last executing test programs: 13.40342748s ago: executing program 2 (id=1080): setpriority(0x0, 0x1, 0xa7a8) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x18, 0x0, 0x0) syz_io_uring_modify_offsets$generic(0x0, 0x0, 0x2c, 0x10000) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, 0x0, 0x0) r3 = add_key(0x0, &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\'\x00\x00\x00\a'], 0x50) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r4, &(0x7f0000000000), 0xd) keyctl$get_persistent(0x16, 0x0, r3) 11.322276303s ago: executing program 2 (id=1085): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e22, 0x5, @empty, 0xfc}}, 0x6, 0x400}, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 11.162996897s ago: executing program 2 (id=1087): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x18, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56561, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0x2, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x7, 0xffffff00, 0x4, 0xa57, 0x0, 0xec6, 0x8, 0x8001}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 10.959275061s ago: executing program 2 (id=1091): mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x4004000) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_clone(0xa000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ptrace(0x10, r3) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000000)=0x1d6f4194, 0x8, 0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) shmget$private(0x0, 0x4000, 0x54001800, &(0x7f0000000000/0x4000)=nil) lseek(0xffffffffffffffff, 0x1000000, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0x58, 0x2e, 0x9, 0x70bd28, 0x25dfdbfe, {0x4}, [@nested={0x43, 0x11, 0x0, 0x1, [@generic="31f9e05e2f826cfc31dc2af824704f63dac994ce05dc7224e5479795b50d9015743a8b755e02f990bdfc3da898257de5b8996dbc932b5009df63b75f105c53"]}]}, 0x58}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r5 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_buf(r5, 0x29, 0x32, &(0x7f0000001100)="3814da1ff9ba5b40fbd82f2348e4025c179d045a", 0x14) connect$inet6(r5, &(0x7f00000011c0)={0xa, 0x4e20, 0x7, @private1}, 0x1c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r6, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r6, &(0x7f0000000380)="4e813cbfba79cae0486c4303d9d8aba8e590094c6a6abac2699434a0b1dba046dbb65b2bef2c084c9d2fdb6f360ba4b44f3149af2c08b294d85798eefc119c9e6350f6abde287c8c", 0x48, 0x24000045, 0x0, 0x0) shutdown(r6, 0x1) 9.191568748s ago: executing program 0 (id=1094): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000001180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010003704fe00"/20, @ANYRES32=r3, @ANYBLOB="c30407001b1cbf262000128008000100736974001400028008000200ac14141a060008001500000008001f0007"], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg$inet(r1, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 8.234735918s ago: executing program 1 (id=1096): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x90, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_gact={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x1, 0x7, 0xffffffff}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x1add, 0x10000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 8.081590561s ago: executing program 0 (id=1097): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8000000000100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r4}, 0x4) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180)={0xffffffffffffffff, r3}, 0xc) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000000040)="e4", 0x1, 0x10, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) 8.009247313s ago: executing program 1 (id=1098): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_DEL_TX_TS(0xffffffffffffffff, &(0x7f0000002580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200080c0}, 0x810) futex(0x0, 0x6, 0x0, 0x0, 0x0, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket(0x1, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$rds(0x15, 0x5, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x21, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x1, &(0x7f0000000000)=0xffffff7e, 0x4) bind$inet(r3, 0x0, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) accept4(r4, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 8.009074193s ago: executing program 3 (id=1099): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f00000001c0)=[@decrefs={0x40046307, 0x2}], 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) 7.106553652s ago: executing program 3 (id=1100): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$sock_int(r4, 0x1, 0x22, &(0x7f0000000300)=0x20, 0x4) readv(r4, &(0x7f0000000000)=[{&(0x7f0000000340)=""/4096, 0x1000}], 0x1) write$binfmt_misc(r4, &(0x7f0000000300), 0x6) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x104, 0x4, 0x3c8, 0xe8, 0x1d0, 0x1d0, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@remote, @multicast2, 0x0, 0x0, 0x7, 0x0, {@mac=@link_local={0x2, 0x80, 0xc2, 0x7}}, {}, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 'bridge0\x00', 'erspan0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x100}}}, {{@arp={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0xfc, {@empty, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bond_slave_1\x00', 'ipvlan1\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) 7.045672413s ago: executing program 0 (id=1101): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000}, 0x3, 0x0, 0x1, 0x0, 0x0, 0x4000090}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.583196713s ago: executing program 1 (id=1102): bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, 0x0, 0x0) io_uring_setup(0x23c, &(0x7f0000000280)={0x0, 0x4b7d, 0x10, 0x86, 0x1db}) syz_create_resource$binfmt(0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) recvmsg$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{0x0}, {&(0x7f00000001c0)=""/17, 0x11}], 0x2}, 0x12153) socket$unix(0x1, 0x1, 0x0) add_key$user(0x0, &(0x7f0000002340)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000280)={0x4, 0x8, 0x3, 0x1, 0x3, 0x6, 0x0, 0x2, 0x23, 0xfd, 0x3f, 0x9, 0x0, 0x5}, 0xe) shutdown(0xffffffffffffffff, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xffffff49) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 5.582484393s ago: executing program 3 (id=1103): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x7e0, 0x628, 0x3f8, 0x3f8, 0x0, 0x628, 0x710, 0x710, 0x710, 0x710, 0x710, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @mcast1, [], [], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0x1e0, 0x228, 0x7400, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@dev, @empty, @remote, @private2, @private1, @dev, @loopback, @mcast2, @local, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, @loopback, @local, @private1, @dev]}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@remote, 'nr0\x00'}}}, {{@ipv6={@empty, @private0, [], [], 'sit0\x00', 'sit0\x00'}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@dst={{0x48}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@private, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x840) syz_open_dev$evdev(0x0, 0x4, 0x101001) 5.582176683s ago: executing program 4 (id=1104): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_destroy(0x0) ioctl$XFS_IOC_FSGETXATTRA(0xffffffffffffffff, 0x801c582d, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendto(r3, &(0x7f0000000180)='%', 0x300000, 0x840, 0x0, 0x60) 4.015803456s ago: executing program 4 (id=1105): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101080, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='net/rt6_stats\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, 0x0) write$vhost_msg_v2(r2, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xe) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e22, 0x3, 'rr\x00', 0x1e, 0x4, 0x68}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e21, 0x3, 'lc\x00', 0x11, 0x3240, 0x3d}, {@loopback, 0x4e23, 0x4, 0x8628, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'8255\x00', [0x3, 0xfffffffc, 0x5, 0x4, 0x2f, 0xfffffff7, 0x8001, 0xa22, 0xfffffff8, 0x2, 0xfffffffc, 0xc3, 0x5006, 0x1000007, 0x1, 0x10003, 0x801000, 0x7fffffff, 0x1ff, 0x3ff, 0x1001010, 0x1ff, 0x8, 0x3, 0x8001, 0x7, 0x3ff, 0x5, 0x404, 0x3, 0xfffd]}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000000c0)) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8954) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x1d0) socket$nl_crypto(0x10, 0x3, 0x15) 3.991922507s ago: executing program 1 (id=1106): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) connect$can_bcm(r1, 0x0, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000003008000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x4004844) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x100003, {0x0, 0x0, 0x0, r3, {0xb, 0xfff3}, {0x3, 0xfff9}, {0xffe0}}}, 0x24}}, 0x0) close(r1) 3.991249477s ago: executing program 0 (id=1107): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x8, 0x3, 0x378, 0x0, 0x11, 0x148, 0x218, 0x0, 0x308, 0x2a8, 0x2a8, 0x308, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1c8, 0x1f0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'vlan1\x00', {0x0, 0x6, 0x45, 0xfffffffb, 0x9, 0x100, 0x1, 0x3ff, 0x0, 0x20}, {0x3}}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x1, 0x9d}}}, {{@ip={@multicast2, @rand_addr=0x64010104, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xc0, 0xf0, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0xf}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x9f7ffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d8) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000001540), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x101400, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000040)={0x4, {"0dbad96fff01000008ff00200800", "3dfab043e15fad27a639f905b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x40010, 0x6}) preadv(r3, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000180), 0x0, &(0x7f00000004c0)=ANY=[]) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r3, 0x6f2d, 0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x48) socket$inet_tcp(0x2, 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@in_dx={0x69, 0x20, {0x123, 0x2}}, @out_dx={0x6a, 0x28, {0x456, 0x4, 0xffffffff}}], 0x48}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="140000001300015b993dde440113e90006"], 0x14}], 0x1}, 0x0) 2.42100044s ago: executing program 4 (id=1108): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x90, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_gact={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x1, 0x7, 0xffffffff}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x1add, 0x10000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 2.332143491s ago: executing program 4 (id=1109): keyctl$clear(0x7, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10) r2 = socket$inet(0x2, 0x801, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) shutdown(r2, 0x1) sendto$inet(r0, 0x0, 0x0, 0x200007bd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 2.315515671s ago: executing program 2 (id=1110): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f00000001c0)=[@decrefs={0x40046307, 0x2}], 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) 2.168338665s ago: executing program 4 (id=1111): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8000000000100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r4}, 0x4) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180)={0xffffffffffffffff, r3}, 0xc) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000000040)="e4", 0x1, 0x10, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) 2.038405387s ago: executing program 1 (id=1112): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0xf0f002, 0x1}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000000)) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_mr_vif\x00') read$FUSE(r3, &(0x7f0000002400)={0x2020}, 0x2020) preadv(r3, &(0x7f0000000900)=[{&(0x7f0000000580)=""/240, 0xf0}], 0x1, 0x81, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000005000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fea000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000002000/0x1000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000ff6000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x2ddf, &(0x7f0000000040)={0x0, 0x100aeb9, 0xd000, 0x20000a, 0x60}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xd, 0x1}, {0x9, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x44040) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0xddccb000, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, {0x0, 0xdddd8000, 0x18, 0x8, 0x0, 0x4, 0x81, 0x0, 0x80, 0xd1, 0x4, 0x3}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x1a, 0xa8}, {0x10000, 0xd000, 0x0, 0x4, 0x0, 0x8f, 0x0, 0x0, 0xff, 0xfc, 0x86, 0xde}, {0xeeee8000, 0x30000, 0x3, 0x0, 0x7, 0x0, 0x0, 0x80, 0x0, 0x4}, {0xd000, 0xeeee8000, 0x3, 0x82, 0x0, 0x10, 0x4, 0xe}, {0x6000}, {0x30000, 0xfffe}, 0x0, 0x0, 0x70000, 0x10, 0x1, 0x0, 0x900, [0x0, 0x4, 0x10000, 0x1f0]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) socket$inet_sctp(0x2, 0x1, 0x84) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x3) 1.670578205s ago: executing program 0 (id=1113): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_DEL_TX_TS(0xffffffffffffffff, &(0x7f0000002580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200080c0}, 0x810) futex(0x0, 0x6, 0x0, 0x0, 0x0, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket(0x1, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$rds(0x15, 0x5, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x21, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x1, &(0x7f0000000000)=0xffffff7e, 0x4) bind$inet(r3, 0x0, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) accept4(r4, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 1.670150895s ago: executing program 1 (id=1114): openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000062554014"], 0x14}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001340)=@deltfilter={0x1048, 0x2d, 0x200, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xb}, {0x9, 0xb}, {0x4, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x1018, 0x2, [@TCA_BASIC_POLICE={0x1014, 0x4, [@TCA_POLICE_RATE={0x404, 0x2, [0x101795ff, 0x8749, 0x7, 0x2, 0x1, 0x6, 0x5, 0xffff7649, 0x3, 0x5, 0x4, 0x2, 0x10008, 0x5, 0x7, 0x519, 0x3, 0x1, 0xa, 0x4, 0xa7, 0x9, 0x3, 0x26, 0x5, 0x1, 0x13bc, 0xf, 0x8, 0x5, 0x3, 0xff, 0x4, 0x6, 0xf, 0x0, 0x3, 0x63c4000, 0x7, 0x9, 0x7f, 0x9, 0x8, 0xfffffffb, 0x5, 0x2, 0x5, 0x7d3, 0x7, 0x5, 0x5ce, 0x8, 0x9, 0x10000, 0xff000, 0x1, 0x8, 0x101, 0x10000, 0x79, 0xfffffff1, 0x9, 0x2, 0x80000001, 0x3, 0x8, 0x7f, 0x2, 0xfffffff7, 0x2, 0x3, 0x101, 0x3, 0xc, 0x2, 0x6, 0xb2da, 0xc, 0x6, 0x6504, 0xfffffff7, 0x7, 0x3ff, 0x7, 0x7, 0x3, 0x6, 0x6, 0xfffffff7, 0xd, 0x7, 0x18, 0xfff, 0x0, 0x7, 0x0, 0x95a8, 0x0, 0xc636, 0x0, 0x3, 0x6, 0x5, 0x63, 0x6, 0xfffffffe, 0xf5, 0xb, 0x2, 0x5, 0x9, 0x4, 0x3, 0x3, 0x2b, 0x2, 0x4, 0x3, 0x3, 0x3, 0x0, 0x533, 0xfffffffb, 0x200, 0x9, 0xfffffffe, 0x81, 0x100, 0x7, 0x3, 0xa, 0x4, 0x8, 0x101, 0x2, 0x5, 0x1, 0x9, 0xffffff97, 0x3ff, 0x2, 0x9, 0x87, 0x0, 0x6, 0x0, 0x72e, 0x2, 0x10fd, 0xfffffff7, 0x7, 0x9, 0x8, 0x2, 0x5, 0x4, 0xfffffc21, 0x5, 0x7114, 0x5, 0x557, 0x3ce, 0x3b9a, 0x2, 0xb, 0x10001, 0xd2, 0x10001, 0xfffffffe, 0x3, 0x800, 0x3, 0x5ee7, 0x123, 0x80000001, 0x4, 0x800, 0x8000, 0x1, 0x7f, 0x12000, 0x4, 0x81, 0x7, 0x200, 0x8f, 0x80000001, 0xaf4, 0x81, 0xa8b2, 0x2, 0x0, 0x9311, 0x1ff, 0x7ff, 0x8, 0x5a68, 0x4c07, 0xfffffff7, 0x1, 0x4, 0x383d, 0x1, 0xf, 0x1, 0x3, 0x8552, 0x1, 0xffff, 0xfffffff8, 0x9, 0x101, 0xd, 0xa, 0x7, 0x7f, 0x7, 0x8, 0x9, 0xc988, 0x10001, 0xf2e3, 0x10, 0x1, 0xe1, 0x86e, 0x9cf, 0x0, 0x0, 0x9, 0xf, 0x1000, 0x2, 0xb36f, 0x8, 0x1042, 0x0, 0xffffffff, 0xef, 0x10001, 0x0, 0x6, 0x0, 0x3, 0xffffffff, 0x7, 0x43, 0x1000, 0x6, 0x8, 0x7, 0xe, 0x0, 0x7, 0xe, 0x7d]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x2, 0x1, 0x10001, 0x8, 0x8, 0xac1f, 0x5, 0xbf3, 0x4, 0x6ea, 0x1, 0x5, 0xdd2, 0x9, 0x7, 0x3, 0x8, 0x189d, 0x5, 0x4, 0x7, 0x9, 0xb, 0x6, 0x5, 0x3, 0x5, 0x1, 0x2, 0x0, 0x5, 0x7, 0x89588710, 0x9, 0x7, 0x0, 0x8, 0xfffffff7, 0x5, 0x244b, 0x7fff, 0x81, 0x7, 0xd, 0x101, 0x1, 0x5, 0x686, 0x3e1, 0x4, 0x10, 0x2, 0x7, 0xd619, 0xb9, 0x400, 0x54d1, 0x7, 0x4, 0x6, 0x6, 0x1, 0x74, 0x3, 0x10, 0x7, 0xd4f, 0x5, 0x3, 0x1, 0x0, 0x93b, 0x1, 0x5, 0xffff, 0x6, 0x4, 0x96, 0xb7d2, 0x10000, 0x8, 0x0, 0x0, 0x5, 0x31bd, 0x2, 0x7, 0xffff, 0xfffffffd, 0x5, 0xfffffff9, 0x2, 0x4265, 0x0, 0x7fff, 0xc14, 0x1d, 0x6, 0x0, 0x8, 0x10001, 0x10, 0x2, 0x7fffffff, 0x8, 0x0, 0x6, 0x3, 0x4823, 0x8, 0x101, 0x3, 0x5, 0x0, 0x5, 0x3, 0x6a2b, 0x8, 0xce, 0x5, 0x0, 0x8, 0x9, 0x3, 0x9b, 0x8000, 0x2, 0x9, 0x3, 0xfffff242, 0x9, 0x81, 0x8, 0x81, 0x81, 0xeb, 0x1ceb, 0xe, 0x1, 0x1, 0x777a8d85, 0x9, 0x6, 0x3, 0x1, 0x4deda6ef, 0x0, 0x3, 0x3, 0x6, 0x3, 0x3, 0x568, 0x34, 0x61, 0x4, 0x1000, 0x8, 0x1, 0x0, 0x5, 0x5, 0xa3, 0x5, 0x4b02, 0x7, 0x9, 0xffffffdb, 0xf, 0x8d6, 0xffffffff, 0x8, 0xf4, 0x3, 0x3, 0x6b7, 0x5, 0x7f, 0x80000001, 0x6, 0x3, 0xc371, 0xfffffff7, 0x2, 0x5, 0x7fff, 0x4, 0xffffff81, 0x3, 0x3, 0x2, 0x6, 0x1ff, 0x6, 0xffff, 0x40, 0x8c, 0x2, 0x2, 0x1, 0x2, 0x3, 0x8001, 0x0, 0x10000, 0x7, 0x400, 0x9, 0x5, 0x7, 0x6, 0x36d3, 0x401, 0x1830, 0x8, 0x8, 0x0, 0x436, 0x9, 0x1, 0xae6, 0x7, 0x3, 0x401, 0x1, 0x8000, 0x0, 0x6, 0x0, 0x2, 0x9, 0x4, 0x1, 0xfffffdd6, 0x4, 0x0, 0x7, 0x9, 0x6, 0x2, 0x4, 0xfffffffe, 0x7, 0x0, 0x200, 0x5, 0xfffffffd, 0x5, 0x6, 0x4, 0x2, 0x7f, 0x2, 0xf, 0xc]}, @TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x8001, 0x3fec, 0x9, 0xc84, 0x3, 0x4, 0x4, 0x7, 0x7f, 0xaa, 0x6, 0x0, 0x4, 0x9, 0x1, 0x8, 0x3ff, 0x5, 0x3ff, 0x1, 0x1, 0x3, 0x180, 0x2, 0xcec, 0x60000000, 0xa6d, 0x0, 0x4, 0x4, 0x5, 0xb50, 0xcb5, 0x3ff, 0x80, 0x6, 0x8, 0xffff, 0xff, 0x7, 0x8, 0x9, 0x80, 0x7, 0xe, 0x0, 0x30, 0x6276, 0x0, 0x88b, 0xd, 0x100, 0x0, 0x100, 0x0, 0x5, 0x4, 0x309a, 0xf0a3, 0x3, 0x4, 0x0, 0x6, 0x0, 0x100, 0x8, 0xffffffff, 0x2, 0xf4c9, 0x5, 0x8, 0xc26, 0x6, 0x8, 0x8, 0x9, 0x401, 0x6, 0x7c, 0x1, 0xfffffff8, 0x6, 0x7, 0x0, 0x4, 0xffff, 0xf, 0x81, 0x5, 0x1, 0x1, 0x7fff, 0x9, 0xffff, 0x7, 0xa7, 0x9, 0x3cc, 0xf, 0x6, 0x2d20, 0x2, 0x9, 0x6c, 0xfff, 0x0, 0x1, 0x6, 0x1, 0xd, 0xffffffff, 0x7, 0x9, 0x6, 0xfffffffd, 0x1ff, 0xc, 0x1ff, 0x401, 0x74bb, 0x2, 0xee, 0x4, 0xf, 0x0, 0x3, 0x10001, 0x7, 0x3, 0x0, 0x3, 0xbf, 0x4, 0x9b7, 0x2, 0x34, 0x5, 0x8001, 0x2, 0x5c, 0x1, 0x800, 0x1, 0x4f, 0x6, 0x400, 0x81, 0x1, 0x7, 0x6, 0x9a, 0x13, 0x1, 0x129, 0x4, 0x8, 0x5ed, 0x2f, 0xcb0, 0x4db0, 0x2, 0x1000, 0xbfa, 0x8, 0xfff, 0x10001, 0x2, 0xffffffff, 0x2, 0xda, 0x1, 0xf90, 0x3, 0x0, 0x2, 0x9, 0x9, 0xffff, 0x0, 0x196, 0x10, 0x8, 0x8, 0xe26, 0x0, 0x80, 0x7ff, 0xf00000, 0x6, 0x0, 0x3ff, 0x0, 0x8, 0x8, 0x9, 0x57, 0x4, 0x9, 0xa, 0x2ff, 0x8, 0xb6b8, 0x4a2, 0x0, 0x9, 0x2, 0x6, 0x7, 0xff, 0x800, 0x7, 0x60, 0x8, 0x7, 0x4, 0xffffffff, 0x6, 0x3, 0x0, 0xb, 0x5, 0x1f, 0xff, 0x7ff, 0x61, 0x7, 0x9, 0x5, 0xd42, 0x36ce, 0x0, 0xfffffff8, 0x4, 0x9, 0x8000, 0x8, 0x0, 0x3, 0xff, 0x0, 0x400, 0x7f, 0x5, 0x7, 0x16a5, 0x43f, 0x4f6a, 0xfffff001, 0x0, 0x2, 0x10, 0x14, 0x1, 0x7, 0x5]}, @TCA_POLICE_RATE={0x404, 0x2, [0x800, 0x6, 0x7, 0x6, 0x6, 0x3, 0x9, 0xffffff2a, 0x3, 0x100, 0x10000, 0x6, 0xd4b4, 0x1, 0x9, 0xb0, 0x8c, 0x101, 0x4, 0x0, 0x7f, 0x34, 0xffff, 0x6, 0x7fffffff, 0x10, 0x1, 0x1000, 0x10, 0x5, 0xffffffc0, 0x7, 0x2, 0x8, 0x8, 0x40, 0x2, 0xfffffff7, 0x32e841a5, 0xa, 0x40, 0x4, 0x22, 0xfffffffd, 0x8, 0xfffffff8, 0x80000000, 0x8001, 0x80000001, 0x1ff, 0xfffffffa, 0x7ca, 0x1c, 0x4c, 0x7ff, 0x0, 0x6, 0x3, 0x3e, 0x0, 0xd27c, 0x5da6, 0x9, 0xccb, 0x6, 0xffff, 0x0, 0xe, 0xeb, 0x7, 0x68, 0x6, 0x7, 0xff, 0x2, 0xd8f6, 0x7ff, 0x3ff, 0x2, 0xb2, 0x8, 0xffff, 0x990, 0xffffffff, 0x3d35, 0x8, 0x9, 0x5, 0xfffffffe, 0x1, 0xffffffff, 0x8, 0x200, 0x80000000, 0x40, 0x3e, 0xfffffffd, 0x7f0, 0xfffffffb, 0x8, 0x2, 0xb3ad, 0x13e, 0x6, 0x100, 0x0, 0x8, 0x2, 0x8, 0x7fff, 0xffffffff, 0xfffffff3, 0x1, 0x4167, 0xff, 0x6, 0x8, 0xfffffbff, 0x2, 0x0, 0x7, 0xc, 0xea, 0x7fff, 0x4, 0x3, 0xfffffff6, 0x8, 0x1, 0x3, 0xff, 0x40, 0x8, 0x8, 0xd74, 0x4, 0x30, 0x6, 0x1, 0x5, 0x9, 0x7ff, 0x7, 0x1, 0x3, 0xe, 0x3800, 0x1, 0x1, 0x7ff, 0x8, 0x3, 0x6, 0x4e43, 0x9015, 0x6, 0x558a0ebb, 0x1, 0x7, 0x6, 0xaf9, 0x7, 0xfffffff7, 0xffffffff, 0x9, 0x2, 0x144, 0x5, 0x7ff, 0x1, 0xfffe, 0x47f, 0x2, 0xfffffff6, 0x64, 0x7be, 0xe14, 0x4, 0x10000000, 0x8, 0x9, 0x5, 0x1ff2, 0x40, 0xf, 0xeb77, 0x2, 0x7, 0xbd7c, 0x4, 0x9, 0x4, 0xe, 0x8, 0xffffffff, 0x4, 0x3ff80000, 0x0, 0xd78d, 0x7f, 0x8, 0x4, 0x2, 0x5, 0x3, 0x1, 0x35, 0x401, 0x0, 0x1, 0x400, 0x7fff, 0x4, 0x9, 0x1, 0x1ff, 0x7, 0x8, 0x26c4, 0x7fff, 0x394d, 0x7, 0x8, 0x5, 0x1, 0x4, 0x1, 0x8000, 0xe, 0x9, 0x7, 0x1, 0xfffffffb, 0x6, 0x2, 0x8, 0x2f, 0x6, 0x10000, 0x3, 0x218, 0x7ff, 0x80, 0x5, 0x0, 0x0, 0xfff, 0x5, 0x0, 0x704f1bb1, 0x8, 0x5, 0x8, 0xee4, 0xffffffff, 0xfffeffff]}]}]}}]}, 0x1048}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000006c0)="27031c00160014000000002f1eafacf706e105400000894f00050004ee0b80558ddbba9b37242d37a518fc9c5be50eaf07c3650596", 0x35}], 0x1}, 0x4) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000000), 0x101, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = syz_clone(0x30303600, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$getregset(0x4204, r1, 0x2, 0x0) syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB="73686f727461642c756e64656c6574652c73657373696f6e3d30303030000800003030303030303030303139302c6d6f64653d30303030303030303030303030303030303030303030352c726f6f746469723d30303030303030303030303030303030303030352c646d6f64653d30303030303030303030303030303030303030303030362c696f636861727365743d6370313235312c696f636861727365743d6b6f69382d722c6e6f7672732c0084f5b23d82aacbefd1de1daab7394a9b4696461da9ab46f2d71c895d8c"], 0x1, 0xc41, &(0x7f0000001b80)="$eJzs3U9sHNd9B/DfG5Hi0m4rxnYUJ42LTVuksmK5+hdTsQp3VdNsA8gyEYq5BeCKpNSFKZIgqUY20oLupYceAhRFDzkRaI0CKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAOQUMZvatuKRJmzb/iLI+H5v67s68N/PezHJGIvjmBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ8QcvXTl7Lt3vVgAAh+na6NfOnnf/B4CHynX//gcAAAAAAAAAAAAAgKMuRRGPR4q5a2tpvHrfVrva6r1zd2xoePtq/amqeawqX37Vzp2/cPHLzw1e6uTV1swH1N9vn4tXRq9fqb84e3tufmphYWqyPjbTmpidnNr1FvZaf6vT1QGo3371zuTNmwv1889e2LT67sB7fY+eHLg8+PSZpzplx4aGh0c3itS6y/d87Ia07TTC43gUcSZSPPO9n6ZmRBSx92NRO9xzv1V/1YnTVSfGhoarjky3mjOL5cqRzoEoIupdlRqdY7T9uYie3kPtw84aEUtl88sGny67NzrXnG/emJ6qjzTnF1uLrdmZkdRubdmfehRxKUUsR8Rq3/s31xtF9ESK75xYSzci4ljnOHypGhi8czuKA+zjLpTtrPdGLBcPwDk7wvqiiJcjxc/ePhUT+TpTXWu+GPFymT+IeLPMFyJS+cG4GPHuNp8jHkw9UcRfluf/8lqarK4HnevK1a/Xvzpzc7arbOe68hHvD++7Utyn+0P/ljwcR/zaVIsimtUVfy19/L/sAAAAAAAAAAAAAAAAALDf+qOIz0aKl/7jT6pxxVGNSz9xefAPB361e8z4kx+ynbLssxGxVOxuTO7xPDBwJI2kdJ/HEj/MalHEn+bxf2/c78YAAAAAAAAAAAAAAAAAAAA81Ir4SaR4/p1TaTm65xRvzdyqX2/emG7PCtuZ+7czZ/r6+vp6PbWzkXM851LO5ZwrOVdzRpHr52zkHM+5lHM550rO1ZxxLNfP2cg5nnMp53LOlZyrOaMn18/ZyDmecynncs6VnKs544jM3QsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8ElSRBG/iBTf/uZaihQRjYjxaOdK3/1uHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQ6ktFfD9S1P+ocW9ZT0Sk6v+2U+UfF6NxvMzHojFY5gvRuJKzWWVP44370H72pjcV8eNI0Vd7K1JPe1k+/73td/c+BvHmtzbefS6XPdZZOfBe36MnT1weHP6NJ3d6nbZrwOmrrZk7d+tjQ8PDo12Le/LeH+taNpD3W+xT34lYeO31V5vT01PzH/9F+RHYQ/UH6EX5DXIEmuHFYb2IniPRjPvTdx4C5f3/3Ujxu+/8Z+eG377/1+JX2u/u3eHj53+2cf9/fuuGdnn/79laL9//y3v6dvf/x7uWPZ//NtLbE1FbvD3XezKitvDa62dat5u3pm5NzVw8e/Yrg4NfuXC293hE7WZreqrr1b4cLgAAAAAAAAAAAAAAAIDDk4r4/UjR/PFaqkfE3Wq81sDlwafPPHUsjlXjrTaN235l9PqV+ouzt+fmpxYWpibrYzOtidnJqd3urlYN9xobGj6Qznyo/gNuf3/txdm51+Zbt/54cdv1j9Su3FhYnG9ObL86+qOIaHQvOV01eGxouGr0dKs5U1Ud2XYw/UfXm4r4r0gxcbGevpCX5fH/W0f4bxr/v7R1Qwc0/v9TXcvKfaZUxM8jxe/81ZPxhaqdj8T7jlku93eR4vSlz+dycbws12nDY9VDBNojA8uy/xcp/ukXm8t2xkO2xyBWZc/t/sg+GMrzfyJSfP8vvhu/mZdtfv7D9uf/ka0bOqDz/0TXskc2Pa9gz10nn/8zkeKFx9+K38rLPuj5H51nb5zKhe89n+OAzv+nu5YN5P3+9v50HQAAAAAAAAAA4IHWm4r4+0jxw+Ge9Fxetpvf/5vcuqED+v2vz3Qtm9yf+Yo+9MWeDyoAAAAAHBG9qYifRIpbi2/dG0O9efx31/jP39sY/zmUtqytfs73a9VzA/bz53/dBvJ+x/febQAAAAAAAAAAAAAAAAAAADhSUiriuTyf+ng1nn9yx/nUVyLFS//zTC6XTpblOvPAD1R/1q7Nzpy5Mj09O9FcbN6YnqqPzjUnpsq6T0SKtb/9fK5bVPOrd+abb8/xvjEX+3ykGP6HTtn2XOyducmf2Ch7riz7qUjx3/+Yy66vV2U781h/eqPs+bLs30SKb/zL5u12yp7cKHuhLPvdSPGjb9Q7ZR8py3aej/qZjbLPTswWB3BWAAAAAAAAAAAAAAAAAAAAeNj0piL+PFL87+3le2P58/z/vV1vK29+q2u+/y3uVvP8D1Tz/+/0+uPM/189V2Bpp70CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAnU4oiXo8Uc9fW0kpf+b6tdrU1c+fu2NDw9tX6U1XzWFW+/KqdO3/h4pefG7zUyQ+uv98+G6+MXr9Sf3H29tz81MLC1GR9bKY1MTs5test7LX+VqerA1C//eqdyZs3F+rnn72wafXdgff6Hj05cHnw6TNPdcqODQ0Pj3aV6en9qDt9Y8c1aYflx6OIv44Uz3zvp+mHfRFF7P1YbPvZ6dt9L/aov+rE6aoTY0PDVUemW82ZxXLlSOdAFBH1rkqNzjHat3NxQBoRS2XzywafLrs3Otecb96YnqqPNOcXW4ut2ZmR1G5t2Z96FHEpRSxHxOo256A3ing1UnznxFr6176IY53j8KVro187e37ndhQH2MddKNtZ741YLh6Ac3aE9UUR/xwpfvb2qfi3voieaH/FFyNeLvMHEW9G+3yn8oNxMeLdw/te5oD1RBH/X57/y2vp7b7yetC5rlz9ev2rMzdnu8p2risHcn84PP2Hurcjfm2qRRE/qq74a+nffV8DAAAAAAAAAAAAAAAAHCFF/HqkeP6dU6kaH3xvTHFr5lb9evPGdHtYX2fsX2fM9Pr6+no9tbORczznUs7lnCs5V3NGkevnbJRZW18fz++Xci7nXMm5mjOO5fo5GznHcy7lXM65knM1Z/Tk+jkbOcdzLuVczrmSczVnHJGxewAAAAAAAAAAAAAAAAAAwCdLUf2X4tvfXEvrfe35pcejnSvmA/3E+2UAAAD//xtt+zc=") prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40283) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000140)=ANY=[]) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r4 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) setrlimit(0x8, &(0x7f00000000c0)={0x3, 0x6}) write(r4, &(0x7f0000000680), 0x0) 1.670026205s ago: executing program 3 (id=1115): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000001180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010003704fe00"/20, @ANYRES32=r3, @ANYBLOB="c30407001b1cbf262000128008000100736974001400028008000200ac14141a060008001500000008001f0007"], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg$inet(r1, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 1.605685877s ago: executing program 3 (id=1116): bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, 0x0, 0x0) io_uring_setup(0x23c, &(0x7f0000000280)={0x0, 0x4b7d, 0x10, 0x86, 0x1db}) syz_create_resource$binfmt(0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) recvmsg$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{0x0}, {&(0x7f00000001c0)=""/17, 0x11}], 0x2}, 0x12153) socket$unix(0x1, 0x1, 0x0) add_key$user(0x0, &(0x7f0000002340)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000280)={0x4, 0x8, 0x3, 0x1, 0x3, 0x6, 0x0, 0x2, 0x23, 0xfd, 0x3f, 0x9, 0x0, 0x5}, 0xe) shutdown(0xffffffffffffffff, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xffffff49) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 1.43453805s ago: executing program 2 (id=1117): r0 = syz_open_dev$dvb_demux(&(0x7f00000001c0), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000000000)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0xf9, 0x5}) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002b8426c104b062578b862010203010902"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 953.43504ms ago: executing program 4 (id=1118): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x101800, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001f00)=[{{&(0x7f0000000300)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, 0x0}}, {{&(0x7f0000000040)={0xa, 0x4e22, 0x1, @private1, 0x10002}, 0x1c, &(0x7f0000000340)}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001e80)=[@rthdrdstopts={{0x18, 0x29, 0x37, {0x2e}}}], 0x18}}], 0x3, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_TABLE(r2, 0x0, 0xcf, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0xc, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) setsockopt$inet_mreq(r3, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000180)={0x9c0000, 0x1, 0x6844, r1, 0x0, &(0x7f0000000140)={0x9c0909, 0x3ff, '\x00', @p_u16=&(0x7f0000000100)=0xf}}) ioctl$F2FS_IOC_DEFRAGMENT(r6, 0xc010f508, &(0x7f00000000c0)={0x3ff, 0xffffffffffffffb2}) sendmsg$nl_xfrm(r5, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4) landlock_create_ruleset(&(0x7f0000000040)={0x880, 0x0, 0x2, 0x1001, 0x6, 0x1}, 0x30, 0x3) io_submit(r0, 0x20000000000002fb, &(0x7f0000004540)) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x5400, 0x3f00) 693.58µs ago: executing program 0 (id=1119): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x90, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_gact={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x1, 0x7, 0xffffffff}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x1add, 0x10000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 0s ago: executing program 3 (id=1120): mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x4004000) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_clone(0xa000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ptrace(0x10, r3) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000000)=0x1d6f4194, 0x8, 0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) shmget$private(0x0, 0x4000, 0x54001800, &(0x7f0000000000/0x4000)=nil) lseek(0xffffffffffffffff, 0x1000000, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0x58, 0x2e, 0x9, 0x70bd28, 0x25dfdbfe, {0x4}, [@nested={0x43, 0x11, 0x0, 0x1, [@generic="31f9e05e2f826cfc31dc2af824704f63dac994ce05dc7224e5479795b50d9015743a8b755e02f990bdfc3da898257de5b8996dbc932b5009df63b75f105c53"]}]}, 0x58}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r5 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_buf(r5, 0x29, 0x32, &(0x7f0000001100)="3814da1ff9ba5b40fbd82f2348e4025c179d045a", 0x14) connect$inet6(r5, &(0x7f00000011c0)={0xa, 0x4e20, 0x7, @private1}, 0x1c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r6, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r6, &(0x7f0000000380)="4e813cbfba79cae0486c4303d9d8aba8e590094c6a6abac2699434a0b1dba046dbb65b2bef2c084c9d2fdb6f360ba4b44f3149af2c08b294d85798eefc119c9e6350f6abde287c8c", 0x48, 0x24000045, 0x0, 0x0) shutdown(r6, 0x1) kernel console output (not intermixed with test programs): 120.849648][ T5052] udc-core: couldn't find an available UDC or it's busy [ 120.864815][ T5052] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 120.946032][ C0] wdm_int_callback: 68 callbacks suppressed [ 120.946052][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 120.958591][ C0] wdm_int_callback: 68 callbacks suppressed [ 120.958604][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 120.971035][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 120.977663][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 120.986017][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 120.992649][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.006026][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.012678][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.026032][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.032796][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.050902][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.057557][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.066009][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.069522][ T5067] device syzkaller0 entered promiscuous mode [ 121.072820][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.086078][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.092711][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.106026][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.112766][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.126027][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 121.132683][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 121.341746][ T5077] device syzkaller0 entered promiscuous mode [ 121.363514][ T5077] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 121.443650][ T5079] fuse: Bad value for 'fd' [ 121.596212][ T5083] netlink: 96 bytes leftover after parsing attributes in process `syz.0.250'. [ 121.687268][ T5083] netlink: 'syz.0.250': attribute type 13 has an invalid length. [ 121.700429][ T5083] netlink: 'syz.0.250': attribute type 17 has an invalid length. [ 121.718195][ T5083] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 121.735921][ T5083] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 122.276430][ T4267] usb 3-1: USB disconnect, device number 4 [ 122.359147][ T5101] device syzkaller0 entered promiscuous mode [ 122.494689][ T5104] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5105] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5104] [ 123.122246][ T5113] fuse: Unknown parameter '0x0000000000000005' [ 123.293112][ T5115] device syzkaller0 entered promiscuous mode [ 123.387294][ T5117] netlink: 96 bytes leftover after parsing attributes in process `syz.4.263'. [ 123.474123][ T5115] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 123.496137][ T5119] netlink: 'syz.4.263': attribute type 13 has an invalid length. [ 123.503921][ T5119] netlink: 'syz.4.263': attribute type 17 has an invalid length. [ 123.528376][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 123.561820][ T5119] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 123.942920][ T5131] binder: BINDER_SET_CONTEXT_MGR already set [ 123.967023][ T5131] binder: 5130:5131 ioctl 4018620d 2000000002c0 returned -16 [ 124.187421][ T5138] device syzkaller0 entered promiscuous mode [ 124.699093][ T13] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 124.848966][ T5152] fuse: Unknown parameter '0x0000000000000005' [ 124.881878][ T5153] device syzkaller0 entered promiscuous mode [ 124.904359][ T5153] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 124.922914][ T5155] netlink: 96 bytes leftover after parsing attributes in process `syz.2.277'. [ 124.990530][ T5155] netlink: 'syz.2.277': attribute type 13 has an invalid length. [ 124.998559][ T5155] netlink: 'syz.2.277': attribute type 17 has an invalid length. [ 125.010131][ T5155] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 125.019436][ T5155] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 125.086458][ T13] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.134724][ T13] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 125.232314][ T13] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 125.290082][ T13] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 125.302817][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.346450][ T5137] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 125.387328][ T13] hub 4-1:1.0: bad descriptor, ignoring hub [ 125.398854][ T13] hub: probe of 4-1:1.0 failed with error -5 [ 125.418079][ T13] cdc_wdm 4-1:1.0: skipping garbage [ 125.429653][ T13] cdc_wdm 4-1:1.0: skipping garbage [ 125.447356][ T5171] device syzkaller0 entered promiscuous mode [ 125.462549][ T13] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 125.471369][ T13] cdc_wdm 4-1:1.0: Unknown control protocol [ 125.885933][ T5180] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5181] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5180] [ 125.904620][ T5175] udc-core: couldn't find an available UDC or it's busy [ 125.926960][ T5175] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 126.016033][ C1] wdm_int_callback: 55 callbacks suppressed [ 126.016057][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.028602][ C1] wdm_int_callback: 55 callbacks suppressed [ 126.028621][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.040871][ C1] vkms_vblank_simulate: vblank timer overrun [ 126.056014][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.062655][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.086073][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.092740][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.116015][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.122713][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.146078][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.152861][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.176011][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.182861][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.216022][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.222717][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.246015][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.252679][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.276010][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.282817][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.306009][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 126.312666][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 126.480463][ T5184] binder: BINDER_SET_CONTEXT_MGR already set [ 126.509271][ T5184] binder: 5183:5184 ioctl 4018620d 2000000002c0 returned -16 [ 127.236543][ T1111] usb 4-1: USB disconnect, device number 4 [ 127.344159][ T5196] device syzkaller0 entered promiscuous mode [ 127.345195][ T5195] fuse: Unknown parameter '0x0000000000000005' [ 127.370371][ T5196] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 127.452492][ T5198] netlink: 96 bytes leftover after parsing attributes in process `syz.1.291'. [ 127.562145][ T5198] netlink: 'syz.1.291': attribute type 13 has an invalid length. [ 127.590005][ T5198] netlink: 'syz.1.291': attribute type 17 has an invalid length. [ 127.616103][ T5198] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 127.638640][ T5198] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 127.801898][ T5220] binder: BINDER_SET_CONTEXT_MGR already set [ 127.817022][ T5220] binder: 5218:5220 ioctl 4018620d 2000000002c0 returned -16 [ 128.356190][ T21] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 128.786156][ T21] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.826145][ T21] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 128.835313][ T21] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 128.846942][ T21] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 128.876729][ T21] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.906246][ T5229] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 128.927103][ T21] hub 3-1:1.0: bad descriptor, ignoring hub [ 128.933071][ T21] hub: probe of 3-1:1.0 failed with error -5 [ 128.982804][ T21] cdc_wdm 3-1:1.0: skipping garbage [ 129.011001][ T21] cdc_wdm 3-1:1.0: skipping garbage [ 129.056874][ T21] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 129.080940][ T21] cdc_wdm 3-1:1.0: Unknown control protocol [ 129.331695][ T5229] udc-core: couldn't find an available UDC or it's busy [ 129.371787][ T5229] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 129.596528][ T21] usb 3-1: USB disconnect, device number 5 [ 129.734515][ T5248] fuse: Unknown parameter '0x0000000000000005' [ 129.885070][ T5250] device syzkaller0 entered promiscuous mode [ 129.935182][ T5250] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 129.964920][ T5252] netlink: 96 bytes leftover after parsing attributes in process `syz.1.306'. [ 130.145647][ T5252] netlink: 'syz.1.306': attribute type 13 has an invalid length. [ 130.174035][ T5252] netlink: 'syz.1.306': attribute type 17 has an invalid length. [ 130.212492][ T5252] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 130.254816][ T5252] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 131.432372][ T5292] fuse: Unknown parameter '0x0000000000000005' [ 131.956037][ T13] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 132.326591][ T5303] device syzkaller0 entered promiscuous mode [ 132.347008][ T5303] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 132.386444][ T13] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 132.404601][ T13] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 132.423918][ T13] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 132.445162][ T13] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 132.483560][ T13] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.536332][ T5297] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 132.556832][ T13] hub 2-1:1.0: bad descriptor, ignoring hub [ 132.562784][ T13] hub: probe of 2-1:1.0 failed with error -5 [ 132.611656][ T13] cdc_wdm 2-1:1.0: skipping garbage [ 132.626864][ T5306] netlink: 96 bytes leftover after parsing attributes in process `syz.0.322'. [ 132.646096][ T13] cdc_wdm 2-1:1.0: skipping garbage [ 132.658117][ T13] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 132.664452][ T13] cdc_wdm 2-1:1.0: Unknown control protocol [ 132.708712][ T5306] netlink: 'syz.0.322': attribute type 13 has an invalid length. [ 132.724040][ T5306] netlink: 'syz.0.322': attribute type 17 has an invalid length. [ 132.754281][ T5306] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 132.786541][ T5306] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 132.869304][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.877398][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.081573][ T5312] udc-core: couldn't find an available UDC or it's busy [ 133.102381][ T5312] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 133.206027][ C1] wdm_int_callback: 37 callbacks suppressed [ 133.206049][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.218607][ C1] wdm_int_callback: 37 callbacks suppressed [ 133.218629][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.256013][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.262675][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.286015][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.292666][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.316017][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.322706][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.346200][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.352847][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.376097][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.382768][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.416004][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.422666][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.456013][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.462687][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.496026][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.502797][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.526028][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 133.532681][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 133.944111][ T5338] fuse: Unknown parameter '0x0000000000000005' [ 134.295277][ T5351] device syzkaller0 entered promiscuous mode [ 134.318560][ T5351] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 134.433423][ T5353] netlink: 96 bytes leftover after parsing attributes in process `syz.0.335'. [ 134.484148][ T5353] netlink: 'syz.0.335': attribute type 13 has an invalid length. [ 134.493743][ T5353] netlink: 'syz.0.335': attribute type 17 has an invalid length. [ 134.510119][ T5353] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 134.522914][ T5353] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 134.746553][ T21] usb 2-1: USB disconnect, device number 4 [ 135.555536][ T5384] fuse: Unknown parameter 'fd0x0000000000000005' [ 136.493562][ T5395] device syzkaller0 entered promiscuous mode [ 136.535316][ T5395] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 136.610838][ T5397] netlink: 96 bytes leftover after parsing attributes in process `syz.1.347'. [ 136.726228][ T5399] netlink: 'syz.1.347': attribute type 13 has an invalid length. [ 136.762892][ T5399] netlink: 'syz.1.347': attribute type 17 has an invalid length. [ 136.782000][ T5399] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 136.823266][ T5399] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 137.206065][ T21] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 137.576178][ T21] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 137.586700][ T21] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 137.607140][ T21] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 137.632512][ T21] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 137.640984][ T5430] fuse: Unknown parameter 'fd0x0000000000000005' [ 137.653193][ T21] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.676328][ T5405] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 137.702081][ T21] hub 1-1:1.0: bad descriptor, ignoring hub [ 137.714509][ T21] hub: probe of 1-1:1.0 failed with error -5 [ 137.731440][ T21] cdc_wdm 1-1:1.0: skipping garbage [ 137.742766][ T21] cdc_wdm 1-1:1.0: skipping garbage [ 137.764365][ T21] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 137.810560][ T21] cdc_wdm 1-1:1.0: Unknown control protocol [ 138.220925][ T5444] udc-core: couldn't find an available UDC or it's busy [ 138.245168][ T5444] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 138.335997][ C1] wdm_int_callback: 49 callbacks suppressed [ 138.336024][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.348755][ C1] wdm_int_callback: 49 callbacks suppressed [ 138.348776][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.361057][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.367646][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.375997][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.382674][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.396025][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.402673][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.416034][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.422861][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.446106][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.452758][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.476102][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.482836][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.496020][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.502660][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.516011][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.522740][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.536020][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 138.542740][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 138.722956][ T5448] device syzkaller0 entered promiscuous mode [ 138.800042][ T5448] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 139.386231][ T5469] netlink: 96 bytes leftover after parsing attributes in process `syz.2.365'. [ 139.480176][ T5469] netlink: 'syz.2.365': attribute type 13 has an invalid length. [ 139.495100][ T5469] netlink: 'syz.2.365': attribute type 17 has an invalid length. [ 139.530375][ T5469] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 139.571761][ T5469] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 139.585703][ T5476] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5477] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5476] [ 139.791081][ T5480] binder: BINDER_SET_CONTEXT_MGR already set [ 139.834476][ T5480] binder: 5479:5480 ioctl 4018620d 2000000002c0 returned -16 [ 139.976571][ T1111] usb 1-1: USB disconnect, device number 5 [ 140.031963][ T5486] fuse: Unknown parameter 'fd0x0000000000000005' [ 140.855346][ T5500] device syzkaller0 entered promiscuous mode [ 140.889983][ T5500] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 141.114101][ T5506] device syzkaller0 entered promiscuous mode [ 141.152884][ T5510] netlink: 96 bytes leftover after parsing attributes in process `syz.4.379'. [ 141.253238][ T5510] netlink: 'syz.4.379': attribute type 13 has an invalid length. [ 141.273156][ T5510] netlink: 'syz.4.379': attribute type 17 has an invalid length. [ 141.296714][ T5510] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 141.366685][ T5510] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 141.740887][ T21] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 142.082356][ T5534] binder: BINDER_SET_CONTEXT_MGR already set [ 142.106337][ T21] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 142.132452][ T5534] binder: 5533:5534 ioctl 4018620d 2000000002c0 returned -16 [ 142.150649][ T21] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 142.191115][ T21] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 142.232228][ T21] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 142.271557][ T21] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.356279][ T5519] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 142.377865][ T21] hub 1-1:1.0: bad descriptor, ignoring hub [ 142.385389][ T21] hub: probe of 1-1:1.0 failed with error -5 [ 142.394966][ T21] cdc_wdm 1-1:1.0: skipping garbage [ 142.400810][ T21] cdc_wdm 1-1:1.0: skipping garbage [ 142.409037][ T21] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 142.415463][ T21] cdc_wdm 1-1:1.0: Unknown control protocol [ 142.525646][ T5539] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5540] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5539] [ 142.899584][ T5541] udc-core: couldn't find an available UDC or it's busy [ 142.913313][ T5541] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 142.985273][ T5543] device syzkaller0 entered promiscuous mode [ 143.010850][ T5543] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 143.356002][ C1] wdm_int_callback: 83 callbacks suppressed [ 143.356026][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.368737][ C1] wdm_int_callback: 83 callbacks suppressed [ 143.368755][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.396020][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.402688][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.436012][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.442664][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.476020][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.482680][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.506046][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.512704][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.536006][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.542664][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.575998][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.582649][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.605999][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.612765][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.643652][ T5558] device syzkaller0 entered promiscuous mode [ 143.645995][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.656449][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.675998][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 143.682647][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 143.815845][ T5560] netlink: 96 bytes leftover after parsing attributes in process `syz.2.394'. [ 143.907554][ T5560] netlink: 'syz.2.394': attribute type 13 has an invalid length. [ 143.940893][ T5560] netlink: 'syz.2.394': attribute type 17 has an invalid length. [ 143.981634][ T5560] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 144.020395][ T5560] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 144.351904][ T5576] binder: BINDER_SET_CONTEXT_MGR already set [ 144.371398][ T5576] binder: 5575:5576 ioctl 4018620d 2000000002c0 returned -16 [ 144.537237][ T4227] usb 1-1: USB disconnect, device number 6 [ 144.539385][ T5580] device syzkaller0 entered promiscuous mode [ 144.609324][ T5583] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 145.494763][ T5597] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5598] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5597] [ 145.580943][ T5600] device syzkaller0 entered promiscuous mode [ 145.985790][ T5610] netlink: 'syz.4.408': attribute type 13 has an invalid length. [ 146.048393][ T5610] netlink: 'syz.4.408': attribute type 17 has an invalid length. [ 146.099969][ T5610] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 146.149712][ T5610] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 146.736147][ T1111] usb 5-1: new low-speed USB device number 3 using dummy_hcd [ 146.868245][ T5627] device syzkaller0 entered promiscuous mode [ 146.889484][ T5627] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 147.176165][ T1111] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.202444][ T1111] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 147.211854][ T1111] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 147.226803][ T1111] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 147.239192][ T1111] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.266850][ T5620] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 147.301082][ T1111] hub 5-1:1.0: bad descriptor, ignoring hub [ 147.311141][ T1111] hub: probe of 5-1:1.0 failed with error -5 [ 147.318530][ T1111] cdc_wdm 5-1:1.0: skipping garbage [ 147.323788][ T1111] cdc_wdm 5-1:1.0: skipping garbage [ 147.334654][ T1111] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 147.340975][ T1111] cdc_wdm 5-1:1.0: Unknown control protocol [ 147.807158][ T5646] udc-core: couldn't find an available UDC or it's busy [ 147.823738][ T5646] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 147.881997][ T5656] netlink: 96 bytes leftover after parsing attributes in process `syz.1.423'. [ 147.930619][ T5656] netlink: 'syz.1.423': attribute type 13 has an invalid length. [ 147.939809][ T5656] netlink: 'syz.1.423': attribute type 17 has an invalid length. [ 147.951616][ T5656] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 147.966185][ T5656] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 148.366074][ C0] wdm_int_callback: 55 callbacks suppressed [ 148.366098][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.386048][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.392683][ C0] wdm_int_callback: 56 callbacks suppressed [ 148.392695][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.405985][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.412696][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.426042][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.432788][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.446026][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.452695][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.465999][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.472651][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.485999][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.492641][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.505998][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.512660][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.526013][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.532670][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.549372][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 148.556033][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.575041][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 148.644091][ T5674] tipc: Enabling of bearer rejected, failed to enable media [ 148.669247][ T5674] device syzkaller0 entered promiscuous mode [ 148.693156][ T5674] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 148.812851][ T5676] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5677] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5676] [ 149.496396][ T1108] usb 5-1: USB disconnect, device number 3 [ 150.370835][ T5705] netlink: 96 bytes leftover after parsing attributes in process `syz.3.435'. [ 150.433635][ T5705] netlink: 'syz.3.435': attribute type 13 has an invalid length. [ 150.478045][ T5705] netlink: 'syz.3.435': attribute type 17 has an invalid length. [ 150.531477][ T5705] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 150.555754][ T5705] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 150.844690][ T5720] tipc: Enabling of bearer rejected, failed to enable media [ 150.862192][ T5720] device syzkaller0 entered promiscuous mode [ 150.885177][ T5720] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 151.756106][ T4267] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 151.819737][ T5754] netlink: 96 bytes leftover after parsing attributes in process `syz.3.450'. [ 151.879815][ T5754] netlink: 'syz.3.450': attribute type 13 has an invalid length. [ 151.890514][ T5754] netlink: 'syz.3.450': attribute type 17 has an invalid length. [ 151.911921][ T5754] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 151.923094][ T5754] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 152.126248][ T4267] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.167554][ T4267] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 152.196118][ T4267] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 152.226254][ T4267] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 152.248789][ T4267] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.296419][ T5747] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 152.317983][ T4267] hub 1-1:1.0: bad descriptor, ignoring hub [ 152.331856][ T4267] hub: probe of 1-1:1.0 failed with error -5 [ 152.350948][ T4267] cdc_wdm 1-1:1.0: skipping garbage [ 152.366738][ T4267] cdc_wdm 1-1:1.0: skipping garbage [ 152.384962][ T4267] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 152.401665][ T4267] cdc_wdm 1-1:1.0: Unknown control protocol [ 152.840606][ T5771] udc-core: couldn't find an available UDC or it's busy [ 152.856241][ T5771] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 153.243658][ T5780] tipc: Enabling of bearer rejected, failed to enable media [ 153.278585][ T5780] device syzkaller0 entered promiscuous mode [ 153.315795][ T5780] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 153.386088][ C0] wdm_int_callback: 68 callbacks suppressed [ 153.386112][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.407908][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.414522][ C0] wdm_int_callback: 68 callbacks suppressed [ 153.414534][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.426738][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.433321][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.463509][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.470244][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.476500][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.483185][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.531052][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.537718][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.627334][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.634081][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.677836][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.684493][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.756293][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.762965][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.820760][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 153.827414][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 153.857987][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 154.234805][ T5810] netlink: 96 bytes leftover after parsing attributes in process `syz.2.464'. [ 154.264141][ T5810] netlink: 'syz.2.464': attribute type 13 has an invalid length. [ 154.272233][ T5810] netlink: 'syz.2.464': attribute type 17 has an invalid length. [ 154.284106][ T5810] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 154.292982][ T5810] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 154.537472][ T13] usb 1-1: USB disconnect, device number 7 [ 155.000369][ T5826] tipc: Enabling of bearer rejected, failed to enable media [ 155.028606][ T5826] device syzkaller0 entered promiscuous mode [ 155.048717][ T5826] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 155.969004][ T5851] netlink: 96 bytes leftover after parsing attributes in process `syz.1.475'. [ 156.062021][ T5851] netlink: 'syz.1.475': attribute type 13 has an invalid length. [ 156.080592][ T5851] netlink: 'syz.1.475': attribute type 17 has an invalid length. [ 156.116703][ T5851] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 156.163596][ T5851] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 156.946112][ T4227] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 157.247486][ T5870] tipc: Enabling of bearer rejected, failed to enable media [ 157.305653][ T5872] device syzkaller0 entered promiscuous mode [ 157.321344][ T5870] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 157.366275][ T4227] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 157.383405][ T4227] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 157.396037][ T4227] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 157.407261][ T4227] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 157.416968][ T4227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.468111][ T5866] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 157.541078][ T4227] hub 4-1:1.0: bad descriptor, ignoring hub [ 157.549382][ T4227] hub: probe of 4-1:1.0 failed with error -5 [ 157.583263][ T4227] cdc_wdm 4-1:1.0: skipping garbage [ 157.624194][ T4227] cdc_wdm 4-1:1.0: skipping garbage [ 157.652309][ T4227] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 157.677779][ T4227] cdc_wdm 4-1:1.0: Unknown control protocol [ 158.064628][ T5885] udc-core: couldn't find an available UDC or it's busy [ 158.080206][ T5885] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 158.184200][ T5898] netlink: 96 bytes leftover after parsing attributes in process `syz.2.487'. [ 158.327453][ T5898] netlink: 'syz.2.487': attribute type 13 has an invalid length. [ 158.362416][ T5898] netlink: 'syz.2.487': attribute type 17 has an invalid length. [ 158.406004][ C0] wdm_int_callback: 43 callbacks suppressed [ 158.406026][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.413989][ T5898] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 158.426006][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.432808][ C0] wdm_int_callback: 43 callbacks suppressed [ 158.432829][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.445992][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.452627][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.465636][ T5898] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 158.466031][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.487842][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.494542][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.501176][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.507857][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.514597][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.536281][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.543021][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.559034][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.565886][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.576001][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.582660][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.596002][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 158.602660][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 158.615998][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 159.084852][ T5911] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5912] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5911] [ 159.596158][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 159.637496][ T4227] usb 4-1: USB disconnect, device number 5 [ 159.782534][ T5921] tipc: Enabling of bearer rejected, failed to enable media [ 159.816659][ T5921] device syzkaller0 entered promiscuous mode [ 159.846286][ T5921] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 160.114044][ T5929] device syzkaller0 entered promiscuous mode [ 160.314798][ T5938] netlink: 96 bytes leftover after parsing attributes in process `syz.3.500'. [ 160.355502][ T5938] netlink: 'syz.3.500': attribute type 13 has an invalid length. [ 160.363671][ T5938] netlink: 'syz.3.500': attribute type 17 has an invalid length. [ 160.375885][ T5938] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 160.385820][ T5938] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 161.426985][ T4267] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 161.442565][ T5959] tipc: Enabling of bearer rejected, failed to enable media [ 161.454883][ T5959] device syzkaller0 entered promiscuous mode [ 161.463696][ T5959] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 161.682662][ T5964] device syzkaller0 entered promiscuous mode [ 161.796220][ T4267] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.816649][ T4267] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 161.866117][ T4267] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 161.920978][ T4267] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 161.941198][ T4267] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.006435][ T5953] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 162.039540][ T4267] hub 3-1:1.0: bad descriptor, ignoring hub [ 162.047675][ T4267] hub: probe of 3-1:1.0 failed with error -5 [ 162.069695][ T4267] cdc_wdm 3-1:1.0: skipping garbage [ 162.083840][ T4267] cdc_wdm 3-1:1.0: skipping garbage [ 162.105633][ T4267] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 162.112263][ T4267] cdc_wdm 3-1:1.0: Unknown control protocol [ 162.122073][ T5970] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5971] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5970] [ 162.553906][ T5974] udc-core: couldn't find an available UDC or it's busy [ 162.566246][ T5974] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 162.666294][ T5977] netlink: 96 bytes leftover after parsing attributes in process `syz.1.513'. [ 162.807183][ T5977] netlink: 'syz.1.513': attribute type 13 has an invalid length. [ 162.821760][ T5977] netlink: 'syz.1.513': attribute type 17 has an invalid length. [ 162.840564][ T5977] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 162.852890][ T5977] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 163.416075][ C1] wdm_int_callback: 82 callbacks suppressed [ 163.416099][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.456081][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.462744][ C1] wdm_int_callback: 82 callbacks suppressed [ 163.462767][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.495997][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.502761][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.536088][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.542739][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.576104][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.582760][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.605989][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.612649][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.635995][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.642647][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.666002][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.672654][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.696034][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.702695][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.725995][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.732655][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.756087][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.776353][ T6002] tipc: Enabling of bearer rejected, failed to enable media [ 163.800533][ T6002] device syzkaller0 entered promiscuous mode [ 163.821397][ T6002] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 163.855522][ T6006] device syzkaller0 entered promiscuous mode [ 164.258308][ T6023] netlink: 96 bytes leftover after parsing attributes in process `syz.2.527'. [ 164.262539][ T21] usb 3-1: USB disconnect, device number 6 [ 164.316941][ T6023] netlink: 'syz.2.527': attribute type 13 has an invalid length. [ 164.324733][ T6023] netlink: 'syz.2.527': attribute type 17 has an invalid length. [ 164.342989][ T6023] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 164.356251][ T6023] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 165.303862][ T6051] binder: transaction release 89 bad handle 2, ret = -22 [ 166.185664][ T6064] device syzkaller0 entered promiscuous mode [ 166.301605][ T6066] tipc: Enabling of bearer rejected, failed to enable media [ 166.327107][ T6066] device syzkaller0 entered promiscuous mode [ 166.367581][ T6066] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 166.402119][ T6070] netlink: 96 bytes leftover after parsing attributes in process `syz.3.538'. [ 166.472648][ T6070] netlink: 'syz.3.538': attribute type 13 has an invalid length. [ 166.483992][ T6070] netlink: 'syz.3.538': attribute type 17 has an invalid length. [ 166.512505][ T6070] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.534813][ T6070] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 167.006063][ T4227] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 167.090685][ T6096] binder: transaction release 98 bad handle 2, ret = -22 [ 167.376232][ T4227] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 167.414899][ T4227] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 167.443951][ T6107] device syzkaller0 entered promiscuous mode [ 167.456666][ T4227] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 167.472427][ T6105] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6108] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6105] [ 167.486212][ T4227] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 167.495624][ T4227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.546298][ T6076] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 167.567205][ T4227] hub 4-1:1.0: bad descriptor, ignoring hub [ 167.579380][ T4227] hub: probe of 4-1:1.0 failed with error -5 [ 167.586496][ T4227] cdc_wdm 4-1:1.0: skipping garbage [ 167.592845][ T4227] cdc_wdm 4-1:1.0: skipping garbage [ 167.605624][ T4227] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 167.622504][ T4227] cdc_wdm 4-1:1.0: Unknown control protocol [ 168.783616][ T6114] udc-core: couldn't find an available UDC or it's busy [ 168.825163][ T6114] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 168.838416][ T6117] device syzkaller0 entered promiscuous mode [ 168.899480][ T6120] netlink: 96 bytes leftover after parsing attributes in process `syz.1.551'. [ 168.925991][ C1] wdm_int_callback: 19 callbacks suppressed [ 168.926013][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 168.938574][ C1] wdm_int_callback: 18 callbacks suppressed [ 168.938592][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 168.950668][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.957028][ T6119] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 168.969025][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 168.975717][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 168.987905][ T6120] netlink: 'syz.1.551': attribute type 13 has an invalid length. [ 169.005999][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.012647][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.036014][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.041842][ T6120] netlink: 'syz.1.551': attribute type 17 has an invalid length. [ 169.042661][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.076009][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.082651][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.116119][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.119123][ T6120] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 169.122764][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.136715][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.143350][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.165997][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.172815][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.195175][ T6120] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 169.215991][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.222637][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.246002][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 169.252770][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 169.962376][ T6147] binder: transaction release 107 bad handle 2, ret = -22 [ 169.988123][ T4230] usb 4-1: USB disconnect, device number 6 [ 170.095695][ T6154] device syzkaller0 entered promiscuous mode [ 171.175896][ T6170] netlink: 96 bytes leftover after parsing attributes in process `syz.1.565'. [ 171.213586][ T6170] netlink: 'syz.1.565': attribute type 13 has an invalid length. [ 171.232885][ T6170] netlink: 'syz.1.565': attribute type 17 has an invalid length. [ 171.253308][ T6170] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 171.273835][ T6170] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 171.309570][ T6173] device syzkaller0 entered promiscuous mode [ 171.336568][ T6173] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 171.753779][ T6200] binder: transaction release 116 bad handle 2, ret = -22 [ 171.836034][ T4227] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 172.088355][ T6204] device syzkaller0 entered promiscuous mode [ 172.306388][ T4227] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 173.056353][ T4227] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 173.089278][ T6210] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6211] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6210] [ 173.120979][ T4227] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 173.136973][ T4227] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 173.148204][ T4227] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.196288][ T6192] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 173.247095][ T6218] netlink: 96 bytes leftover after parsing attributes in process `syz.2.578'. [ 173.251912][ T4227] hub 2-1:1.0: bad descriptor, ignoring hub [ 173.296732][ T6221] device syzkaller0 entered promiscuous mode [ 173.307645][ T6218] netlink: 'syz.2.578': attribute type 13 has an invalid length. [ 173.319815][ T6218] netlink: 'syz.2.578': attribute type 17 has an invalid length. [ 173.330734][ T6218] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 173.348074][ T4227] hub: probe of 2-1:1.0 failed with error -5 [ 173.360994][ T6218] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 173.381936][ T6221] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 173.476725][ T4227] cdc_wdm 2-1:1.0: skipping garbage [ 173.482069][ T4227] cdc_wdm 2-1:1.0: skipping garbage [ 173.512056][ T4227] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 173.537451][ T4227] cdc_wdm 2-1:1.0: Unknown control protocol [ 173.648393][ T6192] udc-core: couldn't find an available UDC or it's busy [ 173.662469][ T6192] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 173.692330][ T4227] usb 2-1: USB disconnect, device number 5 [ 174.629397][ T6251] device syzkaller0 entered promiscuous mode [ 175.521792][ T6265] netlink: 96 bytes leftover after parsing attributes in process `syz.3.590'. [ 175.590467][ T6265] netlink: 'syz.3.590': attribute type 13 has an invalid length. [ 175.602032][ T6265] netlink: 'syz.3.590': attribute type 17 has an invalid length. [ 175.620263][ T6265] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 175.632169][ T6265] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 175.654414][ T6270] device syzkaller0 entered promiscuous mode [ 175.666596][ T6270] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 176.096047][ T4227] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 176.556385][ T4227] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 176.609404][ T4227] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 176.701648][ T4227] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 176.874836][ T4227] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 176.995987][ T4227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.096444][ T6280] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 177.125750][ T6294] device syzkaller0 entered promiscuous mode [ 177.153394][ T4227] hub 4-1:1.0: bad descriptor, ignoring hub [ 177.169748][ T4227] hub: probe of 4-1:1.0 failed with error -5 [ 177.189634][ T4227] cdc_wdm 4-1:1.0: skipping garbage [ 177.205192][ T4227] cdc_wdm 4-1:1.0: skipping garbage [ 177.234435][ T4227] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 177.242823][ T4227] cdc_wdm 4-1:1.0: Unknown control protocol [ 177.560538][ T6312] device syzkaller0 entered promiscuous mode [ 177.571130][ T6312] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 177.655478][ T6313] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6314] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6313] [ 177.669883][ T6307] udc-core: couldn't find an available UDC or it's busy [ 177.689277][ T6307] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 177.753300][ T6317] netlink: 96 bytes leftover after parsing attributes in process `syz.4.606'. [ 177.795983][ C1] wdm_int_callback: 30 callbacks suppressed [ 177.796007][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 177.808559][ C1] wdm_int_callback: 30 callbacks suppressed [ 177.808580][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 177.834308][ T6317] netlink: 'syz.4.606': attribute type 13 has an invalid length. [ 177.845994][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 177.852633][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 177.860763][ T6317] netlink: 'syz.4.606': attribute type 17 has an invalid length. [ 177.876009][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 177.882648][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 177.900516][ T6317] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 177.915994][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 177.922725][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 177.946032][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 177.952679][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 177.976283][ T6317] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 178.006236][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.012884][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.065606][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.072271][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.129428][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.136086][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.156731][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.163375][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.196055][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.202708][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.886493][ T4227] usb 4-1: USB disconnect, device number 7 [ 179.047017][ T6337] device syzkaller0 entered promiscuous mode [ 180.031757][ T6350] device syzkaller0 entered promiscuous mode [ 180.094209][ T6355] netlink: 96 bytes leftover after parsing attributes in process `syz.1.617'. [ 180.130123][ T6359] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 180.191937][ T6355] netlink: 'syz.1.617': attribute type 13 has an invalid length. [ 180.219338][ T6355] netlink: 'syz.1.617': attribute type 17 has an invalid length. [ 180.234686][ T6355] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 180.246373][ T6355] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 181.086099][ T1108] usb 1-1: new low-speed USB device number 8 using dummy_hcd [ 181.204672][ T6385] binder: 6384:6385 ioctl 4018620d 0 returned -22 [ 181.277232][ T6387] device syzkaller0 entered promiscuous mode [ 181.546217][ T1108] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.556525][ T1108] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 182.332832][ T1108] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 182.346347][ T1108] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 182.355507][ T1108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.389827][ T6379] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 182.427455][ T1108] hub 1-1:1.0: bad descriptor, ignoring hub [ 182.440039][ T1108] hub: probe of 1-1:1.0 failed with error -5 [ 182.453548][ T1108] cdc_wdm 1-1:1.0: skipping garbage [ 182.466452][ T1108] cdc_wdm 1-1:1.0: skipping garbage [ 182.486656][ T1108] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 182.516128][ T1108] cdc_wdm 1-1:1.0: Unknown control protocol [ 182.558977][ T6406] netlink: 96 bytes leftover after parsing attributes in process `syz.1.631'. [ 182.700351][ T6406] netlink: 'syz.1.631': attribute type 13 has an invalid length. [ 182.737952][ T6406] netlink: 'syz.1.631': attribute type 17 has an invalid length. [ 182.758261][ T6406] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 182.774903][ T6406] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 182.894126][ T6416] device syzkaller0 entered promiscuous mode [ 182.905175][ T6416] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 182.936602][ T6414] udc-core: couldn't find an available UDC or it's busy [ 182.958494][ T6414] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 182.974517][ T6417] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6421] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6417] [ 183.026025][ C0] wdm_int_callback: 26 callbacks suppressed [ 183.026042][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.038671][ C0] wdm_int_callback: 26 callbacks suppressed [ 183.038687][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.050962][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.057593][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.065988][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.072611][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.085985][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.092635][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.106099][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.112739][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.125981][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.132658][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.145980][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.152619][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.166049][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.172838][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.185991][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.192622][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.206002][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 183.212647][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 183.846387][ T6430] device syzkaller0 entered promiscuous mode [ 184.086513][ T4267] usb 1-1: USB disconnect, device number 8 [ 184.152349][ T6435] binder: 6433:6435 ioctl 4018620d 0 returned -22 [ 184.831191][ T6451] netlink: 96 bytes leftover after parsing attributes in process `syz.3.643'. [ 185.346388][ T6451] netlink: 'syz.3.643': attribute type 13 has an invalid length. [ 185.354176][ T6451] netlink: 'syz.3.643': attribute type 17 has an invalid length. [ 185.405664][ T6451] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 185.414934][ T6451] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 185.482731][ T6463] device syzkaller0 entered promiscuous mode [ 185.524131][ T6463] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 185.732002][ T6475] device syzkaller0 entered promiscuous mode [ 186.146099][ T4267] Bluetooth: hci1: command 0x0406 tx timeout [ 186.146602][ T4227] Bluetooth: hci3: command 0x0406 tx timeout [ 186.162498][ T4267] Bluetooth: hci4: command 0x0406 tx timeout [ 186.180667][ T4267] Bluetooth: hci2: command 0x0406 tx timeout [ 186.187078][ T4267] Bluetooth: hci0: command 0x0406 tx timeout [ 186.355848][ T6488] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6489] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6488] [ 186.376030][ T1111] usb 4-1: new low-speed USB device number 8 using dummy_hcd [ 186.776233][ T1111] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 186.793288][ T1111] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 186.815578][ T1111] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 186.847534][ T1111] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 186.875566][ T1111] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.916457][ T6484] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 186.947239][ T1111] hub 4-1:1.0: bad descriptor, ignoring hub [ 186.956110][ T1111] hub: probe of 4-1:1.0 failed with error -5 [ 186.971642][ T1111] cdc_wdm 4-1:1.0: skipping garbage [ 186.985069][ T1111] cdc_wdm 4-1:1.0: skipping garbage [ 186.998913][ T1111] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 187.005195][ T1111] cdc_wdm 4-1:1.0: Unknown control protocol [ 187.235555][ T6497] binder: 6496:6497 ioctl 4018620d 0 returned -22 [ 187.457273][ T6495] udc-core: couldn't find an available UDC or it's busy [ 187.466970][ T6495] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 188.035983][ C1] wdm_int_callback: 62 callbacks suppressed [ 188.036010][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.048549][ C1] wdm_int_callback: 62 callbacks suppressed [ 188.048564][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.060769][ C1] vkms_vblank_simulate: vblank timer overrun [ 188.085981][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.092649][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.116028][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.122685][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.155977][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.162633][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.186037][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.192691][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.225997][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.232648][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.265980][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.272636][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.296004][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.302659][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.315793][ T6518] netlink: 96 bytes leftover after parsing attributes in process `syz.1.660'. [ 188.326002][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.332658][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.342236][ T6516] device syzkaller0 entered promiscuous mode [ 188.356042][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 188.360310][ T6518] netlink: 'syz.1.660': attribute type 13 has an invalid length. [ 188.362693][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 188.378322][ T6518] netlink: 'syz.1.660': attribute type 17 has an invalid length. [ 188.389885][ T6518] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 188.399299][ T6518] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 188.416395][ T6516] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 188.431843][ T6520] device syzkaller0 entered promiscuous mode [ 189.096285][ T21] usb 4-1: USB disconnect, device number 8 [ 189.663367][ T6547] binder: BINDER_SET_CONTEXT_MGR already set [ 189.723064][ T6547] binder: 6546:6547 ioctl 4018620d 2000000002c0 returned -16 [ 189.980441][ T6556] netlink: 96 bytes leftover after parsing attributes in process `syz.1.673'. [ 190.810013][ T6561] device syzkaller0 entered promiscuous mode [ 190.834576][ T6556] netlink: 'syz.1.673': attribute type 13 has an invalid length. [ 190.875351][ T6556] netlink: 'syz.1.673': attribute type 17 has an invalid length. [ 190.917975][ T6556] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 190.972094][ T6556] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 191.210773][ T6578] device syzkaller0 entered promiscuous mode [ 191.300776][ T6578] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 191.706093][ T4267] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 191.893301][ T6595] binder: BINDER_SET_CONTEXT_MGR already set [ 191.899871][ T6595] binder: 6594:6595 ioctl 4018620d 2000000002c0 returned -16 [ 192.076315][ T4267] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 192.098129][ T4267] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 192.109308][ T4267] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 192.121201][ T4267] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 192.130407][ T4267] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.246694][ T6587] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 192.257427][ T4267] hub 5-1:1.0: bad descriptor, ignoring hub [ 192.263406][ T4267] hub: probe of 5-1:1.0 failed with error -5 [ 192.270336][ T4267] cdc_wdm 5-1:1.0: skipping garbage [ 192.275563][ T4267] cdc_wdm 5-1:1.0: skipping garbage [ 192.282816][ T4267] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 192.288850][ T4267] cdc_wdm 5-1:1.0: Unknown control protocol [ 193.124835][ T6605] netlink: 96 bytes leftover after parsing attributes in process `syz.0.688'. [ 193.167206][ T6605] netlink: 'syz.0.688': attribute type 13 has an invalid length. [ 193.175898][ T6605] netlink: 'syz.0.688': attribute type 17 has an invalid length. [ 193.188027][ T6605] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 193.202261][ T6605] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 193.351587][ T6601] udc-core: couldn't find an available UDC or it's busy [ 193.362970][ T6601] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 193.456006][ C0] wdm_int_callback: 31 callbacks suppressed [ 193.456031][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.468732][ C0] wdm_int_callback: 31 callbacks suppressed [ 193.468745][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.480895][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.487685][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.495979][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.502702][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.515976][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.522627][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.535991][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.542636][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.555983][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.562708][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.575980][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.582602][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.595982][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.602634][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.615991][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.622637][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.635991][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 193.642645][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 193.645564][ T6617] device syzkaller0 entered promiscuous mode [ 193.881854][ T6619] device syzkaller0 entered promiscuous mode [ 193.927595][ T6619] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 194.212029][ T6627] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6628] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6627] [ 194.316742][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.323134][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.516452][ T4267] usb 5-1: USB disconnect, device number 4 [ 194.538551][ T6635] binder: BINDER_SET_CONTEXT_MGR already set [ 194.587048][ T6635] binder: 6634:6635 ioctl 4018620d 2000000002c0 returned -16 [ 194.692361][ T6642] netlink: 96 bytes leftover after parsing attributes in process `syz.4.700'. [ 194.719632][ T6642] netlink: 'syz.4.700': attribute type 13 has an invalid length. [ 194.727849][ T6642] netlink: 'syz.4.700': attribute type 17 has an invalid length. [ 194.743733][ T6642] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 194.755886][ T6642] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 195.917757][ T6649] device syzkaller0 entered promiscuous mode [ 196.405581][ T6664] device syzkaller0 entered promiscuous mode [ 196.443867][ T6664] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 196.810478][ T6676] netlink: 96 bytes leftover after parsing attributes in process `syz.2.712'. [ 196.831293][ T6676] netlink: 'syz.2.712': attribute type 13 has an invalid length. [ 196.846685][ T6676] netlink: 'syz.2.712': attribute type 17 has an invalid length. [ 196.862214][ T6676] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 196.903638][ T6676] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 197.006139][ T13] usb 5-1: new low-speed USB device number 5 using dummy_hcd [ 197.046660][ T6683] binder: 6680:6683 ioctl c0306201 0 returned -14 [ 197.376204][ T13] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.961079][ T13] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 197.983663][ T13] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 198.024445][ T13] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 198.036601][ T6690] device syzkaller0 entered promiscuous mode [ 198.054188][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.096377][ T6674] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 198.117257][ T13] hub 5-1:1.0: bad descriptor, ignoring hub [ 198.123228][ T13] hub: probe of 5-1:1.0 failed with error -5 [ 198.137086][ T13] cdc_wdm 5-1:1.0: skipping garbage [ 198.142506][ T13] cdc_wdm 5-1:1.0: skipping garbage [ 198.157419][ T13] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 198.165225][ T13] cdc_wdm 5-1:1.0: Unknown control protocol [ 198.530950][ T6701] device syzkaller0 entered promiscuous mode [ 198.569924][ T6701] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 198.646610][ T6699] udc-core: couldn't find an available UDC or it's busy [ 198.666370][ T6699] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 198.796077][ C1] wdm_int_callback: 41 callbacks suppressed [ 198.796104][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.808734][ C1] wdm_int_callback: 41 callbacks suppressed [ 198.808756][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 198.835994][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.842634][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 198.866030][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.872690][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 198.895987][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.902649][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 198.925981][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.932834][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 198.956000][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.962653][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 198.986012][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 198.992664][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 199.015979][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 199.022631][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 199.045992][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 199.052644][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 199.075980][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 199.082630][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 199.235097][ T6716] netlink: 96 bytes leftover after parsing attributes in process `syz.1.726'. [ 199.372474][ T6718] netlink: 'syz.1.726': attribute type 13 has an invalid length. [ 199.405248][ T6718] netlink: 'syz.1.726': attribute type 17 has an invalid length. [ 199.447713][ T6718] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 199.569816][ T6718] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 199.826652][ T6724] binder: 6723:6724 ioctl c0306201 0 returned -14 [ 199.876477][ T13] usb 5-1: USB disconnect, device number 5 [ 199.943611][ T6728] device syzkaller0 entered promiscuous mode [ 201.111456][ T6742] device syzkaller0 entered promiscuous mode [ 201.137707][ T6742] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 201.492320][ T6758] netlink: 96 bytes leftover after parsing attributes in process `syz.0.740'. [ 201.525128][ T6758] netlink: 'syz.0.740': attribute type 13 has an invalid length. [ 201.544043][ T6758] netlink: 'syz.0.740': attribute type 17 has an invalid length. [ 201.565860][ T6758] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 201.596776][ T6758] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 201.741984][ T6767] binder: 6766:6767 ioctl c0306201 0 returned -14 [ 201.896110][ T4226] usb 5-1: new low-speed USB device number 6 using dummy_hcd [ 202.306099][ T4226] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 202.318431][ T4226] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 202.328189][ T4226] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 202.339660][ T4226] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 202.349087][ T4226] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.396833][ T6764] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 202.427189][ T4226] hub 5-1:1.0: bad descriptor, ignoring hub [ 202.437558][ T4226] hub: probe of 5-1:1.0 failed with error -5 [ 202.444247][ T4226] cdc_wdm 5-1:1.0: skipping garbage [ 202.549900][ T4226] cdc_wdm 5-1:1.0: skipping garbage [ 202.557822][ T4226] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 202.563866][ T4226] cdc_wdm 5-1:1.0: Unknown control protocol [ 203.416153][ T6776] device syzkaller0 entered promiscuous mode [ 203.675505][ T6779] udc-core: couldn't find an available UDC or it's busy [ 203.699892][ T6779] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 203.765880][ T6786] device syzkaller0 entered promiscuous mode [ 203.782995][ T6786] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 203.805980][ C0] wdm_int_callback: 31 callbacks suppressed [ 203.806003][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.825982][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.832724][ C0] wdm_int_callback: 32 callbacks suppressed [ 203.832753][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.846146][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.852843][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.866414][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.873099][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.887888][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.894504][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.910552][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.917330][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.927067][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.933709][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.941835][ T6793] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6794] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6793] [ 203.945987][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.962098][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.968680][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.975276][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 203.983545][ T6795] netlink: 96 bytes leftover after parsing attributes in process `syz.1.752'. [ 203.986045][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 203.999118][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 204.006205][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 204.154802][ T6795] netlink: 'syz.1.752': attribute type 13 has an invalid length. [ 204.168990][ T6795] netlink: 'syz.1.752': attribute type 17 has an invalid length. [ 204.193144][ T6795] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 204.207319][ T6795] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 204.253237][ T6800] netlink: 4 bytes leftover after parsing attributes in process `syz.0.753'. [ 204.856395][ T4267] usb 5-1: USB disconnect, device number 6 [ 205.031657][ T6818] device syzkaller0 entered promiscuous mode [ 206.485057][ T6833] tipc: Started in network mode [ 206.506359][ T6833] tipc: Node identity 8ae35cf3a883, cluster identity 4711 [ 206.537300][ T6833] tipc: Enabled bearer , priority 0 [ 206.544042][ T6837] netlink: 96 bytes leftover after parsing attributes in process `syz.1.765'. [ 206.640628][ T6836] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 206.648906][ T6840] netlink: 'syz.1.765': attribute type 13 has an invalid length. [ 206.661714][ T6840] netlink: 'syz.1.765': attribute type 17 has an invalid length. [ 206.673865][ T6840] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 206.685728][ T6840] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 206.727838][ T6836] tipc: Resetting bearer [ 206.742136][ T6851] netlink: 4 bytes leftover after parsing attributes in process `syz.0.767'. [ 206.801221][ T6832] tipc: Disabling bearer [ 206.992486][ T6860] device syzkaller0 entered promiscuous mode [ 208.048589][ T4267] usb 2-1: new low-speed USB device number 6 using dummy_hcd [ 208.162544][ T6870] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6874] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6870] [ 208.436158][ T4267] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 208.454504][ T4267] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 208.490174][ T4267] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 208.525787][ T4267] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 208.550673][ T4267] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.596309][ T6857] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 208.618514][ T4267] hub 2-1:1.0: bad descriptor, ignoring hub [ 208.628240][ T4267] hub: probe of 2-1:1.0 failed with error -5 [ 208.646622][ T4267] cdc_wdm 2-1:1.0: skipping garbage [ 208.659756][ T4267] cdc_wdm 2-1:1.0: skipping garbage [ 208.680638][ T4267] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 208.700468][ T4267] cdc_wdm 2-1:1.0: Unknown control protocol [ 209.127259][ T6875] udc-core: couldn't find an available UDC or it's busy [ 209.135741][ T6875] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 209.285993][ C0] wdm_int_callback: 41 callbacks suppressed [ 209.286018][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.298561][ C0] wdm_int_callback: 40 callbacks suppressed [ 209.298582][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.317164][ T6884] netlink: 4 bytes leftover after parsing attributes in process `syz.4.778'. [ 209.326071][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.326097][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.345969][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.352634][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.375987][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.382650][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.405977][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.412628][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.436092][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.442753][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.476066][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.482730][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.515984][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.522654][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.546086][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.552745][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.576166][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 209.582831][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 209.744870][ T6897] netlink: 96 bytes leftover after parsing attributes in process `syz.3.780'. [ 209.770778][ T6896] netlink: 4 bytes leftover after parsing attributes in process `syz.2.781'. [ 209.814134][ T6897] netlink: 'syz.3.780': attribute type 13 has an invalid length. [ 209.827424][ T6897] netlink: 'syz.3.780': attribute type 17 has an invalid length. [ 209.838824][ T6897] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 209.855524][ T6897] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 209.899333][ T6900] tipc: Started in network mode [ 209.914525][ T6900] tipc: Node identity be9deb69e06c, cluster identity 4711 [ 209.929036][ T6900] tipc: Enabled bearer , priority 0 [ 209.972161][ T6902] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 209.973544][ T6908] binder: BINDER_SET_CONTEXT_MGR already set [ 210.005298][ T6908] binder: 6906:6908 ioctl 4018620d 2000000002c0 returned -16 [ 210.009216][ T6900] tipc: Resetting bearer [ 210.031295][ T6905] device syzkaller0 entered promiscuous mode [ 210.088186][ T6899] tipc: Disabling bearer [ 210.306047][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 210.346993][ T4226] usb 2-1: USB disconnect, device number 6 [ 211.223923][ T6938] netlink: 4 bytes leftover after parsing attributes in process `syz.0.791'. [ 212.049659][ T6949] netlink: 'syz.0.795': attribute type 13 has an invalid length. [ 212.078782][ T6949] netlink: 'syz.0.795': attribute type 17 has an invalid length. [ 212.117676][ T6949] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 212.141957][ T6949] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 212.183294][ T6963] netlink: 4 bytes leftover after parsing attributes in process `syz.4.796'. [ 212.339229][ T6966] tipc: Enabled bearer , priority 0 [ 212.352398][ T6966] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 212.366035][ T6966] tipc: Resetting bearer [ 212.378793][ T6965] tipc: Disabling bearer [ 212.403472][ T6968] device syzkaller0 entered promiscuous mode [ 212.816377][ T4226] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 213.186714][ T4226] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.228852][ T4226] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 214.785594][ T4226] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 214.854346][ T4226] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 214.890858][ T4226] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.965273][ T6993] netlink: 4 bytes leftover after parsing attributes in process `syz.2.804'. [ 214.976401][ T6972] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 215.018336][ T4226] hub 5-1:1.0: bad descriptor, ignoring hub [ 215.043293][ T4226] hub: probe of 5-1:1.0 failed with error -5 [ 215.071861][ T4226] cdc_wdm 5-1:1.0: skipping garbage [ 215.090080][ T4226] cdc_wdm 5-1:1.0: skipping garbage [ 215.114224][ T4226] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 215.133888][ T4226] cdc_wdm 5-1:1.0: Unknown control protocol [ 215.261530][ T7000] netlink: 96 bytes leftover after parsing attributes in process `syz.2.808'. [ 215.333036][ T7000] netlink: 'syz.2.808': attribute type 13 has an invalid length. [ 215.344230][ T7000] netlink: 'syz.2.808': attribute type 17 has an invalid length. [ 215.364955][ T7000] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 215.380944][ T7000] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 215.533487][ T7002] udc-core: couldn't find an available UDC or it's busy [ 215.545378][ T7002] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 215.609790][ T7010] tipc: Enabled bearer , priority 0 [ 215.627905][ T7010] device syzkaller0 entered promiscuous mode [ 215.636119][ C1] wdm_int_callback: 30 callbacks suppressed [ 215.636139][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.648640][ C1] wdm_int_callback: 30 callbacks suppressed [ 215.648653][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.660867][ C1] vkms_vblank_simulate: vblank timer overrun [ 215.684100][ T7011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.809'. [ 215.685973][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.699546][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.705970][ C1] vkms_vblank_simulate: vblank timer overrun [ 215.735993][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.742656][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.776034][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.782725][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.806076][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.812734][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.831063][ T7010] tipc: Resetting bearer [ 215.845984][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.852636][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.875983][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.882650][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.890544][ T7008] tipc: Resetting bearer [ 215.906057][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.912705][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.930578][ T7008] tipc: Disabling bearer [ 215.945978][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.952631][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 215.975986][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 215.982650][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 216.000899][ T7020] device syzkaller0 entered promiscuous mode [ 216.415379][ T7034] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7036] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7034] [ 216.656070][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 216.687210][ T13] usb 5-1: USB disconnect, device number 7 [ 216.886336][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.4.818'. [ 218.163334][ T7056] netlink: 96 bytes leftover after parsing attributes in process `syz.4.822'. [ 218.298235][ T7056] netlink: 'syz.4.822': attribute type 13 has an invalid length. [ 218.323176][ T7056] netlink: 'syz.4.822': attribute type 17 has an invalid length. [ 218.344328][ T7056] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 218.369445][ T7056] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 218.410888][ T7062] tipc: Started in network mode [ 218.441794][ T7062] tipc: Node identity fa88b9844cf6, cluster identity 4711 [ 218.470188][ T7062] tipc: Enabled bearer , priority 0 [ 218.524956][ T7067] netlink: 4 bytes leftover after parsing attributes in process `syz.1.823'. [ 218.545657][ T7068] device syzkaller0 entered promiscuous mode [ 218.599796][ T7062] tipc: Resetting bearer [ 218.611378][ T7061] tipc: Resetting bearer [ 218.638537][ T7061] tipc: Disabling bearer [ 218.679903][ T7074] device syzkaller0 entered promiscuous mode [ 219.086179][ T4225] usb 2-1: new low-speed USB device number 7 using dummy_hcd [ 219.244165][ T7088] netlink: 4 bytes leftover after parsing attributes in process `syz.0.832'. [ 219.476233][ T4225] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.503023][ T4225] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 219.524627][ T7098] netlink: 96 bytes leftover after parsing attributes in process `syz.0.835'. [ 219.536248][ T4225] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 219.570583][ T4225] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 219.600078][ T4225] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.603648][ T7098] netlink: 'syz.0.835': attribute type 13 has an invalid length. [ 219.625236][ T7098] netlink: 'syz.0.835': attribute type 17 has an invalid length. [ 219.646280][ T7080] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 219.647876][ T7098] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 219.669156][ T7098] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 219.687692][ T4225] hub 2-1:1.0: bad descriptor, ignoring hub [ 219.701507][ T4225] hub: probe of 2-1:1.0 failed with error -5 [ 219.739774][ T4225] cdc_wdm 2-1:1.0: skipping garbage [ 219.769271][ T4225] cdc_wdm 2-1:1.0: skipping garbage [ 219.777027][ T4225] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 219.783168][ T4225] cdc_wdm 2-1:1.0: Unknown control protocol [ 219.971526][ T7114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.837'. [ 220.092029][ T7080] udc-core: couldn't find an available UDC or it's busy [ 220.105326][ T7117] tipc: Enabled bearer , priority 0 [ 220.114471][ T7080] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 220.126688][ T7117] device syzkaller0 entered promiscuous mode [ 220.161728][ T7117] tipc: Resetting bearer [ 220.174219][ T7112] tipc: Resetting bearer [ 220.192588][ T7112] tipc: Disabling bearer [ 220.266835][ T21] usb 2-1: USB disconnect, device number 7 [ 221.156856][ T7127] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 221.844460][ T7135] netlink: 96 bytes leftover after parsing attributes in process `syz.1.846'. [ 221.981357][ T7135] netlink: 'syz.1.846': attribute type 13 has an invalid length. [ 222.010040][ T7135] netlink: 'syz.1.846': attribute type 17 has an invalid length. [ 222.032892][ T7135] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 222.071069][ T7135] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 222.163763][ T7146] netlink: 4 bytes leftover after parsing attributes in process `syz.2.847'. [ 222.708015][ T7166] netlink: 4 bytes leftover after parsing attributes in process `syz.0.851'. [ 222.835382][ T7168] tipc: Enabled bearer , priority 0 [ 222.854843][ T7168] device syzkaller0 entered promiscuous mode [ 222.896111][ T7168] tipc: Resetting bearer [ 222.910110][ T7167] tipc: Resetting bearer [ 222.924926][ T7167] tipc: Disabling bearer [ 223.332336][ T7179] loop4: detected capacity change from 0 to 512 [ 223.339945][ T13] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 223.391582][ T7179] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 223.431339][ T7179] ext4 filesystem being mounted at /174/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 223.571908][ T7186] netlink: 'syz.1.859': attribute type 13 has an invalid length. [ 223.580131][ T7186] netlink: 'syz.1.859': attribute type 17 has an invalid length. [ 223.594401][ T7186] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 223.612487][ T7186] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 223.736398][ T13] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.773399][ T13] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 223.809177][ T13] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 223.840680][ T13] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 223.860148][ T13] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.896332][ T7177] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 223.924871][ T13] hub 3-1:1.0: bad descriptor, ignoring hub [ 223.942897][ T13] hub: probe of 3-1:1.0 failed with error -5 [ 224.086033][ T13] cdc_wdm 3-1:1.0: skipping garbage [ 224.091409][ T13] cdc_wdm 3-1:1.0: skipping garbage [ 224.107868][ T13] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 224.113834][ T13] cdc_wdm 3-1:1.0: Unknown control protocol [ 224.529649][ T7177] udc-core: couldn't find an available UDC or it's busy [ 224.916472][ T7177] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 225.056350][ T13] usb 3-1: USB disconnect, device number 7 [ 225.084059][ T7206] netlink: 4 bytes leftover after parsing attributes in process `syz.4.865'. [ 226.200828][ T7222] tipc: Started in network mode [ 226.230856][ T7222] tipc: Node identity 829fd6c857cc, cluster identity 4711 [ 226.274425][ T7226] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7227] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7226] [ 226.299939][ T7222] tipc: Enabled bearer , priority 0 [ 226.355193][ T7229] device syzkaller0 entered promiscuous mode [ 226.407075][ T7222] tipc: Resetting bearer [ 226.462620][ T7220] tipc: Resetting bearer [ 226.505799][ T7220] tipc: Disabling bearer [ 228.606883][ T7260] netlink: 4 bytes leftover after parsing attributes in process `syz.0.877'. [ 229.006242][ T4230] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 229.456308][ T4230] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 229.504012][ T4230] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 229.533067][ T4230] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 229.536795][ T7274] tipc: Enabled bearer , priority 0 [ 229.561689][ T7274] device syzkaller0 entered promiscuous mode [ 229.576366][ T4230] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 229.590320][ T7274] tipc: Resetting bearer [ 229.601417][ T4230] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.630883][ T7262] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 229.636180][ T7273] tipc: Resetting bearer [ 229.663111][ T4230] hub 2-1:1.0: bad descriptor, ignoring hub [ 229.673273][ T4230] hub: probe of 2-1:1.0 failed with error -5 [ 229.688440][ T7273] tipc: Disabling bearer [ 229.694913][ T4230] cdc_wdm 2-1:1.0: skipping garbage [ 229.699604][ T7279] binder: 7278:7279 ioctl 4018620d 0 returned -22 [ 229.709747][ T4230] cdc_wdm 2-1:1.0: skipping garbage [ 229.726841][ T4230] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 229.734030][ T4230] cdc_wdm 2-1:1.0: Unknown control protocol [ 230.167066][ T7285] udc-core: couldn't find an available UDC or it's busy [ 230.191483][ T7285] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 231.115999][ C0] wdm_int_callback: 29 callbacks suppressed [ 231.116025][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.128554][ C0] wdm_int_callback: 29 callbacks suppressed [ 231.128570][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.165979][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.172620][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.205971][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.212642][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.245997][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.252659][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.276019][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.282698][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.306028][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.312674][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.335996][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.342624][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.365997][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.372666][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.396009][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.402636][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 231.426091][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 231.432738][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 232.166317][ T21] usb 2-1: USB disconnect, device number 8 [ 233.284603][ T7310] binder: 7304:7310 ioctl c0306201 0 returned -14 [ 234.770415][ T7321] netlink: 'syz.4.896': attribute type 13 has an invalid length. [ 234.806064][ T7321] netlink: 'syz.4.896': attribute type 17 has an invalid length. [ 234.868324][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 234.955803][ T7321] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 236.234970][ T7332] loop0: detected capacity change from 0 to 32768 [ 236.286408][ T7332] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.902 (7332) [ 236.316062][ T7] usb 5-1: new low-speed USB device number 8 using dummy_hcd [ 236.351088][ T7332] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 236.360196][ T7332] BTRFS info (device loop0): use zlib compression, level 3 [ 236.367516][ T7332] BTRFS info (device loop0): turning on sync discard [ 236.374231][ T7332] BTRFS info (device loop0): using free space tree [ 236.380844][ T7332] BTRFS info (device loop0): has skinny extents [ 236.566108][ T7332] BTRFS info (device loop0): enabling ssd optimizations [ 236.730697][ T7355] binder: 7354:7355 ioctl 4018620d 0 returned -22 [ 236.737578][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 236.748796][ T7] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 236.758313][ T7] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 236.934440][ T7] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 236.943699][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.270510][ T26] audit: type=1800 audit(1784343061.088:3): pid=7357 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.902" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 237.298841][ T7328] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 237.457523][ T7] hub 5-1:1.0: bad descriptor, ignoring hub [ 237.465026][ T7] hub: probe of 5-1:1.0 failed with error -5 [ 237.514010][ T7] cdc_wdm 5-1:1.0: skipping garbage [ 237.548232][ T7] cdc_wdm 5-1:1.0: skipping garbage [ 237.610250][ T7] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 237.681709][ T7] cdc_wdm 5-1:1.0: Unknown control protocol [ 237.898390][ T7328] udc-core: couldn't find an available UDC or it's busy [ 237.936377][ T7328] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 238.223669][ T21] usb 5-1: USB disconnect, device number 8 [ 238.965849][ T7374] binder: 7370:7374 ioctl c0306201 0 returned -14 [ 239.312805][ T7386] netlink: 4 bytes leftover after parsing attributes in process `syz.1.908'. [ 240.302193][ T7396] binder: 7394:7396 ioctl 4018620d 0 returned -22 [ 242.586424][ T7426] device syzkaller0 entered promiscuous mode [ 242.666757][ T7432] binder: 7425:7432 ioctl c0306201 0 returned -14 [ 242.689118][ T7433] netlink: 4 bytes leftover after parsing attributes in process `syz.0.922'. [ 242.756099][ T13] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 243.116544][ T13] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 243.177572][ T13] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 243.297238][ T13] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 243.437106][ T7445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.925'. [ 243.448388][ T13] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 243.614090][ T13] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.736395][ T7420] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 243.758620][ T13] hub 2-1:1.0: bad descriptor, ignoring hub [ 243.791263][ T13] hub: probe of 2-1:1.0 failed with error -5 [ 244.954590][ T13] cdc_wdm 2-1:1.0: skipping garbage [ 244.961774][ T13] cdc_wdm 2-1:1.0: skipping garbage [ 244.968564][ T13] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 244.974511][ T13] cdc_wdm 2-1:1.0: Unknown control protocol [ 245.017856][ T7452] binder: 7449:7452 ioctl c0306201 0 returned -14 [ 245.223095][ T7420] udc-core: couldn't find an available UDC or it's busy [ 245.258880][ T7420] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 245.398725][ T13] usb 2-1: USB disconnect, device number 9 [ 246.359090][ T7471] netlink: 4 bytes leftover after parsing attributes in process `syz.1.934'. [ 246.574677][ T7474] ALSA: mixer_oss: invalid OSS volume '' [ 246.683517][ T7478] binder: 7475:7478 ioctl c0306201 0 returned -14 [ 246.698087][ T263] block nbd1: Attempted send on invalid socket [ 246.705631][ T263] blk_update_request: I/O error, dev nbd1, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 246.718957][ T7479] qnx4: unable to read the superblock [ 247.518682][ T7483] netlink: 8 bytes leftover after parsing attributes in process `syz.0.928'. [ 247.721417][ T7483] device syz_tun entered promiscuous mode [ 247.950199][ T7490] netlink: 4 bytes leftover after parsing attributes in process `syz.1.939'. [ 249.570426][ T7499] binder: 7496:7499 ioctl c0306201 0 returned -14 [ 251.292785][ T7516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.945'. [ 252.514011][ T7534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.951'. [ 252.534399][ T7534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.951'. [ 252.547650][ T7534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.951'. [ 252.558342][ T7534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.951'. [ 252.598944][ T7533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.952'. [ 253.616249][ T21] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 254.219578][ T7542] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 255.176402][ T21] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 255.229317][ T21] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 255.302228][ T21] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 255.391702][ T21] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 255.465461][ T21] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.666566][ T7538] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 255.748961][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.755345][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.797388][ T21] hub 3-1:1.0: bad descriptor, ignoring hub [ 255.810193][ T21] hub: probe of 3-1:1.0 failed with error -5 [ 255.837646][ T21] cdc_wdm 3-1:1.0: skipping garbage [ 255.843414][ T21] cdc_wdm 3-1:1.0: skipping garbage [ 256.163081][ T21] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 256.198534][ T21] cdc_wdm 3-1:1.0: Unknown control protocol [ 256.714243][ T7560] binder: 7555:7560 ioctl c0306201 0 returned -14 [ 256.743029][ T1111] usb 3-1: USB disconnect, device number 8 [ 256.770774][ T7566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.960'. [ 256.938743][ T7574] syz.3.962 uses obsolete (PF_INET,SOCK_PACKET) [ 257.428568][ T7589] binder: 7588:7589 ioctl c0306201 0 returned -14 [ 258.518234][ T7598] loop3: detected capacity change from 0 to 512 [ 259.126605][ T7604] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 259.796627][ T7598] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 259.804028][ T7598] EXT4-fs (loop3): Unrecognized mount option "fscontext=system_u" or missing value [ 260.683509][ T4191] Bluetooth: hci4: unexpected event for opcode 0x2027 [ 260.945901][ C1] sched: RT throttling activated [ 260.945994][ T1111] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 261.171387][ T7619] binder: 7615:7619 ioctl c0306201 0 returned -14 [ 261.177403][ T7618] netlink: 4 bytes leftover after parsing attributes in process `syz.4.973'. [ 261.272674][ T7622] device syzkaller0 entered promiscuous mode [ 261.436244][ T1111] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 261.466790][ T1111] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 261.498878][ T1111] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 261.524549][ T1111] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 261.539446][ T1111] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.626205][ T1111] usb 1-1: can't set config #1, error -71 [ 261.673417][ T1111] usb 1-1: USB disconnect, device number 9 [ 263.804658][ T7657] loop4: detected capacity change from 0 to 2048 [ 263.833268][ T7657] EXT4-fs (loop4): Ignoring removed nobh option [ 263.877035][ T7655] tipc: Enabled bearer , priority 0 [ 263.917136][ T7655] device syzkaller0 entered promiscuous mode [ 263.925501][ T7657] EXT4-fs (loop4): mounted filesystem without journal. Opts: init_itable,usrjquota=,nobh,resuid=0x0000000000000000,,errors=continue. Quota mode: none. [ 263.932786][ T7661] loop1: detected capacity change from 0 to 512 [ 263.947425][ T7657] ext4 filesystem being mounted at /199/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.011049][ T26] audit: type=1800 audit(1784343087.998:4): pid=7657 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.984" name="file0" dev="loop4" ino=13 res=0 errno=0 [ 264.012618][ T7657] fs-verity: sha256 using implementation "sha256-avx2" [ 264.075874][ T7655] tipc: Resetting bearer [ 264.103025][ T7652] tipc: Resetting bearer [ 264.133353][ T7673] binder: 7663:7673 ioctl c0306201 0 returned -14 [ 264.146408][ T7652] tipc: Disabling bearer [ 264.153593][ T7661] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 264.172359][ T7661] EXT4-fs (loop1): Unrecognized mount option "fscontext=system_u" or missing value [ 264.208681][ T7672] netlink: 4 bytes leftover after parsing attributes in process `syz.0.987'. [ 264.595059][ T7682] binder: 7677:7682 ioctl c0306201 0 returned -14 [ 264.602171][ T13] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 264.741662][ T7684] loop1: detected capacity change from 0 to 2048 [ 265.606552][ T13] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 265.705613][ T13] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 266.830880][ T13] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 266.842188][ T13] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 266.851723][ T13] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.906228][ T7676] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 266.927100][ T13] hub 3-1:1.0: bad descriptor, ignoring hub [ 266.933109][ T13] hub: probe of 3-1:1.0 failed with error -5 [ 266.966541][ T13] cdc_wdm 3-1:1.0: skipping garbage [ 267.080602][ T13] cdc_wdm 3-1:1.0: skipping garbage [ 267.139593][ T13] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 267.294931][ T13] cdc_wdm 3-1:1.0: Unknown control protocol [ 267.498227][ T7676] udc-core: couldn't find an available UDC or it's busy [ 267.516378][ T7676] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 267.656216][ T13] usb 3-1: USB disconnect, device number 9 [ 267.969033][ T7720] tipc: Enabled bearer , priority 0 [ 268.032373][ T7720] device syzkaller0 entered promiscuous mode [ 268.107898][ T7720] tipc: Resetting bearer [ 268.382079][ T7719] tipc: Resetting bearer [ 269.012934][ T7729] loop2: detected capacity change from 0 to 512 [ 269.112122][ T7729] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 269.148639][ T7729] ext4 filesystem being mounted at /203/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 269.317041][ T7725] loop0: detected capacity change from 0 to 131072 [ 269.366789][ T7719] tipc: Disabling bearer [ 269.396582][ T7725] ======================================================= [ 269.396582][ T7725] WARNING: The mand mount option has been deprecated and [ 269.396582][ T7725] and is ignored by this kernel. Remove the mand [ 269.396582][ T7725] option from the mount to silence this warning. [ 269.396582][ T7725] ======================================================= [ 269.431565][ C1] vkms_vblank_simulate: vblank timer overrun [ 269.493447][ T7725] F2FS-fs (loop0): Invalid log sectorsize (67108873) [ 269.500510][ T7725] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 269.512231][ T7725] F2FS-fs (loop0): invalid crc value [ 269.512265][ T7377] tipc: Node number set to 3579041480 [ 269.582709][ T7734] device syzkaller0 entered promiscuous mode [ 269.615680][ T7725] F2FS-fs (loop0): Found nat_bits in checkpoint [ 269.675095][ T7725] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 269.683536][ T7725] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 270.932607][ T7769] 0x000000000010-0x000000000020 : "" [ 271.627359][ T7769] ftl_cs: FTL header corrupt! [ 271.645347][ T7771] loop2: detected capacity change from 0 to 512 [ 271.760313][ T7771] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 271.804496][ T7771] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 272.009179][ T7771] EXT4-fs (loop2): warning: checktime reached, running e2fsck is recommended [ 272.022376][ T7771] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002] [ 272.036727][ T7771] System zones: 0-2, 18-18, 34-34 [ 272.049578][ T7785] loop1: detected capacity change from 0 to 512 [ 272.084951][ T7771] EXT4-fs error (device loop2): ext4_orphan_get:1432: comm syz.2.1011: bad orphan inode 15 [ 272.172525][ T7771] ext4_test_bit(bit=14, block=18) = 1 [ 272.173288][ T7785] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 272.211117][ T7785] ext4 filesystem being mounted at /189/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 272.219003][ T7771] is_bad_inode(inode)=0 [ 272.263292][ T7771] NEXT_ORPHAN(inode)=2264924160 [ 272.306780][ T7771] max_ino=32 [ 272.310049][ T7771] i_nlink=0 [ 272.354901][ T7771] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 272.477001][ T7732] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 80: padding at end of block bitmap is not set [ 272.529064][ T7794] tipc: Started in network mode [ 272.544041][ T7794] tipc: Node identity 2ea5fcd174c1, cluster identity 4711 [ 272.553684][ T7769] EXT4-fs error (device loop2): ext4_search_dir:1549: inode #2: block 3: comm syz.2.1011: bad entry in directory: rec_len is smaller than minimal - offset=44, inode=262156, rec_len=0, size=4096 fake=0 [ 272.603528][ T7794] tipc: Enabled bearer , priority 0 [ 272.654786][ T7795] device syzkaller0 entered promiscuous mode [ 272.726776][ T7794] tipc: Resetting bearer [ 273.681754][ T4228] tipc: Node number set to 1516567761 [ 273.705612][ T7793] tipc: Resetting bearer [ 273.737253][ T7793] tipc: Disabling bearer [ 273.942313][ T7803] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7804] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7803] [ 274.062666][ T7810] netlink: 'syz.0.1008': attribute type 13 has an invalid length. [ 274.085738][ T7810] netlink: 'syz.0.1008': attribute type 17 has an invalid length. [ 274.131668][ T7810] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 274.175104][ T7810] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 274.389494][ T7815] loop2: detected capacity change from 0 to 64 [ 274.517392][ T7815] attempt to access beyond end of device [ 274.517392][ T7815] loop2: rw=34817, want=69, limit=64 [ 274.534553][ T7815] attempt to access beyond end of device [ 274.534553][ T7815] loop2: rw=34817, want=74, limit=64 [ 274.662853][ T7815] attempt to access beyond end of device [ 274.662853][ T7815] loop2: rw=34817, want=2117, limit=64 [ 274.758837][ T7815] attempt to access beyond end of device [ 274.758837][ T7815] loop2: rw=34817, want=4165, limit=64 [ 274.783464][ T7815] attempt to access beyond end of device [ 274.783464][ T7815] loop2: rw=34817, want=4171, limit=64 [ 274.801773][ T7815] attempt to access beyond end of device [ 274.801773][ T7815] loop2: rw=34817, want=4194, limit=64 [ 274.825531][ T7815] attempt to access beyond end of device [ 274.825531][ T7815] loop2: rw=34817, want=4362, limit=64 [ 274.838245][ T7815] attempt to access beyond end of device [ 274.838245][ T7815] loop2: rw=34817, want=4385, limit=64 [ 274.862310][ T7815] attempt to access beyond end of device [ 274.862310][ T7815] loop2: rw=34817, want=4417, limit=64 [ 274.888519][ T7815] attempt to access beyond end of device [ 274.888519][ T7815] loop2: rw=34817, want=4450, limit=64 [ 276.018947][ T7836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1026'. [ 276.638754][ T7845] loop3: detected capacity change from 0 to 512 [ 277.363132][ T7845] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 277.578345][ T7845] ext4 filesystem being mounted at /195/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 277.630487][ T7857] tipc: Enabled bearer , priority 0 [ 277.714652][ T7860] netlink: 'syz.0.1032': attribute type 13 has an invalid length. [ 277.746519][ T7860] netlink: 'syz.0.1032': attribute type 17 has an invalid length. [ 277.769569][ T7860] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 277.818470][ T7860] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 277.851253][ T7856] tipc: Disabling bearer [ 279.289592][ T7892] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1039'. [ 279.990189][ T7909] tipc: Enabled bearer , priority 0 [ 280.011190][ T7909] device syzkaller0 entered promiscuous mode [ 280.052225][ T7909] tipc: Resetting bearer [ 280.083998][ T7908] tipc: Resetting bearer [ 280.116822][ T7908] tipc: Disabling bearer [ 280.357134][ T7911] netlink: 'syz.3.1045': attribute type 13 has an invalid length. [ 280.396011][ T7911] netlink: 'syz.3.1045': attribute type 17 has an invalid length. [ 280.415502][ T7913] loop0: detected capacity change from 0 to 512 [ 280.435378][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 280.533705][ T7913] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 280.546570][ T7913] ext4 filesystem being mounted at /229/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 280.581492][ T7911] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 282.256343][ T7927] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 282.676268][ T7936] tipc: Enabled bearer , priority 0 [ 282.698967][ T7936] device syzkaller0 entered promiscuous mode [ 282.802347][ T7936] tipc: Resetting bearer [ 282.826396][ T7935] tipc: Resetting bearer [ 282.906117][ T4228] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 282.945611][ T7935] tipc: Disabling bearer [ 283.166318][ T4228] usb 2-1: Using ep0 maxpacket: 32 [ 283.287244][ T4228] usb 2-1: config index 0 descriptor too short (expected 65307, got 36) [ 283.373297][ T4228] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 283.583643][ T4228] usb 2-1: config 2 has no interface number 0 [ 283.826304][ T4228] usb 2-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 283.907431][ T4228] usb 2-1: config 2 interface 88 altsetting 25 endpoint 0x82 has an invalid bInterval 39, changing to 9 [ 283.931511][ T7949] loop3: detected capacity change from 0 to 512 [ 283.967965][ T4228] usb 2-1: config 2 interface 88 has no altsetting 0 [ 284.031277][ T7953] loop2: detected capacity change from 0 to 2048 [ 284.084159][ T7949] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 284.109152][ T7953] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 284.116178][ T4228] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 284.152327][ T4228] usb 2-1: New USB device strings: Mfr=1, Product=0, SerialNumber=1 [ 284.164444][ T7949] ext4 filesystem being mounted at /202/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 284.239071][ T7957] program syz.2.1060 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 284.262391][ T7957] netlink: 'syz.2.1060': attribute type 4 has an invalid length. [ 284.270506][ T7957] netlink: 17 bytes leftover after parsing attributes in process `syz.2.1060'. [ 284.448161][ T4228] usb 2-1: Manufacturer: syz [ 284.471847][ T4228] usb 2-1: SerialNumber: syz [ 284.529550][ T7934] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 284.919598][ T4228] asix: probe of 2-1:2.88 failed with error -22 [ 285.187258][ T7971] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1052'. [ 285.241951][ T4231] usb 2-1: USB disconnect, device number 10 [ 285.286097][ T4228] usb 4-1: new low-speed USB device number 9 using dummy_hcd [ 285.926361][ T7975] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 286.346243][ T4228] usb 4-1: unable to get BOS descriptor or descriptor too short [ 286.426166][ T4228] usb 4-1: config 8 has an invalid interface number: 109 but max is 0 [ 286.442261][ T4228] usb 4-1: config 8 has no interface number 0 [ 286.503341][ T4228] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 286.544112][ T4228] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid maxpacket 19095, setting to 8 [ 286.564107][ T7983] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7984] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7983] [ 286.697942][ T4228] usb 4-1: config 8 interface 109 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 287.770563][ T4228] usb 4-1: string descriptor 0 read error: -22 [ 287.786044][ T4228] usb 4-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 288.556319][ T4228] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.624092][ T4228] usb 4-1: can't set config #8, error -71 [ 288.656903][ T7998] binder: 7997:7998 ioctl c0306201 0 returned -14 [ 289.260238][ T4228] usb 4-1: USB disconnect, device number 9 [ 289.318157][ T8003] loop4: detected capacity change from 0 to 512 [ 289.425501][ T8003] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 289.448757][ T8003] ext4 filesystem being mounted at /216/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 289.932971][ T8020] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1074'. [ 292.963800][ T8057] binder: 8055:8057 ioctl c0306201 0 returned -14 [ 293.523710][ T8066] device bond0 entered promiscuous mode [ 293.529952][ T8066] device bond_slave_0 entered promiscuous mode [ 293.536064][ T4225] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 293.544353][ T8067] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 293.544619][ T8066] device bond_slave_1 entered promiscuous mode [ 293.572080][ T8066] device bond0 left promiscuous mode [ 293.577912][ T8066] device bond_slave_0 left promiscuous mode [ 293.584082][ T8066] device bond_slave_1 left promiscuous mode [ 293.658213][ T8069] tipc: Enabled bearer , priority 0 [ 293.669710][ T8069] device syzkaller0 entered promiscuous mode [ 293.702645][ T8069] tipc: Resetting bearer [ 293.710727][ T8068] tipc: Resetting bearer [ 293.733335][ T8068] tipc: Disabling bearer [ 293.776001][ T4225] usb 1-1: Using ep0 maxpacket: 16 [ 293.921101][ T4225] usb 1-1: config 0 has no interfaces? [ 294.136277][ T4225] usb 1-1: New USB device found, idVendor=064b, idProduct=7825, bcdDevice=62.b8 [ 294.156294][ T4225] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.165184][ T4225] usb 1-1: Product: syz [ 294.174657][ T4225] usb 1-1: Manufacturer: syz [ 294.180820][ T4225] usb 1-1: SerialNumber: syz [ 294.208132][ T4225] usb 1-1: config 0 descriptor?? [ 294.222701][ T8080] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[8081] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[8080] [ 294.500826][ T1111] usb 1-1: USB disconnect, device number 10 [ 295.771021][ T8091] IPv6: sit1: Disabled Multicast RS [ 296.932849][ T8103] binder: 8100:8103 ioctl c0306201 0 returned -14 [ 298.487803][ T8115] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 300.931654][ T8134] comedi comedi0: 8255: I/O port conflict (0x3,4) [ 300.938833][ T8134] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffffc,4) [ 300.946843][ T8134] comedi comedi0: 8255: I/O port conflict (0x5,4) [ 300.953624][ T8134] comedi comedi0: 8255: I/O port conflict (0x4,4) [ 300.960661][ T8134] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffff7,4) [ 300.968898][ T8134] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffff8,4) [ 300.976821][ T8134] comedi comedi0: 8255: I/O port conflict (0x2,4) [ 300.983402][ T8134] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffffc,4) [ 300.991467][ T8134] comedi comedi0: 8255: I/O port conflict (0xc3,4) [ 300.999084][ T8134] comedi comedi0: 8255: I/O port conflict (0x1000007,4) [ 301.006344][ T8134] comedi comedi0: 8255: I/O port conflict (0x1,4) [ 301.012923][ T8134] comedi comedi0: 8255: I/O port conflict (0x10003,4) [ 301.020065][ T8134] comedi comedi0: 8255: I/O port conflict (0x801000,4) [ 301.027093][ T8134] comedi comedi0: 8255: I/O port conflict (0x7fffffff,4) [ 301.035573][ T8134] comedi comedi0: 8255: I/O port conflict (0x3ff,4) [ 301.042434][ T8134] comedi comedi0: 8255: I/O port conflict (0x1001010,4) [ 301.049537][ T8134] comedi comedi0: 8255: I/O port conflict (0x1ff,4) [ 301.056405][ T8134] comedi comedi0: 8255: I/O port conflict (0x8,4) [ 301.063066][ T8134] comedi comedi0: 8255: I/O port conflict (0x3,4) [ 301.069740][ T8134] comedi comedi0: 8255: I/O port conflict (0x8001,4) [ 301.076703][ T8134] comedi comedi0: 8255: I/O port conflict (0x7,4) [ 301.083246][ T8134] comedi comedi0: 8255: I/O port conflict (0x3ff,4) [ 301.090009][ T8134] comedi comedi0: 8255: I/O port conflict (0x5,4) [ 301.096746][ T8134] comedi comedi0: 8255: I/O port conflict (0x3,4) [ 301.103597][ T8134] comedi comedi0: 8255: I/O port conflict (0xfffd,4) [ 302.467818][ T8143] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1106'. [ 303.121079][ T8158] IPv6: sit1: Disabled Multicast RS [ 303.211495][ T8159] loop1: detected capacity change from 0 to 2048 [ 303.289683][ T8159] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 304.570862][ T8171] program syz.1.1114 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 304.829804][ T8175] [ 304.832203][ T8175] ============================= [ 304.863913][ T8175] WARNING: suspicious RCU usage [ 304.875110][ T8175] syzkaller #0 Not tainted [ 304.887494][ T8175] ----------------------------- [ 304.893562][ T8175] include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage! [ 304.910380][ T8175] [ 304.910380][ T8175] other info that might help us debug this: [ 304.910380][ T8175] [ 304.980434][ T8175] [ 304.980434][ T8175] rcu_scheduler_active = 2, debug_locks = 1 [ 305.036690][ T7377] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 305.076792][ T8175] 1 lock held by syz.4.1118/8175: [ 305.092975][ T8175] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: ip_mroute_setsockopt+0x139/0x1230 [ 305.125062][ T8175] [ 305.125062][ T8175] stack backtrace: [ 305.150665][ T8175] CPU: 0 PID: 8175 Comm: syz.4.1118 Not tainted syzkaller #0 [ 305.158167][ T8175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 305.168250][ T8175] Call Trace: [ 305.171530][ T8175] [ 305.174452][ T8175] dump_stack_lvl+0x188/0x250 [ 305.179121][ T8175] ? load_image+0x410/0x410 [ 305.183614][ T8175] ? show_regs_print_info+0x20/0x20 [ 305.188813][ T8175] ? lockdep_rcu_suspicious+0x110/0x180 [ 305.194492][ T8175] ? local_bh_enable+0x20/0x20 [ 305.199278][ T8175] rhltable_lookup+0x787/0x7a0 [ 305.204153][ T8175] ? mark_lock+0x94/0x320 [ 305.208495][ T8175] ? mr_mfc_find_parent+0x190/0x190 [ 305.213816][ T8175] ? local_bh_enable+0x20/0x20 [ 305.218621][ T8175] ? lock_chain_count+0x20/0x20 [ 305.223505][ T8175] mr_mfc_find_any_parent+0xb7/0x1d0 [ 305.228825][ T8175] ? local_bh_enable+0x20/0x20 [ 305.233631][ T8175] ip_mr_forward+0x247/0xf60 [ 305.238312][ T8175] ipmr_mfc_add+0x2273/0x2bd0 [ 305.243017][ T8175] ? ipmr_mfc_delete+0x5f0/0x5f0 [ 305.247952][ T8175] ? __lock_acquire+0x7b50/0x7b50 [ 305.252982][ T8175] ip_mroute_setsockopt+0xecd/0x1230 [ 305.258277][ T8175] ? ipmr_rule_default+0x70/0x70 [ 305.263255][ T8175] ? __might_sleep+0xf0/0xf0 [ 305.267891][ T8175] ip_setsockopt+0x568/0x31e0 [ 305.272598][ T8175] ? ipv4_pktinfo_prepare+0x6b0/0x6b0 [ 305.277961][ T8175] ? aa_sk_perm+0x7dc/0x910 [ 305.282476][ T8175] ? aa_af_perm+0x340/0x340 [ 305.286990][ T8175] ? __fget_files+0x402/0x470 [ 305.291748][ T8175] ? aa_sock_opt_perm+0x74/0x100 [ 305.296677][ T8175] ? sock_common_setsockopt+0x32/0xb0 [ 305.302040][ T8175] ? raw_setsockopt+0xc2/0x170 [ 305.306797][ T8175] ? sock_common_recvmsg+0x1c0/0x1c0 [ 305.312076][ T8175] __sys_setsockopt+0x2bf/0x3d0 [ 305.316918][ T8175] __x64_sys_setsockopt+0xb1/0xc0 [ 305.321956][ T8175] do_syscall_64+0x4c/0xa0 [ 305.326363][ T8175] ? clear_bhb_loop+0x30/0x80 [ 305.331030][ T8175] ? clear_bhb_loop+0x30/0x80 [ 305.335697][ T8175] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 305.341577][ T8175] RIP: 0033:0x7f54c6ca3e99 [ 305.345992][ T8175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.365591][ T8175] RSP: 002b:00007f54c4efc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 305.374005][ T8175] RAX: ffffffffffffffda RBX: 00007f54c6f2bfa0 RCX: 00007f54c6ca3e99 [ 305.381986][ T8175] RDX: 00000000000000d2 RSI: 0000000000000000 RDI: 0000000000000008 [ 305.389962][ T8175] RBP: 00007f54c6d39eaf R08: 000000000000003c R09: 0000000000000000 [ 305.397934][ T8175] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 305.405908][ T8175] R13: 00007f54c6f2c038 R14: 00007f54c6f2bfa0 R15: 00007ffe25fbe5f8 [ 305.414000][ T8175] [ 305.417129][ C0] vkms_vblank_simulate: vblank timer overrun [ 305.427225][ T8175] [ 305.429595][ T8175] ============================= [ 305.437696][ T8175] WARNING: suspicious RCU usage [ 305.445006][ T8175] syzkaller #0 Not tainted [ 305.452695][ T8175] ----------------------------- [ 305.452987][ T8190] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[8191] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[8190] [ 305.476957][ T8175] include/linux/rhashtable.h:369 suspicious rcu_dereference_check() usage! [ 305.489343][ T8175] [ 305.489343][ T8175] other info that might help us debug this: [ 305.489343][ T8175] [ 305.500161][ T8175] [ 305.500161][ T8175] rcu_scheduler_active = 2, debug_locks = 1 [ 305.509089][ T8175] 1 lock held by syz.4.1118/8175: [ 305.514747][ T8175] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: ip_mroute_setsockopt+0x139/0x1230 [ 305.524730][ T8175] [ 305.524730][ T8175] stack backtrace: [ 305.531797][ T8175] CPU: 1 PID: 8175 Comm: syz.4.1118 Not tainted syzkaller #0 [ 305.536008][ T7377] usb 3-1: Using ep0 maxpacket: 16 [ 305.539195][ T8175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 305.554538][ T8175] Call Trace: [ 305.557865][ T8175] [ 305.560844][ T8175] dump_stack_lvl+0x188/0x250 [ 305.565540][ T8175] ? load_image+0x410/0x410 [ 305.570052][ T8175] ? show_regs_print_info+0x20/0x20 [ 305.575299][ T8175] ? lockdep_rcu_suspicious+0x110/0x180 [ 305.580875][ T8175] ? local_bh_enable+0x20/0x20 [ 305.585670][ T8175] rhltable_lookup+0x512/0x7a0 [ 305.590483][ T8175] ? local_bh_enable+0x20/0x20 [ 305.595272][ T8175] ? mr_mfc_find_parent+0x190/0x190 [ 305.600508][ T8175] ? local_bh_enable+0x20/0x20 [ 305.605300][ T8175] ? lock_chain_count+0x20/0x20 [ 305.610178][ T8175] mr_mfc_find_any_parent+0xb7/0x1d0 [ 305.615490][ T8175] ? local_bh_enable+0x20/0x20 [ 305.620306][ T8175] ip_mr_forward+0x247/0xf60 [ 305.624936][ T8175] ipmr_mfc_add+0x2273/0x2bd0 [ 305.629652][ T8175] ? ipmr_mfc_delete+0x5f0/0x5f0 [ 305.634699][ T8175] ? __lock_acquire+0x7b50/0x7b50 [ 305.639777][ T8175] ip_mroute_setsockopt+0xecd/0x1230 [ 305.645124][ T8175] ? ipmr_rule_default+0x70/0x70 [ 305.650110][ T8175] ? __might_sleep+0xf0/0xf0 [ 305.654730][ T8175] ip_setsockopt+0x568/0x31e0 [ 305.656199][ T7377] usb 3-1: config 0 has no interfaces? [ 305.659433][ T8175] ? ipv4_pktinfo_prepare+0x6b0/0x6b0 [ 305.670338][ T8175] ? aa_sk_perm+0x7dc/0x910 [ 305.674870][ T8175] ? aa_af_perm+0x340/0x340 [ 305.679391][ T8175] ? __fget_files+0x402/0x470 [ 305.684093][ T8175] ? aa_sock_opt_perm+0x74/0x100 [ 305.689046][ T8175] ? sock_common_setsockopt+0x32/0xb0 [ 305.694436][ T8175] ? raw_setsockopt+0xc2/0x170 [ 305.699216][ T8175] ? sock_common_recvmsg+0x1c0/0x1c0 [ 305.704545][ T8175] __sys_setsockopt+0x2bf/0x3d0 [ 305.709446][ T8175] __x64_sys_setsockopt+0xb1/0xc0 [ 305.714503][ T8175] do_syscall_64+0x4c/0xa0 [ 305.718941][ T8175] ? clear_bhb_loop+0x30/0x80 [ 305.723642][ T8175] ? clear_bhb_loop+0x30/0x80 [ 305.728337][ T8175] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 305.734335][ T8175] RIP: 0033:0x7f54c6ca3e99 [ 305.738771][ T8175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.758404][ T8175] RSP: 002b:00007f54c4efc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 305.766858][ T8175] RAX: ffffffffffffffda RBX: 00007f54c6f2bfa0 RCX: 00007f54c6ca3e99 [ 305.774857][ T8175] RDX: 00000000000000d2 RSI: 0000000000000000 RDI: 0000000000000008 [ 305.782847][ T8175] RBP: 00007f54c6d39eaf R08: 000000000000003c R09: 0000000000000000 [ 305.790859][ T8175] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 305.798852][ T8175] R13: 00007f54c6f2c038 R14: 00007f54c6f2bfa0 R15: 00007ffe25fbe5f8 [ 305.806865][ T8175] [ 305.816567][ T7377] usb 3-1: New USB device found, idVendor=064b, idProduct=7825, bcdDevice=62.b8 [ 305.836017][ T8175] [ 305.838375][ T8175] ============================= [ 305.875979][ T7377] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.879920][ T8175] WARNING: suspicious RCU usage [ 305.885681][ T7377] usb 3-1: Product: syz [ 305.891359][ T8175] syzkaller #0 Not tainted [ 305.898966][ T7377] usb 3-1: Manufacturer: syz [ 305.899054][ T8175] ----------------------------- [ 305.903583][ T7377] usb 3-1: SerialNumber: syz [ 305.905372][ T7377] usb 3-1: config 0 descriptor?? [ 305.910261][ T8175] include/linux/rhashtable.h:614 suspicious rcu_dereference_check() usage! [ 305.936166][ T8175] [ 305.936166][ T8175] other info that might help us debug this: [ 305.936166][ T8175] [ 305.947243][ T8175] [ 305.947243][ T8175] rcu_scheduler_active = 2, debug_locks = 1 [ 305.955433][ T8175] 1 lock held by syz.4.1118/8175: [ 305.961179][ T8175] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: ip_mroute_setsockopt+0x139/0x1230 [ 305.972643][ T8175] [ 305.972643][ T8175] stack backtrace: [ 305.979010][ T8175] CPU: 1 PID: 8175 Comm: syz.4.1118 Not tainted syzkaller #0 [ 305.986413][ T8175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 305.996594][ T8175] Call Trace: [ 305.999896][ T8175] [ 306.002844][ T8175] dump_stack_lvl+0x188/0x250 [ 306.008252][ T8175] ? load_image+0x410/0x410 [ 306.012780][ T8175] ? show_regs_print_info+0x20/0x20 [ 306.018027][ T8175] ? lockdep_rcu_suspicious+0x110/0x180 [ 306.023595][ T8175] ? local_bh_enable+0x20/0x20 [ 306.028380][ T8175] rhltable_lookup+0x5fc/0x7a0 [ 306.033176][ T8175] ? local_bh_enable+0x20/0x20 [ 306.037968][ T8175] ? mr_mfc_find_parent+0x190/0x190 [ 306.043192][ T8175] ? local_bh_enable+0x20/0x20 [ 306.047988][ T8175] ? lock_chain_count+0x20/0x20 [ 306.052985][ T8175] mr_mfc_find_any_parent+0xb7/0x1d0 [ 306.058295][ T8175] ? local_bh_enable+0x20/0x20 [ 306.063078][ T8175] ip_mr_forward+0x247/0xf60 [ 306.067698][ T8175] ipmr_mfc_add+0x2273/0x2bd0 [ 306.072414][ T8175] ? ipmr_mfc_delete+0x5f0/0x5f0 [ 306.077372][ T8175] ? __lock_acquire+0x7b50/0x7b50 [ 306.082442][ T8175] ip_mroute_setsockopt+0xecd/0x1230 [ 306.087760][ T8175] ? ipmr_rule_default+0x70/0x70 [ 306.092824][ T8175] ? __might_sleep+0xf0/0xf0 [ 306.097440][ T8175] ip_setsockopt+0x568/0x31e0 [ 306.102154][ T8175] ? ipv4_pktinfo_prepare+0x6b0/0x6b0 [ 306.107638][ T8175] ? aa_sk_perm+0x7dc/0x910 [ 306.112179][ T8175] ? aa_af_perm+0x340/0x340 [ 306.116710][ T8175] ? __fget_files+0x402/0x470 [ 306.121412][ T8175] ? aa_sock_opt_perm+0x74/0x100 [ 306.126374][ T8175] ? sock_common_setsockopt+0x32/0xb0 [ 306.131763][ T8175] ? raw_setsockopt+0xc2/0x170 [ 306.136558][ T8175] ? sock_common_recvmsg+0x1c0/0x1c0 [ 306.142041][ T8175] __sys_setsockopt+0x2bf/0x3d0 [ 306.146916][ T8175] __x64_sys_setsockopt+0xb1/0xc0 [ 306.151957][ T8175] do_syscall_64+0x4c/0xa0 [ 306.156389][ T8175] ? clear_bhb_loop+0x30/0x80 [ 306.161076][ T8175] ? clear_bhb_loop+0x30/0x80 [ 306.165768][ T8175] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 306.171652][ T8175] RIP: 0033:0x7f54c6ca3e99 [ 306.176071][ T8175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 306.195705][ T8175] RSP: 002b:00007f54c4efc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 306.204114][ T8175] RAX: ffffffffffffffda RBX: 00007f54c6f2bfa0 RCX: 00007f54c6ca3e99 [ 306.212093][ T8175] RDX: 00000000000000d2 RSI: 0000000000000000 RDI: 0000000000000008 [ 306.220068][ T8175] RBP: 00007f54c6d39eaf R08: 000000000000003c R09: 0000000000000000 [ 306.228030][ T8175] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 306.235995][ T8175] R13: 00007f54c6f2c038 R14: 00007f54c6f2bfa0 R15: 00007ffe25fbe5f8 [ 306.243964][ T8175] [ 306.289993][ T8159] netlink: 'syz.1.1114': attribute type 4 has an invalid length. [ 306.297882][ T8159] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1114'. [ 306.321927][ T7377] usb 3-1: USB disconnect, device number 10