] audit: type=1107 audit(1723351143.148:1163): pid=17733 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1661.469466][ T5228] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1661.509662][ T5228] usb 2-1: device descriptor read/8, error -71 [ 1661.667062][T17725] orangefs_mount: mount request failed with -4 [ 1661.765900][ T29] audit: type=1400 audit(1723351143.588:1164): avc: denied { sqpoll } for pid=17740 comm="syz.3.1909" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1661.819879][ T5228] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1661.842349][ T1056] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1661.888383][ T5228] usb 2-1: device descriptor read/8, error -71 [ 1661.904282][ T1056] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1661.956086][ T1056] bond0 (unregistering): Released all slaves [ 1661.992904][T17654] chnl_net:caif_netlink_parms(): no params data found [ 1662.049601][ T5228] usb usb2-port1: unable to enumerate USB device [ 1662.237069][T13726] Bluetooth: hci2: command tx timeout [ 1662.273898][T13726] Bluetooth: hci6: SCO packet for unknown connection handle 200 [ 1662.460277][T17654] bridge0: port 1(bridge_slave_0) entered blocking state [ 1662.536378][T17654] bridge0: port 1(bridge_slave_0) entered disabled state [ 1662.544292][T17754] vivid-000: ================= START STATUS ================= [ 1662.552053][T17754] vivid-000: Generate PTS: true [ 1662.557155][T17754] vivid-000: Generate SCR: true [ 1662.562057][T17754] tpg source WxH: 320x180 (Y'CbCr) [ 1662.568119][T17754] tpg field: 1 [ 1662.571508][T17754] tpg crop: 320x180@0x0 [ 1662.575686][T17754] tpg compose: 320x180@0x0 [ 1662.580285][T17754] tpg colorspace: 8 [ 1662.584108][T17754] tpg transfer function: 0/0 [ 1662.585629][T17654] bridge_slave_0: entered allmulticast mode [ 1662.588835][T17754] tpg Y'CbCr encoding: 0/0 [ 1662.588852][T17754] tpg quantization: 0/0 [ 1662.588872][T17754] tpg RGB range: 0/2 [ 1662.588886][T17754] vivid-000: ================== END STATUS ================== [ 1662.639082][T17654] bridge_slave_0: entered promiscuous mode [ 1662.947430][T17654] bridge0: port 2(bridge_slave_1) entered blocking state [ 1662.947541][ T6421] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1663.038781][T17654] bridge0: port 2(bridge_slave_1) entered disabled state [ 1663.187405][ T6421] usb 4-1: Using ep0 maxpacket: 8 [ 1663.510242][ T6421] usb 4-1: config index 0 descriptor too short (expected 6427, got 27) [ 1663.536454][ T6421] usb 4-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 1663.566177][ T6421] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 241 [ 1663.577254][T17654] bridge_slave_1: entered allmulticast mode [ 1663.584193][T17654] bridge_slave_1: entered promiscuous mode [ 1663.618488][ T6421] usb 4-1: config 0 has no interface number 0 [ 1663.625200][ T6421] usb 4-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1663.707059][ T6421] usb 4-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1663.740434][ T6421] usb 4-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1663.779202][ T6421] usb 4-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1663.841638][ T6421] usb 4-1: New USB device strings: Mfr=228, Product=255, SerialNumber=0 [ 1663.875036][T17654] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1663.891027][ T6421] usb 4-1: Product: syz [ 1663.895223][ T6421] usb 4-1: Manufacturer: syz [ 1664.011563][ T29] audit: type=1107 audit(1723351145.848:1165): pid=17775 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1664.033061][ T6421] usb 4-1: config 0 descriptor?? [ 1664.041854][ T1056] hsr_slave_0: left promiscuous mode [ 1664.069081][T17754] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1664.185582][ T1056] hsr_slave_1: left promiscuous mode [ 1664.201583][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1664.247150][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1664.281982][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1664.304564][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1664.432399][ T1056] veth1_macvtap: left promiscuous mode [ 1664.487724][T17754] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1664.496363][T17754] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1664.514296][ T1056] veth0_macvtap: left promiscuous mode [ 1664.587515][ T1056] veth1_vlan: left promiscuous mode [ 1664.622585][ T1056] veth0_vlan: left promiscuous mode [ 1665.551445][ T6421] usb 4-1: USB disconnect, device number 60 [ 1669.536146][ T1264] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.542567][ T1264] ieee802154 phy1 wpan1: encryption failed: -22 [ 1676.973655][T17803] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1676.986434][T17803] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1677.018820][T13719] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1677.037740][T17806] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1677.052671][T17806] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1677.063300][T13719] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1677.071168][T17806] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1677.090271][T17806] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1677.097960][T17806] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1677.110482][T17807] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1677.119524][T17807] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1677.127883][T17807] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1677.130530][T17806] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1677.148304][T17807] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1677.157279][T17803] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1677.168425][T17803] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1677.213319][T17807] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1677.221298][T17806] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 1677.230076][T17806] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1677.230076][T17807] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1677.251019][T17806] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1677.295059][T13719] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1677.309746][T13719] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 1677.318132][T13719] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1677.509603][ T1056] team0 (unregistering): Port device team_slave_1 removed [ 1677.573083][ T1056] team0 (unregistering): Port device team_slave_0 removed [ 1678.023540][T17654] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1678.045917][T17779] netlink: 'syz.4.1915': attribute type 4 has an invalid length. [ 1678.072816][T17782] netlink: 'syz.4.1915': attribute type 4 has an invalid length. [ 1678.615949][T17654] team0: Port device team_slave_0 added [ 1678.629159][T17654] team0: Port device team_slave_1 added [ 1678.774225][T17654] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1678.781847][T17654] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1678.808186][T17654] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1678.880983][T17654] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1678.888654][T17654] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1678.916864][T17654] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1679.199003][T13719] Bluetooth: hci4: command tx timeout [ 1679.199051][T17803] Bluetooth: hci3: command tx timeout [ 1679.264852][T17654] hsr_slave_0: entered promiscuous mode [ 1679.279525][T17654] hsr_slave_1: entered promiscuous mode [ 1679.286105][T17654] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1679.302783][T17654] Cannot create hsr debugfs directory [ 1679.357409][T17803] Bluetooth: hci7: command tx timeout [ 1679.357458][T13719] Bluetooth: hci6: command tx timeout [ 1679.785379][ T1056] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1679.952469][ T1056] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1680.082815][ T1056] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1680.130421][T17801] chnl_net:caif_netlink_parms(): no params data found [ 1680.145986][T17804] chnl_net:caif_netlink_parms(): no params data found [ 1680.185033][T17808] chnl_net:caif_netlink_parms(): no params data found [ 1680.203986][T17811] chnl_net:caif_netlink_parms(): no params data found [ 1680.398175][ T1056] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1681.076696][T17804] bridge0: port 1(bridge_slave_0) entered blocking state [ 1681.085096][T17804] bridge0: port 1(bridge_slave_0) entered disabled state [ 1681.093961][T17804] bridge_slave_0: entered allmulticast mode [ 1681.102380][T17804] bridge_slave_0: entered promiscuous mode [ 1681.192373][T17801] bridge0: port 1(bridge_slave_0) entered blocking state [ 1681.199741][T17801] bridge0: port 1(bridge_slave_0) entered disabled state [ 1681.206870][T17801] bridge_slave_0: entered allmulticast mode [ 1681.216069][T17801] bridge_slave_0: entered promiscuous mode [ 1681.227246][T17804] bridge0: port 2(bridge_slave_1) entered blocking state [ 1681.234400][T17804] bridge0: port 2(bridge_slave_1) entered disabled state [ 1681.244121][T17804] bridge_slave_1: entered allmulticast mode [ 1681.251634][T17804] bridge_slave_1: entered promiscuous mode [ 1681.276914][T17808] bridge0: port 1(bridge_slave_0) entered blocking state [ 1681.277161][T13719] Bluetooth: hci4: command tx timeout [ 1681.277422][T17803] Bluetooth: hci3: command tx timeout [ 1681.295484][T17808] bridge0: port 1(bridge_slave_0) entered disabled state [ 1681.302879][T17808] bridge_slave_0: entered allmulticast mode [ 1681.310767][T17808] bridge_slave_0: entered promiscuous mode [ 1681.319939][T17808] bridge0: port 2(bridge_slave_1) entered blocking state [ 1681.327259][T17808] bridge0: port 2(bridge_slave_1) entered disabled state [ 1681.334484][T17808] bridge_slave_1: entered allmulticast mode [ 1681.344364][T17808] bridge_slave_1: entered promiscuous mode [ 1681.379306][T17811] bridge0: port 1(bridge_slave_0) entered blocking state [ 1681.386484][T17811] bridge0: port 1(bridge_slave_0) entered disabled state [ 1681.393966][T17811] bridge_slave_0: entered allmulticast mode [ 1681.401887][T17811] bridge_slave_0: entered promiscuous mode [ 1681.411831][T17811] bridge0: port 2(bridge_slave_1) entered blocking state [ 1681.419152][T17811] bridge0: port 2(bridge_slave_1) entered disabled state [ 1681.426368][T17811] bridge_slave_1: entered allmulticast mode [ 1681.433936][T17811] bridge_slave_1: entered promiscuous mode [ 1681.440127][T17803] Bluetooth: hci6: command tx timeout [ 1681.440137][T13719] Bluetooth: hci7: command tx timeout [ 1681.456878][T17801] bridge0: port 2(bridge_slave_1) entered blocking state [ 1681.466370][T17801] bridge0: port 2(bridge_slave_1) entered disabled state [ 1681.474162][T17801] bridge_slave_1: entered allmulticast mode [ 1681.484241][T17801] bridge_slave_1: entered promiscuous mode [ 1681.546765][T17804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1681.665188][T17801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1681.685143][T17804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1681.742425][T17811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1681.756868][T17811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1681.780042][T17801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1681.830163][T17804] team0: Port device team_slave_0 added [ 1681.842446][T17808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1681.860032][T17808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1681.919810][ T1056] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.011521][ T1056] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.044744][T17804] team0: Port device team_slave_1 added [ 1682.082597][T17811] team0: Port device team_slave_0 added [ 1682.122015][T17801] team0: Port device team_slave_0 added [ 1682.158825][ T1056] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.194012][T17811] team0: Port device team_slave_1 added [ 1682.250393][T17801] team0: Port device team_slave_1 added [ 1682.302361][T17808] team0: Port device team_slave_0 added [ 1682.314137][T17808] team0: Port device team_slave_1 added [ 1682.343019][ T1056] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.358308][T17811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1682.365827][T17811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.392357][T17811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1682.454023][T17654] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1682.467589][T17804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1682.474552][T17804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.505049][T17804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1682.519195][T17804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1682.526160][T17804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.552659][T17804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1682.586260][T17811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1682.593633][T17811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.622712][T17811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1682.643379][T17801] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1682.651298][T17801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.678436][T17801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1682.689788][T17654] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1682.774833][T17808] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1682.782051][T17808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.811328][T17808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1682.824205][T17808] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1682.831426][T17808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.857993][T17808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1682.871129][T17801] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1682.880228][T17801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.906495][T17801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1682.928391][T17654] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1682.945106][T17654] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1683.044730][T17804] hsr_slave_0: entered promiscuous mode [ 1683.054682][T17804] hsr_slave_1: entered promiscuous mode [ 1683.061127][T17804] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1683.069148][T17804] Cannot create hsr debugfs directory [ 1683.101472][T17811] hsr_slave_0: entered promiscuous mode [ 1683.108658][T17811] hsr_slave_1: entered promiscuous mode [ 1683.116431][T17811] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1683.124566][T17811] Cannot create hsr debugfs directory [ 1683.201675][T17808] hsr_slave_0: entered promiscuous mode [ 1683.210105][T17808] hsr_slave_1: entered promiscuous mode [ 1683.224984][T17808] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1683.232656][T17808] Cannot create hsr debugfs directory [ 1683.359129][T17803] Bluetooth: hci4: command tx timeout [ 1683.364640][T13719] Bluetooth: hci3: command tx timeout [ 1683.384145][T17801] hsr_slave_0: entered promiscuous mode [ 1683.391841][T17801] hsr_slave_1: entered promiscuous mode [ 1683.398884][T17801] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1683.406454][T17801] Cannot create hsr debugfs directory [ 1683.518451][T17803] Bluetooth: hci6: command tx timeout [ 1683.525620][T13719] Bluetooth: hci7: command tx timeout [ 1683.620932][ T1056] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1683.786286][ T1056] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1683.928440][ T1056] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1684.081146][ T1056] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1684.592102][ T1056] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1684.771805][ T1056] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1684.826377][T17654] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1684.911323][ T1056] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1685.036808][ T1056] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1685.082678][T17654] 8021q: adding VLAN 0 to HW filter on device team0 [ 1685.128767][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1685.135971][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1685.170991][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1685.178220][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1685.437481][T17803] Bluetooth: hci4: command tx timeout [ 1685.442983][T13719] Bluetooth: hci3: command tx timeout [ 1685.543509][ T1056] bridge_slave_1: left allmulticast mode [ 1685.557101][ T1056] bridge_slave_1: left promiscuous mode [ 1685.562934][ T1056] bridge0: port 2(bridge_slave_1) entered disabled state [ 1685.597797][ T1056] bridge_slave_0: left allmulticast mode [ 1685.598402][T13719] Bluetooth: hci7: command tx timeout [ 1685.603457][ T1056] bridge_slave_0: left promiscuous mode [ 1685.609054][T17803] Bluetooth: hci6: command tx timeout [ 1685.627352][ T1056] bridge0: port 1(bridge_slave_0) entered disabled state [ 1685.644797][ T1056] bridge_slave_1: left allmulticast mode [ 1685.667123][ T1056] bridge_slave_1: left promiscuous mode [ 1685.673023][ T1056] bridge0: port 2(bridge_slave_1) entered disabled state [ 1685.706440][ T1056] bridge_slave_0: left allmulticast mode [ 1685.712286][ T1056] bridge_slave_0: left promiscuous mode [ 1685.718770][ T1056] bridge0: port 1(bridge_slave_0) entered disabled state [ 1685.731675][ T1056] bridge_slave_1: left allmulticast mode [ 1685.737581][ T1056] bridge_slave_1: left promiscuous mode [ 1685.744101][ T1056] bridge0: port 2(bridge_slave_1) entered disabled state [ 1685.773164][ T1056] bridge_slave_0: left allmulticast mode [ 1685.794132][ T1056] bridge_slave_0: left promiscuous mode [ 1685.800831][ T1056] bridge0: port 1(bridge_slave_0) entered disabled state [ 1685.826161][ T1056] bridge_slave_1: left allmulticast mode [ 1685.837537][ T1056] bridge_slave_1: left promiscuous mode [ 1685.843665][ T1056] bridge0: port 2(bridge_slave_1) entered disabled state [ 1685.872619][ T1056] bridge_slave_0: left allmulticast mode [ 1685.887100][ T1056] bridge_slave_0: left promiscuous mode [ 1685.892898][ T1056] bridge0: port 1(bridge_slave_0) entered disabled state [ 1688.053153][ T1056] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1688.065074][ T1056] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1688.076074][ T1056] bond0 (unregistering): Released all slaves [ 1688.210595][ T1056] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1688.223533][ T1056] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1688.237869][ T1056] bond0 (unregistering): Released all slaves [ 1688.367081][ T1056] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1688.380144][ T1056] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1688.391631][ T1056] bond0 (unregistering): Released all slaves [ 1688.522036][ T1056] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1688.575425][ T1056] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1688.587944][ T1056] bond0 (unregistering): Released all slaves [ 1688.829395][T17654] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1689.239380][T17654] veth0_vlan: entered promiscuous mode [ 1689.280196][T17654] veth1_vlan: entered promiscuous mode [ 1689.498805][T17654] veth0_macvtap: entered promiscuous mode [ 1689.608849][T17654] veth1_macvtap: entered promiscuous mode [ 1689.671395][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1689.705881][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.715954][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1689.726985][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.736804][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1689.747377][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.758667][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1689.770863][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.780727][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1689.791303][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.803084][T17654] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1689.831280][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.862493][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.874503][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.885509][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.896809][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.907486][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.917995][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.928588][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.938781][T17654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.949412][T17654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.961308][T17654] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1690.074249][T17654] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.106303][T17654] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.115336][T17654] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.137443][T17654] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.741025][T17804] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1690.764059][T17804] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1690.777242][T14184] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1690.785090][T14184] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1690.981799][T17804] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1691.097373][T17804] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1691.183099][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1691.209886][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1691.235090][ T1056] hsr_slave_0: left promiscuous mode [ 1691.246507][ T1056] hsr_slave_1: left promiscuous mode [ 1691.266569][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1691.287098][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1691.307957][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1691.315382][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1691.329902][ T1056] hsr_slave_0: left promiscuous mode [ 1691.336024][ T1056] hsr_slave_1: left promiscuous mode [ 1691.342988][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1691.355766][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1691.368450][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1691.375897][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1691.392905][ T1056] hsr_slave_0: left promiscuous mode [ 1691.399459][ T1056] hsr_slave_1: left promiscuous mode [ 1691.405393][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1691.413471][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1691.421471][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1691.429498][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1691.444024][ T1056] hsr_slave_0: left promiscuous mode [ 1691.454344][ T1056] hsr_slave_1: left promiscuous mode [ 1691.462466][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1691.469944][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1691.480648][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1691.488184][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1691.574389][ T1056] veth1_macvtap: left promiscuous mode [ 1691.581294][ T1056] veth0_macvtap: left promiscuous mode [ 1691.586910][ T1056] veth1_vlan: left promiscuous mode [ 1691.592330][ T1056] veth0_vlan: left promiscuous mode [ 1691.600863][ T1056] veth1_macvtap: left promiscuous mode [ 1691.606391][ T1056] veth0_macvtap: left promiscuous mode [ 1691.612161][ T1056] veth1_vlan: left promiscuous mode [ 1691.619000][ T1056] veth0_vlan: left promiscuous mode [ 1691.625499][ T1056] veth1_macvtap: left promiscuous mode [ 1691.631131][ T1056] veth0_macvtap: left promiscuous mode [ 1691.636739][ T1056] veth1_vlan: left promiscuous mode [ 1691.642427][ T1056] veth0_vlan: left promiscuous mode [ 1691.652178][ T1056] veth1_macvtap: left promiscuous mode [ 1691.657880][ T1056] veth0_macvtap: left promiscuous mode [ 1691.663489][ T1056] veth1_vlan: left promiscuous mode [ 1691.669346][ T1056] veth0_vlan: left promiscuous mode [ 1692.642422][ T1056] team0 (unregistering): Port device team_slave_1 removed [ 1692.690298][ T1056] team0 (unregistering): Port device team_slave_0 removed [ 1693.551418][ T1056] team0 (unregistering): Port device team_slave_1 removed [ 1693.595180][ T1056] team0 (unregistering): Port device team_slave_0 removed [ 1694.473598][ T1056] team0 (unregistering): Port device team_slave_1 removed [ 1694.529362][ T1056] team0 (unregistering): Port device team_slave_0 removed [ 1695.400829][ T1056] team0 (unregistering): Port device team_slave_1 removed [ 1695.454295][ T1056] team0 (unregistering): Port device team_slave_0 removed [ 1696.384136][T17804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1696.460535][T17801] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1696.484803][T17801] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1696.532350][T17804] 8021q: adding VLAN 0 to HW filter on device team0 [ 1696.540727][T17801] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1696.555665][T17801] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1696.594255][ T966] bridge0: port 1(bridge_slave_0) entered blocking state [ 1696.601494][ T966] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1696.671623][T14185] bridge0: port 2(bridge_slave_1) entered blocking state [ 1696.678795][T14185] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1696.797929][T17811] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1696.851657][T17811] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1696.864938][T17811] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1696.895273][T17811] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1697.194912][T17808] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1697.438162][T17808] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1697.465376][T17808] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1697.508989][T17808] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1698.096240][ T6421] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1698.457378][ T6421] usb 1-1: Using ep0 maxpacket: 8 [ 1698.475338][ T6421] usb 1-1: New USB device found, idVendor=0499, idProduct=5005, bcdDevice= 8.ff [ 1698.498607][ T6421] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1698.516411][ T6421] usb 1-1: Product: syz [ 1698.524954][ T6421] usb 1-1: Manufacturer: syz [ 1698.537329][ T6421] usb 1-1: SerialNumber: syz [ 1698.547917][T17801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1698.558993][ T6421] usb 1-1: config 0 descriptor?? [ 1698.583517][ T6421] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1698.667788][ T6421] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1698.679774][T17801] 8021q: adding VLAN 0 to HW filter on device team0 [ 1698.770500][T17984] udevd[17984]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1698.808255][T17804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1698.881060][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1698.888299][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1698.906539][T17811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1698.950508][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1698.957734][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1699.208275][T17811] 8021q: adding VLAN 0 to HW filter on device team0 [ 1699.294877][ T1056] bridge0: port 1(bridge_slave_0) entered blocking state [ 1699.302108][ T1056] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1699.345686][T17808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1699.389381][ T966] bridge0: port 2(bridge_slave_1) entered blocking state [ 1699.396600][ T966] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1699.530180][T17808] 8021q: adding VLAN 0 to HW filter on device team0 [ 1699.616406][T17804] veth0_vlan: entered promiscuous mode [ 1699.639088][ T1056] bridge0: port 1(bridge_slave_0) entered blocking state [ 1699.646317][ T1056] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1699.681852][ T1056] bridge0: port 2(bridge_slave_1) entered blocking state [ 1699.689087][ T1056] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1699.774788][T17804] veth1_vlan: entered promiscuous mode [ 1700.046111][T17801] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1700.060127][T17804] veth0_macvtap: entered promiscuous mode [ 1700.125279][T17804] veth1_macvtap: entered promiscuous mode [ 1700.224384][T17804] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1700.242721][ T9] usb 1-1: USB disconnect, device number 50 [ 1700.272814][T17804] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1700.293302][T17804] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1700.304762][T17804] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1700.320409][T17804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1700.524511][T17811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1700.541381][T17804] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1700.577121][T17804] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1700.596405][T17804] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1700.614959][T17804] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1700.629454][T17804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1700.704267][T17804] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1700.734361][T17804] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1700.755310][T17804] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1700.773921][T17804] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1701.645775][T17808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1701.746616][T17811] veth0_vlan: entered promiscuous mode [ 1702.247323][T17132] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1702.469808][T17132] usb 1-1: Using ep0 maxpacket: 8 [ 1702.520572][T18053] netlink: 'syz.0.1925': attribute type 2 has an invalid length. [ 1702.530916][T17132] usb 1-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice=b4.99 [ 1702.547502][ T966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1702.559752][ T966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1702.577451][T17132] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1702.589127][T17132] usb 1-1: Product: syz [ 1702.593325][T17132] usb 1-1: Manufacturer: syz [ 1702.609201][T17132] usb 1-1: SerialNumber: syz [ 1702.625271][T17132] usb 1-1: config 0 descriptor?? [ 1702.650452][T17811] veth1_vlan: entered promiscuous mode [ 1702.691887][T17801] veth0_vlan: entered promiscuous mode [ 1702.732697][T17801] veth1_vlan: entered promiscuous mode [ 1702.742900][T17808] veth0_vlan: entered promiscuous mode [ 1702.751174][ T1056] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1702.765473][ T1056] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1702.778160][T17132] rtsx_usb 1-1:0.0: probe with driver rtsx_usb failed with error -22 [ 1702.946081][T17811] veth0_macvtap: entered promiscuous mode [ 1702.964464][T17808] veth1_vlan: entered promiscuous mode [ 1703.007850][T17811] veth1_macvtap: entered promiscuous mode [ 1703.140377][T17811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.171304][T17811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.200363][T17811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.229528][T17811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.265631][T17811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.293280][T17811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.315860][T17811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1703.399592][T17811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1703.412975][T17811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.425004][T17811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1703.441113][T17811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.451837][T17811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1703.462892][T17811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.476703][T17811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1703.492412][T17801] veth0_macvtap: entered promiscuous mode [ 1703.536802][T17811] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.572522][T17811] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.584291][T17811] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.604278][T17811] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.625105][T17801] veth1_macvtap: entered promiscuous mode [ 1703.644032][T17808] veth0_macvtap: entered promiscuous mode [ 1703.700386][T17808] veth1_macvtap: entered promiscuous mode [ 1703.767523][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.782325][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.792755][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.808413][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.820490][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.833786][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.844358][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1703.857584][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1703.874501][T18058] orangefs_mount: mount request failed with -4 [ 1703.884116][T17801] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1703.967807][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1704.039756][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.058577][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1704.145869][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.156416][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1704.168155][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.182473][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1704.194986][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.206882][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1704.219399][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.236167][T17808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1704.270670][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1704.289797][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.302147][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1704.314466][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.324887][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1704.336124][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.346010][T17801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1704.356494][T17801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1704.368578][T17801] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1704.920177][T17801] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1704.997849][T17801] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.037004][T17801] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.062359][T17801] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.096887][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1705.118370][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1705.143471][T18069] vivid-000: ================= START STATUS ================= [ 1705.151238][T18069] vivid-000: Generate PTS: true [ 1705.156129][T18069] vivid-000: Generate SCR: true [ 1705.161064][T18069] tpg source WxH: 320x180 (Y'CbCr) [ 1705.166193][T18069] tpg field: 1 [ 1705.169600][T18069] tpg crop: 320x180@0x0 [ 1705.173773][T18069] tpg compose: 320x180@0x0 [ 1705.178362][T18069] tpg colorspace: 8 [ 1705.182193][T18069] tpg transfer function: 0/0 [ 1705.186804][T18069] tpg Y'CbCr encoding: 0/0 [ 1705.191422][T18069] tpg quantization: 0/0 [ 1705.195668][T18069] tpg RGB range: 0/2 [ 1705.197126][ T5292] usb 1-1: USB disconnect, device number 51 [ 1705.207131][T18069] vivid-000: ================== END STATUS ================== [ 1705.229073][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1705.241946][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1705.252227][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1705.263061][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1705.283947][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1705.294739][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1705.305011][T17808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1705.317492][T17808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1705.328910][T17808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1705.376023][ T966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1705.381887][T17808] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.392825][T17808] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.399860][ T966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1705.406580][T17808] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.424772][T17808] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1705.530029][ T29] audit: type=1326 audit(1723351187.368:1166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18071 comm="syz.1.1928" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff12dd779f9 code=0x0 [ 1705.668845][ T5292] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1705.768090][ T2910] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1705.804569][ T2910] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1705.871968][ T1056] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1705.887224][ T5292] usb 1-1: Using ep0 maxpacket: 8 [ 1705.899994][ T1056] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1705.910661][ T5292] usb 1-1: config index 0 descriptor too short (expected 6427, got 27) [ 1705.935827][ T5292] usb 1-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 1705.985239][ T5292] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 241 [ 1706.025556][ T5292] usb 1-1: config 0 has no interface number 0 [ 1706.058986][ T5292] usb 1-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1706.076513][T14184] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1706.110541][ T5292] usb 1-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1706.114018][T14184] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1706.138131][ T5292] usb 1-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1706.202813][ T5292] usb 1-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1706.233021][ T5292] usb 1-1: New USB device strings: Mfr=228, Product=255, SerialNumber=0 [ 1706.267111][ T5292] usb 1-1: Product: syz [ 1706.273687][ T1056] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1706.301501][ T5292] usb 1-1: Manufacturer: syz [ 1706.307506][ T29] audit: type=1107 audit(1723351188.138:1167): pid=18076 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1706.323764][ T1056] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1706.333720][ T5292] usb 1-1: config 0 descriptor?? [ 1706.348531][T18070] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1706.390038][T18078] netlink: 'syz.2.1921': attribute type 4 has an invalid length. [ 1706.498282][T18080] netlink: 'syz.2.1921': attribute type 4 has an invalid length. [ 1706.534469][ T7727] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1706.579572][ T7727] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1706.768929][T18069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1706.778196][T18069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1707.596966][ C1] hrtimer: interrupt took 49143 ns [ 1709.031849][ T5292] usb 1-1: USB disconnect, device number 52 [ 1709.094746][ T47] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1709.287213][ T47] usb 4-1: device descriptor read/64, error -71 [ 1713.310134][T18122] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1936'. [ 1713.349359][ T29] audit: type=1107 audit(1723351195.188:1168): pid=18113 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 1714.470944][T18118] netlink: 'syz.2.1934': attribute type 4 has an invalid length. [ 1714.599954][T18128] netlink: 'syz.2.1934': attribute type 4 has an invalid length. [ 1715.122118][T18133] orangefs_mount: mount request failed with -4 [ 1716.300366][T18147] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1939'. [ 1717.221496][T18152] vivid-000: ================= START STATUS ================= [ 1717.229191][T18152] vivid-000: Generate PTS: true [ 1717.234044][T18152] vivid-000: Generate SCR: true [ 1717.238973][T18152] tpg source WxH: 320x180 (Y'CbCr) [ 1717.244068][T18152] tpg field: 1 [ 1717.247451][T18152] tpg crop: 320x180@0x0 [ 1717.251591][T18152] tpg compose: 320x180@0x0 [ 1717.255987][T18152] tpg colorspace: 8 [ 1717.259803][T18152] tpg transfer function: 0/0 [ 1717.264372][T18152] tpg Y'CbCr encoding: 0/0 [ 1717.268818][T18152] tpg quantization: 0/0 [ 1717.273067][T18152] tpg RGB range: 0/2 [ 1717.277810][T18152] vivid-000: ================== END STATUS ================== [ 1717.441518][T18158] netlink: 'syz.3.1941': attribute type 2 has an invalid length. [ 1718.257788][ T9] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1718.477536][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1718.496488][ T9] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 1718.530317][ T9] usb 3-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 1718.552029][ T9] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 241 [ 1718.563521][ T9] usb 3-1: config 0 has no interface number 0 [ 1718.576301][ T9] usb 3-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1718.595548][ T9] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1718.607147][ T9] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1718.634230][ T9] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1718.650529][ T9] usb 3-1: New USB device strings: Mfr=228, Product=255, SerialNumber=0 [ 1718.667489][ T9] usb 3-1: Product: syz [ 1718.671681][ T9] usb 3-1: Manufacturer: syz [ 1718.680691][ T9] usb 3-1: config 0 descriptor?? [ 1718.686626][T18152] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1718.967053][ T5292] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1719.102009][T18152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1719.110893][T18152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1720.731248][ T9] usb 3-1: USB disconnect, device number 61 [ 1720.777375][ T5292] usb 4-1: Using ep0 maxpacket: 8 [ 1720.808249][ T5276] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1721.017500][ T5292] usb 4-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice=b4.99 [ 1721.046109][ T5292] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1721.754639][ T5276] usb 1-1: device descriptor read/64, error -71 [ 1722.046993][ T5292] usb 4-1: Product: syz [ 1722.051209][ T5292] usb 4-1: Manufacturer: syz [ 1722.055827][ T5292] usb 4-1: SerialNumber: syz [ 1722.186109][T18184] netlink: 'syz.0.1947': attribute type 2 has an invalid length. [ 1723.048585][ T5292] usb 4-1: config 0 descriptor?? [ 1723.133351][ T5292] usb 4-1: can't set config #0, error -71 [ 1723.164489][ T5292] usb 4-1: USB disconnect, device number 63 [ 1723.217028][ T5276] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1723.477598][ T5276] usb 1-1: Using ep0 maxpacket: 8 [ 1723.706341][ T5276] usb 1-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice=b4.99 [ 1723.761294][ T5276] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.788408][ T5276] usb 1-1: Product: syz [ 1723.795507][ T5276] usb 1-1: Manufacturer: syz [ 1723.823937][ T5276] usb 1-1: SerialNumber: syz [ 1723.833052][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1948'. [ 1724.128513][ T5276] usb 1-1: config 0 descriptor?? [ 1724.269108][ T5276] rtsx_usb 1-1:0.0: probe with driver rtsx_usb failed with error -22 [ 1726.041621][ T9] usb 1-1: USB disconnect, device number 54 [ 1730.067045][ T5276] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 1730.582141][T18217] vivid-000: ================= START STATUS ================= [ 1730.589882][T18217] vivid-000: Generate PTS: true [ 1730.596305][T18217] vivid-000: Generate SCR: true [ 1730.601308][T18217] tpg source WxH: 320x180 (Y'CbCr) [ 1730.606424][T18217] tpg field: 1 [ 1730.609930][T18217] tpg crop: 320x180@0x0 [ 1730.614069][T18217] tpg compose: 320x180@0x0 [ 1730.618490][T18217] tpg colorspace: 8 [ 1730.622275][T18217] tpg transfer function: 0/0 [ 1730.627257][T18217] tpg Y'CbCr encoding: 0/0 [ 1730.632432][T18217] tpg quantization: 0/0 [ 1730.637653][T18217] tpg RGB range: 0/2 [ 1730.641784][T18217] vivid-000: ================== END STATUS ================== [ 1730.962209][ T1264] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.968784][ T1264] ieee802154 phy1 wpan1: encryption failed: -22 [ 1731.157135][ T5276] usb 2-1: device descriptor read/64, error -71 [ 1731.318491][T18227] FAULT_INJECTION: forcing a failure. [ 1731.318491][T18227] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1731.331836][T18227] CPU: 1 UID: 0 PID: 18227 Comm: syz.4.1956 Not tainted 6.11.0-rc2-syzkaller-00257-g5189dafa4cf9 #0 [ 1731.342621][T18227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 1731.352687][T18227] Call Trace: [ 1731.355966][T18227] [ 1731.358890][T18227] dump_stack_lvl+0x16c/0x1f0 [ 1731.363577][T18227] should_fail_ex+0x497/0x5b0 [ 1731.368262][T18227] _copy_from_user+0x30/0xf0 [ 1731.372856][T18227] __sys_bpf+0x21c/0x4a20 [ 1731.377202][T18227] ? ksys_write+0x21c/0x260 [ 1731.381714][T18227] ? reacquire_held_locks+0x440/0x4c0 [ 1731.387100][T18227] ? __pfx___sys_bpf+0x10/0x10 [ 1731.391882][T18227] ? vfs_write+0x14d/0x1140 [ 1731.396395][T18227] ? __mutex_unlock_slowpath+0x164/0x650 [ 1731.402045][T18227] ? fput+0x32/0x390 [ 1731.405946][T18227] ? ksys_write+0x1ab/0x260 [ 1731.410447][T18227] ? __pfx_ksys_write+0x10/0x10 [ 1731.415298][T18227] __x64_sys_bpf+0x78/0xc0 [ 1731.419726][T18227] ? lockdep_hardirqs_on+0x7c/0x110 [ 1731.424931][T18227] do_syscall_64+0xcd/0x250 [ 1731.429443][T18227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1731.435349][T18227] RIP: 0033:0x7f56021779f9 [ 1731.439763][T18227] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1731.459372][T18227] RSP: 002b:00007f5602fc9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1731.467787][T18227] RAX: ffffffffffffffda RBX: 00007f5602305f80 RCX: 00007f56021779f9 [ 1731.475754][T18227] RDX: 0000000000000050 RSI: 0000000020001bc0 RDI: 000000000000000a [ 1731.483719][T18227] RBP: 00007f5602fc9090 R08: 0000000000000000 R09: 0000000000000000 [ 1731.491690][T18227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1731.499657][T18227] R13: 0000000000000000 R14: 00007f5602305f80 R15: 00007fffed7e76d8 [ 1731.507645][T18227] [ 1732.387147][ T5276] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1732.607177][ T5228] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1732.616951][ T5276] usb 2-1: Using ep0 maxpacket: 8 [ 1732.630814][ T5276] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 1732.644724][ T5276] usb 2-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 1732.657130][ T5276] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 241 [ 1732.666407][ T5276] usb 2-1: config 0 has no interface number 0 [ 1732.673065][ T5276] usb 2-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1732.686143][ T5276] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1732.698057][ T5276] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1732.712041][ T5276] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1732.722222][ T5276] usb 2-1: New USB device strings: Mfr=228, Product=255, SerialNumber=0 [ 1732.731434][ T5276] usb 2-1: Product: syz [ 1732.735898][ T5276] usb 2-1: Manufacturer: syz [ 1732.748493][ T5276] usb 2-1: config 0 descriptor?? [ 1732.755134][T18217] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1732.787417][ T5228] usb 3-1: device descriptor read/64, error -71 [ 1732.807344][T17132] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1732.817003][ T5292] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1732.997212][ T5292] usb 5-1: Using ep0 maxpacket: 16 [ 1733.013545][ T5292] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1733.022790][ T5292] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1733.027046][T17132] usb 4-1: Using ep0 maxpacket: 16 [ 1733.030945][ T5292] usb 5-1: Product: syz [ 1733.040365][ T5292] usb 5-1: Manufacturer: syz [ 1733.045059][ T5292] usb 5-1: SerialNumber: syz [ 1733.075771][T17132] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 1733.080363][ T5292] r8152-cfgselector 5-1: Unknown version 0x0000 [ 1733.087043][ T5228] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1733.090521][ T5292] r8152-cfgselector 5-1: config 0 descriptor?? [ 1733.098220][T17132] usb 4-1: config 0 has an invalid descriptor of length 13, skipping remainder of the config [ 1733.116554][T17132] usb 4-1: config 0 has no interface number 0 [ 1733.126469][T17132] usb 4-1: config 0 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1733.143876][T17132] usb 4-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice= 0.88 [ 1733.158267][T17132] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1733.167936][T17132] usb 4-1: Product: syz [ 1733.170902][T18217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1733.172205][T17132] usb 4-1: SerialNumber: syz [ 1733.181333][T18217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1733.204574][T17132] usb 4-1: config 0 descriptor?? [ 1733.264544][T17132] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1733.271926][ T5228] usb 3-1: device descriptor read/64, error -71 [ 1733.407733][ T5228] usb usb3-port1: attempt power cycle [ 1733.422236][T17132] snd-usb-audio 4-1:0.2: probe with driver snd-usb-audio failed with error -2 [ 1733.538045][T18233] libceph: resolve '. [ 1733.538045][T18233] #)|.fǝa2sow?'%ЏKAqfCzeSb3L)HyoǤYMhE$ [ 1733.538045][T18233] ' (ret=-3): failed [ 1733.862045][T17982] udevd[17982]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1733.945091][ T5228] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1733.995066][ T5228] usb 3-1: device descriptor read/8, error -71 [ 1734.277752][ T5276] usb 2-1: USB disconnect, device number 56 [ 1735.594716][T18250] dccp_v6_rcv: dropped packet with invalid checksum [ 1735.966476][T18260] binder: 18257:18260 ioctl 8818564c 20000680 returned -22 [ 1736.873735][ T29] audit: type=1400 audit(1723351218.708:1169): avc: denied { read } for pid=18257 comm="syz.0.1963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1737.001556][ T29] audit: type=1400 audit(1723351218.838:1170): avc: denied { write } for pid=18257 comm="syz.0.1963" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 1737.107966][T18265] binder: 18257:18265 ioctl c018620b 0 returned -14 [ 1737.176754][ T5276] usb 4-1: USB disconnect, device number 64 [ 1737.263104][ T29] audit: type=1326 audit(1723351219.088:1171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18263 comm="syz.2.1965" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f24cf1779f9 code=0x0 [ 1737.648057][T18274] dccp_v6_rcv: dropped packet with invalid checksum [ 1737.857353][ T5292] r8152-cfgselector 5-1: Unknown version 0x0000 [ 1737.895036][ T5292] r8152-cfgselector 5-1: bad CDC descriptors [ 1737.901797][ T5276] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1737.937762][ T5292] r8152-cfgselector 5-1: USB disconnect, device number 59 [ 1738.229979][ T5276] usb 4-1: Using ep0 maxpacket: 8 [ 1738.268876][ T5276] usb 4-1: config 0 has an invalid descriptor of length 88, skipping remainder of the config [ 1739.604113][T18281] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1969'. [ 1739.967254][ T5276] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1739.976186][ T5276] usb 4-1: Duplicate descriptor for config 0 interface 0 altsetting 0, skipping [ 1740.175917][ T5276] usb 4-1: New USB device found, idVendor=0403, idProduct=8a98, bcdDevice=a6.12 [ 1740.198481][ T5276] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1740.231377][ T5276] usb 4-1: Product: syz [ 1740.241423][ T5276] usb 4-1: Manufacturer: syz [ 1740.353560][ T5276] usb 4-1: SerialNumber: syz [ 1740.370766][ T5276] usb 4-1: config 0 descriptor?? [ 1740.379526][ T5276] ftdi_sio 4-1:0.0: Ignoring interface reserved for JTAG [ 1740.495856][ T5276] usb 4-1: USB disconnect, device number 65 [ 1740.669084][T18293] vivid-000: ================= START STATUS ================= [ 1740.676731][T18293] vivid-000: Generate PTS: true [ 1740.681634][T18293] vivid-000: Generate SCR: true [ 1740.686516][T18293] tpg source WxH: 320x180 (Y'CbCr) [ 1740.691724][T18293] tpg field: 1 [ 1740.695100][T18293] tpg crop: 320x180@0x0 [ 1740.699315][T18293] tpg compose: 320x180@0x0 [ 1740.703740][T18293] tpg colorspace: 8 [ 1740.707596][T18293] tpg transfer function: 0/0 [ 1740.712189][T18293] tpg Y'CbCr encoding: 0/0 [ 1740.716589][T18293] tpg quantization: 0/0 [ 1740.722073][T18293] tpg RGB range: 0/2 [ 1740.726192][T18293] vivid-000: ================== END STATUS ================== [ 1741.128233][ T5276] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1741.356298][ T5276] usb 4-1: Using ep0 maxpacket: 8 [ 1741.758334][ T5276] usb 4-1: config index 0 descriptor too short (expected 6427, got 27) [ 1741.766653][ T5276] usb 4-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 1741.786167][ T5276] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 241 [ 1741.798591][ T5276] usb 4-1: config 0 has no interface number 0 [ 1741.804809][ T5276] usb 4-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1741.822467][T13254] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1741.832213][ T5276] usb 4-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1741.851207][ T5276] usb 4-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1741.880886][ T5276] usb 4-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1741.892683][ T5276] usb 4-1: New USB device strings: Mfr=228, Product=255, SerialNumber=0 [ 1741.910017][ T5276] usb 4-1: Product: syz [ 1741.914327][ T5276] usb 4-1: Manufacturer: syz [ 1741.926792][ T5276] usb 4-1: config 0 descriptor?? [ 1741.939739][T18293] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1742.027016][T13254] usb 1-1: Using ep0 maxpacket: 16 [ 1742.035906][T13254] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 1742.047042][T13254] usb 1-1: config 0 has an invalid descriptor of length 13, skipping remainder of the config [ 1742.069882][T13254] usb 1-1: config 0 has no interface number 0 [ 1742.076832][T13254] usb 1-1: config 0 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1742.119704][T13254] usb 1-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice= 0.88 [ 1742.139239][T13254] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1742.192612][T13254] usb 1-1: Product: syz [ 1742.196839][T13254] usb 1-1: SerialNumber: syz [ 1742.236408][T13254] usb 1-1: config 0 descriptor?? [ 1742.272529][T13254] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1742.350027][T13254] snd-usb-audio 1-1:0.2: probe with driver snd-usb-audio failed with error -2 [ 1742.695645][T18293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1742.704625][T18293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1743.400526][T17983] udevd[17983]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1743.627178][ T5278] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1743.771838][ T5276] usb 4-1: USB disconnect, device number 66 [ 1743.837293][ T5278] usb 5-1: device descriptor read/64, error -71 [ 1744.127160][ T5278] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1744.614240][ T5276] usb 1-1: USB disconnect, device number 55 [ 1746.237103][T13254] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1752.134061][T13254] usb 3-1: device descriptor read/64, error -110 [ 1752.588848][T18345] vivid-000: ================= START STATUS ================= [ 1752.596517][T18345] vivid-000: Generate PTS: true [ 1752.601439][T18345] vivid-000: Generate SCR: true [ 1752.606292][T18345] tpg source WxH: 320x180 (Y'CbCr) [ 1752.613626][T18345] tpg field: 1 [ 1752.617049][T18345] tpg crop: 320x180@0x0 [ 1752.621188][T18345] tpg compose: 320x180@0x0 [ 1752.625587][T18345] tpg colorspace: 8 [ 1752.629405][T18345] tpg transfer function: 0/0 [ 1752.633977][T18345] tpg Y'CbCr encoding: 0/0 [ 1752.638403][T18345] tpg quantization: 0/0 [ 1752.644166][T18345] tpg RGB range: 0/2 [ 1752.648306][T18345] vivid-000: ================== END STATUS ================== [ 1753.157349][T13254] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1753.537017][T13254] usb 3-1: Using ep0 maxpacket: 8 [ 1753.558797][T13254] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 1753.578423][T13254] usb 3-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 1753.588523][T13254] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 241 [ 1753.598734][T13254] usb 3-1: config 0 has no interface number 0 [ 1753.643940][T13254] usb 3-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1753.655651][T13254] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1753.679431][T13254] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1753.714301][T13254] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1753.723462][T13254] usb 3-1: New USB device strings: Mfr=228, Product=255, SerialNumber=0 [ 1753.731940][T13254] usb 3-1: Product: syz [ 1753.738092][T13254] usb 3-1: Manufacturer: syz [ 1753.765214][T13254] usb 3-1: config 0 descriptor?? [ 1753.907095][ T5276] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1754.149774][T18345] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1754.327127][ T5276] usb 2-1: device descriptor read/64, error -71 [ 1754.565334][T18345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1754.574159][T18345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1754.607191][ T5276] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1754.777028][ T5276] usb 2-1: device descriptor read/64, error -71 [ 1755.010748][ T5276] usb usb2-port1: attempt power cycle [ 1756.309681][T18366] vivid-007: kernel_thread() failed [ 1756.469960][T13254] usb 3-1: USB disconnect, device number 67 [ 1756.959572][T13254] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1757.297251][T13254] usb 3-1: Using ep0 maxpacket: 16 [ 1758.338355][T13254] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 1758.362234][T13254] usb 3-1: config 0 has an invalid descriptor of length 13, skipping remainder of the config [ 1758.420124][T13254] usb 3-1: config 0 has no interface number 0 [ 1758.439425][T13254] usb 3-1: config 0 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1758.519539][T13254] usb 3-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice= 0.88 [ 1758.580918][T13254] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1758.605166][T13254] usb 3-1: Product: syz [ 1758.811200][T13254] usb 3-1: SerialNumber: syz [ 1758.931254][T13254] usb 3-1: config 0 descriptor?? [ 1760.486178][T13254] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1760.519060][T13254] snd-usb-audio 3-1:0.2: probe with driver snd-usb-audio failed with error -2 [ 1761.514741][ T5276] usb 3-1: USB disconnect, device number 68 [ 1761.959397][T18404] netlink: 'syz.4.1999': attribute type 2 has an invalid length. [ 1762.178067][T18338] udevd[18338]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1762.713150][T18413] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1998'. [ 1766.188981][ T47] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1766.390284][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1766.417808][ T47] usb 5-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice=b4.99 [ 1766.427662][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1766.468328][ T47] usb 5-1: Product: syz [ 1766.477236][ T47] usb 5-1: Manufacturer: syz [ 1766.482233][ T47] usb 5-1: SerialNumber: syz [ 1766.574260][ T47] usb 5-1: config 0 descriptor?? [ 1766.579833][ T47] usb 5-1: can't set config #0, error -71 [ 1766.614793][ T47] usb 5-1: USB disconnect, device number 62 [ 1767.486735][T18417] orangefs_mount: mount request failed with -4 [ 1768.411430][T18443] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2006'. [ 1772.538142][T13719] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1772.564533][T13719] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1772.573689][T13719] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1772.585453][T13719] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1772.605381][T13719] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1772.613289][T13719] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1774.501849][ T9] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 1774.730139][T17803] Bluetooth: hci0: command tx timeout [ 1774.817010][ T9] usb 3-1: device descriptor read/64, error -71 [ 1774.862802][ T970] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1775.222264][ T9] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1775.427482][ T9] usb 3-1: device descriptor read/64, error -71 [ 1775.593877][ T9] usb usb3-port1: attempt power cycle [ 1775.817323][ T970] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1776.177039][ T9] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 1776.284522][ T970] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1776.313756][ T9] usb 3-1: device descriptor read/8, error -71 [ 1776.797767][T17803] Bluetooth: hci0: command tx timeout [ 1777.757432][T18506] netlink: 'syz.4.2020': attribute type 2 has an invalid length. [ 1777.830051][ T970] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1778.911286][T13719] Bluetooth: hci0: command tx timeout [ 1779.207076][T13719] Bluetooth: hci2: command 0x0406 tx timeout [ 1779.237005][ T47] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1779.427079][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1779.454454][ T47] usb 5-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice=b4.99 [ 1779.486222][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1779.515655][ T47] usb 5-1: Product: syz [ 1779.531549][ T47] usb 5-1: Manufacturer: syz [ 1779.543397][ T47] usb 5-1: SerialNumber: syz [ 1779.548751][T18499] orangefs_mount: mount request failed with -4 [ 1779.599154][ T47] usb 5-1: config 0 descriptor?? [ 1779.764047][ T47] rtsx_usb 5-1:0.0: probe with driver rtsx_usb failed with error -22 [ 1779.795409][T18463] chnl_net:caif_netlink_parms(): no params data found [ 1780.754476][ T970] bridge_slave_1: left allmulticast mode [ 1780.865685][ T47] usb 5-1: USB disconnect, device number 63 [ 1780.918229][ T970] bridge_slave_1: left promiscuous mode [ 1780.924071][ T970] bridge0: port 2(bridge_slave_1) entered disabled state [ 1780.957173][T17803] Bluetooth: hci0: command tx timeout [ 1781.040430][ T970] bridge_slave_0: left allmulticast mode [ 1781.046117][ T970] bridge_slave_0: left promiscuous mode [ 1781.096852][ T970] bridge0: port 1(bridge_slave_0) entered disabled state [ 1787.358228][ T29] audit: type=1400 audit(1723351269.198:1172): avc: denied { connect } for pid=18550 comm="syz.0.2031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1787.439583][ T29] audit: type=1400 audit(1723351269.218:1173): avc: denied { bind } for pid=18550 comm="syz.0.2031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1787.462746][T18551] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1787.526631][ T29] audit: type=1400 audit(1723351269.218:1174): avc: denied { write } for pid=18550 comm="syz.0.2031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1787.610423][ T29] audit: type=1400 audit(1723351269.228:1175): avc: denied { getopt } for pid=18550 comm="syz.0.2031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1787.757807][T13719] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1787.771187][T13719] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1787.779935][T13719] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1787.794407][T13719] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1787.803659][T13719] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1787.816295][T13719] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1787.942413][ T29] audit: type=1400 audit(1723351269.768:1176): avc: denied { name_bind } for pid=18561 comm="syz.0.2034" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 1788.171251][ T970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1788.186024][ T970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1788.200103][ T970] bond0 (unregistering): Released all slaves [ 1789.141440][T18463] bridge0: port 1(bridge_slave_0) entered blocking state [ 1789.189806][T18463] bridge0: port 1(bridge_slave_0) entered disabled state [ 1789.247135][T18463] bridge_slave_0: entered allmulticast mode [ 1789.287511][T18463] bridge_slave_0: entered promiscuous mode [ 1789.551443][T18463] bridge0: port 2(bridge_slave_1) entered blocking state [ 1789.606116][T18463] bridge0: port 2(bridge_slave_1) entered disabled state [ 1789.637364][T18463] bridge_slave_1: entered allmulticast mode [ 1789.690815][T18463] bridge_slave_1: entered promiscuous mode [ 1789.918117][T17803] Bluetooth: hci4: command tx timeout [ 1789.969432][ T970] hsr_slave_0: left promiscuous mode [ 1790.002425][ T970] hsr_slave_1: left promiscuous mode [ 1790.042003][ T970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1790.070920][ T970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1790.109048][ T970] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1790.143387][ T970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1790.305917][ T970] veth1_macvtap: left promiscuous mode [ 1790.340454][ T970] veth0_macvtap: left promiscuous mode [ 1790.364923][ T970] veth1_vlan: left promiscuous mode [ 1790.390771][ T970] veth0_vlan: left promiscuous mode [ 1790.813505][ T29] audit: type=1326 audit(1723351272.648:1177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18574 comm="syz.4.2039" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f56021779f9 code=0x0 [ 1792.001612][T17803] Bluetooth: hci4: command tx timeout [ 1792.388674][ T970] team0 (unregistering): Port device team_slave_1 removed [ 1792.403452][ T1264] ieee802154 phy0 wpan0: encryption failed: -22 [ 1792.412836][ T1264] ieee802154 phy1 wpan1: encryption failed: -22 [ 1792.456513][ T970] team0 (unregistering): Port device team_slave_0 removed [ 1793.201040][T18463] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1793.252809][T18463] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1793.414081][T18463] team0: Port device team_slave_0 added [ 1793.461049][T18631] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2050'. [ 1793.659748][T18463] team0: Port device team_slave_1 added [ 1793.813208][T18463] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1793.835094][T18463] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1793.897114][T18463] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1793.920618][T18463] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1793.934203][T18463] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1793.987119][T18463] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1794.087237][T17803] Bluetooth: hci4: command tx timeout [ 1794.302499][ T29] audit: type=1400 audit(1723351276.138:1178): avc: denied { remount } for pid=18649 comm="syz.2.2059" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1794.538040][ T29] audit: type=1400 audit(1723351276.378:1179): avc: denied { create } for pid=18641 comm="syz.4.2057" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 1794.604427][T18463] hsr_slave_0: entered promiscuous mode [ 1794.613988][T18463] hsr_slave_1: entered promiscuous mode [ 1794.861486][T18663] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2062'. [ 1794.949858][ T9] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 1795.174775][ T970] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1795.195331][ T9] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1795.210087][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1795.243726][ T9] usb 3-1: config 0 descriptor?? [ 1795.261602][ T9] cp210x 3-1:0.0: cp210x converter detected [ 1795.560077][ T970] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1795.634478][T18558] chnl_net:caif_netlink_parms(): no params data found [ 1795.692071][ T970] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1795.834423][ T970] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1795.919568][ T9] cp210x 3-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 1795.933137][ T9] cp210x 3-1:0.0: GPIO initialisation failed: -71 [ 1795.954197][ T9] usb 3-1: cp210x converter now attached to ttyUSB0 [ 1795.976317][ T9] usb 3-1: USB disconnect, device number 73 [ 1796.006425][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1796.038354][ T9] cp210x 3-1:0.0: device disconnected [ 1796.123246][T18558] bridge0: port 1(bridge_slave_0) entered blocking state [ 1796.136810][T18558] bridge0: port 1(bridge_slave_0) entered disabled state [ 1796.145618][T18558] bridge_slave_0: entered allmulticast mode [ 1796.160008][T18558] bridge_slave_0: entered promiscuous mode [ 1796.167484][T17803] Bluetooth: hci4: command tx timeout [ 1796.219106][T18558] bridge0: port 2(bridge_slave_1) entered blocking state [ 1796.244021][T18558] bridge0: port 2(bridge_slave_1) entered disabled state [ 1796.267127][T18558] bridge_slave_1: entered allmulticast mode [ 1796.275147][T18558] bridge_slave_1: entered promiscuous mode [ 1796.624088][T18558] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1796.673937][ T29] audit: type=1326 audit(1723351278.508:1180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18701 comm="syz.2.2072" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f24cf1779f9 code=0x0 [ 1796.704782][T18558] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1796.904405][ T970] bridge_slave_1: left allmulticast mode [ 1796.916062][ T970] bridge_slave_1: left promiscuous mode [ 1796.924621][ T970] bridge0: port 2(bridge_slave_1) entered disabled state [ 1796.943927][ T970] bridge_slave_0: left allmulticast mode [ 1796.952425][ T970] bridge_slave_0: left promiscuous mode [ 1796.958691][ T970] bridge0: port 1(bridge_slave_0) entered disabled state [ 1797.452299][ T970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1797.468743][ T970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1797.479468][ T970] bond0 (unregistering): Released all slaves [ 1797.726358][T18558] team0: Port device team_slave_0 added [ 1797.734917][ T29] audit: type=1400 audit(1723351279.558:1181): avc: denied { append } for pid=18714 comm="syz.4.2075" name="fb0" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1797.754806][T18558] team0: Port device team_slave_1 added [ 1798.371368][T18558] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1798.389678][T18558] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1798.431681][T18558] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1798.493912][T18558] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1798.526948][T18558] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1798.582498][ T29] audit: type=1400 audit(1723351280.418:1182): avc: denied { map } for pid=18729 comm="syz.0.2080" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1798.609510][T18558] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1798.641978][ T970] hsr_slave_0: left promiscuous mode [ 1798.654144][ T970] hsr_slave_1: left promiscuous mode [ 1798.671132][ T970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1798.683310][T18732] ------------[ cut here ]------------ [ 1798.690040][T18732] kernel BUG at drivers/android/binder.c:1173! [ 1798.692232][ T970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1798.696220][T18732] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 1798.710228][T18732] CPU: 0 UID: 0 PID: 18732 Comm: syz.0.2080 Not tainted 6.11.0-rc2-syzkaller-00257-g5189dafa4cf9 #0 [ 1798.720969][T18732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 1798.731006][T18732] RIP: 0010:binder_inc_ref_for_node+0x1051/0x11f0 [ 1798.737430][T18732] Code: f9 e9 2c f3 ff ff 48 8b 7c 24 10 e8 99 d2 47 f9 e9 30 fe ff ff 48 8b 7c 24 60 e8 ba d2 47 f9 e9 ae fc ff ff e8 e0 9c ea f8 90 <0f> 0b e8 68 d3 47 f9 e9 15 fb ff ff 4c 89 e7 e8 3b d2 47 f9 e9 32 [ 1798.757054][T18732] RSP: 0018:ffffc90003ae7920 EFLAGS: 00010287 [ 1798.763125][T18732] RAX: 0000000000001c48 RBX: ffff888068433c10 RCX: ffffc9000a241000 [ 1798.771092][T18732] RDX: 0000000000040000 RSI: ffffffff889fded0 RDI: 0000000000000004 [ 1798.779070][T18732] RBP: ffffc90003ae79b0 R08: 0000000000000004 R09: 0000000000000000 [ 1798.787037][T18732] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888057761800 [ 1798.795004][T18732] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 1798.802982][T18732] FS: 00007f19e0bde6c0(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 [ 1798.811913][T18732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1798.818491][T18732] CR2: 00007f19e0bddf98 CR3: 0000000052ddc000 CR4: 00000000003506f0 [ 1798.826456][T18732] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1798.834418][T18732] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1798.842381][T18732] Call Trace: [ 1798.845649][T18732] [ 1798.848572][T18732] ? show_regs+0x8c/0xa0 [ 1798.852826][T18732] ? die+0x36/0xa0 [ 1798.856548][T18732] ? do_trap+0x232/0x430 [ 1798.860789][T18732] ? binder_inc_ref_for_node+0x1051/0x11f0 [ 1798.866597][T18732] ? binder_inc_ref_for_node+0x1051/0x11f0 [ 1798.872405][T18732] ? do_error_trap+0xf4/0x230 [ 1798.877088][T18732] ? binder_inc_ref_for_node+0x1051/0x11f0 [ 1798.882907][T18732] ? handle_invalid_op+0x34/0x40 [ 1798.887847][T18732] ? binder_inc_ref_for_node+0x1051/0x11f0 [ 1798.893657][T18732] ? exc_invalid_op+0x2e/0x50 [ 1798.898353][T18732] ? asm_exc_invalid_op+0x1a/0x20 [ 1798.903383][T18732] ? binder_inc_ref_for_node+0x1050/0x11f0 [ 1798.909190][T18732] ? binder_inc_ref_for_node+0x1051/0x11f0 [ 1798.914998][T18732] ? __pfx___might_resched+0x10/0x10 [ 1798.920287][T18732] binder_thread_write+0x248d/0x3ac0 [ 1798.925579][T18732] ? __pfx_binder_thread_write+0x10/0x10 [ 1798.931218][T18732] ? find_held_lock+0x2d/0x110 [ 1798.936001][T18732] ? __might_fault+0x13b/0x190 [ 1798.940757][T18732] ? binder_debug+0xdf/0x1b0 [ 1798.945350][T18732] ? __pfx_binder_debug+0x10/0x10 [ 1798.950377][T18732] ? __might_fault+0xe3/0x190 [ 1798.955046][T18732] binder_ioctl+0x2250/0x6b10 [ 1798.959733][T18732] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1798.965629][T18732] ? do_vfs_ioctl+0x515/0x1ad0 [ 1798.970399][T18732] ? __pfx_binder_ioctl+0x10/0x10 [ 1798.975428][T18732] ? ioctl_has_perm.constprop.0.isra.0+0x2f0/0x470 [ 1798.981924][T18732] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470 [ 1798.988424][T18732] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1798.995266][T18732] ? find_held_lock+0x2d/0x110 [ 1799.000037][T18732] ? selinux_file_ioctl+0x180/0x270 [ 1799.005227][T18732] ? selinux_file_ioctl+0xb4/0x270 [ 1799.010333][T18732] ? __pfx_binder_ioctl+0x10/0x10 [ 1799.015361][T18732] __x64_sys_ioctl+0x193/0x220 [ 1799.020134][T18732] do_syscall_64+0xcd/0x250 [ 1799.024638][T18732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1799.030539][T18732] RIP: 0033:0x7f19e11779f9 [ 1799.034946][T18732] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1799.054547][T18732] RSP: 002b:00007f19e0bde038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1799.062956][T18732] RAX: ffffffffffffffda RBX: 00007f19e1306058 RCX: 00007f19e11779f9 [ 1799.070920][T18732] RDX: 0000000020000480 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1799.078885][T18732] RBP: 00007f19e11e58ee R08: 0000000000000000 R09: 0000000000000000 [ 1799.086847][T18732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1799.094813][T18732] R13: 0000000000000001 R14: 00007f19e1306058 R15: 00007ffee57e7a88 [ 1799.102781][T18732] [ 1799.105789][T18732] Modules linked in: [ 1799.110197][T18732] ---[ end trace 0000000000000000 ]--- [ 1799.115669][T18732] RIP: 0010:binder_inc_ref_for_node+0x1051/0x11f0 [ 1799.126689][T18732] Code: f9 e9 2c f3 ff ff 48 8b 7c 24 10 e8 99 d2 47 f9 e9 30 fe ff ff 48 8b 7c 24 60 e8 ba d2 47 f9 e9 ae fc ff ff e8 e0 9c ea f8 90 <0f> 0b e8 68 d3 47 f9 e9 15 fb ff ff 4c 89 e7 e8 3b d2 47 f9 e9 32 [ 1799.148160][T18732] RSP: 0018:ffffc90003ae7920 EFLAGS: 00010287 [ 1799.154250][T18732] RAX: 0000000000001c48 RBX: ffff888068433c10 RCX: ffffc9000a241000 [ 1799.162748][T18732] RDX: 0000000000040000 RSI: ffffffff889fded0 RDI: 0000000000000004 [ 1799.170764][T18732] RBP: ffffc90003ae79b0 R08: 0000000000000004 R09: 0000000000000000 [ 1799.178783][T18732] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888057761800 [ 1799.186736][T18732] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 1799.194704][T18732] FS: 00007f19e0bde6c0(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 [ 1799.203948][T18732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1799.210769][T18732] CR2: 00007f19e0bddf98 CR3: 0000000052ddc000 CR4: 00000000003506f0 [ 1799.218750][T18732] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1799.226708][T18732] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1799.234974][T18732] Kernel panic - not syncing: Fatal exception [ 1799.241236][T18732] Kernel Offset: disabled [ 1799.245633][T18732] Rebooting in 86400 seconds..