last executing test programs: 3m9.024705657s ago: executing program 4 (id=315): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmmsg$inet(r0, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000800)="2fae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dea658eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0768021fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a6e453a8a28cd5c4b733fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62", 0x1e9}, {&(0x7f0000000240)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859207067c10aa7352abbdf98e9bf033a3184a11e84639d3b9164d9c5d729f3dd409d39ff041e657c8df70e1607d58c863d5f323f6d5cf367cd939f790732e8d2310e876fcb299cd44b72bda697035b7b475bc35afbb483db39ac864dbee0c9760c22a1d32d83588afd7c994652413b22db76874ca052ef2013317eb7fcc5677e9d", 0xa0}, {&(0x7f0000000200)="f610e61fc81cc3edc86f0500194d27a5a42cf1880b0dfd1ecda0fd0ed9", 0x1d}], 0x4, 0x0, 0x0, 0x900}}], 0x1, 0x0) 3m6.464919263s ago: executing program 4 (id=318): r0 = mq_open(&(0x7f0000000900)=':@=\x18\xb9\xbfn\'U\r \x98O\xbaT\x12\xef\x1b\xa2\xed\x8f\f=\x9b\xc5\xd4):\x84\x9f\xcba\x0er\x9a\xc4kD80H+\xec\xaa)\xec\xf4\f\x1a\xc5\xe9\xe5k\xa83\xc3_\xcc\xec70\x82\xab\x83\xc0\xc7\x86\xb3\xa8\xf0$\xf3\xbc)\x84\x14\x8d\xbb\x82\xb91\xa4\b\xb9\xa8\xb2\xc0\x1f\xd1q\x86gx\x84\xa3\xc0X\xda5u\xf1\xc8!\xb3\xe1`V\xd4\x85\xb4\x03D\t-\xa9\xf4x\xae\xee\xfd\x9cA\xe5\xd4\xa92\x1c(\x92_\x03L\xb4\xd4X\xa5\xd6su\x1ap\xbe\xb1Ea\xfb\xcb*3\x0fc\xfc\xbe+\x06\a\xb8\xf3\xd7d\xc0U^\xf7V\x11\x83e\xca\xf0\x96\xc5\'jo\xf7f2\x9c\xdb\xa0(;\xa2\xa5\xe3\x12\xb8\xc3\xf3\xf9\x16\xf0\xf2m!\x009\x8b+\x01\x17_\xc5q\xb5\t\xa8\xe5%k\b]f\x961\xad^\x9f\x80J0\xcf\x01\f\x81\x1b\x93|\xd2\xbe\xd2L\xf6b\xc4\\uM\xb7\x03\x1dEZ#\x93\xa2\xd8]T>i\"\xa6\x01\x97\xeb\xa0\x1eD+\xb4\x91~sX\xca\x04\xda=E\xbf\xca6u^\xb9\x1e`\x85fYO#3\xf3f\xb20x0) timer_settime(r5, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) preadv2(r6, &(0x7f0000000180)=[{&(0x7f0000000000)=""/167, 0xa7}], 0x1, 0x0, 0x4, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001700)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000001780)="8c4a9cff497b9cdaf9d504d153e5adcbd9ac975419c349e65e8c6234d08f23df10b3df566db8342a4ee26a2d8f5e50c6cdc3ceb8495690a9364a12938f1171b6ea8513750424c93827357d7bba8ce3e6fdd5ac24330d3e66ea8639d9f1aa4cb93f460dd33f9c0b550f161bfaa7632b2ae73de4622c8161b71f82245e8f8f801b56d5035081cb020afe2513adfb5953e7b0391c96b869b0b708e08837fd51900348a817b324bbdc0e5566ce52c0b53f002da767b3fe3ad6d4e3b6e3fb3a0177e997b74be3f61e5dade31a268fc40245981e007cdd9e8ede1af1ecb6b4373297", 0xdf}, 0x68) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES64, @ANYBLOB], 0x10) 3m2.143379148s ago: executing program 4 (id=330): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) open(&(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', 0xc0003, 0xc) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ppoll(&(0x7f00000000c0)=[{r1, 0xd000}, {r1, 0x4018}], 0x2, 0x0, 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000240), 0xf) write$vga_arbiter(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='\a\x00\x00\x00des none\x00'], 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) sendfile(r3, r2, 0x0, 0x6) read$watch_queue(r3, &(0x7f0000000540)=""/4096, 0x1000) r4 = gettid() fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000400), &(0x7f0000000440), 0x2, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(r5, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) preadv2(r6, &(0x7f0000000180)=[{&(0x7f0000000000)=""/167, 0xa7}], 0x1, 0x0, 0x4, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001700)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000001780)="8c4a9cff497b9cdaf9d504d153e5adcbd9ac975419c349e65e8c6234d08f23df10b3df566db8342a4ee26a2d8f5e50c6cdc3ceb8495690a9364a12938f1171b6ea8513750424c93827357d7bba8ce3e6fdd5ac24330d3e66ea8639d9f1aa4cb93f460dd33f9c0b550f161bfaa7632b2ae73de4622c8161b71f82245e8f8f801b56d5035081cb020afe2513adfb5953e7b0391c96b869b0b708e08837fd51900348a817b324bbdc0e5566ce52c0b53f002da767b3fe3ad6d4e3b6e3fb3a0177e997b74be3f61e5dade31a268fc40245981e007cdd9e8ede1af1ecb6b4373297", 0xdf}, 0x68) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES64, @ANYBLOB], 0x10) 2m59.874769652s ago: executing program 4 (id=335): socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_procfs(r2, &(0x7f0000019300)='pagemap\x00') pread64(r5, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r6 = add_key$keyring(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) add_key(&(0x7f0000000180)='rxrpc\x00', &(0x7f0000019200)={'syz', 0x3}, &(0x7f0000019240)="3150bce562735501c682aaa7de7adf4ce09f766ed6f1fc2640602c508507360cede1d3bd971202686dc0784f76fa6066a0921b176d5b3b9fc3704ae2a6b1d14c5cbf730d77a805e7f8023d7fed9c83e52ce2a351e62f6ea4fded62b6755c218c69f00775d69187b9", 0x68, r6) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r9}) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000019340)=@assoc_value={0x0, 0x80000000}, 0x8) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000001000)='x', 0x1}], 0x1}, 0x0) close(0x3) recvmsg(0xffffffffffffffff, 0x0, 0x121) 2m44.123304379s ago: executing program 32 (id=335): socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_procfs(r2, &(0x7f0000019300)='pagemap\x00') pread64(r5, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r6 = add_key$keyring(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) add_key(&(0x7f0000000180)='rxrpc\x00', &(0x7f0000019200)={'syz', 0x3}, &(0x7f0000019240)="3150bce562735501c682aaa7de7adf4ce09f766ed6f1fc2640602c508507360cede1d3bd971202686dc0784f76fa6066a0921b176d5b3b9fc3704ae2a6b1d14c5cbf730d77a805e7f8023d7fed9c83e52ce2a351e62f6ea4fded62b6755c218c69f00775d69187b9", 0x68, r6) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r9}) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000019340)=@assoc_value={0x0, 0x80000000}, 0x8) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000001000)='x', 0x1}], 0x1}, 0x0) close(0x3) recvmsg(0xffffffffffffffff, 0x0, 0x121) 2m21.480841176s ago: executing program 0 (id=400): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) bind$can_raw(r0, &(0x7f00000000c0), 0x10) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}], 0x8) 2m19.731404607s ago: executing program 0 (id=408): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5b}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@mptcp=@ack={0x1e, 0x4, 0x278}]}}}}}}}}, 0x0) 2m19.535924677s ago: executing program 0 (id=412): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYBLOB="dc05ee057ada978f61034835c9655cc8f5553beda9f730e151772060ac74b31cd73d524a83d2278bcacaf9ccf186df9ce51f99f2e19707bd19279dea3a989ab3c0bcffcfba1b5cdd4eb33ba40f0198d12e4108f58d9942e2a7a2efac7ed3d4a8ba0211be34077582823b52cea03ece14b22f2f5754", @ANYRES32, @ANYRESHEX, @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES32=0x0, @ANYRES8=0x0, @ANYRESHEX, @ANYRESHEX, @ANYRESDEC], 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) close(r1) bind$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x3, 0x54}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000100000001"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @local}, 0xf}, 0x1c) listen(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004000) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) close(0xffffffffffffffff) 2m17.823047398s ago: executing program 0 (id=413): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000940), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000980)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000009c0)={0x2c, r1, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1702}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) 2m17.075791717s ago: executing program 0 (id=416): r0 = socket$unix(0x1, 0x2, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000200)=0x10) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 2m17.012518024s ago: executing program 0 (id=417): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r1, 0x4, 0x0, @void}, 0x10) 2m1.912008002s ago: executing program 33 (id=417): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r1, 0x4, 0x0, @void}, 0x10) 1m45.889376631s ago: executing program 3 (id=493): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x48}) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r3, 0x40045402, &(0x7f0000000140)=0x1) read(r3, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) 1m44.395744004s ago: executing program 3 (id=496): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000192c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(r2, &(0x7f0000019300)='pagemap\x00') r5 = add_key$keyring(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) add_key(&(0x7f0000000180)='rxrpc\x00', &(0x7f0000019200)={'syz', 0x3}, &(0x7f0000019240)="3150bce562735501c682aaa7de7adf4ce09f766ed6f1fc2640602c508507360cede1d3bd971202686dc0784f76fa6066a0921b176d5b3b9fc3704ae2a6b1d14c5cbf730d77a805e7f8023d7fed9c83e52ce2a351e62f6ea4fded62b6755c218c69f00775d69187b9", 0x68, r5) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000001000)='x', 0x1}], 0x1}, 0x0) close(0x3) 1m42.952264142s ago: executing program 3 (id=500): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0e0000000400000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x6, &(0x7f00000000c0)=ANY=[@ANYRES32=r0], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0x70, 0x0, &(0x7f0000000440)="ffb667cfd3201452a5c79b784bcead87bfe7494e4c5097b6dcba954cc16968f32fb2c5f065bf069a04cccff30567c63ff682caf1d1306b3d5ddac9f624d92d440112d90ea7231c35659fcab1a603a4f0af61f42992161cc4b21caf5cef0b472ea329f058aa7f160cc5d57e6482288aa0", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x2}}, './file0\x00'}) bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r4}, 0x8) bpf$BPF_LINK_CREATE(0x8, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff, 0x1d, 0x0, @val=@netkit}, 0x1c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="d80100001c00"], 0x1d8}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x2f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r6, 0x84, 0x7f, 0x0, 0x0) clock_gettime(0x4, 0x0) socket$unix(0x1, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x5, 0x84) 1m42.098624789s ago: executing program 3 (id=502): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x50) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r0, 0x2000012, 0x70, 0x0, &(0x7f0000000440)="ffb667cfd3201452a5c79b784bcead87bfe7494e4c5097b6dcba954cc16968f32fb2c5f065bf069a04cccff30567c63ff682caf1d1306b3d5ddac9f624d92d440112d90ea7231c35659fcab1a603a4f0af61f42992161cc4b21caf5cef0b472ea329f058aa7f160cc5d57e6482288aa0", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x2}}, './file0\x00'}) bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r3}, 0x8) bpf$BPF_LINK_CREATE(0x8, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff, 0x1d, 0x0, @val=@netkit}, 0x1c) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="d80100001c00"], 0x1d8}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x2f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r5, 0x84, 0x7f, 0x0, 0x0) clock_gettime(0x4, 0x0) socket$unix(0x1, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x5, 0x84) 1m40.892889273s ago: executing program 3 (id=506): socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000192c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_procfs(r2, &(0x7f0000019300)='pagemap\x00') pread64(r5, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r6 = add_key$keyring(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) add_key(&(0x7f0000000180)='rxrpc\x00', &(0x7f0000019200)={'syz', 0x3}, &(0x7f0000019240)="3150bce562735501c682aaa7de7adf4ce09f766ed6f1fc2640602c508507360cede1d3bd971202686dc0784f76fa6066a0921b176d5b3b9fc3704ae2a6b1d14c5cbf730d77a805e7f8023d7fed9c83e52ce2a351e62f6ea4fded62b6755c218c69f00775d69187b9", 0x68, r6) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r9}) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000019340)=@assoc_value={0x0, 0x80000000}, 0x8) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000001000)='x', 0x1}], 0x1}, 0x0) close(0x3) recvmsg(0xffffffffffffffff, 0x0, 0x121) 1m39.483253045s ago: executing program 3 (id=509): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYBLOB="dc05ee057ada978f61034835c9655cc8f5553beda9f730e151772060ac74b31cd73d524a83d2278bcacaf9ccf186df9ce51f99f2e19707bd19279dea3a989ab3c0bcffcfba1b5cdd4eb33ba40f0198d12e4108f58d9942e2a7a2efac7ed3d4a8ba0211be34077582823b52cea03ece14b22f2f5754", @ANYRES32, @ANYRESHEX, @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES32=0x0, @ANYRES8=0x0, @ANYRESHEX, @ANYRESHEX, @ANYRESDEC], 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) close(r1) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x3, 0x54}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000100000001"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @local}, 0xf}, 0x1c) listen(r6, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004000) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) close(r2) 1m33.520955744s ago: executing program 2 (id=511): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', r2, 0x0, 0xfff7fffffffffff5}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x1418, 0x1, 0x0, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000804}, 0x44810) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$unix(0x1, 0x2, 0x0) r7 = syz_genetlink_get_family_id$batadv(0x0, r1) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, r7, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x24000840) r8 = socket$unix(0x1, 0x2, 0x0) connect$unix(r8, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f0000000080)=0x7fe00, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) 1m25.735626947s ago: executing program 2 (id=516): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x48}) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r4, 0x40045402, &(0x7f0000000140)=0x1) read(r4, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r4, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) 1m19.107102305s ago: executing program 34 (id=509): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYBLOB="dc05ee057ada978f61034835c9655cc8f5553beda9f730e151772060ac74b31cd73d524a83d2278bcacaf9ccf186df9ce51f99f2e19707bd19279dea3a989ab3c0bcffcfba1b5cdd4eb33ba40f0198d12e4108f58d9942e2a7a2efac7ed3d4a8ba0211be34077582823b52cea03ece14b22f2f5754", @ANYRES32, @ANYRESHEX, @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES32=0x0, @ANYRES8=0x0, @ANYRESHEX, @ANYRESHEX, @ANYRESDEC], 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) close(r1) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x3, 0x54}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000100000001"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @local}, 0xf}, 0x1c) listen(r6, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004000) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) close(r2) 1m17.561031427s ago: executing program 1 (id=518): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r0, 0x7aa, 0x0) 1m16.368788927s ago: executing program 2 (id=519): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x9d, 0xea, 0x78, 0x40, 0x18b4, 0xfffb, 0xdc7b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0xa0, 0x1f, 0x71}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) preadv(r1, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000300)=""/149, 0x95}], 0x2, 0x2, 0x4) 1m13.561529268s ago: executing program 2 (id=520): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, 0x0, &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000060000,user_i', @ANYRESHEX=r1, @ANYRES16=r0, @ANYBLOB]) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [], 0x2f}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) syz_open_dev$dri(0x0, 0xf5a6, 0x4040) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) sendto$inet(r3, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r3, 0x1) recvfrom(r3, &(0x7f0000000000)=""/116, 0xffffffdd, 0x734, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001240)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x10001, 0x0) 1m12.822447622s ago: executing program 1 (id=521): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4204, r0, 0x200, &(0x7f0000000480)={0x0}) 1m11.873049057s ago: executing program 1 (id=522): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYBLOB="dc05ee057ada978f61034835c9655cc8f5553beda9f730e151772060ac74b31cd73d524a83d2278bcacaf9ccf186df9ce51f99f2e19707bd19279dea3a989ab3c0bcffcfba1b5cdd4eb33ba40f0198d12e4108f58d9942e2a7a2efac7ed3d4a8ba0211be34077582823b52cea03ece14b22f2f5754", @ANYRES32, @ANYRESHEX, @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES32=0x0, @ANYRES8=0x0, @ANYRESHEX, @ANYRESHEX, @ANYRESDEC], 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) close(r1) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x3, 0x54}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000100000001"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @local}, 0xf}, 0x1c) listen(r6, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004000) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) close(r2) 1m2.543350157s ago: executing program 1 (id=523): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x82000, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000), 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000000)) 1m2.30095126s ago: executing program 1 (id=524): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) munlockall() mount$fuse(0x0, 0x0, 0x0, 0x802043, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) bpf$OBJ_PIN_MAP(0x9, &(0x7f0000000040)=@generic={0x0}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() syz_emit_ethernet(0x66, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x8000000}}}}}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) select(0x0, 0x0, &(0x7f00000000c0)={0x3, 0x1, 0xff, 0xfffffffffffffe5e, 0x4, 0x5, 0x6, 0x9}, &(0x7f00000001c0)={0x9, 0xffffffff, 0x8, 0x2fdd64c9, 0x10001, 0x6, 0x7ff, 0x20000}, &(0x7f0000000240)={0x77359400}) munlockall() r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r4, &(0x7f0000000040)={0x1f, @none, 0x2}, 0xa) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r4, 0x1) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) 1m0.007049881s ago: executing program 1 (id=525): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', 0xffffffffffffffff, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) open(&(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', 0xc0003, 0xc) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ppoll(&(0x7f00000000c0)=[{r1, 0xd000}, {r1, 0x4018}], 0x2, 0x0, 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000240), 0xf) write$vga_arbiter(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='\a\x00\x00\x00des none\x00'], 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) sendfile(r3, r2, 0x0, 0x6) read$watch_queue(r3, &(0x7f0000000540)=""/4096, 0x1000) r4 = gettid() fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000400), &(0x7f0000000440), 0x2, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(r5, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) preadv2(r6, &(0x7f0000000180)=[{&(0x7f0000000000)=""/167, 0xa7}], 0x1, 0x0, 0x4, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001700)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000001780)="8c4a9cff497b9cdaf9d504d153e5adcbd9ac975419c349e65e8c6234d08f23df10b3df566db8342a4ee26a2d8f5e50c6cdc3ceb8495690a9364a12938f1171b6ea8513750424c93827357d7bba8ce3e6fdd5ac24330d3e66ea8639d9f1aa4cb93f460dd33f9c0b550f161bfaa7632b2ae73de4622c8161b71f82245e8f8f801b56d5035081cb020afe2513adfb5953e7b0391c96b869b0b708e08837fd51900348a817b324bbdc0e5566ce52c0b53f002da767b3fe3ad6d4e3b6e3fb3a0177e997b74be3f61e5dade31a268fc40245981e007cdd9e8ede1af1ecb6b4373297", 0xdf}, 0x68) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES64, @ANYBLOB], 0x10) 59.965106773s ago: executing program 2 (id=526): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r0 = syz_io_uring_setup(0x234, &(0x7f0000000580)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r0, 0x207a98, 0x0, 0x0, 0x0, 0x0) 55.928977731s ago: executing program 2 (id=527): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) unshare(0x20060400) 4.360018483s ago: executing program 35 (id=525): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', 0xffffffffffffffff, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) open(&(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', 0xc0003, 0xc) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ppoll(&(0x7f00000000c0)=[{r1, 0xd000}, {r1, 0x4018}], 0x2, 0x0, 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000240), 0xf) write$vga_arbiter(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='\a\x00\x00\x00des none\x00'], 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) sendfile(r3, r2, 0x0, 0x6) read$watch_queue(r3, &(0x7f0000000540)=""/4096, 0x1000) r4 = gettid() fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000400), &(0x7f0000000440), 0x2, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(r5, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) preadv2(r6, &(0x7f0000000180)=[{&(0x7f0000000000)=""/167, 0xa7}], 0x1, 0x0, 0x4, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001700)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000001780)="8c4a9cff497b9cdaf9d504d153e5adcbd9ac975419c349e65e8c6234d08f23df10b3df566db8342a4ee26a2d8f5e50c6cdc3ceb8495690a9364a12938f1171b6ea8513750424c93827357d7bba8ce3e6fdd5ac24330d3e66ea8639d9f1aa4cb93f460dd33f9c0b550f161bfaa7632b2ae73de4622c8161b71f82245e8f8f801b56d5035081cb020afe2513adfb5953e7b0391c96b869b0b708e08837fd51900348a817b324bbdc0e5566ce52c0b53f002da767b3fe3ad6d4e3b6e3fb3a0177e997b74be3f61e5dade31a268fc40245981e007cdd9e8ede1af1ecb6b4373297", 0xdf}, 0x68) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES64, @ANYBLOB], 0x10) 0s ago: executing program 36 (id=527): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) unshare(0x20060400) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.14' (ED25519) to the list of known hosts. [ 73.104947][ T5822] cgroup: Unknown subsys name 'net' [ 73.366225][ T5822] cgroup: Unknown subsys name 'cpuset' [ 73.402378][ T5822] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.023965][ T5822] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.702777][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.714891][ T5849] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.720155][ T5849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.722245][ T5849] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.723349][ T5849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.725254][ T5849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.726149][ T5849] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.726553][ T5849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.727286][ T5849] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.729150][ T5849] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.730529][ T5849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.731033][ T5849] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.742656][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.743259][ T5849] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.744095][ T5849] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.744930][ T5849] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.753509][ T5849] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.763015][ T5849] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.774239][ T5848] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.807232][ T5851] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.832549][ T5851] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.842807][ T5851] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.852136][ T5851] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.854925][ T5154] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.860633][ T5154] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.757141][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 78.772714][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 78.777319][ T5832] chnl_net:caif_netlink_parms(): no params data found [ 78.881135][ T5834] chnl_net:caif_netlink_parms(): no params data found [ 79.164129][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 79.845005][ T59] Bluetooth: hci1: command tx timeout [ 79.913421][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.914258][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.914775][ T5836] bridge_slave_0: entered allmulticast mode [ 79.917278][ T5836] bridge_slave_0: entered promiscuous mode [ 79.921045][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.921175][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.921338][ T5835] bridge_slave_0: entered allmulticast mode [ 79.922114][ T5851] Bluetooth: hci3: command tx timeout [ 79.922217][ T5851] Bluetooth: hci0: command tx timeout [ 79.922393][ T59] Bluetooth: hci4: command tx timeout [ 79.924638][ T5835] bridge_slave_0: entered promiscuous mode [ 79.964786][ T5832] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.964914][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.965067][ T5832] bridge_slave_0: entered allmulticast mode [ 79.970322][ T5832] bridge_slave_0: entered promiscuous mode [ 80.002136][ T5838] Bluetooth: hci2: command tx timeout [ 80.093799][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.093933][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.094094][ T5836] bridge_slave_1: entered allmulticast mode [ 80.095614][ T5836] bridge_slave_1: entered promiscuous mode [ 80.098285][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.098357][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.098455][ T5835] bridge_slave_1: entered allmulticast mode [ 80.099887][ T5835] bridge_slave_1: entered promiscuous mode [ 80.163619][ T5832] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.163810][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.164370][ T5832] bridge_slave_1: entered allmulticast mode [ 80.166251][ T5832] bridge_slave_1: entered promiscuous mode [ 80.549146][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.549225][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.549504][ T5834] bridge_slave_0: entered allmulticast mode [ 80.550939][ T5834] bridge_slave_0: entered promiscuous mode [ 80.832282][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.832404][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.832534][ T5834] bridge_slave_1: entered allmulticast mode [ 80.834268][ T5834] bridge_slave_1: entered promiscuous mode [ 80.838447][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.841427][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.841645][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.841801][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.852728][ T5833] bridge_slave_0: entered allmulticast mode [ 80.855225][ T5833] bridge_slave_0: entered promiscuous mode [ 80.947598][ T5832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.026159][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.026392][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.026526][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.027020][ T5833] bridge_slave_1: entered allmulticast mode [ 81.029045][ T5833] bridge_slave_1: entered promiscuous mode [ 81.031617][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.036285][ T5832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.448516][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.608680][ T991] cfg80211: failed to load regulatory.db [ 81.811829][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.827914][ T5836] team0: Port device team_slave_0 added [ 81.835818][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.851801][ T5835] team0: Port device team_slave_0 added [ 81.861497][ T5832] team0: Port device team_slave_0 added [ 81.922012][ T5838] Bluetooth: hci1: command tx timeout [ 81.966360][ T5836] team0: Port device team_slave_1 added [ 81.970041][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.985447][ T5835] team0: Port device team_slave_1 added [ 81.997104][ T5832] team0: Port device team_slave_1 added [ 82.002091][ T5838] Bluetooth: hci4: command tx timeout [ 82.002118][ T5838] Bluetooth: hci0: command tx timeout [ 82.002136][ T5838] Bluetooth: hci3: command tx timeout [ 82.082036][ T59] Bluetooth: hci2: command tx timeout [ 82.614394][ T5834] team0: Port device team_slave_0 added [ 82.907342][ T5834] team0: Port device team_slave_1 added [ 82.908460][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.908469][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.908482][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.911543][ T5833] team0: Port device team_slave_0 added [ 82.914668][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.914679][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.914702][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.916946][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.916957][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.916978][ T5832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.012790][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.012805][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.012828][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.017341][ T5833] team0: Port device team_slave_1 added [ 83.018819][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.018830][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.018852][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.020116][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.020126][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.020148][ T5832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.374745][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.374760][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.374784][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.468537][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.468553][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.468576][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.472492][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.472505][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.472527][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.566432][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.566447][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.566470][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.960543][ T5836] hsr_slave_0: entered promiscuous mode [ 83.961494][ T5836] hsr_slave_1: entered promiscuous mode [ 83.980832][ T5832] hsr_slave_0: entered promiscuous mode [ 83.981771][ T5832] hsr_slave_1: entered promiscuous mode [ 83.983613][ T5832] debugfs: 'hsr0' already exists in 'hsr' [ 83.983716][ T5832] Cannot create hsr debugfs directory [ 83.993561][ T5835] hsr_slave_0: entered promiscuous mode [ 84.002525][ T5835] hsr_slave_1: entered promiscuous mode [ 84.003312][ T5835] debugfs: 'hsr0' already exists in 'hsr' [ 84.003333][ T5835] Cannot create hsr debugfs directory [ 84.004115][ T59] Bluetooth: hci1: command tx timeout [ 84.082061][ T59] Bluetooth: hci3: command tx timeout [ 84.082089][ T59] Bluetooth: hci0: command tx timeout [ 84.082108][ T59] Bluetooth: hci4: command tx timeout [ 84.161982][ T5838] Bluetooth: hci2: command tx timeout [ 84.405713][ T5834] hsr_slave_0: entered promiscuous mode [ 84.406998][ T5834] hsr_slave_1: entered promiscuous mode [ 84.407930][ T5834] debugfs: 'hsr0' already exists in 'hsr' [ 84.407952][ T5834] Cannot create hsr debugfs directory [ 84.571987][ T5833] hsr_slave_0: entered promiscuous mode [ 84.573281][ T5833] hsr_slave_1: entered promiscuous mode [ 84.574139][ T5833] debugfs: 'hsr0' already exists in 'hsr' [ 84.574161][ T5833] Cannot create hsr debugfs directory [ 86.082432][ T5838] Bluetooth: hci1: command tx timeout [ 86.162385][ T5838] Bluetooth: hci4: command tx timeout [ 86.162415][ T5838] Bluetooth: hci0: command tx timeout [ 86.162444][ T5838] Bluetooth: hci3: command tx timeout [ 86.206223][ T5836] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.252234][ T59] Bluetooth: hci2: command tx timeout [ 86.254010][ T5836] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.278981][ T5836] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.333499][ T5836] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.445709][ T5835] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.490910][ T5835] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.537370][ T5835] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.603819][ T5835] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.747147][ T5832] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.783871][ T5832] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.820914][ T5832] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.876747][ T5832] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.050334][ T5834] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.087150][ T5834] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.126965][ T5834] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.179139][ T5834] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.349922][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.395065][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.436464][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.480587][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.490318][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.570209][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.617830][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.675737][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.675962][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.719665][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.726123][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.726332][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.771382][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.777198][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.778229][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.828602][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.828723][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.917093][ T5832] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.960104][ T3603] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.960231][ T3603] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.974379][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.014036][ T3603] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.014139][ T3603] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.140341][ T5834] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.196569][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.197276][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.258757][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.300495][ T79] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.300818][ T79] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.430673][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.493153][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.493426][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.528095][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.530336][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.574178][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.785753][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.091427][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.199750][ T5835] veth0_vlan: entered promiscuous mode [ 89.275535][ T5835] veth1_vlan: entered promiscuous mode [ 89.294937][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.408672][ T5832] veth0_vlan: entered promiscuous mode [ 89.473909][ T5832] veth1_vlan: entered promiscuous mode [ 89.507989][ T5835] veth0_macvtap: entered promiscuous mode [ 89.545286][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.565015][ T5835] veth1_macvtap: entered promiscuous mode [ 89.568679][ T5836] veth0_vlan: entered promiscuous mode [ 89.598381][ T5834] veth0_vlan: entered promiscuous mode [ 89.631356][ T5836] veth1_vlan: entered promiscuous mode [ 89.658345][ T5834] veth1_vlan: entered promiscuous mode [ 89.664152][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.699647][ T5832] veth0_macvtap: entered promiscuous mode [ 89.705700][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.735787][ T5832] veth1_macvtap: entered promiscuous mode [ 89.752909][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.758747][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.768724][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.798168][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.897209][ T5833] veth0_vlan: entered promiscuous mode [ 89.900506][ T5836] veth0_macvtap: entered promiscuous mode [ 89.907776][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.987149][ T5836] veth1_macvtap: entered promiscuous mode [ 89.998922][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.006672][ T5834] veth0_macvtap: entered promiscuous mode [ 90.071621][ T5833] veth1_vlan: entered promiscuous mode [ 90.099828][ T3603] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.100332][ T5834] veth1_macvtap: entered promiscuous mode [ 90.118934][ T3603] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.123668][ T3603] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.138235][ T3603] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.205808][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.271312][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.271336][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.275037][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.338591][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.369874][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.496337][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.509819][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.528672][ T3603] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.528688][ T3603] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.529585][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.531307][ T5833] veth0_macvtap: entered promiscuous mode [ 90.565635][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.586168][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.590511][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.644815][ T5833] veth1_macvtap: entered promiscuous mode [ 90.647329][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.679866][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.681339][ T3603] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.681354][ T3603] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.050080][ T782] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.050100][ T782] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.119285][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.230497][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.323674][ T79] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.323930][ T782] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.323945][ T782] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.394067][ T79] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.458770][ T79] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.493285][ T79] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.529107][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.529125][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.291962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.292058][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.292105][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.292196][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.292243][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.346800][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.347392][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.611982][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.612050][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 92.612165][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 93.756625][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.756646][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.724592][ T1118] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.724612][ T1118] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.022620][ T782] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.022639][ T782] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.223991][ T1118] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.224010][ T1118] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.244621][ T5991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17'. [ 96.244645][ T5991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17'. [ 96.396983][ T6001] netlink: 'syz.1.18': attribute type 12 has an invalid length. [ 96.396997][ T6001] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18'. [ 98.554693][ T6018] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 101.703355][ T6042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.30'. [ 101.703371][ T6042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.30'. [ 103.085312][ T6057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.33'. [ 103.085328][ T6057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.33'. [ 104.414540][ T6071] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 104.708539][ T6076] bridge1: entered promiscuous mode [ 105.072186][ T6087] netlink: 4 bytes leftover after parsing attributes in process `syz.1.41'. [ 107.740517][ T6116] Bluetooth: MGMT ver 1.23 [ 108.455236][ T6126] netlink: 'syz.0.53': attribute type 8 has an invalid length. [ 108.681825][ T6128] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 109.081164][ T6145] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 110.608718][ T6176] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 111.134468][ T6172] netlink: 340 bytes leftover after parsing attributes in process `syz.1.70'. [ 111.135561][ T6172] netlink: 48 bytes leftover after parsing attributes in process `syz.1.70'. [ 112.100954][ T6185] (unnamed net_device) (uninitialized): up delay (7) is not a multiple of miimon (3), value rounded to 6 ms [ 112.100983][ T6185] (unnamed net_device) (uninitialized): down delay (7) is not a multiple of miimon (3), value rounded to 6 ms [ 113.154884][ T6200] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 113.375488][ T6185] 8021q: adding VLAN 0 to HW filter on device bond1 [ 114.338480][ T6216] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 115.435574][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.0.81'. [ 115.435615][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.0.81'. [ 116.946711][ T6229] geneve2: entered promiscuous mode [ 117.816248][ T6242] netlink: 8 bytes leftover after parsing attributes in process `syz.2.91'. [ 117.816266][ T6242] netlink: 8 bytes leftover after parsing attributes in process `syz.2.91'. [ 118.334556][ T6258] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 118.417657][ T6256] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 119.159278][ T6268] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 122.418750][ T6281] lo: entered allmulticast mode [ 122.421519][ T6281] lo: left allmulticast mode [ 124.275675][ T6296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.105'. [ 124.275692][ T6296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.105'. [ 124.874319][ T6306] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 127.410543][ T6310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.109'. [ 127.410560][ T6310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.109'. [ 127.761053][ T6323] netlink: 452 bytes leftover after parsing attributes in process `syz.4.113'. [ 130.152126][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 130.237235][ T6346] netlink: 124 bytes leftover after parsing attributes in process `syz.1.119'. [ 130.237461][ T6346] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 130.416301][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 130.416336][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.416377][ T10] usb 1-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 130.416399][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.633957][ T10] usb 1-1: config 0 descriptor?? [ 130.748973][ T6352] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 131.454709][ T6349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.120'. [ 131.455117][ T6349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.120'. [ 131.869452][ T10] hid-generic 0003:04F3:0754.0001: failed to start in urb: -90 [ 132.183649][ T10] hid-generic 0003:04F3:0754.0001: hidraw0: USB HID v1.01 Device [HID 04f3:0754] on usb-dummy_hcd.0-1/input0 [ 132.336176][ T6363] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 132.940697][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.940793][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.031567][ T10] usb 1-1: USB disconnect, device number 2 [ 133.459694][ T6365] fido_id[6365]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 133.605122][ T6374] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 134.338764][ T6383] netlink: 'syz.2.130': attribute type 10 has an invalid length. [ 134.338788][ T6383] netlink: 40 bytes leftover after parsing attributes in process `syz.2.130'. [ 134.340452][ T6383] batadv0: entered promiscuous mode [ 134.340478][ T6383] batadv0: entered allmulticast mode [ 134.341396][ T6383] bridge0: port 3(batadv0) entered blocking state [ 134.343115][ T6383] bridge0: port 3(batadv0) entered disabled state [ 135.065312][ T6383] bridge0: port 3(batadv0) entered blocking state [ 135.065466][ T6383] bridge0: port 3(batadv0) entered forwarding state [ 135.223890][ T6385] netlink: 452 bytes leftover after parsing attributes in process `syz.3.129'. [ 135.690915][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 135.690935][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 135.738356][ T6390] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 136.117099][ T6400] pim6reg: entered allmulticast mode [ 136.133896][ T6400] pim6reg: left allmulticast mode [ 136.393840][ T6405] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 138.798629][ T6414] netlink: 8 bytes leftover after parsing attributes in process `syz.3.138'. [ 138.798645][ T6414] netlink: 8 bytes leftover after parsing attributes in process `syz.3.138'. [ 139.539149][ T6434] netlink: 16 bytes leftover after parsing attributes in process `syz.2.142'. [ 140.871815][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 141.038176][ T6433] fuse: Unknown parameter '0xffffffffffffffff' [ 141.069500][ T6448] netlink: 8 bytes leftover after parsing attributes in process `syz.2.151'. [ 141.069517][ T6448] netlink: 8 bytes leftover after parsing attributes in process `syz.2.151'. [ 141.114658][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 141.118969][ T31] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 141.118994][ T31] usb 1-1: config 0 has no interface number 0 [ 141.119032][ T31] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 141.119044][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.170188][ T31] usb 1-1: config 0 descriptor?? [ 141.298910][ T31] viperboard 1-1:0.143: version 0.00 found at bus 001 address 003 [ 142.288211][ T31] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 142.288257][ T31] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 142.362433][ T6455] netlink: 452 bytes leftover after parsing attributes in process `syz.1.152'. [ 142.364269][ T31] usb 1-1: USB disconnect, device number 3 [ 143.776146][ T6471] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 144.220308][ T6476] syz.0.157 uses obsolete (PF_INET,SOCK_PACKET) [ 144.721686][ T6477] netlink: 8 bytes leftover after parsing attributes in process `syz.2.156'. [ 144.721757][ T6477] netlink: 8 bytes leftover after parsing attributes in process `syz.2.156'. [ 145.702231][ T31] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 145.812043][ T5953] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 145.903730][ T31] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 145.903764][ T31] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 145.903790][ T31] usb 1-1: config 0 interface 0 has no altsetting 0 [ 145.903824][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 145.903847][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.965601][ T31] usb 1-1: config 0 descriptor?? [ 145.966387][ T6484] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 145.982030][ T5953] usb 3-1: Using ep0 maxpacket: 32 [ 145.985880][ T5953] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 145.985923][ T5953] usb 3-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 145.985945][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.991078][ T5953] usb 3-1: config 0 descriptor?? [ 146.385271][ T6490] netlink: 8 bytes leftover after parsing attributes in process `syz.1.163'. [ 146.385296][ T6490] netlink: 8 bytes leftover after parsing attributes in process `syz.1.163'. [ 146.435576][ T31] logitech 0003:046D:C24F.0002: unbalanced collection at end of report description [ 146.436417][ T31] logitech 0003:046D:C24F.0002: parse failed [ 146.436518][ T31] logitech 0003:046D:C24F.0002: probe with driver logitech failed with error -22 [ 146.497806][ T5953] hid-picolcd 0003:04D8:F002.0003: unknown main item tag 0x0 [ 147.728810][ T1803] usb 1-1: USB disconnect, device number 4 [ 147.998263][ T5953] hid-picolcd 0003:04D8:F002.0003: No report with id 0xf3 found [ 147.998287][ T5953] hid-picolcd 0003:04D8:F002.0003: No report with id 0xf4 found [ 148.019263][ T5953] usb 3-1: USB disconnect, device number 2 [ 149.144581][ T5953] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 149.165988][ T6513] netlink: 8 bytes leftover after parsing attributes in process `syz.3.169'. [ 149.166004][ T6513] netlink: 8 bytes leftover after parsing attributes in process `syz.3.169'. [ 149.292045][ T5953] usb 2-1: Using ep0 maxpacket: 8 [ 149.294153][ T5953] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 149.294168][ T5953] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 149.294196][ T5953] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 149.294209][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.456372][ T5953] hub 2-1:1.0: bad descriptor, ignoring hub [ 149.456412][ T5953] hub 2-1:1.0: probe with driver hub failed with error -5 [ 149.577540][ T6509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.578090][ T6509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.750061][ T1803] usb 2-1: USB disconnect, device number 2 [ 149.755026][ T6525] fuse: Unknown parameter '0xffffffffffffffff' [ 150.325846][ T6535] netlink: 8 bytes leftover after parsing attributes in process `syz.2.175'. [ 150.325991][ T6535] netlink: 8 bytes leftover after parsing attributes in process `syz.2.175'. [ 150.935270][ T6539] fuse: Unknown parameter '' [ 151.712114][ T5926] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 152.514612][ T5926] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 152.514645][ T5926] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 152.514664][ T5926] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 152.514682][ T5926] usb 5-1: config 220 has no interface number 2 [ 153.460738][ T5926] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 153.460773][ T5926] usb 5-1: config 220 interface 0 has no altsetting 0 [ 153.460792][ T5926] usb 5-1: config 220 interface 76 has no altsetting 0 [ 153.460809][ T5926] usb 5-1: config 220 interface 1 has no altsetting 0 [ 153.492175][ T5926] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 153.492206][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.492224][ T5926] usb 5-1: Product: syz [ 153.492237][ T5926] usb 5-1: Manufacturer: syz [ 153.492250][ T5926] usb 5-1: SerialNumber: syz [ 153.869894][ T5926] usb 5-1: can't set config #220, error -71 [ 153.912496][ T5926] usb 5-1: USB disconnect, device number 2 [ 155.033135][ T6561] fuse: Unknown parameter '0xffffffffffffffff' [ 155.869897][ T6577] fuse: Unknown parameter '' [ 157.197299][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 157.531188][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 157.579557][ T6583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.192'. [ 157.579580][ T6583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.192'. [ 157.662152][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 157.662184][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 157.662224][ T31] usb 2-1: New USB device found, idVendor=0925, idProduct=0005, bcdDevice= 0.00 [ 157.662246][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.735408][ T31] usb 2-1: config 0 descriptor?? [ 157.738736][ T6584] netlink: 452 bytes leftover after parsing attributes in process `syz.2.193'. [ 158.191186][ T31] smartjoyplus 0003:0925:0005.0004: item fetching failed at offset 3/5 [ 158.191613][ T31] smartjoyplus 0003:0925:0005.0004: parse failed [ 158.191650][ T31] smartjoyplus 0003:0925:0005.0004: probe with driver smartjoyplus failed with error -22 [ 158.437331][ T5953] usb 2-1: USB disconnect, device number 3 [ 159.502097][ T5953] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 159.676623][ T5953] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 159.676648][ T5953] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 159.685410][ T5953] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 159.685439][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 159.685457][ T5953] usb 3-1: SerialNumber: syz [ 159.849809][ T6621] netlink: 452 bytes leftover after parsing attributes in process `syz.1.207'. [ 160.043529][ T5953] usb 3-1: 0:2 : does not exist [ 161.158748][ T5953] usb 3-1: USB disconnect, device number 3 [ 161.424451][ T6635] netlink: 452 bytes leftover after parsing attributes in process `syz.3.210'. [ 161.812006][ T5926] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 162.232776][ T5926] usb 2-1: Using ep0 maxpacket: 16 [ 162.237063][ T5926] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.237093][ T5926] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.237115][ T5926] usb 2-1: config 0 interface 0 has no altsetting 0 [ 162.237147][ T5926] usb 2-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 162.237170][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.327469][ T5926] usb 2-1: config 0 descriptor?? [ 163.473290][ T5838] Bluetooth: hci4: command 0x0405 tx timeout [ 163.611371][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611398][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611419][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611434][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611448][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611463][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611477][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611492][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611506][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.611520][ T5926] kye 0003:0458:0138.0005: unknown main item tag 0x0 [ 163.693252][ T5965] udevd[5965]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 163.723916][ T5926] kye 0003:0458:0138.0005: collection stack underflow [ 163.723935][ T5926] kye 0003:0458:0138.0005: item 0 0 0 12 parsing failed [ 163.724418][ T5926] kye 0003:0458:0138.0005: parse failed [ 163.724456][ T5926] kye 0003:0458:0138.0005: probe with driver kye failed with error -22 [ 163.812244][ T10] usb 2-1: USB disconnect, device number 4 [ 163.902000][ T6022] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 164.012068][ T5926] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 164.062035][ T6022] usb 5-1: Using ep0 maxpacket: 16 [ 164.065083][ T6022] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 164.065137][ T6022] usb 5-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00 [ 164.065159][ T6022] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.085868][ T6022] usb 5-1: config 0 descriptor?? [ 164.182073][ T5926] usb 3-1: Using ep0 maxpacket: 16 [ 164.184929][ T5926] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 164.184959][ T5926] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 164.184997][ T5926] usb 3-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 164.185018][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.248372][ T5926] usb 3-1: config 0 descriptor?? [ 164.742470][ T6022] usb 5-1: USB disconnect, device number 3 [ 164.817909][ T5926] hid-multitouch 0003:1FD2:6007.0007: hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.2-1/input0 [ 164.966666][ T5926] usb 3-1: USB disconnect, device number 4 [ 165.076999][ T6654] fido_id[6654]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 168.603941][ T6684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.225'. [ 168.603975][ T6684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.225'. [ 174.343984][ T6721] netlink: 452 bytes leftover after parsing attributes in process `syz.0.237'. [ 174.692120][ T10] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 175.754027][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 175.754048][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 175.754070][ T10] usb 5-1: New USB device found, idVendor=054c, idProduct=0ba0, bcdDevice= 0.00 [ 175.754082][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.757977][ T10] usb 5-1: config 0 descriptor?? [ 175.758549][ T6727] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 176.261583][ T10] hid_parser_main: 645 callbacks suppressed [ 176.261598][ T10] playstation 0003:054C:0BA0.0008: unknown main item tag 0x0 [ 176.261617][ T10] playstation 0003:054C:0BA0.0008: unknown main item tag 0x0 [ 176.261632][ T10] playstation 0003:054C:0BA0.0008: unknown main item tag 0x0 [ 176.261647][ T10] playstation 0003:054C:0BA0.0008: unknown main item tag 0x0 [ 176.261662][ T10] playstation 0003:054C:0BA0.0008: unknown main item tag 0x0 [ 176.329411][ T10] playstation 0003:054C:0BA0.0008: hidraw0: USB HID v1.01 Device [HID 054c:0ba0] on usb-dummy_hcd.4-1/input0 [ 176.330533][ T37] audit: type=1326 audit(1758500306.609:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6725 comm="syz.2.239" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d1075ec29 code=0x7fc00000 [ 176.453303][ T10] playstation 0003:054C:0BA0.0008: Failed to retrieve feature with reportID 18: -71 [ 176.453328][ T10] playstation 0003:054C:0BA0.0008: Failed to retrieve DualShock4 pairing info: -71 [ 176.453374][ T10] playstation 0003:054C:0BA0.0008: Failed to get MAC address from DualShock4 [ 176.453393][ T10] playstation 0003:054C:0BA0.0008: Failed to create dualshock4. [ 176.458120][ T10] playstation 0003:054C:0BA0.0008: probe with driver playstation failed with error -71 [ 176.519149][ T10] usb 5-1: USB disconnect, device number 4 [ 176.626693][ T6739] fido_id[6739]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 176.991808][ T6745] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 177.742490][ T6753] netlink: 8 bytes leftover after parsing attributes in process `syz.4.247'. [ 177.823448][ T6753] ipvlan2: entered promiscuous mode [ 178.802108][ T59] Bluetooth: hci4: command 0x0405 tx timeout [ 182.640064][ T6774] warning: `syz.2.252' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 182.822149][ T5855] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 183.724919][ T5855] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 183.724950][ T5855] usb 2-1: New USB device found, idVendor=044e, idProduct=121e, bcdDevice= 0.00 [ 183.724962][ T5855] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.780006][ T5855] usb 2-1: config 0 descriptor?? [ 184.224694][ T6794] netlink: 4 bytes leftover after parsing attributes in process `syz.4.256'. [ 184.262432][ T6796] fuse: Unknown parameter '0xffffffffffffffff' [ 184.353043][ T37] audit: type=1326 audit(1758500314.639:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6769 comm="syz.3.253" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8747dec29 code=0x7fc00000 [ 184.529635][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.529671][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.529698][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.529723][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.529749][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.529774][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.529800][ T5855] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 184.566240][ T5855] hid-alps 0003:044E:121E.0009: hidraw0: USB HID v0.05 Device [HID 044e:121e] on usb-dummy_hcd.1-1/input0 [ 184.757498][ T991] usb 2-1: USB disconnect, device number 5 [ 186.314953][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 186.450289][ T6806] fido_id[6806]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 186.461996][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 186.473202][ T9] usb 1-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 186.473236][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.551157][ T9] usb 1-1: config 0 descriptor?? [ 187.719360][ T9] magicmouse 0003:05AC:0269.000A: reserved main item tag 0xd [ 187.719401][ T9] magicmouse 0003:05AC:0269.000A: item fetching failed at offset 4/5 [ 187.761217][ T9] magicmouse 0003:05AC:0269.000A: magicmouse hid parse failed [ 187.761338][ T9] magicmouse 0003:05AC:0269.000A: probe with driver magicmouse failed with error -22 [ 187.996177][ T9] usb 1-1: USB disconnect, device number 5 [ 188.318039][ T6832] netlink: 452 bytes leftover after parsing attributes in process `syz.3.268'. [ 188.743528][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.382143][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.605690][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.764945][ T6844] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 190.333816][ C0] vkms_vblank_simulate: vblank timer overrun [ 190.632006][ T37] audit: type=1400 audit(1758500320.919:4): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=6846 comm="syz.0.273" src=1 dest=20000 netif=wpan0 [ 191.318372][ C0] vkms_vblank_simulate: vblank timer overrun [ 191.412029][ T991] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 191.566200][ T991] usb 2-1: Using ep0 maxpacket: 32 [ 191.569644][ T991] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 191.569658][ T991] usb 2-1: config 0 has no interface number 0 [ 191.604223][ T991] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 191.604263][ T991] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.604282][ T991] usb 2-1: Product: syz [ 191.604296][ T991] usb 2-1: Manufacturer: syz [ 191.604309][ T991] usb 2-1: SerialNumber: syz [ 191.690594][ T991] usb 2-1: config 0 descriptor?? [ 191.808284][ T991] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 191.808314][ T991] usb 2-1: selecting invalid altsetting 1 [ 191.808329][ T991] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 191.966027][ T991] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 191.966866][ T991] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 191.966945][ T991] usb 2-1: media controller created [ 191.982290][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 192.139968][ T991] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 192.143892][ T5953] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 192.195161][ T9] usb 3-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 192.195185][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.195195][ T9] usb 3-1: Product: syz [ 192.195203][ T9] usb 3-1: Manufacturer: syz [ 192.195210][ T9] usb 3-1: SerialNumber: syz [ 192.237576][ T9] usb 3-1: config 0 descriptor?? [ 192.293894][ T5953] usb 1-1: config 0 has an invalid interface number: 93 but max is 0 [ 192.293912][ T5953] usb 1-1: config 0 has no interface number 0 [ 192.297347][ T5953] usb 1-1: New USB device found, idVendor=10b8, idProduct=1bb4, bcdDevice=34.65 [ 192.297363][ T5953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.297373][ T5953] usb 1-1: Product: syz [ 192.297380][ T5953] usb 1-1: Manufacturer: syz [ 192.297432][ T5953] usb 1-1: SerialNumber: syz [ 192.360086][ T5953] usb 1-1: config 0 descriptor?? [ 192.404398][ T991] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 192.405623][ T991] zl10353_read_register: readreg error (reg=127, ret==-71) [ 192.447550][ T991] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 192.623028][ T5953] dvb-usb: found a 'DiBcom TFE7090PVR reference design' in warm state. [ 193.512821][ T5953] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 193.521431][ T5953] dvbdev: DVB: registering new adapter (DiBcom TFE7090PVR reference design) [ 193.523176][ T5953] usb 1-1: media controller created [ 194.083686][ T9] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 194.084275][ T9] asix 3-1:0.0: probe with driver asix failed with error -71 [ 194.090755][ T5953] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 194.273635][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.273708][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.335796][ T9] usb 3-1: USB disconnect, device number 5 [ 194.364565][ T991] usb 2-1: USB disconnect, device number 6 [ 194.444817][ T5953] DVB: Unable to find symbol dib7000p_attach() [ 194.444847][ T5953] dvb-usb: no frontend was attached by 'DiBcom TFE7090PVR reference design' [ 194.444859][ T5953] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 194.445667][ T5953] dvbdev: DVB: registering new adapter (DiBcom TFE7090PVR reference design) [ 194.445724][ T5953] usb 1-1: media controller created [ 194.449626][ T5953] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 194.511484][ T5953] dib0700: the master dib7090 has to be initialized first [ 194.511498][ T5953] dvb-usb: no frontend was attached by 'DiBcom TFE7090PVR reference design' [ 194.664224][ T5953] rc_core: IR keymap rc-dib0700-rc5 not found [ 194.664256][ T5953] Registered IR keymap rc-empty [ 194.664901][ T5953] dvb-usb: could not initialize remote control. [ 194.664912][ T5953] dvb-usb: DiBcom TFE7090PVR reference design successfully initialized and connected. [ 194.942041][ T44] usb 1-1: USB disconnect, device number 6 [ 195.059306][ T44] dvb-usb: DiBcom TFE7090PVR reference design successfully deinitialized and disconnected. [ 195.312537][ T31] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 195.514423][ T6889] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 196.245654][ T31] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 196.245681][ T31] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 196.245699][ T31] usb 3-1: config 0 has no interface number 0 [ 196.245748][ T31] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 196.245770][ T31] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 196.252121][ T31] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 196.252149][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.252168][ T31] usb 3-1: Product: syz [ 196.252182][ T31] usb 3-1: Manufacturer: syz [ 196.252194][ T31] usb 3-1: SerialNumber: syz [ 196.259446][ T31] usb 3-1: config 0 descriptor?? [ 197.674541][ T31] usbtouchscreen 3-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 197.718139][ T31] usb 3-1: USB disconnect, device number 6 [ 197.862466][ T6901] tipc: Started in network mode [ 197.862493][ T6901] tipc: Node identity 8, cluster identity 4711 [ 197.862506][ T6901] tipc: Node number set to 8 [ 198.004607][ T6904] netlink: 452 bytes leftover after parsing attributes in process `syz.1.290'. [ 201.012940][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 201.165891][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 201.168583][ T9] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 201.168640][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 201.168667][ T9] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 201.168692][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 201.168716][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 201.170137][ T9] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 201.170185][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 201.170211][ T9] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 201.170235][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 201.170259][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 201.232093][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 201.233244][ T9] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 201.233301][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 201.233387][ T9] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 201.233417][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 201.233442][ T9] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 201.275935][ T9] usb 1-1: string descriptor 0 read error: -22 [ 201.276092][ T9] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 201.276114][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.479411][ T6923] fuse: Unknown parameter '0x0000000000000005' [ 202.148917][ T10] usb 4-1: device descriptor read/all, error -71 [ 202.213549][ T9] usb 1-1: can't set config #168, error -71 [ 202.267920][ T9] usb 1-1: USB disconnect, device number 7 [ 202.778594][ T6937] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 203.091764][ T5154] Bluetooth: hci1: command 0x0406 tx timeout [ 203.298703][ T5844] Bluetooth: hci3: command 0x0406 tx timeout [ 203.298762][ T5154] Bluetooth: hci2: command 0x0406 tx timeout [ 206.106089][ T6930] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 206.241368][ T6930] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 206.593372][ T44] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 206.770524][ T6952] netlink: 452 bytes leftover after parsing attributes in process `syz.0.304'. [ 206.868783][ T44] usb 3-1: Using ep0 maxpacket: 16 [ 207.629148][ T44] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.629240][ T44] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 207.629267][ T44] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 207.629325][ T44] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 207.629378][ T44] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 207.653255][ T44] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 207.653284][ T44] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 207.653337][ T44] usb 3-1: Manufacturer: syz [ 207.915913][ T44] usb 3-1: config 0 descriptor?? [ 207.933650][ T9] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 208.092101][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 208.094481][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.094510][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 208.094547][ T9] usb 5-1: New USB device found, idVendor=172f, idProduct=0034, bcdDevice= 0.00 [ 208.094570][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.106523][ T9] usb 5-1: config 0 descriptor?? [ 209.113323][ T5953] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 209.362725][ T5953] usb 4-1: Using ep0 maxpacket: 8 [ 209.371487][ T5953] usb 4-1: unable to get BOS descriptor or descriptor too short [ 209.472595][ T5953] usb 4-1: config 4 interface 0 has no altsetting 0 [ 209.495999][ T5953] usb 4-1: string descriptor 0 read error: -22 [ 209.496145][ T5953] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 209.496167][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.548016][ T5953] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 209.562094][ T44] rc_core: IR keymap rc-hauppauge not found [ 209.562113][ T44] Registered IR keymap rc-empty [ 209.562893][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 209.564588][ T9] waltop 0003:172F:0034.000B: item fetching failed at offset 0/2 [ 209.565474][ T9] waltop 0003:172F:0034.000B: probe with driver waltop failed with error -22 [ 209.582122][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 209.618853][ T44] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 209.638343][ T5953] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 209.638843][ T5953] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 209.638890][ T5953] usb 4-1: media controller created [ 209.713213][ T5953] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 209.763845][ T6959] usb 4-1: dvb_usb_au6610: wlen=0, aborting [ 209.779271][ T5953] zl10353_read_register: readreg error (reg=127, ret==0) [ 209.846526][ T5953] usb 4-1: USB disconnect, device number 4 [ 209.934065][ T991] usb 5-1: USB disconnect, device number 5 [ 210.164551][ T6969] fuse: Unknown parameter '0x0000000000000005' [ 211.095925][ T5843] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 211.384613][ T44] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input8 [ 211.686716][ T5843] usb 2-1: device not accepting address 7, error -71 [ 211.963533][ T6985] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 212.054230][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.118968][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.161145][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.231616][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.302150][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.658170][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.672149][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.692288][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.712166][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 212.733134][ T44] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 213.953559][ T44] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 213.953575][ T44] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 214.036813][ T44] usb 3-1: USB disconnect, device number 7 [ 214.480026][ T7001] netlink: 452 bytes leftover after parsing attributes in process `syz.3.317'. [ 215.662168][ T991] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 215.662434][ C0] raw-gadget.1 gadget.0: ignoring, device is not running [ 215.808465][ T991] usb 1-1: device descriptor read/64, error -32 [ 216.073880][ T991] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 216.090132][ T44] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 216.278874][ T44] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.278907][ T44] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 216.279026][ T44] usb 3-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 216.279096][ T44] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.432513][ T44] usb 3-1: config 0 descriptor?? [ 216.468534][ T991] usb 1-1: Using ep0 maxpacket: 8 [ 216.965923][ T991] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 216.965973][ T991] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 216.965995][ T991] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.051666][ T991] usb 1-1: config 0 descriptor?? [ 217.369892][ T44] ortek 0003:1223:3F07.000C: unknown main item tag 0x3 [ 217.369914][ T44] ortek 0003:1223:3F07.000C: item fetching failed at offset 48/69 [ 217.477819][ T7030] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 218.261610][ T44] ortek 0003:1223:3F07.000C: probe with driver ortek failed with error -22 [ 218.305153][ T44] usb 3-1: USB disconnect, device number 8 [ 219.055444][ T7034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.328'. [ 219.055470][ T7034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.328'. [ 219.194874][ T991] usbhid 1-1:0.0: can't add hid device: -71 [ 219.195205][ T991] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 219.400041][ T991] usb 1-1: USB disconnect, device number 9 [ 220.186029][ T7044] netlink: 452 bytes leftover after parsing attributes in process `syz.0.331'. [ 221.399453][ T7057] netlink: 452 bytes leftover after parsing attributes in process `syz.1.337'. [ 222.006871][ T7060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.336'. [ 222.006918][ T7060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.336'. [ 222.931616][ T7071] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 223.545586][ T1803] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 223.712225][ T1803] usb 3-1: Using ep0 maxpacket: 16 [ 223.834160][ T1803] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.834195][ T1803] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 223.834238][ T1803] usb 3-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00 [ 223.834260][ T1803] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.665643][ T1803] usb 3-1: config 0 descriptor?? [ 225.754707][ T1803] usb 3-1: can't set config #0, error -71 [ 225.760033][ T1803] usb 3-1: USB disconnect, device number 9 [ 228.386150][ T7095] netlink: 8 bytes leftover after parsing attributes in process `syz.3.344'. [ 228.386167][ T7095] netlink: 8 bytes leftover after parsing attributes in process `syz.3.344'. [ 228.452089][ T44] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 228.723241][ T5851] Bluetooth: hci4: command 0x0405 tx timeout [ 228.744857][ T44] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 228.744884][ T44] usb 2-1: config 0 has no interface number 0 [ 228.744932][ T44] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 228.744955][ T44] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 228.744980][ T44] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 228.745004][ T44] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 228.745028][ T44] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 228.745053][ T44] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 228.745092][ T44] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 228.745113][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.750836][ T44] usb 2-1: config 0 descriptor?? [ 228.752329][ T7097] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 228.755051][ T7097] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 229.089740][ T7108] netlink: 452 bytes leftover after parsing attributes in process `syz.3.350'. [ 229.465191][ T44] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 229.488971][ T44] usb 2-1: USB disconnect, device number 9 [ 229.617016][ T44] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 230.196875][ T7116] netlink: 452 bytes leftover after parsing attributes in process `syz.2.351'. [ 236.316538][ T7145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.360'. [ 236.316554][ T7145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.360'. [ 236.955352][ T7155] netlink: 452 bytes leftover after parsing attributes in process `syz.2.363'. [ 238.000859][ T7158] netlink: 8 bytes leftover after parsing attributes in process `syz.3.364'. [ 238.000876][ T7158] netlink: 8 bytes leftover after parsing attributes in process `syz.3.364'. [ 238.562224][ T7167] netlink: 452 bytes leftover after parsing attributes in process `syz.2.366'. [ 239.210510][ T5851] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 240.008140][ T5851] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 240.035702][ T5851] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 240.038893][ T5851] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 240.039769][ T5851] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 242.662345][ T5851] Bluetooth: hci5: command tx timeout [ 243.290204][ T7205] pimreg: entered allmulticast mode [ 243.680296][ T7209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.374'. [ 243.680372][ T7209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.374'. [ 243.822297][ T1803] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 243.904639][ T7205] pimreg: left allmulticast mode [ 244.147455][ T7214] netlink: 452 bytes leftover after parsing attributes in process `syz.2.377'. [ 244.454524][ T1803] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 244.454562][ T1803] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.454582][ T1803] usb 4-1: Product: syz [ 244.454595][ T1803] usb 4-1: Manufacturer: syz [ 244.454609][ T1803] usb 4-1: SerialNumber: syz [ 244.509665][ T7171] chnl_net:caif_netlink_parms(): no params data found [ 244.687133][ T1803] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 244.723639][ T5851] Bluetooth: hci5: command tx timeout [ 244.780516][ T31] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 245.379726][ T7228] netlink: 452 bytes leftover after parsing attributes in process `syz.2.381'. [ 245.439286][ T5855] usb 4-1: USB disconnect, device number 5 [ 246.408314][ T31] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 246.409001][ T31] ath9k_htc: Failed to initialize the device [ 246.457278][ T5855] usb 4-1: ath9k_htc: USB layer deinitialized [ 246.802077][ T5851] Bluetooth: hci5: command tx timeout [ 248.882148][ T5851] Bluetooth: hci5: command tx timeout [ 254.197645][ T7254] netlink: 452 bytes leftover after parsing attributes in process `syz.0.388'. [ 255.372439][ T7258] netlink: 8 bytes leftover after parsing attributes in process `syz.2.387'. [ 255.372457][ T7258] netlink: 8 bytes leftover after parsing attributes in process `syz.2.387'. [ 255.537005][ T7264] netlink: 'syz.0.390': attribute type 11 has an invalid length. [ 255.699511][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.699588][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.441849][ T7276] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 257.364129][ T6386] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.582148][ T991] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 258.460937][ T991] usb 4-1: Using ep0 maxpacket: 8 [ 258.732044][ T991] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 258.964181][ T991] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 258.964212][ T991] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.964230][ T991] usb 4-1: Product: syz [ 258.964243][ T991] usb 4-1: Manufacturer: syz [ 258.964255][ T991] usb 4-1: SerialNumber: syz [ 258.970705][ T991] usb 4-1: config 0 descriptor?? [ 259.000237][ T991] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 259.000322][ T991] usb 4-1: setting power ON [ 259.000866][ T991] dvb-usb: bulk message failed: -22 (2/0) [ 259.010133][ T7292] netlink: 452 bytes leftover after parsing attributes in process `syz.2.399'. [ 259.044423][ T991] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 259.049741][ T991] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 259.049810][ T991] usb 4-1: media controller created [ 259.146712][ T991] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 259.206038][ T7281] dvb-usb: bulk message failed: -22 (3/0) [ 259.206054][ T7281] cxusb: i2c wr: len=79 is too big! [ 259.206054][ T7281] [ 259.297729][ T991] usb 4-1: selecting invalid altsetting 6 [ 259.297751][ T991] usb 4-1: digital interface selection failed (-22) [ 259.297765][ T991] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 259.304564][ T991] usb 4-1: setting power OFF [ 259.304699][ T991] dvb-usb: bulk message failed: -22 (2/0) [ 259.304716][ T991] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 259.304727][ T991] (NULL device *): no alternate interface [ 259.441572][ T6386] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.467235][ T991] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 259.499992][ T991] usb 4-1: USB disconnect, device number 6 [ 259.953158][ T7310] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 260.720994][ T7171] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.721153][ T7171] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.721390][ T7171] bridge_slave_0: entered allmulticast mode [ 260.724272][ T7171] bridge_slave_0: entered promiscuous mode [ 260.783537][ T7312] IPv6: NLM_F_CREATE should be specified when creating new route [ 261.129317][ T6386] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.172093][ T1803] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 261.714695][ T7171] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.714804][ T7171] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.769139][ T1803] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 261.769171][ T1803] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 261.769209][ T1803] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 261.769232][ T1803] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.775030][ T7171] bridge_slave_1: entered allmulticast mode [ 261.859901][ T7324] netlink: 452 bytes leftover after parsing attributes in process `syz.2.411'. [ 262.412002][ T7171] bridge_slave_1: entered promiscuous mode [ 262.431158][ T1803] usb 2-1: config 0 descriptor?? [ 262.877390][ T1803] hid-steam 0003:28DE:1142.000D: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 262.943886][ T1803] hid-steam 0003:28DE:1142.000D: Steam wireless receiver connected [ 263.039536][ T1803] hid-steam 0003:28DE:1142.000E: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 263.092340][ T6386] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.095979][ T1803] usb 2-1: USB disconnect, device number 10 [ 263.169554][ T1803] hid-steam 0003:28DE:1142.000D: Steam wireless receiver disconnected [ 263.280031][ T7345] fido_id[7345]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 263.425592][ T7171] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 263.791077][ T7171] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.112067][ T31] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 264.262116][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 264.285409][ T31] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 264.285447][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.337222][ T7171] team0: Port device team_slave_0 added [ 264.352703][ T31] pvrusb2: Hardware description: Terratec Grabster AV400 [ 264.352722][ T31] pvrusb2: ********** [ 264.352731][ T31] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 264.352857][ T31] pvrusb2: Important functionality might not be entirely working. [ 264.352865][ T31] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 264.352873][ T31] pvrusb2: ********** [ 264.490165][ T7171] team0: Port device team_slave_1 added [ 264.572513][ T2367] pvrusb2: Invalid write control endpoint [ 264.794540][ T7352] pvrusb2: Invalid write control endpoint [ 264.811426][ T991] usb 2-1: USB disconnect, device number 11 [ 264.974474][ T2367] pvrusb2: Invalid write control endpoint [ 264.974490][ T2367] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 264.974498][ T2367] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 264.974506][ T2367] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 264.974515][ T2367] pvrusb2: Device being rendered inoperable [ 265.026898][ T2367] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 265.027059][ T2367] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 265.087342][ T2367] pvrusb2: Attached sub-driver cx25840 [ 265.087368][ T2367] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 265.087377][ T2367] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 265.563230][ T7171] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 265.563246][ T7171] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 265.563270][ T7171] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 265.686594][ T7363] netlink: 8 bytes leftover after parsing attributes in process `syz.1.422'. [ 265.686611][ T7363] netlink: 8 bytes leftover after parsing attributes in process `syz.1.422'. [ 265.751163][ T7171] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 265.751178][ T7171] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 265.751201][ T7171] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 266.745386][ T6386] bridge_slave_1: left allmulticast mode [ 266.745809][ T6386] bridge_slave_1: left promiscuous mode [ 266.749326][ T6386] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.918396][ T6386] bridge_slave_0: left allmulticast mode [ 266.918435][ T6386] bridge_slave_0: left promiscuous mode [ 266.919493][ T6386] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.952261][ T31] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 267.102127][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 267.108854][ T31] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 267.108887][ T31] usb 3-1: config 0 has no interface number 0 [ 267.108937][ T31] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 267.108960][ T31] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 267.108984][ T31] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 267.109008][ T31] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 267.109050][ T31] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 267.109309][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.124483][ T31] usb 3-1: config 0 descriptor?? [ 267.226493][ T31] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 267.493256][ T31] usb 3-1: USB disconnect, device number 10 [ 267.521451][ T31] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 270.145467][ T6386] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 270.222939][ T6386] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 270.255281][ T6386] bond0 (unregistering): Released all slaves [ 271.261178][ T6386] bond1 (unregistering): Released all slaves [ 271.642442][ T7171] hsr_slave_0: entered promiscuous mode [ 271.643823][ T7171] hsr_slave_1: entered promiscuous mode [ 271.644775][ T7171] debugfs: 'hsr0' already exists in 'hsr' [ 271.644798][ T7171] Cannot create hsr debugfs directory [ 271.650346][ T6386] tipc: Left network mode [ 273.292179][ T1803] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 273.445697][ T1803] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 273.445719][ T1803] usb 2-1: config 0 has no interface number 0 [ 273.447055][ T7409] netlink: 452 bytes leftover after parsing attributes in process `syz.3.437'. [ 273.448655][ T1803] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 273.448670][ T1803] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.448681][ T1803] usb 2-1: Product: syz [ 273.448688][ T1803] usb 2-1: Manufacturer: syz [ 273.448696][ T1803] usb 2-1: SerialNumber: syz [ 273.599825][ T1803] usb 2-1: config 0 descriptor?? [ 274.018278][ T1803] usb 2-1: Firmware: major: 177, minor: 79, hardware type: HULUSB (4) [ 274.283783][ T1803] usb 2-1: failed to fetch extended address, random address set [ 275.042822][ T59] Bluetooth: hci5: command 0x0405 tx timeout [ 275.374133][ T7422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.440'. [ 275.374149][ T7422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.440'. [ 275.700506][ T7426] netlink: 8 bytes leftover after parsing attributes in process `syz.1.442'. [ 275.887596][ T1803] usb 2-1: USB disconnect, device number 12 [ 276.042052][ T44] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 276.192068][ T44] usb 4-1: Using ep0 maxpacket: 8 [ 276.196770][ T44] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 276.196794][ T44] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 276.196840][ T44] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 276.196914][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.334672][ T44] hub 4-1:1.0: bad descriptor, ignoring hub [ 276.334713][ T44] hub 4-1:1.0: probe with driver hub failed with error -5 [ 276.469340][ T7428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.494355][ T7428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.510377][ T7428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.510932][ T7428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.517249][ T59] Bluetooth: hci3: Unknown advertising packet type: 0x5f [ 276.632590][ T44] usb 4-1: USB disconnect, device number 7 [ 276.871868][ T6386] hsr_slave_0: left promiscuous mode [ 276.907277][ T7441] netlink: 452 bytes leftover after parsing attributes in process `syz.2.447'. [ 276.946199][ T6386] hsr_slave_1: left promiscuous mode [ 276.947609][ T6386] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 276.947698][ T6386] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 277.012515][ T6386] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 277.012549][ T6386] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 277.319145][ T6386] veth1_macvtap: left promiscuous mode [ 277.319410][ T6386] veth0_macvtap: left promiscuous mode [ 277.319736][ T6386] veth1_vlan: left promiscuous mode [ 277.342515][ T6386] veth0_vlan: left promiscuous mode [ 279.753013][ T7449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.451'. [ 279.753029][ T7449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.451'. [ 280.037587][ T5851] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 280.058845][ T5851] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 280.079597][ T5851] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 280.089575][ T5851] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 280.112141][ T5851] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 280.203513][ T991] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 280.404737][ T991] usb 3-1: Using ep0 maxpacket: 32 [ 280.406766][ T991] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 280.406793][ T991] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.432376][ T991] usb 3-1: config 0 descriptor?? [ 280.664554][ T991] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 280.681620][ T991] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 280.685810][ T991] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 280.685867][ T991] usb 3-1: media controller created [ 280.738048][ T991] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 280.885419][ T7455] az6027: more than 2 i2c messages at a time is not handled yet. TODO. [ 280.891864][ T991] az6027: usb out operation failed. (-71) [ 280.892444][ T991] az6027: usb out operation failed. (-71) [ 280.892457][ T991] stb0899_attach: Driver disabled by Kconfig [ 280.892465][ T991] az6027: no front-end attached [ 280.892465][ T991] [ 280.892969][ T991] az6027: usb out operation failed. (-71) [ 280.892981][ T991] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 280.896457][ T991] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input9 [ 280.903838][ T991] dvb-usb: schedule remote query interval to 400 msecs. [ 280.903860][ T991] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 280.907190][ T991] usb 3-1: USB disconnect, device number 11 [ 281.006173][ T7407] udevd[7407]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 281.130604][ T991] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 282.052875][ T6386] team0 (unregistering): Port device team_slave_1 removed [ 282.242095][ T59] Bluetooth: hci4: command tx timeout [ 282.263040][ T6386] team0 (unregistering): Port device team_slave_0 removed [ 282.746512][ T44] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 282.892055][ T44] usb 3-1: Using ep0 maxpacket: 32 [ 282.895490][ T44] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.895523][ T44] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.895536][ T44] usb 3-1: config 0 interface 0 has no altsetting 0 [ 282.896650][ T44] usb 3-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 282.896672][ T44] usb 3-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 282.896683][ T44] usb 3-1: Product: syz [ 282.900459][ T44] usb 3-1: config 0 descriptor?? [ 283.317063][ T44] waterforce 0003:1044:7A4D.000F: unknown main item tag 0x0 [ 283.317100][ T44] waterforce 0003:1044:7A4D.000F: unknown main item tag 0x0 [ 283.317127][ T44] waterforce 0003:1044:7A4D.000F: item fetching failed at offset 2/5 [ 283.317910][ T44] waterforce 0003:1044:7A4D.000F: hid parse failed with -22 [ 283.318013][ T44] waterforce 0003:1044:7A4D.000F: probe with driver waterforce failed with error -22 [ 283.518003][ T31] usb 3-1: USB disconnect, device number 12 [ 284.165829][ T37] audit: type=1326 audit(1758500414.459:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.165885][ T37] audit: type=1326 audit(1758500414.459:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d1075ec29 code=0x7ffc0000 [ 284.169085][ T37] audit: type=1326 audit(1758500414.459:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d1075ec29 code=0x7ffc0000 [ 284.169554][ T37] audit: type=1326 audit(1758500414.459:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.169956][ T37] audit: type=1326 audit(1758500414.459:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.170354][ T37] audit: type=1326 audit(1758500414.459:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.170754][ T37] audit: type=1326 audit(1758500414.459:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.171152][ T37] audit: type=1326 audit(1758500414.459:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.171547][ T37] audit: type=1326 audit(1758500414.459:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.188629][ T37] audit: type=1326 audit(1758500414.459:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7465 comm="syz.2.457" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d106fae09 code=0x7ffc0000 [ 284.332069][ T59] Bluetooth: hci4: command tx timeout [ 284.529582][ T7468] ======================================================= [ 284.529582][ T7468] WARNING: The mand mount option has been deprecated and [ 284.529582][ T7468] and is ignored by this kernel. Remove the mand [ 284.529582][ T7468] option from the mount to silence this warning. [ 284.529582][ T7468] ======================================================= [ 286.402690][ T59] Bluetooth: hci4: command tx timeout [ 286.689487][ T7471] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 286.843393][ T5953] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 287.012777][ T5953] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 287.012810][ T5953] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 287.012852][ T5953] usb 4-1: New USB device found, idVendor=06a3, idProduct=0ccd, bcdDevice= 0.00 [ 287.012874][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.085510][ T5953] usb 4-1: config 0 descriptor?? [ 287.089575][ T7487] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 287.596553][ T5953] saitek 0003:06A3:0CCD.0010: item fetching failed at offset 0/2 [ 287.597378][ T5953] saitek 0003:06A3:0CCD.0010: parse failed [ 287.597478][ T5953] saitek 0003:06A3:0CCD.0010: probe with driver saitek failed with error -22 [ 288.280084][ T31] usb 4-1: USB disconnect, device number 8 [ 288.441203][ T7171] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 288.482003][ T59] Bluetooth: hci4: command tx timeout [ 288.536850][ T7171] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 288.642013][ T7171] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 288.769452][ T7171] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 288.962157][ T7519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.473'. [ 290.316706][ T7543] netlink: 452 bytes leftover after parsing attributes in process `syz.1.477'. [ 292.491392][ T7561] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 292.992516][ T7569] netlink: 8 bytes leftover after parsing attributes in process `syz.2.486'. [ 292.992543][ T7569] netlink: 8 bytes leftover after parsing attributes in process `syz.2.486'. [ 293.312804][ T991] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 293.347718][ T7579] netlink: 452 bytes leftover after parsing attributes in process `syz.3.489'. [ 293.742066][ T991] usb 2-1: Using ep0 maxpacket: 8 [ 293.872043][ T991] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 293.872073][ T991] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.881245][ T6386] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.949379][ T991] pvrusb2: Hardware description: Terratec Grabster AV400 [ 293.949396][ T991] pvrusb2: ********** [ 293.949403][ T991] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 293.949413][ T991] pvrusb2: Important functionality might not be entirely working. [ 293.949422][ T991] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 293.949432][ T991] pvrusb2: ********** [ 294.535035][ T2367] pvrusb2: Invalid write control endpoint [ 294.638009][ T7456] chnl_net:caif_netlink_parms(): no params data found [ 294.752540][ T7574] pvrusb2: Invalid write control endpoint [ 294.762033][ T9] usb 2-1: USB disconnect, device number 13 [ 294.858501][ T2367] pvrusb2: Invalid write control endpoint [ 294.858516][ T2367] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 294.858524][ T2367] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 294.858532][ T2367] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 294.858540][ T2367] pvrusb2: Device being rendered inoperable [ 294.858609][ T2367] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 294.858669][ T2367] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 295.088566][ T2367] pvrusb2: Attached sub-driver cx25840 [ 295.088583][ T2367] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 295.088592][ T2367] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 296.899605][ T7606] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 297.225629][ T7609] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 297.563968][ T6386] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.702384][ T7612] program syz.1.498 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 297.741560][ T7615] loop5: detected capacity change from 0 to 524255232 [ 298.218933][ T7619] netlink: 452 bytes leftover after parsing attributes in process `syz.3.500'. [ 298.983288][ T7631] netlink: 452 bytes leftover after parsing attributes in process `syz.3.502'. [ 299.588888][ T6386] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.467684][ T7646] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 304.125992][ T5851] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 305.174342][ T5851] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 305.176211][ T5851] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 305.178210][ T5851] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 305.179929][ T5851] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 311.131963][ T5851] Bluetooth: hci2: command tx timeout [ 314.469186][ T5851] Bluetooth: hci2: command tx timeout [ 317.221951][ C1] sched: DL replenish lagged too much [ 317.237704][ T5851] Bluetooth: hci2: command tx timeout [ 317.262157][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.262232][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.282754][ T5851] Bluetooth: hci2: command tx timeout [ 324.582439][ T5953] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 324.724093][ T59] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 324.743415][ T5953] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 324.743439][ T5953] usb 3-1: config 0 has no interface number 0 [ 324.746644][ T5953] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 324.746670][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.746688][ T5953] usb 3-1: Product: syz [ 324.746700][ T5953] usb 3-1: Manufacturer: syz [ 324.746714][ T5953] usb 3-1: SerialNumber: syz [ 324.775120][ T59] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 324.816341][ T59] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 324.817705][ T59] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 324.838383][ T59] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 324.883766][ T5953] usb 3-1: config 0 descriptor?? [ 325.132776][ T5953] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 325.137147][ T5953] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 325.137548][ T5953] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 325.137597][ T5953] usb 3-1: media controller created [ 325.235556][ T5953] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 326.345020][ T5953] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 326.483144][ T5953] usb 3-1: USB disconnect, device number 13 [ 326.963741][ T59] Bluetooth: hci5: command tx timeout [ 329.042175][ T59] Bluetooth: hci5: command tx timeout [ 331.122068][ T59] Bluetooth: hci5: command tx timeout [ 333.576512][ T59] Bluetooth: hci5: command tx timeout [ 337.947024][ T6386] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.844384][ T5851] Bluetooth: hci5: command 0x0405 tx timeout [ 345.012312][ T6066] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 345.172153][ T6066] usb 3-1: Using ep0 maxpacket: 8 [ 345.177281][ T6066] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 345.177306][ T6066] usb 3-1: config 179 has no interface number 0 [ 345.177358][ T6066] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 345.177384][ T6066] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 345.177409][ T6066] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 345.177433][ T6066] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 345.177459][ T6066] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 345.177501][ T6066] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 345.177522][ T6066] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.320559][ T7741] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 378.581810][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.583140][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 396.986248][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 396.986323][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 397.052967][ T10] usb 3-1: USB disconnect, device number 14 [ 397.708365][ T5851] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 397.734056][ T5851] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 397.735225][ T5851] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 397.736410][ T5851] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 397.767567][ T5851] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 399.842232][ T5851] Bluetooth: hci3: command tx timeout [ 401.923517][ T5851] Bluetooth: hci3: command tx timeout [ 402.783092][ T5838] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 402.832405][ T5838] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 402.855696][ T5838] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 402.857371][ T5838] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 402.858171][ T5838] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 403.176890][ T5154] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 403.208284][ T5154] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 403.215236][ T5154] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 403.216488][ T5154] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 403.217313][ T5154] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 403.367986][ T5844] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 403.384515][ T5844] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 403.386037][ T5844] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 403.387465][ T5844] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 403.388304][ T5844] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 403.624210][ T7777] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 403.646237][ T7777] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 403.647434][ T7777] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 403.648657][ T7777] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 403.649470][ T7777] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 403.865942][ T7779] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 403.884252][ T7779] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 403.889091][ T7779] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 403.890492][ T7779] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 403.891367][ T7779] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 404.002067][ T7779] Bluetooth: hci3: command tx timeout [ 406.082223][ T7779] Bluetooth: hci3: command tx timeout [ 413.026883][ T5154] Bluetooth: hci8: command tx timeout [ 415.042183][ T5154] Bluetooth: hci7: command tx timeout [ 415.042622][ T5154] Bluetooth: hci8: command tx timeout [ 415.042741][ T5154] Bluetooth: hci10: command tx timeout [ 415.042903][ T5154] Bluetooth: hci6: command tx timeout [ 415.043058][ T5154] Bluetooth: hci9: command tx timeout [ 417.123352][ T5838] Bluetooth: hci6: command tx timeout [ 417.123384][ T5838] Bluetooth: hci8: command tx timeout [ 417.123405][ T5838] Bluetooth: hci9: command tx timeout [ 417.123425][ T5838] Bluetooth: hci10: command tx timeout [ 417.123453][ T5838] Bluetooth: hci7: command tx timeout [ 419.202113][ T5838] Bluetooth: hci8: command tx timeout [ 419.202145][ T5838] Bluetooth: hci10: command tx timeout [ 419.202165][ T5838] Bluetooth: hci7: command tx timeout [ 419.202184][ T5838] Bluetooth: hci9: command tx timeout [ 419.202203][ T5838] Bluetooth: hci6: command tx timeout [ 421.282237][ T5154] Bluetooth: hci6: command tx timeout [ 421.282270][ T5154] Bluetooth: hci7: command tx timeout [ 421.282290][ T5154] Bluetooth: hci10: command tx timeout [ 421.282349][ T5838] Bluetooth: hci9: command tx timeout [ 431.851250][ T5838] Bluetooth: hci2: command 0x0406 tx timeout [ 440.008077][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.008155][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 447.213648][ T59] Bluetooth: hci5: command 0x0405 tx timeout [ 463.883466][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 463.904840][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 463.907015][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 463.908439][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 463.909853][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 464.013829][ T5154] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 464.032703][ T5154] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 464.033937][ T5154] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 464.035260][ T5154] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 464.036140][ T5154] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 464.235635][ T7777] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 464.254304][ T7777] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 464.257567][ T7777] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 464.258834][ T7777] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 464.259713][ T7777] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 464.353123][ T5851] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 464.361073][ T5851] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 464.378322][ T5851] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 464.379548][ T5851] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 464.380384][ T5851] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 464.724069][ T5844] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 464.762264][ T5844] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 464.763616][ T5844] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 464.764803][ T5844] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 464.766009][ T5844] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 473.064959][ T7777] Bluetooth: hci11: command tx timeout [ 475.122217][ T5844] Bluetooth: hci11: command tx timeout [ 475.122592][ T5844] Bluetooth: hci12: command tx timeout [ 475.122794][ T5844] Bluetooth: hci4: command tx timeout [ 475.122969][ T5844] Bluetooth: hci0: command tx timeout [ 475.123162][ T5844] Bluetooth: hci1: command tx timeout [ 477.202202][ T5844] Bluetooth: hci1: command tx timeout [ 477.202232][ T5844] Bluetooth: hci0: command tx timeout [ 477.202252][ T5844] Bluetooth: hci4: command tx timeout [ 477.202272][ T5844] Bluetooth: hci12: command tx timeout [ 477.202290][ T5844] Bluetooth: hci11: command tx timeout [ 479.282246][ T7777] Bluetooth: hci12: command tx timeout [ 479.282277][ T7777] Bluetooth: hci4: command tx timeout [ 479.282297][ T7777] Bluetooth: hci0: command tx timeout [ 479.282316][ T7777] Bluetooth: hci1: command tx timeout [ 479.321100][ T5844] Bluetooth: hci11: command tx timeout [ 481.362087][ T7777] Bluetooth: hci1: command tx timeout [ 481.362118][ T7777] Bluetooth: hci4: command tx timeout [ 481.362138][ T7777] Bluetooth: hci12: command tx timeout [ 481.362197][ T5844] Bluetooth: hci0: command tx timeout [ 501.449977][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.450055][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.362677][ T38] INFO: task kworker/u8:17:6386 blocked for more than 143 seconds. [ 503.362705][ T38] Not tainted syzkaller #0 [ 503.362715][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 503.362727][ T38] task:kworker/u8:17 state:D stack:23176 pid:6386 tgid:6386 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 503.362844][ T38] Workqueue: netns cleanup_net [ 503.362886][ T38] Call Trace: [ 503.362893][ T38] [ 503.362906][ T38] __schedule+0x16f3/0x4c20 [ 503.362956][ T38] ? __lock_acquire+0xab9/0xd20 [ 503.362980][ T38] ? __pfx___schedule+0x10/0x10 [ 503.363020][ T38] ? schedule+0x91/0x360 [ 503.363047][ T38] schedule+0x165/0x360 [ 503.363072][ T38] schedule_timeout+0x9a/0x270 [ 503.363095][ T38] ? __pfx_schedule_timeout+0x10/0x10 [ 503.363130][ T38] ? _raw_spin_unlock_irq+0x23/0x50 [ 503.363154][ T38] ? lockdep_hardirqs_on+0x9c/0x150 [ 503.363175][ T38] ? wait_for_completion+0x267/0x5d0 [ 503.363201][ T38] wait_for_completion+0x2bf/0x5d0 [ 503.363239][ T38] ? __pfx_wait_for_completion+0x10/0x10 [ 503.363275][ T38] ? __init_swait_queue_head+0xa9/0x150 [ 503.363301][ T38] rcu_barrier+0x463/0x570 [ 503.363331][ T38] netdev_run_todo+0x327/0xea0 [ 503.363358][ T38] ? __pfx_netdev_run_todo+0x10/0x10 [ 503.363375][ T38] ? kasan_quarantine_put+0xdd/0x220 [ 503.363395][ T38] ? lockdep_hardirqs_on+0x9c/0x150 [ 503.363425][ T38] ? kfree+0x195/0x550 [ 503.363451][ T38] nsim_destroy+0x3a6/0x670 [ 503.363480][ T38] __nsim_dev_port_del+0x14d/0x1b0 [ 503.363507][ T38] nsim_dev_reload_destroy+0x288/0x490 [ 503.363535][ T38] nsim_dev_reload_down+0x8a/0xc0 [ 503.363560][ T38] devlink_reload+0x1b6/0x8d0 [ 503.363584][ T38] ? xa_get_mark+0x67/0x7b0 [ 503.363607][ T38] ? __pfx_devlink_reload+0x10/0x10 [ 503.363625][ T38] ? xa_get_mark+0x70f/0x7b0 [ 503.363658][ T38] devlink_pernet_pre_exit+0x1d9/0x3d0 [ 503.363681][ T38] ? __pfx_devlink_pernet_pre_exit+0x10/0x10 [ 503.363708][ T38] ? class_remove_file_ns+0x124/0x160 [ 503.363734][ T38] ops_undo_list+0x184/0x990 [ 503.363765][ T38] ? __pfx_ops_undo_list+0x10/0x10 [ 503.363799][ T38] cleanup_net+0x4cb/0x800 [ 503.363826][ T38] ? __pfx_cleanup_net+0x10/0x10 [ 503.363851][ T38] ? _raw_spin_unlock_irq+0x23/0x50 [ 503.363874][ T38] ? process_scheduled_works+0x9ef/0x17b0 [ 503.363895][ T38] ? process_scheduled_works+0x9ef/0x17b0 [ 503.363918][ T38] process_scheduled_works+0xade/0x17b0 [ 503.363970][ T38] ? __pfx_process_scheduled_works+0x10/0x10 [ 503.364010][ T38] worker_thread+0x8a0/0xda0 [ 503.364034][ T38] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 503.364068][ T38] ? __kthread_parkme+0x7b/0x200 [ 503.364101][ T38] kthread+0x70e/0x8a0 [ 503.364128][ T38] ? __pfx_worker_thread+0x10/0x10 [ 503.364149][ T38] ? __pfx_kthread+0x10/0x10 [ 503.364177][ T38] ? __rcu_read_unlock+0x84/0xe0 [ 503.364196][ T38] ? __pfx_kthread+0x10/0x10 [ 503.364220][ T38] ret_from_fork+0x436/0x7d0 [ 503.364246][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 503.364279][ T38] ? __switch_to_asm+0x39/0x70 [ 503.364296][ T38] ? __switch_to_asm+0x33/0x70 [ 503.364312][ T38] ? __pfx_kthread+0x10/0x10 [ 503.364337][ T38] ret_from_fork_asm+0x1a/0x30 [ 503.364371][ T38] [ 503.364403][ T38] [ 503.364403][ T38] Showing all locks held in the system: [ 503.364413][ T38] 6 locks held by ktimers/1/29: [ 503.364425][ T38] 2 locks held by ksoftirqd/1/30: [ 503.364435][ T38] 1 lock held by khungtaskd/38: [ 503.364445][ T38] #0: ffffffff8d9a8d80 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 503.364490][ T38] 2 locks held by kworker/1:1/44: [ 503.364507][ T38] 2 locks held by kworker/1:2/993: [ 503.364521][ T38] 3 locks held by kworker/u8:9/1332: [ 503.364531][ T38] #0: ffff888019881138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 503.364577][ T38] #1: ffffc90005197bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 503.364621][ T38] #2: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 503.364674][ T38] 2 locks held by dhcpcd/5500: [ 503.364684][ T38] #0: ffff88804e5fa910 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: netlink_dump+0xbd/0xe90 [ 503.364730][ T38] #1: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 [ 503.364775][ T38] 2 locks held by getty/5594: [ 503.364785][ T38] #0: ffff88823bf2c8a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 503.364832][ T38] #1: ffffc90003e762e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1410 [ 503.364878][ T38] 1 lock held by syz-executor/5832: [ 503.364888][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x41/0x1c0 [ 503.364936][ T38] 1 lock held by syz-executor/5834: [ 503.364946][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x41/0x1c0 [ 503.364991][ T38] 1 lock held by syz-executor/5835: [ 503.365001][ T38] #0: ffffffff8d9ae730 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 [ 503.365041][ T38] 2 locks held by kworker/1:4/5843: [ 503.365052][ T38] 3 locks held by kworker/1:5/5846: [ 503.365062][ T38] #0: ffff888019898538 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 503.365107][ T38] #1: ffffc90004c67bc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 503.365150][ T38] #2: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 503.365198][ T38] 3 locks held by kworker/u8:16/6218: [ 503.365209][ T38] #0: ffff88814d4d7138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 503.365253][ T38] #1: ffffc900061c7bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 503.365304][ T38] #2: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 503.365348][ T38] 6 locks held by kworker/u8:17/6386: [ 503.365358][ T38] #0: ffff88801a6f4138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 503.365402][ T38] #1: ffffc9000660fbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 503.365446][ T38] #2: ffffffff8ecc6980 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 503.365491][ T38] #3: ffff88805e42a0d8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x10a/0x3d0 [ 503.365533][ T38] #4: ffff88805e42c300 (&devlink->lock_key#5){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x11c/0x3d0 [ 503.365580][ T38] #5: ffffffff8d9ae730 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 [ 503.365621][ T38] 2 locks held by kworker/u8:19/6763: [ 503.365631][ T38] 1 lock held by syz-executor/7171: [ 503.365641][ T38] #0: ffffffff8d9ae730 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 [ 503.365684][ T38] 1 lock held by syz-executor/7456: [ 503.365693][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x41/0x1c0 [ 503.365740][ T38] 1 lock held by syz-executor/7795: [ 503.365750][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 503.365793][ T38] 1 lock held by syz-executor/7796: [ 503.365803][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 503.365845][ T38] 1 lock held by syz-executor/7797: [ 503.365855][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 503.365897][ T38] 1 lock held by syz-executor/7800: [ 503.365907][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 503.365949][ T38] 1 lock held by syz-executor/7806: [ 503.365959][ T38] #0: ffffffff8ecd3878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 503.366000][ T38] [ 503.366005][ T38] ============================================= [ 503.366005][ T38] [ 503.366021][ T38] NMI backtrace for cpu 0 [ 503.366044][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 503.366091][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 503.366113][ T38] Call Trace: [ 503.366129][ T38] [ 503.366145][ T38] dump_stack_lvl+0x189/0x250 [ 503.366211][ T38] ? __pfx_dump_stack_lvl+0x10/0x10 [ 503.366271][ T38] ? __pfx__printk+0x10/0x10 [ 503.366301][ T38] nmi_cpu_backtrace+0x39e/0x3d0 [ 503.366326][ T38] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 503.366349][ T38] ? __pfx__printk+0x10/0x10 [ 503.366372][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 503.366396][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 503.366420][ T38] watchdog+0xf93/0xfe0 [ 503.366446][ T38] ? watchdog+0x1de/0xfe0 [ 503.366472][ T38] kthread+0x70e/0x8a0 [ 503.366498][ T38] ? __pfx_watchdog+0x10/0x10 [ 503.366517][ T38] ? __pfx_kthread+0x10/0x10 [ 503.366545][ T38] ? __pfx_kthread+0x10/0x10 [ 503.366570][ T38] ret_from_fork+0x436/0x7d0 [ 503.366593][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 503.366620][ T38] ? __switch_to_asm+0x39/0x70 [ 503.366635][ T38] ? __switch_to_asm+0x33/0x70 [ 503.366650][ T38] ? __pfx_kthread+0x10/0x10 [ 503.366675][ T38] ret_from_fork_asm+0x1a/0x30 [ 503.366707][ T38] [ 503.366713][ T38] Sending NMI from CPU 0 to CPUs 1: [ 503.366738][ C1] NMI backtrace for cpu 1 [ 503.366751][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 503.366768][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 503.366781][ C1] RIP: 0010:kasan_check_range+0xe/0x2c0 [ 503.366802][ C1] Code: 0b cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 55 41 57 41 56 41 55 41 54 53 01 48 85 f6 0f 84 ba 01 00 00 4c 8d 04 37 49 39 f8 0f 82 82 02 [ 503.366814][ C1] RSP: 0018:ffffc90000a3e920 EFLAGS: 00000246 [ 503.366828][ C1] RAX: 1ffff92000147d50 RBX: 0000000000000010 RCX: ffffffff8172cd58 [ 503.366839][ C1] RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc90000a3ea98 [ 503.366849][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8172c165 [ 503.366859][ C1] R10: ffffc90000a3ea98 R11: ffffffff81aaf310 R12: ffffc90000a3f680 [ 503.366870][ C1] R13: ffffc90000a3ea98 R14: ffffc90000a3ea98 R15: ffffc90000a3ea90 [ 503.366882][ C1] FS: 0000000000000000(0000) GS:ffff8881269bc000(0000) knlGS:0000000000000000 [ 503.366895][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 503.366905][ C1] CR2: 00007ffdba6abe78 CR3: 0000000087988000 CR4: 00000000003526f0 [ 503.366919][ C1] Call Trace: [ 503.366925][ C1] [ 503.366933][ C1] __asan_memset+0x22/0x50 [ 503.366949][ C1] unwind_next_frame+0xc98/0x2390 [ 503.366970][ C1] ? unwind_next_frame+0xa5/0x2390 [ 503.366988][ C1] ? NF_HOOK+0x206/0x3a0 [ 503.367008][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 503.367029][ C1] arch_stack_walk+0x11c/0x150 [ 503.367050][ C1] ? NF_HOOK+0x30c/0x3a0 [ 503.367069][ C1] stack_trace_save+0x9c/0xe0 [ 503.367083][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 503.367103][ C1] kasan_save_track+0x3e/0x80 [ 503.367118][ C1] ? kasan_save_track+0x3e/0x80 [ 503.367132][ C1] ? __kasan_slab_alloc+0x6c/0x80 [ 503.367147][ C1] ? kmem_cache_alloc_node_noprof+0x14e/0x330 [ 503.367164][ C1] ? __alloc_skb+0x112/0x2d0 [ 503.367181][ C1] ? synproxy_send_client_synack+0x16c/0xe20 [ 503.367199][ C1] ? nft_synproxy_eval_v4+0x36e/0x560 [ 503.367214][ C1] ? nft_synproxy_do_eval+0x345/0x570 [ 503.367228][ C1] ? nft_do_chain+0x409/0x1920 [ 503.367241][ C1] ? nft_do_chain_inet+0x25d/0x340 [ 503.367255][ C1] ? nf_hook_slow+0xc2/0x220 [ 503.367272][ C1] ? NF_HOOK+0x206/0x3a0 [ 503.367310][ C1] __kasan_slab_alloc+0x6c/0x80 [ 503.367326][ C1] ? __alloc_skb+0x112/0x2d0 [ 503.367343][ C1] kmem_cache_alloc_node_noprof+0x14e/0x330 [ 503.367363][ C1] __alloc_skb+0x112/0x2d0 [ 503.367383][ C1] synproxy_send_client_synack+0x16c/0xe20 [ 503.367408][ C1] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 503.367426][ C1] ? nft_synproxy_eval_v4+0x510/0x560 [ 503.367441][ C1] ? synproxy_pernet+0x45/0x270 [ 503.367458][ C1] nft_synproxy_eval_v4+0x36e/0x560 [ 503.367476][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 503.367493][ C1] ? nf_ip_checksum+0x13c/0x510 [ 503.367510][ C1] nft_synproxy_do_eval+0x345/0x570 [ 503.367528][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 503.367543][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 503.367566][ C1] nft_do_chain+0x409/0x1920 [ 503.367588][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 503.367616][ C1] ? try_to_take_rt_mutex+0x840/0xb00 [ 503.367636][ C1] nft_do_chain_inet+0x25d/0x340 [ 503.367651][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 503.367665][ C1] ? __lock_acquire+0xab9/0xd20 [ 503.367686][ C1] ? NF_HOOK+0x9a/0x3a0 [ 503.367704][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 503.367719][ C1] nf_hook_slow+0xc2/0x220 [ 503.367739][ C1] NF_HOOK+0x206/0x3a0 [ 503.367757][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 503.367774][ C1] ? NF_HOOK+0x9a/0x3a0 [ 503.367790][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 503.367806][ C1] ? ip_rcv_finish_core+0xda3/0x1c00 [ 503.367824][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 503.367843][ C1] ? skb_dst+0x4f/0xd0 [ 503.367860][ C1] ? ip_local_deliver+0x12a/0x1b0 [ 503.367878][ C1] NF_HOOK+0x30c/0x3a0 [ 503.367896][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 503.367913][ C1] ? NF_HOOK+0x9a/0x3a0 [ 503.367930][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 503.367948][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 503.367970][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 503.367986][ C1] __netif_receive_skb+0x143/0x380 [ 503.368003][ C1] ? rt_spin_unlock+0x65/0x80 [ 503.368026][ C1] ? process_backlog+0x27b/0x900 [ 503.368043][ C1] process_backlog+0x31e/0x900 [ 503.368066][ C1] __napi_poll+0xb6/0x540 [ 503.368084][ C1] net_rx_action+0x707/0xe00 [ 503.368101][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 503.368127][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 503.368161][ C1] handle_softirqs+0x22f/0x710 [ 503.368182][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 503.368203][ C1] run_ktimerd+0xcf/0x190 [ 503.368220][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 503.368236][ C1] ? schedule+0x91/0x360 [ 503.368257][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 503.368273][ C1] smpboot_thread_fn+0x53f/0xa60 [ 503.368290][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 503.368310][ C1] kthread+0x70e/0x8a0 [ 503.368330][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 503.368346][ C1] ? __pfx_kthread+0x10/0x10 [ 503.368366][ C1] ? __pfx_kthread+0x10/0x10 [ 503.368385][ C1] ret_from_fork+0x436/0x7d0 [ 503.368403][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 503.368422][ C1] ? __switch_to_asm+0x39/0x70 [ 503.368435][ C1] ? __switch_to_asm+0x33/0x70 [ 503.368448][ C1] ? __pfx_kthread+0x10/0x10 [ 503.368466][ C1] ret_from_fork_asm+0x1a/0x30 [ 503.368487][ C1] [ 503.368739][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 503.368752][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 503.368772][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 503.368781][ T38] Call Trace: [ 503.368788][ T38] [ 503.368795][ T38] dump_stack_lvl+0x99/0x250 [ 503.368819][ T38] ? __asan_memcpy+0x40/0x70 [ 503.368838][ T38] ? __pfx_dump_stack_lvl+0x10/0x10 [ 503.368860][ T38] ? __pfx__printk+0x10/0x10 [ 503.368891][ T38] vpanic+0x281/0x750 [ 503.368917][ T38] ? __pfx_vpanic+0x10/0x10 [ 503.368938][ T38] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 503.368956][ T38] ? lockdep_hardirqs_on+0x9c/0x150 [ 503.368989][ T38] panic+0xb9/0xc0 [ 503.369011][ T38] ? __pfx_panic+0x10/0x10 [ 503.369037][ T38] ? irq_work_queue+0xc3/0x140 [ 503.369062][ T38] ? nmi_trigger_cpumask_backtrace+0x234/0x300 [ 503.369086][ T38] watchdog+0xfd2/0xfe0 [ 503.369112][ T38] ? watchdog+0x1de/0xfe0 [ 503.369138][ T38] kthread+0x70e/0x8a0 [ 503.369165][ T38] ? __pfx_watchdog+0x10/0x10 [ 503.369184][ T38] ? __pfx_kthread+0x10/0x10 [ 503.369211][ T38] ? __pfx_kthread+0x10/0x10 [ 503.369236][ T38] ret_from_fork+0x436/0x7d0 [ 503.369265][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 503.369293][ T38] ? __switch_to_asm+0x39/0x70 [ 503.369308][ T38] ? __switch_to_asm+0x33/0x70 [ 503.369324][ T38] ? __pfx_kthread+0x10/0x10 [ 503.369348][ T38] ret_from_fork_asm+0x1a/0x30 [ 503.369380][ T38] [ 503.369633][ T38] Kernel Offset: disabled