last executing test programs: 15.342417085s ago: executing program 0 (id=1177): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a38d", 0x2) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r3, 0xc0984124, &(0x7f0000000300)) r4 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r4, 0x4112, 0x0) 15.342104934s ago: executing program 0 (id=1178): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000003880)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c9f4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75055df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83766b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b556381768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225c380fac12f8205d182f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42ddd5f393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05bea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d96ee1b84bb64b14aebc6b5194c55dd6890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b07838a3ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8dc0d472672286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8455029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a82a6ef09d0ed9829dec16ab67a4f59a504e09f55ab82bbd405087a17a229a149c53ee9145500db213cb36489a10957739e481a756e65bde579bbbfb404213f661eeaaffacbcfbfd60b1a715c366da2b37ac7e9e3033f8ec04db1c2412e02ccd0617d9fb646c4897750d068c936c3558a94b05d7c65c0d458c0d70d0aa864bc1e324d3f69b1b4061627da875a4b5c2668ab0990623fe6f3b54cd1c79da4baf256f88750c18486330589473e267fa44e220cf40db662b570c2a2fbba9a34a3dd7bbd8368fe506daa62b45797d4b397905a69e58eb436c08cc78963197adb1b16ad83a1a9b420e74c6bcdf1ed0b306141a83bf1268e954ad069257fbfaa1a7ea582badc1a7f2a5b0965f3535872d85c0bc3a233a3ea85df6a8ed76f0f803d54b7bef77d8ea71621f8a78dd17c3b58c5c7476ed6191acbb949e77f7cac81c543f7751e5e1000"/4545], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000200)={@ifindex, r0, 0x2f}, 0x20) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000001c0)={0x0, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001580)={@fallback=r0, r2, 0x2f, 0x2030, 0x4, @void, @void, @value=r3}, 0x20) 15.325542725s ago: executing program 0 (id=1179): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 14.865956052s ago: executing program 0 (id=1182): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r5 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain={'key_or_keyring:', r5}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r9, 0x402, 0x80000034) close(r8) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r10, {0x8, 0x7}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0xffa, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x26044028}, 0x800) 13.854517296s ago: executing program 0 (id=1185): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x9, 0x0, 0x3, 0xfffffffd}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r2, {0x10}, {0x6}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x880) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f0000000140)={&(0x7f00000001c0)=@xdp={0x2c, 0xa888, r8, 0xb}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000340)='f', 0x1}], 0x1}, 0x857) 13.081965998s ago: executing program 3 (id=1191): bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TLS_RX(r1, 0x11a, 0x2, &(0x7f0000000140)=@gcm_128={{0x303}, "8adb03a0b1bb7605", "5922ac9ff30d68ee7692e458bf837c51", "07f94b6b", "763f062c5f2edff2"}, 0x28) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x3, 0x1) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x80}, 0x1, 0x0, 0x0, 0x4004050}, 0x80) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r2, &(0x7f0000000480), 0x21, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r6, &(0x7f0000001100)={0x0, 0x0, 0x0}, 0x80) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x25a) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000540)={0x2, @vbi={0x7, 0x8, 0x3d54, 0x494e4f4b, [0x0, 0x4], [0x3, 0x5], 0x2023c860d0553049}}) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 12.95002995s ago: executing program 4 (id=1194): syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) 12.189996211s ago: executing program 4 (id=1197): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) syz_usb_connect(0x6, 0x5a, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100006325a640402000498b4d000000010902240001000000000904000002"], 0x0) syz_open_dev$video(0x0, 0xc, 0x200) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_drvinfo={0x3, "7339099042a557a8850e56fbf75bc095f998cb3ef37b7f039b4ec027363efa54", "9aa6c4b80a4ed65890ec802b70a5ea39fc53864809df7e77b156b1b640f1777c", "a59a57c7318bfed4ac17a10b39ad26b068644d7b7c9c8e03bb61b6147c12ae59", "3b9379f5952f6e17183155f8a98a3af781746628c6e400", "c5b433a31c2aa404b51099f9d8ddbb8b4f70c2683b24b5f08be8fe769a73865b", "39bc601815fefa6141b60866", 0x1, 0x51, 0x7, 0x6, 0x9}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000680)) quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, 0xffffffffffffffff, 0x0) dup3(r0, r1, 0x80000) 12.003410024s ago: executing program 2 (id=1200): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bond0\x00'}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 11.987719784s ago: executing program 2 (id=1201): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000040)=0x3, 0x4) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) 11.5758013s ago: executing program 2 (id=1202): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000480)={0x0, 0xfffffffffffffefd, &(0x7f0000000000)={&(0x7f0000000180)={0x30, r1, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {0xa1ffffff, 0x3}, {0x14, 0x19, {0x4, 0xfffffffc, 0xe184, 0x8}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4004018}, 0x44050) 9.144006396s ago: executing program 4 (id=1203): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x24000044) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xf, 0x18, &(0x7f0000000740)=ANY=[], &(0x7f0000000440)='syzkaller\x00', 0x8, 0x70, &(0x7f0000000480)=""/112, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000500)=[r4, r4, r4, r4, r4, r4, r4, r4, r4], 0x0, 0x10, 0x3}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r5, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) 1.807634344s ago: executing program 2 (id=1204): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1, 0x100001, 0x5, 0x5, 0x1}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r0, &(0x7f0000000340), 0x0}, 0x20) 1.807024234s ago: executing program 4 (id=1205): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) ptrace$poke(0x4, r0, 0x0, 0x917) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x2) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000002cc0)="099ccccf84f531d9ec214606c11430c1", 0x10) sendmmsg$alg(r5, &(0x7f0000000b40)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001c00)="5985d20392d0e83101f02653a3db12a8", 0x10}], 0x1, &(0x7f0000000080)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x8000}], 0x1, 0x20049001) 1.796724274s ago: executing program 0 (id=1206): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0x0, 0x0, &(0x7f0000000a80)={0x0, 0x0, 0x5, &(0x7f0000000900)={0x5, 0xf, 0x5}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, &(0x7f0000000540)={0x14, &(0x7f00000003c0)={0x40, 0x11, 0x5c, {0x5c, 0x30, "9397c66fc36cadcb096501582068f3826cb6d7ae0ba528ff14b010a7c3c426f54c16db83e9ae24152deee1c89fbe89c1232aad56ce3ad779841558e21465ae8841f2b04db5519e079b16bc05ffd53e231d5661084020d0b90658"}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.762372645s ago: executing program 3 (id=1207): openat$comedi(0xffffff9c, 0x0, 0x2000, 0x0) listen(0xffffffffffffffff, 0x5) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) write(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r2 = io_uring_setup(0x3450, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) 1.694162186s ago: executing program 1 (id=1208): r0 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) syz_emit_ethernet(0x3e, &(0x7f00000004c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa000800"], 0x0) 1.693826386s ago: executing program 2 (id=1209): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x0, 0x0, 0x0}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) 1.550380278s ago: executing program 1 (id=1210): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) r2 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a38d", 0x2) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r3, 0xc0984124, &(0x7f0000000300)) r4 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r4, 0x4112, 0x0) 1.531075458s ago: executing program 1 (id=1211): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r2, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000200)="27030200000214000e00002f74214b34586d47423cddcb0000008000008276000000000000006e81a357601e3876", 0x2e}], 0x1}, 0x5) 1.3961259s ago: executing program 3 (id=1212): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bond0\x00'}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 1.303611272s ago: executing program 3 (id=1213): r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000040)=0x3, 0x4) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) 1.282303592s ago: executing program 1 (id=1214): socket(0x10, 0x803, 0x2) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000400)=0x2, 0x4) bind$can_raw(r0, &(0x7f0000000480), 0x10) close(r0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r6], 0x54}}, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xe, 0xb}, {}, {0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x800) 1.104198464s ago: executing program 1 (id=1215): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$kcm(0x1e, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x5, 0x84) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) 860.988208ms ago: executing program 4 (id=1216): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x24000044) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xf, 0x18, &(0x7f0000000740)=ANY=[], &(0x7f0000000440)='syzkaller\x00', 0x8, 0x70, &(0x7f0000000480)=""/112, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000500)=[r5, r5, r5, r5, r5, r5, r5, r5, r5], 0x0, 0x10, 0x3}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r6, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) 836.478368ms ago: executing program 2 (id=1217): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x9, 0x0, 0x3, 0xfffffffd}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r2, {0x10}, {0x6}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x880) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f0000000140)={&(0x7f00000001c0)=@xdp={0x2c, 0xa888, r8, 0xb}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000340)='f', 0x1}], 0x1}, 0x857) 202.364148ms ago: executing program 1 (id=1218): bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TLS_RX(r1, 0x11a, 0x2, &(0x7f0000000140)=@gcm_128={{0x303}, "8adb03a0b1bb7605", "5922ac9ff30d68ee7692e458bf837c51", "07f94b6b", "763f062c5f2edff2"}, 0x28) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x3, 0x1) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x80}, 0x1, 0x0, 0x0, 0x4004050}, 0x80) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r2, &(0x7f0000000480), 0x21, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r6, &(0x7f0000001100)={0x0, 0x0, 0x0}, 0x80) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x25a) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000540)={0x2, @vbi={0x7, 0x8, 0x3d54, 0x494e4f4b, [0x0, 0x4], [0x3, 0x5], 0x2023c860d0553049}}) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 124.705339ms ago: executing program 3 (id=1219): r0 = syz_open_dev$ndb(&(0x7f0000002480), 0x0, 0x107000) ioctl$NBD_CLEAR_QUE(r0, 0xab05) 106.263059ms ago: executing program 3 (id=1220): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r5 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain={'key_or_keyring:', r5}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x30) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r8, 0x402, 0x80000034) close(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r9, {0x8, 0x7}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0xffa, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x26044028}, 0x800) 0s ago: executing program 4 (id=1221): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r3 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x98, 0x2d8, 0x98, 0x138, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r4 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x20080) ioctl$I2C_PEC(r4, 0x708, 0xb8f7) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x4}}}]}, 0x48}}, 0x0) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f0000000100)={0x1, 0x4, 0x3, 0x0}) r6 = signalfd4(0xffffffffffffffff, &(0x7f00000000c0)={[0x4]}, 0x8, 0x800) read$FUSE(r6, &(0x7f0000000740)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): us mode [ 33.753101][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.754970][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 33.756502][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 33.760124][ T4327] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 33.762221][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 33.764525][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 33.766119][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 33.787206][ T4328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.788569][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.790059][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.791355][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.796974][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.798293][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.801572][ T4326] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.814090][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.816088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.819971][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.821646][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.826209][ T4338] device veth0_macvtap entered promiscuous mode [ 33.839981][ T4337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.847192][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.848624][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.849940][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.851236][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.852802][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.858101][ T4338] device veth1_macvtap entered promiscuous mode [ 33.862776][ T4326] device veth0_vlan entered promiscuous mode [ 33.864587][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.866054][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.867626][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.869200][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.870531][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.888491][ T4326] device veth1_vlan entered promiscuous mode [ 33.895358][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.896973][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.898451][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.899889][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.901262][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.902565][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.903846][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.908320][ T4338] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.911424][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.913255][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.915756][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.918767][ T4328] device veth0_vlan entered promiscuous mode [ 33.924811][ T4327] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.928805][ T4338] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.933293][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.934992][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.938833][ T4338] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.940275][ T4338] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.941754][ T4338] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.943089][ T4338] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.950165][ T4328] device veth1_vlan entered promiscuous mode [ 33.953148][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.954659][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.956044][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.957583][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.960575][ T4326] device veth0_macvtap entered promiscuous mode [ 33.968241][ T4326] device veth1_macvtap entered promiscuous mode [ 33.977403][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.979066][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.980524][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.981984][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.999601][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.001151][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.003050][ T4326] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.005748][ T4326] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.007968][ T4326] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.009608][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.011221][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.013975][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 34.018639][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.022024][ T4326] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.023584][ T4326] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.026378][ T4326] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.030789][ T4328] device veth0_macvtap entered promiscuous mode [ 34.036641][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.038187][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.039677][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.041241][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.042747][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.047814][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.049362][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.051627][ T4326] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.053108][ T4326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.055298][ T4326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.056674][ T4326] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.061920][ T4328] device veth1_macvtap entered promiscuous mode [ 34.066510][ T4337] device veth0_vlan entered promiscuous mode [ 34.072416][ T4386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.073670][ T4386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.081218][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.083028][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.085132][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.086776][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.088819][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.090260][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.091750][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.093270][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.096034][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.097602][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.099194][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.101570][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.103098][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.108446][ T4327] device veth0_vlan entered promiscuous mode [ 34.111443][ T4337] device veth1_vlan entered promiscuous mode [ 34.117713][ T4327] device veth1_vlan entered promiscuous mode [ 34.123332][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.125583][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.127165][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.128885][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.131066][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.136115][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.137651][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.139127][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.140762][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.142425][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.148762][ T4328] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.150191][ T4328] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.151588][ T4328] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.152960][ T4328] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.156374][ T4386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.157590][ T4386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.158843][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.160181][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.163841][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.166739][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.175094][ T4327] device veth0_macvtap entered promiscuous mode [ 34.184652][ T4327] device veth1_macvtap entered promiscuous mode [ 34.188487][ T4386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.189762][ T4386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.191833][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.193931][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.198863][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.213748][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.216067][ T4386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.217328][ T4386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.218650][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.220141][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.221721][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.223263][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.225534][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.228049][ T4327] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.231071][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.232521][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.234143][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.236272][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.237774][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.248220][ T4337] device veth0_macvtap entered promiscuous mode [ 34.259311][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.260951][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.262414][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.264291][ T649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.264304][ T649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.268680][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.270331][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.271918][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.273962][ T4327] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.277125][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.278661][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.279997][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.281482][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.287771][ T4337] device veth1_macvtap entered promiscuous mode [ 34.297735][ T4387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.299158][ T4387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.304309][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.305912][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.310923][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.312698][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.317281][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.319044][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.320601][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.322212][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.323750][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.326287][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.328511][ T4337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.334467][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.336176][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.353403][ T4327] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.357175][ T4327] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.358760][ T4327] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.360145][ T4327] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.370234][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.371919][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.383385][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.386112][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.390078][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.391196][ T4410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.392215][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.394046][ T4410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.396153][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.397820][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.400009][ T4337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.402298][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.404049][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.431541][ T4336] Bluetooth: Unknown LE signaling command 0x37 [ 34.432640][ T4336] Bluetooth: Wrong link type (-22) [ 34.439984][ T4337] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.441587][ T4337] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.443087][ T4337] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.447538][ T4337] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.462077][ T649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.463382][ T649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.468543][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.511991][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.513519][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.518508][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.531064][ T649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.532378][ T649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.533856][ T4386] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.543826][ T4387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.545394][ T4387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.546699][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.634806][ T7] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 34.643227][ T4418] xt_limit: Overflow, try lower: 2147483649/3300 [ 34.652587][ T4418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.655479][ T4418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.677270][ T4419] netlink: 'syz.3.4': attribute type 2 has an invalid length. [ 34.678568][ T4419] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 34.830523][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.832510][ T7] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 34.833926][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.837750][ T7] usb 1-1: config 0 descriptor?? [ 34.946220][ T4424] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6'. [ 34.957548][ T4424] device gtp0 entered promiscuous mode [ 35.284369][ T4334] Bluetooth: hci2: command 0x041b tx timeout [ 35.365008][ T4336] Bluetooth: hci0: command 0x041b tx timeout [ 36.384157][ C0] sched: RT throttling activated [ 36.384454][ T4336] Bluetooth: hci1: command 0x041b tx timeout [ 36.386514][ T4336] Bluetooth: hci3: command 0x041b tx timeout [ 36.387562][ T4336] Bluetooth: hci4: command 0x041b tx timeout [ 36.402200][ T7] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 36.406371][ T7] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0001/input/input2 [ 36.501216][ T4432] xt_NFQUEUE: number of total queues is 0 [ 36.947217][ T7] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 36.953146][ T4440] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 37.201214][ T4374] usb 1-1: USB disconnect, device number 2 [ 37.364526][ T4334] Bluetooth: hci2: command 0x040f tx timeout [ 37.425058][ T113] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 37.428726][ T113] hid-generic 0000:0000:0000.0002: hidraw1: HID v0.00 Device [syz1] on syz0 [ 37.444459][ T4336] Bluetooth: hci0: command 0x040f tx timeout [ 37.575511][ T4455] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15'. [ 38.075698][ T4487] netlink: 160 bytes leftover after parsing attributes in process `syz.1.29'. [ 38.098215][ T4472] netlink: 60 bytes leftover after parsing attributes in process `syz.0.23'. [ 38.101592][ T4472] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 38.414904][ T4334] Bluetooth: hci4: command 0x040f tx timeout [ 38.418899][ T4334] Bluetooth: hci3: command 0x040f tx timeout [ 38.421143][ T4334] Bluetooth: hci1: command 0x040f tx timeout [ 39.243210][ T4517] netlink: 'syz.0.37': attribute type 1 has an invalid length. [ 39.257596][ T4517] batman_adv: batadv0: Adding interface: ip6gretap1 [ 39.260060][ T4517] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.269097][ T4517] batman_adv: batadv0: Not using interface ip6gretap1 (retrying later): interface not active [ 39.273213][ T4517] netlink: 4 bytes leftover after parsing attributes in process `syz.0.37'. [ 39.275654][ T4517] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.277198][ T4517] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.279339][ T4517] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.280743][ T4517] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.282641][ T4517] batman_adv: batadv0: Removing interface: ip6gretap1 [ 39.444244][ T4336] Bluetooth: hci2: command 0x0419 tx timeout [ 39.525842][ T4334] Bluetooth: hci0: command 0x0419 tx timeout [ 40.364300][ T7] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 40.376465][ T4557] netlink: 16 bytes leftover after parsing attributes in process `syz.4.51'. [ 40.385764][ T4557] Zero length message leads to an empty skb [ 40.459684][ T4561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.463697][ T4561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.484418][ T4336] Bluetooth: hci1: command 0x0419 tx timeout [ 40.485500][ T4336] Bluetooth: hci3: command 0x0419 tx timeout [ 40.486460][ T4336] Bluetooth: hci4: command 0x0419 tx timeout [ 40.564759][ T7] usb 1-1: Using ep0 maxpacket: 16 [ 40.568298][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.569904][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.571464][ T7] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 40.572803][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.638706][ T7] usb 1-1: config 0 descriptor?? [ 40.675610][ T4561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.677175][ T4561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.791898][ T4572] xt_CT: You must specify a L4 protocol and not use inversions on it [ 40.986013][ T4573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.988387][ T4573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.998259][ T4573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.002361][ T4573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.192387][ T7] corsair 0003:1B1C:1B02.0003: item fetching failed at offset 1/5 [ 41.193872][ T7] corsair 0003:1B1C:1B02.0003: parse failed [ 41.195624][ T7] corsair: probe of 0003:1B1C:1B02.0003 failed with error -22 [ 41.394720][ T7] usb 1-1: USB disconnect, device number 3 [ 42.629152][ T4645] netlink: 180 bytes leftover after parsing attributes in process `syz.3.77'. [ 42.637433][ T4645] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 42.638989][ T4645] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 42.640371][ T4645] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 42.641768][ T4645] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 42.643386][ T4645] device geneve2 entered promiscuous mode [ 42.904350][ T4374] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 43.084631][ T4374] usb 1-1: Using ep0 maxpacket: 8 [ 43.092356][ T4374] usb 1-1: config 0 has an invalid interface number: 52 but max is 0 [ 43.094126][ T4374] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 43.102512][ T4374] usb 1-1: config 0 has no interface number 0 [ 43.103841][ T4374] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 43.121117][ T4374] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid wMaxPacketSize 0 [ 43.157030][ T4374] usb 1-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 43.203114][ T4374] usb 1-1: config 0 interface 52 has no altsetting 0 [ 43.245479][ T4374] usb 1-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 43.260268][ T4374] usb 1-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 43.261631][ T4374] usb 1-1: Manufacturer: syz [ 43.336759][ T4647] binder: BINDER_SET_CONTEXT_MGR already set [ 43.337790][ T4647] binder: 4646:4647 ioctl 4018620d 20004a80 returned -16 [ 43.339536][ T4647] binder: tried to use weak ref as strong ref [ 43.340601][ T4647] binder: 4646:4647 Acquire 1 refcount change on invalid ref 0 ret -22 [ 43.342103][ T4647] binder: 4646:4647 got transaction to invalid handle, 1 [ 43.343226][ T4647] binder: 4647:4646 cannot find target node [ 43.344094][ T4647] binder: 4646:4647 transaction call to 0:0 failed 3/29201/-22, size 72-24 line 3045 [ 43.358356][ T4647] binder: 4646:4647 got transaction to invalid handle, 3 [ 43.359757][ T4647] binder: 4647:4646 cannot find target node [ 43.360793][ T4647] binder: 4646:4647 transaction call to 0:0 failed 4/29201/-22, size 0-0 line 3045 [ 43.362455][ T4647] binder: undelivered TRANSACTION_ERROR: 29201 [ 43.380891][ T4373] binder: undelivered TRANSACTION_ERROR: 29201 [ 43.692188][ T4374] usb 1-1: config 0 descriptor?? [ 43.697721][ T4374] hub 1-1:0.52: bad descriptor, ignoring hub [ 43.698823][ T4374] hub: probe of 1-1:0.52 failed with error -5 [ 43.830977][ T4674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.833766][ T4674] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.916905][ T4374] synaptics_usb 1-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 43.918456][ T4374] synaptics_usb: probe of 1-1:0.52 failed with error -5 [ 43.983011][ T4685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.985277][ T4685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.334466][ T27] audit: type=1326 audit(44.320:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.338666][ T27] audit: type=1326 audit(44.330:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.342506][ T27] audit: type=1326 audit(44.330:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.347211][ T27] audit: type=1326 audit(44.330:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.351733][ T27] audit: type=1326 audit(44.330:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=430 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.358263][ T27] audit: type=1326 audit(44.330:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.362531][ T27] audit: type=1326 audit(44.330:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.366761][ T27] audit: type=1326 audit(44.330:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.370738][ T27] audit: type=1326 audit(44.330:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=431 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.377200][ T27] audit: type=1326 audit(44.330:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4689 comm="syz.3.99" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x7ffc0000 [ 44.435446][ T4374] usb 1-1: USB disconnect, device number 4 [ 45.055680][ T4709] netlink: 12 bytes leftover after parsing attributes in process `syz.4.108'. [ 45.392647][ T4718] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.399243][ T4718] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.028530][ T4725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.030167][ T4725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.086974][ T4732] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 46.088382][ T4732] overlayfs: missing 'lowerdir' [ 46.135314][ T4733] syz.2.119 uses obsolete (PF_INET,SOCK_PACKET) [ 46.363247][ T4334] block nbd0: Receive control failed (result -107) [ 46.420775][ T4735] binder: 4734:4735 ERROR: BC_REGISTER_LOOPER called without request [ 47.510741][ T4747] xt_CT: No such helper "snmp_trap" [ 47.573501][ T4759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.578545][ T4759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.024262][ T113] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 48.212357][ T113] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.215114][ T113] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 48.243747][ T113] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.477397][ T113] usb 1-1: config 0 descriptor?? [ 48.721302][ T113] usbhid 1-1:0.0: can't add hid device: -71 [ 48.722437][ T113] usbhid: probe of 1-1:0.0 failed with error -71 [ 48.728100][ T113] usb 1-1: USB disconnect, device number 5 [ 48.782457][ T4788] Bluetooth: MGMT ver 1.22 [ 48.847167][ T4796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.852049][ T4796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.085486][ T4805] netlink: 32 bytes leftover after parsing attributes in process `syz.3.145'. [ 49.088125][ T4805] netlink: 16 bytes leftover after parsing attributes in process `syz.3.145'. [ 49.089706][ T4805] netlink: 16 bytes leftover after parsing attributes in process `syz.3.145'. [ 49.617351][ T4811] netlink: 128 bytes leftover after parsing attributes in process `syz.2.149'. [ 49.805798][ T27] kauditd_printk_skb: 546 callbacks suppressed [ 49.805808][ T27] audit: type=1326 audit(49.800:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4820 comm="syz.3.153" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2377b68 code=0x0 [ 49.907361][ T113] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 50.030835][ T4830] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.032183][ T4830] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.237242][ T113] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.239064][ T113] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 50.240527][ T113] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.245443][ T113] usb 1-1: config 0 descriptor?? [ 50.366810][ T4832] netlink: 44 bytes leftover after parsing attributes in process `syz.1.157'. [ 50.558829][ T4840] binder: 4839:4840 tried to acquire reference to desc 0, got 1 instead [ 50.560708][ T4840] binder: 4840:4839 failed to get security context [ 50.562263][ T4840] binder: 4839:4840 transaction call to 4839:0 failed 9/29201/-22, size 0-0 line 3197 [ 50.565366][ T4840] binder: 4839:4840 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 50.567884][ T4840] binder: 4840 RLIMIT_NICE not set [ 50.569088][ T4840] binder: 4839:4840 ioctl c0306201 20000300 returned -11 [ 50.570742][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 50.589532][ T4842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.591629][ T4842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.828814][ T4856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.830334][ T4856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.834847][ T4856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.837217][ T4856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.911772][ T4860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.170'. [ 50.914779][ T4860] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 50.962901][ T4864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.965074][ T4864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.066890][ T113] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 51.068564][ T113] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input5 [ 51.151138][ T4879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.152934][ T4879] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.360590][ T4373] usb 1-1: USB disconnect, device number 6 [ 51.360630][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 51.487850][ T4882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.489285][ T4882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.491607][ T4882] process 'syz.3.179' launched '/dev/fd/-1' with NULL argv: empty string added [ 51.785360][ T4885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.788184][ T4885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.377960][ T4902] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.379500][ T4902] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.395720][ T4922] capability: warning: `syz.2.190' uses deprecated v2 capabilities in a way that may be insecure [ 54.691378][ C1] vxcan1: j1939_tp_rxtimer: 0x00000000531d85d2: rx timeout, send abort [ 54.716853][ T4932] netlink: 36 bytes leftover after parsing attributes in process `syz.4.194'. [ 55.192893][ C1] vxcan1: j1939_tp_rxtimer: 0x00000000531d85d2: abort rx timeout. Force session deactivation [ 55.303404][ T4950] netlink: 84 bytes leftover after parsing attributes in process `syz.0.200'. [ 55.316006][ T4950] netlink: 'syz.0.200': attribute type 1 has an invalid length. [ 55.356399][ T4954] binder: 4953:4954 unknown command 1074553619 [ 55.358702][ T4954] binder: 4953:4954 ioctl c0306201 20000040 returned -22 [ 55.422790][ T4964] binder: 4963:4964 tried to acquire reference to desc 0, got 1 instead [ 55.426182][ T4964] binder: 4963:4964 unknown command 1074553619 [ 55.427451][ T4964] binder: 4963:4964 ioctl c0306201 20004a40 returned -22 [ 55.429107][ T111] binder: release 4963:4964 transaction 17 out, still active [ 55.430736][ T111] binder: undelivered TRANSACTION_COMPLETE [ 55.443917][ T111] binder: send failed reply for transaction 17, target dead [ 55.807819][ T4975] netlink: 68 bytes leftover after parsing attributes in process `syz.0.211'. [ 55.901939][ T4982] input: syz1 as /devices/virtual/input/input6 [ 56.036420][ T4989] binder: 4987:4989 unknown command 1074553619 [ 56.037535][ T4989] binder: 4987:4989 ioctl c0306201 20000040 returned -22 [ 56.280489][ T4999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.287541][ T4999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.404217][ T24] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 56.584260][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 56.586556][ T24] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 56.588109][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 56.589695][ T24] usb 1-1: config 0 has no interface number 0 [ 56.590785][ T24] usb 1-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 56.596561][ T24] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 56.598120][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.599361][ T24] usb 1-1: Product: syz [ 56.600006][ T24] usb 1-1: Manufacturer: syz [ 56.600690][ T24] usb 1-1: SerialNumber: syz [ 56.606182][ T24] usb 1-1: config 0 descriptor?? [ 56.610562][ T24] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 56.810675][ T24] usb 1-1: qt2_setup_urbs - submit read urb failed -8 [ 56.811940][ T24] quatech2: probe of 1-1:0.51 failed with error -8 [ 56.825528][ T5007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.827190][ T5007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.014719][ T111] usb 1-1: USB disconnect, device number 7 [ 57.317121][ T5035] netlink: 84 bytes leftover after parsing attributes in process `syz.4.234'. [ 57.319324][ T5035] netlink: 'syz.4.234': attribute type 1 has an invalid length. [ 57.865806][ T5050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.867443][ T5050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.011176][ T5055] 9pnet: p9_errstr2errno: server reported unknown error 0x00 [ 59.622959][ T5062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.630350][ T5062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.714988][ T5050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.716725][ T5050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.789276][ T5107] binder: 5106:5107 tried to acquire reference to desc 0, got 1 instead [ 60.791212][ T5107] binder: 5106:5107 got transaction with invalid offset (26, min 0 max 72) or object. [ 60.793025][ T5107] binder: 5106:5107 transaction call to 5106:0 failed 30/29201/-22, size 72-24 line 3346 [ 60.809482][ T4919] binder: undelivered TRANSACTION_ERROR: 29201 [ 61.044256][ T111] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 61.213141][ T5145] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.223270][ T5145] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.226085][ T5147] binder: 5146:5147 tried to acquire reference to desc 0, got 1 instead [ 61.229314][ T111] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 61.230879][ T111] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.232055][ T111] usb 1-1: Product: syz [ 61.232694][ T111] usb 1-1: Manufacturer: syz [ 61.233368][ T111] usb 1-1: SerialNumber: syz [ 61.245171][ T111] usb 1-1: config 0 descriptor?? [ 61.286947][ T5147] binder: 5146:5147 got transaction with invalid offset (26, min 0 max 72) or object. [ 61.288862][ T5147] binder: 5146:5147 transaction call to 5146:0 failed 35/29201/-22, size 72-24 line 3346 [ 61.293553][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 61.631938][ T111] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 61.669132][ T5161] ieee802154 phy0 wpan0: encryption failed: -22 [ 61.672342][ T5163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.673893][ T5163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.698046][ T5165] netlink: 8 bytes leftover after parsing attributes in process `syz.2.284'. [ 61.699781][ T5165] netlink: 44 bytes leftover after parsing attributes in process `syz.2.284'. [ 62.271620][ T5184] binder: 5183:5184 got transaction to invalid handle, 1 [ 62.273016][ T5184] binder: 5184:5183 cannot find target node [ 62.275107][ T5184] binder: 5183:5184 transaction call to 0:0 failed 38/29201/-22, size 72-24 line 3045 [ 62.277164][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 62.330608][ T5186] device syzkaller0 entered promiscuous mode [ 62.687902][ T5202] netlink: 8 bytes leftover after parsing attributes in process `syz.2.297'. [ 62.845328][ T5214] binder: tried to use weak ref as strong ref [ 62.846452][ T5214] binder: 5211:5214 Acquire 1 refcount change on invalid ref 0 ret -22 [ 62.848255][ T5214] binder: 5211:5214 got transaction to invalid handle, 1 [ 62.849579][ T5214] binder: 5214:5211 cannot find target node [ 62.850644][ T5214] binder: 5211:5214 transaction call to 0:0 failed 41/29201/-22, size 72-24 line 3045 [ 62.853359][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 62.869224][ T5213] input: syz1 as /devices/virtual/input/input7 [ 62.886844][ T111] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -32 [ 63.083948][ T5226] device syzkaller0 entered promiscuous mode [ 63.101866][ T111] usb 1-1: USB disconnect, device number 8 [ 63.656762][ T5230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.658388][ T5230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.486582][ T2063] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.488095][ T2063] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.536013][ T5260] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.538722][ T5260] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 65.887466][ T5287] input: syz1 as /devices/virtual/input/input8 [ 66.867574][ T5320] input: syz1 as /devices/virtual/input/input9 [ 69.163760][ T4334] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 69.165575][ T4334] Bluetooth: hci1: Injecting HCI hardware error event [ 69.170101][ T4336] Bluetooth: hci1: hardware error 0x00 [ 69.610072][ T14] cfg80211: failed to load regulatory.db [ 69.631465][ T5351] netlink: 284 bytes leftover after parsing attributes in process `syz.1.346'. [ 69.960933][ T5354] binder: 5353:5354 got transaction to invalid handle, 1 [ 69.962750][ T5354] binder: 5354:5353 cannot find target node [ 69.963896][ T5354] binder: 5353:5354 transaction call to 0:0 failed 45/29201/-22, size 72-24 line 3045 [ 69.967979][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 70.260237][ T5362] netlink: 'syz.2.347': attribute type 1 has an invalid length. [ 70.461282][ T5382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.462847][ T5382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.382826][ T5398] netlink: 4 bytes leftover after parsing attributes in process `syz.0.360'. [ 71.434003][ T5397] netlink: 'syz.2.370': attribute type 1 has an invalid length. [ 71.585469][ T4336] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 71.633326][ T5405] netlink: 'syz.3.364': attribute type 12 has an invalid length. [ 71.734647][ T5405] netlink: 'syz.3.364': attribute type 29 has an invalid length. [ 71.736338][ T5405] netlink: 148 bytes leftover after parsing attributes in process `syz.3.364'. [ 71.737908][ T5405] netlink: 59 bytes leftover after parsing attributes in process `syz.3.364'. [ 71.892430][ T5411] binder: 5406:5411 got transaction to invalid handle, 1 [ 71.893672][ T5411] binder: 5411:5406 cannot find target node [ 71.898873][ T5411] binder: 5406:5411 transaction call to 0:0 failed 49/29201/-22, size 72-24 line 3045 [ 71.900702][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.040195][ T5424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.041624][ T5424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.053709][ T5424] netlink: 24 bytes leftover after parsing attributes in process `syz.4.369'. [ 72.666885][ T5422] netlink: 'syz.2.379': attribute type 12 has an invalid length. [ 72.668233][ T5422] netlink: 'syz.2.379': attribute type 29 has an invalid length. [ 72.669462][ T5422] netlink: 148 bytes leftover after parsing attributes in process `syz.2.379'. [ 72.670910][ T5422] netlink: 59 bytes leftover after parsing attributes in process `syz.2.379'. [ 72.740475][ T5443] netlink: 4 bytes leftover after parsing attributes in process `syz.3.375'. [ 72.741861][ T5443] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 72.743060][ T5443] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 72.751978][ T5443] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 72.753509][ T5443] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 73.254589][ T5447] netlink: 'syz.1.377': attribute type 1 has an invalid length. [ 73.396819][ T5470] netlink: 'syz.3.385': attribute type 12 has an invalid length. [ 73.398153][ T5470] netlink: 'syz.3.385': attribute type 29 has an invalid length. [ 73.399460][ T5470] netlink: 148 bytes leftover after parsing attributes in process `syz.3.385'. [ 73.400839][ T5470] netlink: 59 bytes leftover after parsing attributes in process `syz.3.385'. [ 73.798931][ T5484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.805948][ T5484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.514250][ T7] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 74.526121][ T5507] netlink: 'syz.4.398': attribute type 12 has an invalid length. [ 74.754293][ T7] usb 1-1: unable to get BOS descriptor or descriptor too short [ 74.805333][ T7] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 74.807650][ T7] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 74.809462][ T7] usb 1-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 74.836443][ T7] usb 1-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 74.868843][ T7] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 74.935663][ T7] usb 1-1: config 1 interface 1 has no altsetting 0 [ 74.982585][ T7] usb 1-1: string descriptor 0 read error: -22 [ 75.002327][ T7] usb 1-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 75.030427][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.662783][ T5528] validate_nla: 4 callbacks suppressed [ 75.662793][ T5528] netlink: 'syz.4.405': attribute type 4 has an invalid length. [ 75.862240][ T5500] __nla_validate_parse: 2 callbacks suppressed [ 75.862253][ T5500] netlink: 24 bytes leftover after parsing attributes in process `syz.0.395'. [ 75.879196][ T5500] device syzkaller1 entered promiscuous mode [ 75.881285][ T5534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.408'. [ 75.906612][ T5536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.908283][ T5536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.993803][ T5538] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.995682][ T5538] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.006174][ T7] usb 1-1: 2:0: cannot get min/max values for control 2 (id 2) [ 76.012791][ T7] usb 1-1: 2:0: cannot get min/max values for control 2 (id 2) [ 76.015547][ T7] usb 1-1: 2:0: cannot get min/max values for control 2 (id 2) [ 76.019265][ T7] usb 1-1: USB disconnect, device number 9 [ 76.157345][ T5540] netlink: 28 bytes leftover after parsing attributes in process `syz.4.409'. [ 76.876648][ T5549] netlink: 'syz.2.411': attribute type 10 has an invalid length. [ 76.892665][ T5549] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.897954][ T5549] bond0: (slave team0): Enslaving as an active interface with an up link [ 76.909931][ T5549] netlink: 12 bytes leftover after parsing attributes in process `syz.2.411'. [ 77.088434][ T4319] udevd[4319]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 77.165434][ T5553] netlink: 4 bytes leftover after parsing attributes in process `syz.3.413'. [ 77.340863][ T5568] binder: 5567:5568 tried to acquire reference to desc 0, got 1 instead [ 77.342790][ T5568] binder_alloc: 5567: binder_alloc_buf, no vma [ 77.344121][ T5568] binder: cannot allocate buffer: vma cleared, target dead or dying [ 77.344149][ T5568] binder: 5567:5568 transaction call to 5567:0 failed 54/29189/-3, size 72-24 line 3230 [ 77.353393][ T7] binder: undelivered TRANSACTION_ERROR: 29189 [ 77.365272][ T5570] netlink: 8 bytes leftover after parsing attributes in process `syz.3.420'. [ 77.808855][ T5578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.811074][ T5578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.124999][ T5587] netlink: 4 bytes leftover after parsing attributes in process `syz.0.425'. [ 78.229031][ T5598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.230651][ T5598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.245758][ T5598] netlink: 24 bytes leftover after parsing attributes in process `syz.1.430'. [ 78.253027][ T5598] device syzkaller1 entered promiscuous mode [ 78.414233][ T5282] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 78.594235][ T5282] usb 1-1: Using ep0 maxpacket: 8 [ 78.596305][ T5282] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 78.597749][ T5282] usb 1-1: config 0 has no interface number 0 [ 78.598814][ T5282] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 78.600717][ T5282] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 78.602344][ T5282] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 78.605998][ T5282] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 78.607630][ T5282] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.634820][ T5282] usb 1-1: Product: syz [ 78.635966][ T5282] usb 1-1: Manufacturer: syz [ 78.636830][ T5282] usb 1-1: SerialNumber: syz [ 78.645194][ T5282] usb 1-1: config 0 descriptor?? [ 78.647698][ T5282] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 78.886313][ T5603] netlink: 'syz.2.433': attribute type 1 has an invalid length. [ 79.297527][ T5607] netlink: 'syz.1.432': attribute type 10 has an invalid length. [ 79.301286][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.303598][ T5607] bond0: (slave team0): Enslaving as an active interface with an up link [ 79.305402][ T5615] netlink: 12 bytes leftover after parsing attributes in process `syz.1.432'. [ 79.327082][ T5613] netlink: 4 bytes leftover after parsing attributes in process `syz.4.437'. [ 80.139351][ T5632] binder: 5630:5632 tried to acquire reference to desc 0, got 1 instead [ 80.143240][ T5632] binder_alloc: 5630: binder_alloc_buf, no vma [ 80.144511][ T5632] binder: cannot allocate buffer: vma cleared, target dead or dying [ 80.144537][ T5632] binder: 5630:5632 transaction call to 5630:0 failed 59/29189/-3, size 72-24 line 3230 [ 80.147691][ T4374] binder: undelivered TRANSACTION_ERROR: 29189 [ 80.153968][ T5636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.156304][ T5636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.808315][ T5653] syz.4.448 sent an empty control message without MSG_MORE. [ 81.290085][ T5282] usb 1-1: USB disconnect, device number 10 [ 81.577656][ T5657] netlink: 'syz.4.450': attribute type 1 has an invalid length. [ 82.548412][ T5673] binder: tried to use weak ref as strong ref [ 82.549751][ T5673] binder: 5672:5673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 82.551331][ T5673] binder: 5672:5673 got transaction to invalid handle, 1 [ 82.552719][ T5673] binder: 5673:5672 cannot find target node [ 82.553681][ T5673] binder: 5672:5673 transaction call to 0:0 failed 62/29201/-22, size 72-24 line 3045 [ 82.555820][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 83.651180][ T5668] netlink: 'syz.0.453': attribute type 10 has an invalid length. [ 83.655436][ T5668] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.657067][ T5668] bond0: (slave team0): Enslaving as an active interface with an up link [ 83.658548][ T5669] netlink: 12 bytes leftover after parsing attributes in process `syz.0.453'. [ 83.965304][ T5702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.966758][ T5702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.971960][ T5704] netlink: 'syz.1.465': attribute type 12 has an invalid length. [ 84.042869][ T5704] netlink: 'syz.1.465': attribute type 29 has an invalid length. [ 84.044436][ T5704] netlink: 148 bytes leftover after parsing attributes in process `syz.1.465'. [ 84.045856][ T5704] netlink: 'syz.1.465': attribute type 3 has an invalid length. [ 84.047057][ T5704] netlink: 'syz.1.465': attribute type 2 has an invalid length. [ 84.048224][ T5704] netlink: 35 bytes leftover after parsing attributes in process `syz.1.465'. [ 84.078390][ T5709] binder: tried to use weak ref as strong ref [ 84.079444][ T5709] binder: 5708:5709 Acquire 1 refcount change on invalid ref 0 ret -22 [ 84.081074][ T5709] binder: 5708:5709 got transaction to invalid handle, 1 [ 84.082187][ T5709] binder: 5709:5708 cannot find target node [ 84.083743][ T5709] binder: 5708:5709 transaction call to 0:0 failed 65/29201/-22, size 72-24 line 3045 [ 84.174931][ T4375] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 84.335074][ T4336] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 84.336726][ T4336] Bluetooth: hci4: Injecting HCI hardware error event [ 84.339257][ T4334] Bluetooth: hci4: hardware error 0x00 [ 84.369076][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 84.527659][ T5723] netlink: 'syz.1.472': attribute type 1 has an invalid length. [ 84.564273][ T4375] usb 1-1: Using ep0 maxpacket: 8 [ 84.569284][ T4375] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 84.570915][ T4375] usb 1-1: config 0 has no interface number 0 [ 84.571957][ T4375] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 84.573708][ T4375] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 84.575741][ T4375] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 84.579388][ T4375] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 84.580858][ T4375] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.582233][ T4375] usb 1-1: Product: syz [ 84.582875][ T4375] usb 1-1: Manufacturer: syz [ 84.583685][ T4375] usb 1-1: SerialNumber: syz [ 84.586521][ T4375] usb 1-1: config 0 descriptor?? [ 84.589433][ T4375] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 85.956096][ T4336] block nbd4: Receive control failed (result -32) [ 85.962805][ T5721] block nbd4: shutting down sockets [ 86.347737][ T5751] netlink: 'syz.4.479': attribute type 12 has an invalid length. [ 86.349047][ T5751] netlink: 'syz.4.479': attribute type 29 has an invalid length. [ 86.350236][ T5751] netlink: 148 bytes leftover after parsing attributes in process `syz.4.479'. [ 86.371678][ T5751] netlink: 'syz.4.479': attribute type 3 has an invalid length. [ 86.373063][ T5751] netlink: 35 bytes leftover after parsing attributes in process `syz.4.479'. [ 86.380702][ T4336] Bluetooth: hci4: unexpected event for opcode 0x0062 [ 86.382889][ T5753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.387008][ T5753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.472115][ T5758] binder: tried to use weak ref as strong ref [ 86.473140][ T5758] binder: 5757:5758 Acquire 1 refcount change on invalid ref 0 ret -22 [ 86.474933][ T5758] binder: 5757:5758 got transaction to invalid handle, 1 [ 86.476264][ T5758] binder: 5758:5757 cannot find target node [ 86.477701][ T5758] binder: 5757:5758 transaction call to 0:0 failed 68/29201/-22, size 72-24 line 3045 [ 86.489367][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 86.588392][ T5761] netlink: 28 bytes leftover after parsing attributes in process `syz.1.478'. [ 86.590167][ T4334] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 86.921706][ T5770] netlink: 8 bytes leftover after parsing attributes in process `syz.3.486'. [ 87.255571][ T5792] validate_nla: 1 callbacks suppressed [ 87.255645][ T5792] netlink: 'syz.4.492': attribute type 12 has an invalid length. [ 87.257927][ T5792] netlink: 'syz.4.492': attribute type 29 has an invalid length. [ 87.259242][ T5792] netlink: 148 bytes leftover after parsing attributes in process `syz.4.492'. [ 87.260776][ T5792] netlink: 'syz.4.492': attribute type 3 has an invalid length. [ 87.262100][ T5792] netlink: 'syz.4.492': attribute type 2 has an invalid length. [ 87.263433][ T5792] netlink: 35 bytes leftover after parsing attributes in process `syz.4.492'. [ 88.286505][ T4374] usb 1-1: USB disconnect, device number 11 [ 88.357088][ T5803] netlink: 4 bytes leftover after parsing attributes in process `syz.3.496'. [ 88.374455][ T5811] netlink: 'syz.2.498': attribute type 10 has an invalid length. [ 88.429464][ T5816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 88.431629][ T5816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 88.449004][ T5818] netlink: 'syz.3.501': attribute type 1 has an invalid length. [ 89.416671][ T5827] netlink: 'syz.0.504': attribute type 12 has an invalid length. [ 89.418012][ T5827] netlink: 'syz.0.504': attribute type 29 has an invalid length. [ 89.419279][ T5827] __nla_validate_parse: 1 callbacks suppressed [ 89.419293][ T5827] netlink: 148 bytes leftover after parsing attributes in process `syz.0.504'. [ 89.421790][ T5827] netlink: 'syz.0.504': attribute type 3 has an invalid length. [ 89.423185][ T5827] netlink: 'syz.0.504': attribute type 2 has an invalid length. [ 89.425564][ T5827] netlink: 35 bytes leftover after parsing attributes in process `syz.0.504'. [ 89.483000][ T5842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.509'. [ 89.541147][ T5844] netlink: 148 bytes leftover after parsing attributes in process `syz.0.517'. [ 89.542854][ T5844] netlink: 35 bytes leftover after parsing attributes in process `syz.0.517'. [ 89.645601][ T5840] netlink: 60 bytes leftover after parsing attributes in process `syz.4.507'. [ 89.652774][ T5840] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 89.653204][ T5854] input: syz1 as /devices/virtual/input/input13 [ 89.664015][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.665438][ T5840] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.667078][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.668374][ T5840] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.671825][ T5840] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 89.694275][ T5840] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 89.997282][ T5860] netlink: 84 bytes leftover after parsing attributes in process `syz.3.514'. [ 90.491951][ T5628] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 90.523122][ T5866] binder: 5865:5866 got transaction to invalid handle, 1 [ 90.525132][ T5866] binder: 5866:5865 cannot find target node [ 90.526900][ T5866] binder: 5865:5866 transaction call to 0:0 failed 72/29201/-22, size 72-24 line 3045 [ 90.529060][ T111] binder: undelivered TRANSACTION_ERROR: 29201 [ 90.652781][ T5876] netlink: 148 bytes leftover after parsing attributes in process `syz.1.522'. [ 90.654628][ T5876] netlink: 35 bytes leftover after parsing attributes in process `syz.1.522'. [ 90.686008][ T5880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.523'. [ 91.366600][ T5902] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.368389][ T5902] bond0: (slave team0): Enslaving as an active interface with an up link [ 91.398047][ T5908] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.399642][ T5908] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 91.411807][ T5908] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.415937][ T5908] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 91.843305][ T4334] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 91.845014][ T4334] Bluetooth: hci3: Injecting HCI hardware error event [ 91.847383][ T4336] Bluetooth: hci3: hardware error 0x00 [ 91.909392][ T5921] input: syz1 as /devices/virtual/input/input14 [ 91.913413][ T5925] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.915242][ T5925] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.093874][ T5935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.096445][ T5935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.246300][ T5937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.248647][ T5937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.490571][ T5942] xt_limit: Overflow, try lower: 2147483649/3300 [ 92.493297][ T5942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.495464][ T5942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.574252][ T4374] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 92.760191][ T4374] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.761870][ T4374] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.763270][ T4374] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 92.769855][ T4374] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 92.771284][ T4374] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.778188][ T4374] usb 1-1: config 0 descriptor?? [ 92.805078][ T5948] xt_NFQUEUE: number of total queues is 0 [ 94.721639][ T4336] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 94.876120][ T5956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.877772][ T5956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.072015][ T5964] __nla_validate_parse: 4 callbacks suppressed [ 95.072026][ T5964] netlink: 4 bytes leftover after parsing attributes in process `syz.1.559'. [ 95.074903][ T5964] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 95.076206][ T5964] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.077924][ T5964] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.079934][ T5964] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.760713][ T5965] netlink: 8 bytes leftover after parsing attributes in process `syz.3.558'. [ 95.974939][ T5975] validate_nla: 12 callbacks suppressed [ 95.974959][ T5975] netlink: 'syz.3.560': attribute type 10 has an invalid length. [ 96.190634][ T5974] netlink: 'syz.1.561': attribute type 12 has an invalid length. [ 96.192229][ T5974] netlink: 'syz.1.561': attribute type 29 has an invalid length. [ 96.193645][ T5974] netlink: 148 bytes leftover after parsing attributes in process `syz.1.561'. [ 96.195850][ T5974] netlink: 59 bytes leftover after parsing attributes in process `syz.1.561'. [ 96.285973][ T5978] netlink: 'syz.2.557': attribute type 2 has an invalid length. [ 96.287539][ T5978] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 96.811069][ T4374] usbhid 1-1:0.0: can't add hid device: -71 [ 96.812105][ T4374] usbhid: probe of 1-1:0.0 failed with error -71 [ 96.814043][ T4374] usb 1-1: USB disconnect, device number 12 [ 96.829020][ T5988] xt_NFQUEUE: number of total queues is 0 [ 99.060361][ T6004] xt_limit: Overflow, try lower: 2147483649/3300 [ 99.133989][ T6012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.145618][ T6012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.354283][ T7] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 99.534281][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 99.550297][ T7] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 99.551767][ T7] usb 1-1: config 0 has no interface number 0 [ 99.563904][ T7] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 99.566043][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.567491][ T7] usb 1-1: Product: syz [ 99.568134][ T7] usb 1-1: Manufacturer: syz [ 99.569068][ T7] usb 1-1: SerialNumber: syz [ 99.575589][ T7] usb 1-1: config 0 descriptor?? [ 99.580572][ T7] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 99.584086][ T7] usb 1-1: selecting invalid altsetting 1 [ 99.587445][ T7] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 99.598834][ T7] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 99.601726][ T7] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 99.606039][ T7] usb 1-1: media controller created [ 99.610271][ T7] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 99.666380][ T6025] netlink: 4 bytes leftover after parsing attributes in process `syz.4.578'. [ 99.729835][ T6030] netlink: 'syz.4.581': attribute type 1 has an invalid length. [ 99.752572][ T6033] xt_NFQUEUE: number of total queues is 0 [ 99.766084][ T6030] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 99.787006][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.4.581'. [ 99.790206][ T6030] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 99.841335][ T7] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 99.842915][ T7] zl10353_read_register: readreg error (reg=127, ret==-71) [ 99.845065][ T7] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 99.860053][ T6030] bond1 (unregistering): Released all slaves [ 99.861683][ T7] usb 1-1: USB disconnect, device number 13 [ 100.625748][ T6039] netlink: 'syz.2.592': attribute type 12 has an invalid length. [ 100.627275][ T6039] netlink: 'syz.2.592': attribute type 29 has an invalid length. [ 100.628637][ T6039] netlink: 148 bytes leftover after parsing attributes in process `syz.2.592'. [ 100.630087][ T6039] netlink: 59 bytes leftover after parsing attributes in process `syz.2.592'. [ 100.637116][ T6041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.639904][ T6041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 101.689727][ T6056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 101.691726][ T6056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.261372][ T6062] netlink: 4 bytes leftover after parsing attributes in process `syz.1.590'. [ 102.291883][ T6068] netlink: 'syz.1.593': attribute type 1 has an invalid length. [ 102.318684][ T6073] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.320282][ T6073] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.343729][ T6068] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 102.354748][ T6068] netlink: 4 bytes leftover after parsing attributes in process `syz.1.593'. [ 102.357967][ T6068] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 102.416098][ T6068] bond1 (unregistering): Released all slaves [ 102.876760][ T6089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.878971][ T6089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.426391][ T6093] netlink: 4 bytes leftover after parsing attributes in process `syz.0.603'. [ 103.429157][ T6099] netlink: 'syz.2.605': attribute type 4 has an invalid length. [ 103.518425][ T6105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.521258][ T6105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.170355][ T6129] netlink: 'syz.0.616': attribute type 12 has an invalid length. [ 105.171968][ T6129] netlink: 'syz.0.616': attribute type 29 has an invalid length. [ 105.173331][ T6129] netlink: 148 bytes leftover after parsing attributes in process `syz.0.616'. [ 105.179065][ T6129] netlink: 59 bytes leftover after parsing attributes in process `syz.0.616'. [ 105.247437][ T27] audit: type=1326 audit(105.240:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.251891][ T27] audit: type=1326 audit(105.240:560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.258523][ T27] audit: type=1326 audit(105.240:561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.265680][ T27] audit: type=1326 audit(105.240:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.276310][ T27] audit: type=1326 audit(105.240:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=430 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.281610][ T6137] netlink: 4 bytes leftover after parsing attributes in process `syz.3.618'. [ 105.289065][ T27] audit: type=1326 audit(105.240:564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.330568][ T27] audit: type=1326 audit(105.240:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.341344][ T27] audit: type=1326 audit(105.240:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.352401][ T27] audit: type=1326 audit(105.240:567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.427435][ T27] audit: type=1326 audit(105.250:568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6134 comm="syz.0.617" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=431 compat=0 ip=0xffffacb77b68 code=0x7ffc0000 [ 105.440145][ T6142] device syzkaller0 entered promiscuous mode [ 106.064856][ T6151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.068893][ T6151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.072124][ T6155] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.073435][ T6155] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.140455][ T6154] netlink: 4 bytes leftover after parsing attributes in process `syz.3.626'. [ 106.219503][ T6160] netlink: 'syz.2.629': attribute type 12 has an invalid length. [ 106.220755][ T6160] netlink: 'syz.2.629': attribute type 29 has an invalid length. [ 106.222076][ T6160] netlink: 148 bytes leftover after parsing attributes in process `syz.2.629'. [ 106.223466][ T6160] netlink: 59 bytes leftover after parsing attributes in process `syz.2.629'. [ 109.621564][ T6185] binder: 6179:6185 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 110.249078][ T6197] netlink: 4 bytes leftover after parsing attributes in process `syz.4.641'. [ 110.256966][ T27] kauditd_printk_skb: 763 callbacks suppressed [ 110.256975][ T27] audit: type=1326 audit(110.240:1332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.262447][ T27] audit: type=1326 audit(110.250:1333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.284938][ T27] audit: type=1326 audit(110.250:1334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.285194][ T6199] netlink: 'syz.4.643': attribute type 12 has an invalid length. [ 110.288661][ T27] audit: type=1326 audit(110.250:1335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.290437][ T6199] netlink: 'syz.4.643': attribute type 29 has an invalid length. [ 110.295900][ T6199] netlink: 148 bytes leftover after parsing attributes in process `syz.4.643'. [ 110.297539][ T6199] netlink: 59 bytes leftover after parsing attributes in process `syz.4.643'. [ 110.308631][ T27] audit: type=1326 audit(110.250:1336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.312967][ T27] audit: type=1326 audit(110.250:1337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.328705][ T27] audit: type=1326 audit(110.250:1338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.337920][ T27] audit: type=1326 audit(110.250:1339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.353411][ T27] audit: type=1326 audit(110.250:1340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.363531][ T27] audit: type=1326 audit(110.260:1341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6190 comm="syz.1.639" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffff90b5aa2c code=0x7ffc0000 [ 110.677421][ T6214] input: syz1 as /devices/virtual/input/input15 [ 112.109071][ T6212] device syzkaller0 entered promiscuous mode [ 112.119637][ T6216] xt_CT: No such helper "snmp_trap" [ 112.164707][ T4373] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 112.203878][ T6223] binder: 6222:6223 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 112.307557][ T6227] netlink: 'syz.2.654': attribute type 12 has an invalid length. [ 112.308920][ T6227] netlink: 'syz.2.654': attribute type 29 has an invalid length. [ 112.310131][ T6227] netlink: 148 bytes leftover after parsing attributes in process `syz.2.654'. [ 112.311505][ T6227] netlink: 59 bytes leftover after parsing attributes in process `syz.2.654'. [ 112.344339][ T4373] usb 1-1: Using ep0 maxpacket: 8 [ 112.479251][ T4373] usb 1-1: unable to get BOS descriptor or descriptor too short [ 112.483758][ T4373] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 112.546356][ T6239] netlink: 'syz.2.656': attribute type 10 has an invalid length. [ 112.754107][ T4373] usb 1-1: can't read configurations, error -71 [ 113.336320][ T6251] netlink: 'syz.0.663': attribute type 4 has an invalid length. [ 113.862892][ T6261] xt_CT: No such helper "snmp_trap" [ 113.887059][ T6267] binder: 6266:6267 ioctl 4018620d 0 returned -22 [ 113.888703][ T6267] binder: 6266:6267 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 113.891868][ T6267] binder: 6266:6267 got transaction to invalid handle, 1 [ 113.893144][ T6267] binder: 6267:6266 cannot find target node [ 113.894054][ T6267] binder: 6266:6267 transaction call to 0:0 failed 77/29201/-22, size 72-24 line 3045 [ 113.896846][ T111] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.948793][ T6259] netlink: 'syz.1.666': attribute type 12 has an invalid length. [ 113.950250][ T6259] netlink: 'syz.1.666': attribute type 29 has an invalid length. [ 113.951705][ T6259] netlink: 148 bytes leftover after parsing attributes in process `syz.1.666'. [ 113.953253][ T6259] netlink: 59 bytes leftover after parsing attributes in process `syz.1.666'. [ 114.030997][ T6277] input: syz1 as /devices/virtual/input/input16 [ 114.090612][ T6280] device syzkaller0 entered promiscuous mode [ 114.172280][ T6281] netlink: 'syz.4.671': attribute type 10 has an invalid length. [ 114.183340][ T6281] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.188733][ T6281] bond0: (slave team0): Enslaving as an active interface with an up link [ 114.492527][ T6290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.495613][ T6290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.694697][ T6293] netlink: 28 bytes leftover after parsing attributes in process `syz.3.678'. [ 114.982170][ T6300] netlink: 'syz.0.682': attribute type 12 has an invalid length. [ 114.983368][ T6300] netlink: 148 bytes leftover after parsing attributes in process `syz.0.682'. [ 114.985004][ T6300] netlink: 59 bytes leftover after parsing attributes in process `syz.0.682'. [ 115.139318][ T6311] netlink: 4 bytes leftover after parsing attributes in process `syz.0.687'. [ 115.918200][ T6323] xt_CT: No such helper "snmp_trap" [ 115.928444][ T6327] device syzkaller0 entered promiscuous mode [ 116.410739][ T6337] validate_nla: 2 callbacks suppressed [ 116.410755][ T6337] netlink: 'syz.2.691': attribute type 10 has an invalid length. [ 116.413279][ T6341] netlink: 'syz.4.694': attribute type 12 has an invalid length. [ 116.414745][ T6341] netlink: 'syz.4.694': attribute type 29 has an invalid length. [ 116.416074][ T6341] netlink: 148 bytes leftover after parsing attributes in process `syz.4.694'. [ 116.417473][ T6341] netlink: 59 bytes leftover after parsing attributes in process `syz.4.694'. [ 116.531325][ T6348] netlink: 'syz.0.696': attribute type 4 has an invalid length. [ 117.050726][ T6367] input: syz1 as /devices/virtual/input/input17 [ 117.551404][ T6375] netlink: 'syz.3.706': attribute type 12 has an invalid length. [ 117.554783][ T6375] netlink: 'syz.3.706': attribute type 29 has an invalid length. [ 117.556401][ T6375] __nla_validate_parse: 1 callbacks suppressed [ 117.556414][ T6375] netlink: 148 bytes leftover after parsing attributes in process `syz.3.706'. [ 117.556765][ T6377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.558645][ T6375] netlink: 59 bytes leftover after parsing attributes in process `syz.3.706'. [ 117.562515][ T6377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 118.070059][ T6394] device syzkaller0 entered promiscuous mode [ 118.649588][ T6405] netlink: 'syz.1.711': attribute type 10 has an invalid length. [ 118.651283][ T6407] netlink: 8 bytes leftover after parsing attributes in process `syz.4.714'. [ 118.653195][ T6408] netlink: 'syz.2.713': attribute type 1 has an invalid length. [ 118.662947][ T6409] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 118.809254][ T6421] netlink: 'syz.2.719': attribute type 12 has an invalid length. [ 118.810615][ T6421] netlink: 'syz.2.719': attribute type 29 has an invalid length. [ 118.812479][ T6421] netlink: 148 bytes leftover after parsing attributes in process `syz.2.719'. [ 119.165519][ T27] kauditd_printk_skb: 758 callbacks suppressed [ 119.174051][ T27] audit: type=1326 audit(118.890:2100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6412 comm="syz.4.716" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffff89577b68 code=0x0 [ 119.492605][ T6421] netlink: 59 bytes leftover after parsing attributes in process `syz.2.719'. [ 119.898508][ T6435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.905882][ T6435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.019221][ T6449] input: syz1 as /devices/virtual/input/input18 [ 120.079441][ T6450] netlink: 28 bytes leftover after parsing attributes in process `syz.4.722'. [ 120.576188][ T6458] netlink: 4 bytes leftover after parsing attributes in process `syz.1.728'. [ 121.474969][ T6486] netlink: 84 bytes leftover after parsing attributes in process `syz.0.736'. [ 121.918800][ T6490] validate_nla: 1 callbacks suppressed [ 121.918816][ T6490] netlink: 'syz.3.738': attribute type 12 has an invalid length. [ 121.920989][ T6490] netlink: 'syz.3.738': attribute type 29 has an invalid length. [ 121.922239][ T6490] netlink: 148 bytes leftover after parsing attributes in process `syz.3.738'. [ 121.923732][ T6490] netlink: 59 bytes leftover after parsing attributes in process `syz.3.738'. [ 121.984935][ T6498] netlink: 'syz.2.741': attribute type 4 has an invalid length. [ 122.064731][ T6510] device syzkaller0 entered promiscuous mode [ 122.115357][ T6514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.118325][ T6514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.267434][ T27] audit: type=1326 audit(122.260:2101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6511 comm="syz.0.746" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffffacb77b68 code=0x0 [ 122.628775][ T6523] input: syz1 as /devices/virtual/input/input19 [ 122.634856][ T6525] netlink: 'syz.3.751': attribute type 12 has an invalid length. [ 122.636502][ T6525] netlink: 'syz.3.751': attribute type 29 has an invalid length. [ 122.638016][ T6525] __nla_validate_parse: 1 callbacks suppressed [ 122.638112][ T6525] netlink: 148 bytes leftover after parsing attributes in process `syz.3.751'. [ 122.653408][ T6525] netlink: 59 bytes leftover after parsing attributes in process `syz.3.751'. [ 122.680180][ T6529] netlink: 84 bytes leftover after parsing attributes in process `syz.3.753'. [ 122.757682][ T6531] netlink: 'syz.1.754': attribute type 4 has an invalid length. [ 122.853262][ T6544] netlink: 4 bytes leftover after parsing attributes in process `syz.1.756'. [ 122.856167][ T6543] netlink: 'syz.3.758': attribute type 1 has an invalid length. [ 122.872602][ T6543] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 122.875846][ T6543] netlink: 4 bytes leftover after parsing attributes in process `syz.3.758'. [ 122.898056][ T6549] binder: 6548:6549 ioctl c0306201 0 returned -14 [ 122.900276][ T6549] binder: BINDER_SET_CONTEXT_MGR already set [ 122.901303][ T6549] binder: 6548:6549 ioctl 4018620d 20004a80 returned -16 [ 122.916107][ T6549] binder: 6548:6549 Acquire 1 refcount change on invalid ref 0 ret -22 [ 122.917868][ T6549] binder: 6548:6549 got transaction to invalid handle, 1 [ 122.919039][ T6549] binder: 6549:6548 cannot find target node [ 122.937815][ T6549] binder: 6548:6549 transaction call to 0:0 failed 79/29201/-22, size 72-24 line 3045 [ 122.957574][ T6552] device syzkaller0 entered promiscuous mode [ 122.964776][ T4371] binder: undelivered TRANSACTION_ERROR: 29201 [ 122.983588][ T6557] netlink: 'syz.3.764': attribute type 12 has an invalid length. [ 122.985057][ T6557] netlink: 'syz.3.764': attribute type 29 has an invalid length. [ 122.986472][ T6557] netlink: 148 bytes leftover after parsing attributes in process `syz.3.764'. [ 122.988777][ T6557] netlink: 31 bytes leftover after parsing attributes in process `syz.3.764'. [ 123.346720][ T6563] netlink: 'syz.1.760': attribute type 10 has an invalid length. [ 123.401050][ T6569] device syzkaller0 entered promiscuous mode [ 125.926011][ T2063] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.927092][ T2063] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.195397][ T6575] netlink: 4 bytes leftover after parsing attributes in process `syz.0.771'. [ 134.203482][ T6589] validate_nla: 1 callbacks suppressed [ 134.203494][ T6589] netlink: 'syz.1.772': attribute type 1 has an invalid length. [ 134.208919][ T6593] netlink: 4 bytes leftover after parsing attributes in process `syz.1.772'. [ 134.241053][ T6601] binder: 6596:6601 got transaction to invalid handle, 1 [ 134.242307][ T6601] binder: 6601:6596 cannot find target node [ 134.243236][ T6601] binder: 6596:6601 transaction call to 0:0 failed 83/29201/-22, size 72-24 line 3045 [ 134.248576][ T4373] binder: undelivered TRANSACTION_ERROR: 29201 [ 134.268163][ T6603] netlink: 'syz.4.776': attribute type 12 has an invalid length. [ 134.269423][ T6603] netlink: 'syz.4.776': attribute type 29 has an invalid length. [ 134.270649][ T6603] netlink: 148 bytes leftover after parsing attributes in process `syz.4.776'. [ 134.272039][ T6603] netlink: 31 bytes leftover after parsing attributes in process `syz.4.776'. [ 134.325344][ T6608] netlink: 12 bytes leftover after parsing attributes in process `syz.2.778'. [ 134.424252][ T27] audit: type=1326 audit(134.410:2102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6597 comm="syz.1.774" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffff90b77b68 code=0x0 [ 134.644436][ T6617] netlink: 4 bytes leftover after parsing attributes in process `syz.0.784'. [ 134.660647][ T6613] netlink: 'syz.4.779': attribute type 4 has an invalid length. [ 134.866101][ T6636] netlink: 'syz.2.786': attribute type 1 has an invalid length. [ 134.925326][ T6636] netlink: 4 bytes leftover after parsing attributes in process `syz.2.786'. [ 134.932888][ T6636] bond2 (unregistering): Released all slaves [ 135.231835][ T6646] netlink: 'syz.4.783': attribute type 10 has an invalid length. [ 135.242217][ T6649] netlink: 'syz.1.790': attribute type 12 has an invalid length. [ 135.243533][ T6649] netlink: 'syz.1.790': attribute type 29 has an invalid length. [ 135.244870][ T6649] netlink: 148 bytes leftover after parsing attributes in process `syz.1.790'. [ 135.248678][ T6649] netlink: 31 bytes leftover after parsing attributes in process `syz.1.790'. [ 135.300585][ T6655] device syzkaller0 entered promiscuous mode [ 135.417086][ T6662] netlink: 'syz.3.794': attribute type 4 has an invalid length. [ 135.473169][ T6671] netlink: 12 bytes leftover after parsing attributes in process `syz.1.797'. [ 135.504354][ T22] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 135.733382][ T22] usb 1-1: Using ep0 maxpacket: 8 [ 135.757024][ T22] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 135.758704][ T22] usb 1-1: config 0 has no interface number 0 [ 135.760421][ T22] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 135.762622][ T22] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 135.795960][ T22] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 135.987402][ T22] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 135.989021][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.990345][ T22] usb 1-1: Product: syz [ 135.990999][ T22] usb 1-1: Manufacturer: syz [ 135.991997][ T22] usb 1-1: SerialNumber: syz [ 135.994686][ T22] usb 1-1: config 0 descriptor?? [ 135.999339][ T22] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 136.206503][ T6679] netlink: 'syz.3.799': attribute type 1 has an invalid length. [ 136.212605][ T6679] 8021q: adding VLAN 0 to HW filter on device bond2 [ 136.218501][ T6682] bond2: (slave geneve3): making interface the new active one [ 136.221347][ T6682] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 136.223349][ T6481] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 136.357370][ T6704] device syzkaller0 entered promiscuous mode [ 136.444106][ T6714] input: syz1 as /devices/virtual/input/input20 [ 137.036461][ T6726] binder: 6725:6726 got transaction to invalid handle, 1 [ 137.037954][ T6726] binder: 6726:6725 cannot find target node [ 137.040820][ T6726] binder: 6725:6726 transaction call to 0:0 failed 87/29201/-22, size 72-24 line 3045 [ 137.046380][ T111] binder: undelivered TRANSACTION_ERROR: 29201 [ 137.783787][ T6748] bond3 (unregistering): Released all slaves [ 137.882208][ T6765] device syzkaller0 entered promiscuous mode [ 137.909496][ T6769] binder: 6768:6769 got transaction to invalid handle, 1 [ 137.910833][ T6769] binder: 6769:6768 cannot find target node [ 137.911971][ T6769] binder: 6768:6769 transaction call to 0:0 failed 91/29201/-22, size 72-24 line 3045 [ 137.913954][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 137.952234][ T24] usb 1-1: USB disconnect, device number 16 [ 138.003899][ T6775] input: syz1 as /devices/virtual/input/input21 [ 138.904515][ T6801] binder: 6800:6801 got transaction to invalid handle, 1 [ 138.905937][ T6801] binder: 6801:6800 cannot find target node [ 138.919422][ T6795] bond3 (unregistering): Released all slaves [ 139.012101][ T6816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.013552][ T6816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.077224][ T6818] device syzkaller0 entered promiscuous mode [ 139.096142][ T6824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.097828][ T6824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.628317][ T6837] input: syz1 as /devices/virtual/input/input22 [ 140.197523][ T6838] validate_nla: 17 callbacks suppressed [ 140.197539][ T6838] netlink: 'syz.4.851': attribute type 10 has an invalid length. [ 140.255512][ T6840] binder: 6839:6840 got transaction to invalid handle, 1 [ 140.256771][ T6840] binder_debug: 2 callbacks suppressed [ 140.256783][ T6840] binder: 6840:6839 cannot find target node [ 140.258787][ T6840] binder: 6839:6840 transaction call to 0:0 failed 99/29201/-22, size 72-24 line 3045 [ 140.261080][ T111] binder: undelivered TRANSACTION_ERROR: 29201 [ 140.435376][ T6850] netlink: 'syz.0.857': attribute type 1 has an invalid length. [ 140.454472][ T6850] 8021q: adding VLAN 0 to HW filter on device bond1 [ 140.498957][ T6850] bond1: (slave geneve2): making interface the new active one [ 140.513667][ T6850] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 140.515463][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 140.552971][ T6856] netlink: 'syz.3.859': attribute type 1 has an invalid length. [ 140.560391][ T6856] __nla_validate_parse: 12 callbacks suppressed [ 140.560400][ T6856] netlink: 4 bytes leftover after parsing attributes in process `syz.3.859'. [ 140.843613][ T6856] bond3 (unregistering): Released all slaves [ 140.923887][ T6865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.925851][ T6865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.112743][ T6866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.861'. [ 141.115358][ T6866] device gtp0 entered promiscuous mode [ 141.946632][ T6808] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 142.169909][ T6904] netlink: 'syz.2.872': attribute type 1 has an invalid length. [ 142.182969][ T6904] 8021q: adding VLAN 0 to HW filter on device bond2 [ 142.222631][ T6904] bond2: (slave geneve2): making interface the new active one [ 142.228919][ T6904] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 142.235018][ T4528] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 142.373285][ T6913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.874'. [ 142.404442][ T4919] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 142.584934][ T4919] usb 1-1: Using ep0 maxpacket: 8 [ 142.618156][ T4919] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 142.622004][ T4919] usb 1-1: config 0 has no interface number 0 [ 142.639000][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 142.703125][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 142.735079][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 142.741493][ T4919] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 142.745344][ T6927] xt_CT: No such helper "snmp_trap" [ 142.746352][ T4919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.747741][ T4919] usb 1-1: Product: syz [ 142.748428][ T4919] usb 1-1: Manufacturer: syz [ 142.749231][ T4919] usb 1-1: SerialNumber: syz [ 142.751512][ T4919] usb 1-1: config 0 descriptor?? [ 142.753933][ T4919] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 143.206368][ T6948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.209111][ T6948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.684048][ T6953] netlink: 28 bytes leftover after parsing attributes in process `syz.2.882'. [ 143.755253][ T6969] device syzkaller0 entered promiscuous mode [ 144.087413][ T6974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.089130][ T6974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.294659][ T6974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.296784][ T6974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.120388][ T4373] usb 1-1: USB disconnect, device number 17 [ 145.282836][ T6984] xt_CT: No such helper "snmp_trap" [ 153.604310][ T47] Bluetooth: hci2: command 0x0406 tx timeout [ 153.604329][ T4336] Bluetooth: hci0: command 0x0406 tx timeout [ 155.699007][ T6980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.890'. [ 155.726240][ T7005] netlink: 'syz.2.897': attribute type 10 has an invalid length. [ 155.797001][ T7011] netlink: 'syz.0.898': attribute type 1 has an invalid length. [ 155.808957][ T7011] 8021q: adding VLAN 0 to HW filter on device bond2 [ 155.810542][ T7015] netlink: 'syz.4.901': attribute type 12 has an invalid length. [ 155.811703][ T7015] netlink: 'syz.4.901': attribute type 29 has an invalid length. [ 155.812863][ T7015] netlink: 148 bytes leftover after parsing attributes in process `syz.4.901'. [ 155.815272][ T7015] netlink: 'syz.4.901': attribute type 3 has an invalid length. [ 155.816653][ T7015] netlink: 35 bytes leftover after parsing attributes in process `syz.4.901'. [ 155.912426][ T7024] netlink: 'syz.2.905': attribute type 4 has an invalid length. [ 156.012192][ T7037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.016700][ T7037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.026606][ T7021] xt_CT: No such helper "snmp_trap" [ 156.546459][ T4919] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 156.594945][ T7042] device geneve3 entered promiscuous mode [ 156.784597][ T4919] usb 1-1: Using ep0 maxpacket: 8 [ 156.834524][ T4919] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 156.836061][ T4919] usb 1-1: config 0 has no interface number 0 [ 156.837085][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 156.838611][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 156.840431][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 156.865289][ T4919] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 156.866794][ T4919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.868252][ T4919] usb 1-1: Product: syz [ 156.868873][ T4919] usb 1-1: Manufacturer: syz [ 156.869573][ T4919] usb 1-1: SerialNumber: syz [ 156.879021][ T7044] input: syz1 as /devices/virtual/input/input23 [ 156.945407][ T4919] usb 1-1: config 0 descriptor?? [ 156.948805][ T4919] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 156.985068][ T7051] netlink: 'syz.4.913': attribute type 12 has an invalid length. [ 156.986390][ T7051] netlink: 'syz.4.913': attribute type 29 has an invalid length. [ 156.987621][ T7051] netlink: 148 bytes leftover after parsing attributes in process `syz.4.913'. [ 156.989039][ T7051] netlink: 'syz.4.913': attribute type 3 has an invalid length. [ 157.291138][ T7051] netlink: 35 bytes leftover after parsing attributes in process `syz.4.913'. [ 157.296213][ T7052] netlink: 'syz.1.911': attribute type 10 has an invalid length. [ 157.349022][ T7054] device syzkaller0 entered promiscuous mode [ 158.954949][ T4375] usb 1-1: USB disconnect, device number 18 [ 168.384382][ T7074] netlink: 'syz.3.917': attribute type 1 has an invalid length. [ 168.404834][ T7081] netlink: 'syz.0.918': attribute type 4 has an invalid length. [ 168.473040][ T7094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.474875][ T7094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.509331][ T7096] binder: 7093:7096 tried to acquire reference to desc 0, got 1 instead [ 168.512917][ T7096] binder: 7093:7096 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 168.517062][ T7096] binder: 7096 RLIMIT_NICE not set [ 168.518239][ T113] binder: undelivered TRANSACTION_COMPLETE [ 168.575108][ T7100] binder: BINDER_SET_CONTEXT_MGR already set [ 168.576068][ T7100] binder: 7099:7100 ioctl 4018620d 20004a80 returned -16 [ 168.577524][ T7100] binder: tried to use weak ref as strong ref [ 168.578769][ T7100] binder: 7099:7100 Acquire 1 refcount change on invalid ref 0 ret -22 [ 168.618591][ T7095] xt_CT: No such helper "snmp_trap" [ 169.322484][ T7117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.927'. [ 169.450895][ T7130] netlink: 'syz.1.931': attribute type 4 has an invalid length. [ 169.454826][ T7132] netlink: 'syz.4.932': attribute type 1 has an invalid length. [ 169.779762][ T7132] 8021q: adding VLAN 0 to HW filter on device bond1 [ 169.790912][ T7142] bond1: (slave geneve2): making interface the new active one [ 169.796057][ T7142] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 169.807564][ T5543] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 169.839837][ T7135] device syzkaller0 entered promiscuous mode [ 169.907421][ T7152] binder: 7151:7152 tried to acquire reference to desc 0, got 1 instead [ 169.936997][ T7156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 169.939656][ T7156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 170.047791][ T7157] xt_CT: No such helper "snmp_trap" [ 170.104276][ T4919] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 170.284225][ T4919] usb 1-1: Using ep0 maxpacket: 8 [ 170.286417][ T4919] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 170.287988][ T4919] usb 1-1: config 0 has no interface number 0 [ 170.289122][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 170.290858][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 170.292660][ T4919] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 170.297977][ T4919] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 170.299608][ T4919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.300900][ T4919] usb 1-1: Product: syz [ 170.301610][ T4919] usb 1-1: Manufacturer: syz [ 170.302413][ T4919] usb 1-1: SerialNumber: syz [ 170.305014][ T4919] usb 1-1: config 0 descriptor?? [ 170.307679][ T4919] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 170.920218][ T7173] xt_CT: No such helper "snmp_trap" [ 172.845929][ T4375] usb 1-1: USB disconnect, device number 19 [ 180.983097][ T7167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.941'. [ 181.063586][ T7214] binder: 7212:7214 tried to acquire reference to desc 0, got 1 instead [ 181.399440][ T7219] netlink: 8 bytes leftover after parsing attributes in process `syz.3.948'. [ 181.405293][ T7219] device gtp0 entered promiscuous mode [ 181.807365][ T7228] netlink: 'syz.3.954': attribute type 12 has an invalid length. [ 181.808777][ T7228] netlink: 'syz.3.954': attribute type 29 has an invalid length. [ 181.810157][ T7228] netlink: 148 bytes leftover after parsing attributes in process `syz.3.954'. [ 181.811564][ T7228] netlink: 59 bytes leftover after parsing attributes in process `syz.3.954'. [ 182.155639][ T7239] netlink: 'syz.4.958': attribute type 10 has an invalid length. [ 182.198696][ T7238] netlink: 8 bytes leftover after parsing attributes in process `syz.2.957'. [ 182.281078][ T7242] netlink: 4 bytes leftover after parsing attributes in process `syz.1.959'. [ 182.311830][ T7244] device syzkaller0 entered promiscuous mode [ 187.376059][ T2063] ieee802154 phy0 wpan0: encryption failed: -22 [ 187.377115][ T2063] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.194789][ T7266] binder: 7265:7266 tried to acquire reference to desc 0, got 1 instead [ 193.240133][ T7262] netlink: 8 bytes leftover after parsing attributes in process `syz.4.964'. [ 193.269550][ T7270] netlink: 'syz.1.967': attribute type 12 has an invalid length. [ 193.271198][ T7270] netlink: 'syz.1.967': attribute type 29 has an invalid length. [ 193.272430][ T7270] netlink: 148 bytes leftover after parsing attributes in process `syz.1.967'. [ 193.273782][ T7270] netlink: 59 bytes leftover after parsing attributes in process `syz.1.967'. [ 193.329263][ T7276] netlink: 4 bytes leftover after parsing attributes in process `syz.4.971'. [ 193.342458][ T7280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.343990][ T7280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.466096][ T7286] netlink: 'syz.0.973': attribute type 10 has an invalid length. [ 193.499125][ T7291] netlink: 8 bytes leftover after parsing attributes in process `syz.3.976'. [ 193.720789][ T7298] netlink: 'syz.4.977': attribute type 4 has an invalid length. [ 194.086279][ T7304] device syzkaller0 entered promiscuous mode [ 194.121119][ T7302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.979'. [ 194.123728][ T7302] device gtp0 entered promiscuous mode [ 194.184038][ T7307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.186105][ T7307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.198295][ T7309] netlink: 'syz.2.981': attribute type 12 has an invalid length. [ 205.199695][ T7309] netlink: 'syz.2.981': attribute type 29 has an invalid length. [ 205.200920][ T7309] netlink: 148 bytes leftover after parsing attributes in process `syz.2.981'. [ 205.202309][ T7309] netlink: 59 bytes leftover after parsing attributes in process `syz.2.981'. [ 205.208465][ T7329] netlink: 4 bytes leftover after parsing attributes in process `syz.4.985'. [ 205.478716][ T7368] xt_CT: No such helper "snmp_trap" [ 205.512049][ T7373] binder: 7372:7373 tried to acquire reference to desc 0, got 1 instead [ 205.513898][ T7373] binder: 7372:7373 got transaction with invalid data ptr [ 205.515475][ T7373] binder: 7372:7373 transaction call to 7372:0 failed 123/29201/-14, size 0-24 line 3333 [ 205.517722][ T4919] binder: undelivered TRANSACTION_ERROR: 29201 [ 205.545423][ T7377] netlink: 'syz.1.994': attribute type 10 has an invalid length. [ 205.615161][ T7381] netlink: 'syz.3.999': attribute type 12 has an invalid length. [ 205.622456][ T7381] netlink: 'syz.3.999': attribute type 29 has an invalid length. [ 205.624032][ T7381] netlink: 148 bytes leftover after parsing attributes in process `syz.3.999'. [ 205.723008][ T7383] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1000'. [ 205.814727][ T4919] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 205.829694][ T7386] device syzkaller0 entered promiscuous mode [ 205.838874][ T7389] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1003'. [ 205.841169][ T7389] netlink: 'syz.2.1003': attribute type 1 has an invalid length. [ 205.995837][ T4919] usb 1-1: unable to get BOS descriptor or descriptor too short [ 205.998054][ T4919] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 206.001659][ T4919] usb 1-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice= 0.40 [ 206.003412][ T4919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.005477][ T4919] usb 1-1: Product: syz [ 206.006328][ T4919] usb 1-1: Manufacturer: syz [ 206.007176][ T4919] usb 1-1: SerialNumber: syz [ 206.189628][ T7399] binder: 7397:7399 tried to acquire reference to desc 0, got 1 instead [ 206.191504][ T7399] binder_alloc: 7397: binder_alloc_buf, no vma [ 206.192731][ T7399] binder: cannot allocate buffer: vma cleared, target dead or dying [ 206.192765][ T7399] binder: 7397:7399 transaction async to 7397:0 failed 128/29189/-3, size 0-0 line 3230 [ 206.196896][ T7399] binder: 7397:7399 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 206.199354][ T7399] binder: 7399 RLIMIT_NICE not set [ 207.287932][ T7405] binder: undelivered TRANSACTION_ERROR: 29189 [ 207.506110][ T7413] binder: 7412:7413 tried to acquire reference to desc 0, got 1 instead [ 207.508227][ T7413] binder: 7412:7413 got transaction with invalid data ptr [ 207.509570][ T7413] binder: 7412:7413 transaction call to 7412:0 failed 133/29201/-14, size 0-24 line 3333 [ 207.511818][ T7405] binder: undelivered TRANSACTION_ERROR: 29201 [ 207.540353][ T7417] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1011'. [ 207.541890][ T7417] netlink: 340 bytes leftover after parsing attributes in process `syz.1.1011'. [ 211.057589][ T4919] snd-usb-hiface: probe of 1-1:1.1 failed with error -22 [ 211.060607][ T4919] snd-usb-hiface: probe of 1-1:1.2 failed with error -22 [ 217.469803][ T7415] netlink: 'syz.4.1010': attribute type 12 has an invalid length. [ 217.471136][ T7415] netlink: 'syz.4.1010': attribute type 29 has an invalid length. [ 217.471818][ T7404] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 217.472335][ T7415] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1010'. [ 217.473809][ T7404] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 217.475624][ T7421] netlink: 'syz.1.1012': attribute type 1 has an invalid length. [ 217.498247][ T7423] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1012'. [ 217.526058][ T7430] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1014'. [ 217.528238][ T7430] netlink: 'syz.1.1014': attribute type 1 has an invalid length. [ 217.623231][ T4919] usb 1-1: USB disconnect, device number 20 [ 218.036610][ T7439] xt_CT: No such helper "snmp_trap" [ 218.059123][ T7445] binder: tried to use weak ref as strong ref [ 218.060234][ T7445] binder: 7444:7445 Acquire 1 refcount change on invalid ref 0 ret -22 [ 218.061849][ T7445] binder: 7444:7445 got transaction to invalid handle, 1 [ 218.063008][ T7445] binder: 7445:7444 cannot find target node [ 218.064081][ T7445] binder: 7444:7445 transaction async to 0:0 failed 136/29201/-22, size 0-0 line 3045 [ 218.066739][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 218.087794][ T7447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.090017][ T7447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.130425][ T7448] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1017'. [ 218.133376][ T7448] device gtp1 entered promiscuous mode [ 218.307271][ T7454] binder: 7453:7454 tried to acquire reference to desc 0, got 1 instead [ 218.309509][ T4919] binder: release 7453:7454 transaction 141 out, still active [ 218.311368][ T4919] binder: undelivered TRANSACTION_COMPLETE [ 218.319281][ T4919] binder: send failed reply for transaction 141, target dead [ 218.406290][ T7459] netlink: 'syz.1.1024': attribute type 12 has an invalid length. [ 218.407543][ T7459] netlink: 'syz.1.1024': attribute type 29 has an invalid length. [ 218.408857][ T7459] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1024'. [ 218.531345][ T7461] netlink: 'syz.1.1025': attribute type 1 has an invalid length. [ 218.763606][ T7461] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1025'. [ 218.770448][ T7461] bond1 (unregistering): Released all slaves [ 218.793735][ T7465] device syzkaller0 entered promiscuous mode [ 218.939376][ T7474] binder: tried to use weak ref as strong ref [ 218.940545][ T7474] binder: 7473:7474 Acquire 1 refcount change on invalid ref 0 ret -22 [ 218.942621][ T7474] binder: 7473:7474 got transaction to invalid handle, 1 [ 218.943957][ T7474] binder: 7474:7473 cannot find target node [ 218.945462][ T7474] binder: 7473:7474 transaction async to 0:0 failed 144/29201/-22, size 0-0 line 3045 [ 218.947404][ T7405] binder: undelivered TRANSACTION_ERROR: 29201 [ 219.877456][ T7503] binder: 7502:7503 tried to acquire reference to desc 0, got 1 instead [ 219.879301][ T7405] binder: release 7502:7503 transaction 149 out, still active [ 219.900165][ T7505] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.901791][ T7505] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.978329][ T7519] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1040'. [ 230.505421][ T7562] device syzkaller0 entered promiscuous mode [ 230.510562][ T7562] tc action pedit offset must be on 32 bit boundaries [ 231.630161][ T7643] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1053'. [ 231.837373][ T7653] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1056'. [ 231.839339][ T7656] netlink: 'syz.1.1056': attribute type 1 has an invalid length. [ 231.937050][ T7662] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1057'. [ 232.083048][ T7666] input: syz1 as /devices/virtual/input/input27 [ 232.441609][ T7682] device syzkaller0 entered promiscuous mode [ 232.726874][ T7682] tc action pedit offset must be on 32 bit boundaries [ 232.730400][ T7687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.731996][ T7687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.521858][ T7703] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1068'. [ 234.137995][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1069'. [ 234.452228][ T7717] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1072'. [ 234.475014][ T7719] input: syz1 as /devices/virtual/input/input28 [ 234.501644][ T7722] netlink: 'syz.3.1074': attribute type 10 has an invalid length. [ 235.559951][ T7735] binder: BINDER_SET_CONTEXT_MGR already set [ 235.561213][ T7735] binder: 7734:7735 ioctl 4018620d 20004a80 returned -16 [ 235.568737][ T7735] binder: 7734:7735 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 235.570853][ T7735] binder: 7735 RLIMIT_NICE not set [ 235.690865][ T7745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1084'. [ 235.824916][ T7754] input: syz1 as /devices/virtual/input/input29 [ 236.289915][ T7765] netlink: 'syz.2.1090': attribute type 1 has an invalid length. [ 236.300183][ T7765] 8021q: adding VLAN 0 to HW filter on device bond3 [ 236.528413][ T7776] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1092'. [ 236.531263][ T7776] device gtp2 entered promiscuous mode [ 236.566522][ T7780] netlink: 'syz.2.1093': attribute type 10 has an invalid length. [ 237.204821][ T7795] Cannot find set identified by id 0 to match [ 237.437874][ T7794] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1099'. [ 237.558315][ T7797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.570410][ T7797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.810119][ T7808] netlink: 'syz.2.1104': attribute type 1 has an invalid length. [ 237.827771][ T7808] 8021q: adding VLAN 0 to HW filter on device bond4 [ 237.838555][ T7811] binder: BINDER_SET_CONTEXT_MGR already set [ 237.839510][ T7811] binder: 7810:7811 ioctl 4018620d 20004a80 returned -16 [ 237.858151][ T7811] binder: 7810:7811 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 237.860327][ T7811] binder: 7811 RLIMIT_NICE not set [ 237.941346][ T7817] input: syz1 as /devices/virtual/input/input30 [ 238.124352][ T4919] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 238.153108][ T7821] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1109'. [ 238.359143][ T4919] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 238.360972][ T4919] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 238.363087][ T4919] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 238.364637][ T4919] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.383375][ T4919] usb 1-1: config 0 descriptor?? [ 238.397722][ T4919] hdpvr 1-1:0.0: Could not find bulk-in endpoint [ 238.399025][ T4919] hdpvr: probe of 1-1:0.0 failed with error -12 [ 238.729012][ T7830] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1112'. [ 239.623600][ T7851] netlink: 'syz.4.1115': attribute type 10 has an invalid length. [ 239.692778][ T7854] netlink: 'syz.1.1119': attribute type 1 has an invalid length. [ 239.761153][ T7854] 8021q: adding VLAN 0 to HW filter on device bond1 [ 239.869002][ T7859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1117'. [ 239.872054][ T7859] device gtp0 entered promiscuous mode [ 239.879046][ T7860] bond1: (slave geneve2): making interface the new active one [ 239.886840][ T7860] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 239.892881][ T6481] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 240.002834][ T7865] input: syz1 as /devices/virtual/input/input31 [ 240.280632][ T7869] binder: BINDER_SET_CONTEXT_MGR already set [ 240.281691][ T7869] binder: 7868:7869 ioctl 4018620d 20004a80 returned -16 [ 240.283256][ T7869] binder: 7868:7869 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 240.290774][ T7869] binder: 7869 RLIMIT_NICE not set [ 240.311798][ T7871] device syzkaller0 entered promiscuous mode [ 240.315302][ T7871] tc action pedit offset must be on 32 bit boundaries [ 240.575996][ T7873] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1124'. [ 240.888339][ T4375] usb 1-1: USB disconnect, device number 21 [ 240.956779][ T7880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1126'. [ 241.200977][ T7883] device syzkaller1 entered promiscuous mode [ 241.218466][ T7887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.224879][ T7887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.387798][ T7892] ======================================================= [ 241.387798][ T7892] WARNING: The mand mount option has been deprecated and [ 241.387798][ T7892] and is ignored by this kernel. Remove the mand [ 241.387798][ T7892] option from the mount to silence this warning. [ 241.387798][ T7892] ======================================================= [ 242.156062][ T7900] netlink: 'syz.0.1131': attribute type 1 has an invalid length. [ 242.169602][ T7900] 8021q: adding VLAN 0 to HW filter on device bond3 [ 242.271472][ T7905] netlink: 'syz.2.1132': attribute type 10 has an invalid length. [ 242.308560][ T7907] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1133'. [ 242.320171][ T7909] input: syz1 as /devices/virtual/input/input32 [ 242.339436][ T7907] device gtp1 entered promiscuous mode [ 242.472776][ T7916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.476082][ T7916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.782533][ T7922] device syzkaller0 entered promiscuous mode [ 242.786522][ T7922] tc action pedit offset must be on 32 bit boundaries [ 242.889176][ T7924] binder: 7923:7924 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 242.892218][ T7924] binder: 7923:7924 got transaction to invalid handle, 1 [ 242.893512][ T7924] binder_debug: 2 callbacks suppressed [ 242.893525][ T7924] binder: 7924:7923 cannot find target node [ 242.895684][ T7924] binder: 7923:7924 transaction async to 0:0 failed 155/29201/-22, size 0-0 line 3045 [ 242.897706][ T7924] binder: 7923:7924 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 242.899782][ T7924] binder: 7924 RLIMIT_NICE not set [ 243.318258][ T7943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.319987][ T7943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.424505][ T7944] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1145'. [ 243.720832][ T4919] binder: undelivered TRANSACTION_ERROR: 29201 [ 243.777969][ T7947] netlink: 'syz.1.1147': attribute type 1 has an invalid length. [ 243.784741][ T7947] 8021q: adding VLAN 0 to HW filter on device bond2 [ 244.190156][ T7962] input: syz1 as /devices/virtual/input/input33 [ 244.213131][ T7964] device syzkaller0 entered promiscuous mode [ 244.270531][ T7967] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1152'. [ 244.278558][ T7967] device gtp2 entered promiscuous mode [ 248.806031][ T2063] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.188864][ T8001] netlink: 'syz.4.1159': attribute type 1 has an invalid length. [ 255.251714][ T8012] device syzkaller0 entered promiscuous mode [ 255.565631][ T8025] input: syz1 as /devices/virtual/input/input34 [ 255.624297][ T4373] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 255.814245][ T4373] usb 1-1: Using ep0 maxpacket: 8 [ 255.817109][ T4373] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 255.818636][ T4373] usb 1-1: config 0 has no interface number 0 [ 255.819584][ T4373] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 255.821335][ T4373] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 255.823769][ T4373] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 255.825708][ T8029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 255.832188][ T4373] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 255.832266][ T8029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 255.833934][ T4373] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.839185][ T4373] usb 1-1: Product: syz [ 255.841003][ T4373] usb 1-1: Manufacturer: syz [ 255.841783][ T4373] usb 1-1: SerialNumber: syz [ 255.865403][ T4373] usb 1-1: config 0 descriptor?? [ 255.868240][ T4373] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 256.245247][ T7405] usb 1-1: USB disconnect, device number 22 [ 256.457585][ T8037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.459294][ T8037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.577748][ T8043] netlink: 'syz.1.1172': attribute type 1 has an invalid length. [ 256.599588][ T8043] 8021q: adding VLAN 0 to HW filter on device bond3 [ 256.735994][ T8050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1171'. [ 256.738551][ T8050] device gtp1 entered promiscuous mode [ 257.258210][ T8063] device syzkaller0 entered promiscuous mode [ 257.447491][ T8065] input: syz1 as /devices/virtual/input/input35 [ 257.899184][ T8073] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1182'. [ 258.898323][ T8083] device syzkaller0 entered promiscuous mode [ 259.375088][ T8099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.376735][ T8099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.506485][ T8105] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1192'. [ 259.513230][ T8105] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1192'. [ 259.573102][ T8108] binder: 8107:8108 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 259.576384][ T8108] binder: 8107:8108 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 259.578391][ T8108] binder: 8108 RLIMIT_NICE not set [ 259.627140][ T8110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.629682][ T8110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.393565][ T8124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.395400][ T8124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.435383][ T8143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.437247][ T8143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.715971][ T8111] netlink: 'syz.3.1191': attribute type 10 has an invalid length. [ 270.881454][ T8163] binder: 8162:8163 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 270.889982][ T8163] binder: 8162:8163 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 270.891987][ T8163] binder: 8163 RLIMIT_NICE not set [ 271.034218][ T4376] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 271.215317][ T4376] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 271.217379][ T4376] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 271.218926][ T4376] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.222239][ T4376] usb 1-1: config 0 descriptor?? [ 271.386660][ T8180] netlink: 'syz.1.1214': attribute type 1 has an invalid length. [ 271.395850][ T8180] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1214'. [ 271.398781][ T8180] bond4 (unregistering): Released all slaves [ 271.427093][ T4376] usbhid 1-1:0.0: can't add hid device: -71 [ 271.428226][ T4376] usbhid: probe of 1-1:0.0 failed with error -71 [ 271.433777][ T4376] usb 1-1: USB disconnect, device number 23 [ 271.772698][ T8189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.780001][ T8189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.060761][ T8190] device syzkaller0 entered promiscuous mode [ 272.097149][ T4376] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 272.276540][ T4376] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.278336][ T4376] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 272.279945][ T4376] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.285984][ T4376] usb 1-1: config 0 descriptor?? [ 273.119304][ T8209] xt_TPROXY: Can be used only with -p tcp or -p udp [ 273.295382][ T4376] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 273.297771][ T4376] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input36 [ 273.316943][ C1] ================================================================================ [ 273.318469][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 273.319853][ C1] index 87 is out of range for type 'const int[34]' [ 273.320985][ C1] CPU: 1 PID: 8150 Comm: udevd Not tainted syzkaller #0 [ 273.322091][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 273.323769][ C1] Call trace: [ 273.324281][ C1] dump_backtrace+0x1c4/0x1f0 [ 273.325012][ C1] show_stack+0x2c/0x3c [ 273.325691][ C1] __dump_stack+0x30/0x40 [ 273.326398][ C1] dump_stack_lvl+0xf4/0x15c [ 273.327110][ C1] dump_stack+0x1c/0x5c [ 273.327796][ C1] ubsan_epilogue+0x14/0x48 [ 273.328531][ C1] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 273.329497][ C1] aiptek_irq+0x19a0/0x2360 [ 273.330242][ C1] __usb_hcd_giveback_urb+0x2ec/0x50c [ 273.331153][ C1] usb_hcd_giveback_urb+0x100/0x3a4 [ 273.332074][ C1] dummy_timer+0x7c8/0x2840 [ 273.332839][ C1] __hrtimer_run_queues+0x444/0xc58 [ 273.333687][ C1] hrtimer_run_softirq+0x164/0x408 [ 273.334509][ C1] handle_softirqs+0x318/0xc90 [ 273.335328][ C1] __do_softirq+0x14/0x20 [ 273.336058][ C1] ____do_softirq+0x14/0x20 [ 273.336773][ C1] call_on_irq_stack+0x30/0x48 [ 273.337513][ C1] do_softirq_own_stack+0x20/0x2c [ 273.338268][ C1] __irq_exit_rcu+0x23c/0x430 [ 273.339001][ C1] irq_exit_rcu+0x14/0x84 [ 273.339704][ C1] el1_interrupt+0x38/0x54 [ 273.340448][ C1] el1h_64_irq_handler+0x18/0x24 [ 273.341251][ C1] el1h_64_irq+0x64/0x68 [ 273.341942][ C1] cmpxchg_double_slab+0xec/0x2a8 [ 273.342842][ C1] __slab_free+0x94/0x260 [ 273.343489][ C1] ___cache_free+0x16c/0x19c [ 273.344216][ C1] qlink_free+0x5c/0xa0 [ 273.344951][ C1] qlist_free_all+0x3c/0xcc [ 273.345683][ C1] kasan_quarantine_reduce+0x124/0x130 [ 273.346648][ C1] __kasan_slab_alloc+0x2c/0x88 [ 273.347434][ C1] slab_post_alloc_hook+0x74/0x430 [ 273.348280][ C1] __kmem_cache_alloc_node+0x278/0x318 [ 273.349236][ C1] __kmalloc_node+0xc8/0x184 [ 273.350128][ C1] kvmalloc_node+0x88/0x1d4 [ 273.350906][ C1] evdev_open+0xd0/0x474 [ 273.351632][ C1] chrdev_open+0x3d0/0x51c [ 273.352373][ C1] do_dentry_open+0x738/0xf8c [ 273.353193][ C1] vfs_open+0x7c/0x90 [ 273.353897][ C1] path_openat+0x1fc0/0x27a0 [ 273.354646][ C1] do_filp_open+0x198/0x38c [ 273.355391][ C1] do_sys_openat2+0x134/0x3fc [ 273.356189][ C1] __arm64_sys_openat+0x11c/0x150 [ 273.357016][ C1] invoke_syscall+0x98/0x290 [ 273.357829][ C1] el0_svc_common+0x13c/0x258 [ 273.358658][ C1] do_el0_svc+0x5c/0x134 [ 273.359356][ C1] el0_svc+0x58/0x128 [ 273.360021][ C1] el0t_64_sync_handler+0x84/0xf0 [ 273.360851][ C1] el0t_64_sync+0x18c/0x190 [ 273.361579][ C1] ================================================================================ [ 273.363034][ C1] ================================================================================ [ 273.364453][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 273.365818][ C1] index 88 is out of range for type 'const int[34]' [ 273.366885][ C1] CPU: 1 PID: 8150 Comm: udevd Not tainted syzkaller #0 [ 273.368085][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 273.369668][ C1] Call trace: [ 273.370177][ C1] dump_backtrace+0x1c4/0x1f0 [ 273.371010][ C1] show_stack+0x2c/0x3c [ 273.371684][ C1] __dump_stack+0x30/0x40 [ 273.372395][ C1] dump_stack_lvl+0xf4/0x15c [ 273.373206][ C1] dump_stack+0x1c/0x5c [ 273.373935][ C1] ubsan_epilogue+0x14/0x48 [ 273.374678][ C1] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 273.375618][ C1] aiptek_irq+0x186c/0x2360 [ 273.376395][ C1] __usb_hcd_giveback_urb+0x2ec/0x50c [ 273.377305][ C1] usb_hcd_giveback_urb+0x100/0x3a4 [ 273.378181][ C1] dummy_timer+0x7c8/0x2840 [ 273.378972][ C1] __hrtimer_run_queues+0x444/0xc58 [ 273.379803][ C1] hrtimer_run_softirq+0x164/0x408 [ 273.380645][ C1] handle_softirqs+0x318/0xc90 [ 273.381462][ C1] __do_softirq+0x14/0x20 [ 273.382173][ C1] ____do_softirq+0x14/0x20 [ 273.382904][ C1] call_on_irq_stack+0x30/0x48 [ 273.383701][ C1] do_softirq_own_stack+0x20/0x2c [ 273.384492][ C1] __irq_exit_rcu+0x23c/0x430 [ 273.385257][ C1] irq_exit_rcu+0x14/0x84 [ 273.385953][ C1] el1_interrupt+0x38/0x54 [ 273.386724][ C1] el1h_64_irq_handler+0x18/0x24 [ 273.387643][ C1] el1h_64_irq+0x64/0x68 [ 273.388456][ C1] cmpxchg_double_slab+0xec/0x2a8 [ 273.389326][ C1] __slab_free+0x94/0x260 [ 273.390040][ C1] ___cache_free+0x16c/0x19c [ 273.390839][ C1] qlink_free+0x5c/0xa0 [ 273.391574][ C1] qlist_free_all+0x3c/0xcc [ 273.392348][ C1] kasan_quarantine_reduce+0x124/0x130 [ 273.393266][ C1] __kasan_slab_alloc+0x2c/0x88 [ 273.394036][ C1] slab_post_alloc_hook+0x74/0x430 [ 273.394861][ C1] __kmem_cache_alloc_node+0x278/0x318 [ 273.395725][ C1] __kmalloc_node+0xc8/0x184 [ 273.396516][ C1] kvmalloc_node+0x88/0x1d4 [ 273.397219][ C1] evdev_open+0xd0/0x474 [ 273.397883][ C1] chrdev_open+0x3d0/0x51c [ 273.398596][ C1] do_dentry_open+0x738/0xf8c [ 273.399356][ C1] vfs_open+0x7c/0x90 [ 273.399972][ C1] path_openat+0x1fc0/0x27a0 [ 273.400703][ C1] do_filp_open+0x198/0x38c [ 273.401419][ C1] do_sys_openat2+0x134/0x3fc [ 273.402173][ C1] __arm64_sys_openat+0x11c/0x150 [ 273.403002][ C1] invoke_syscall+0x98/0x290 [ 273.403812][ C1] el0_svc_common+0x13c/0x258 [ 273.404585][ C1] do_el0_svc+0x5c/0x134 [ 273.405327][ C1] el0_svc+0x58/0x128 [ 273.406008][ C1] el0t_64_sync_handler+0x84/0xf0 [ 273.406832][ C1] el0t_64_sync+0x18c/0x190 [ 273.407518][ C1] ================================================================================ [ 273.676065][ T4376] usb 1-1: USB disconnect, device number 24 [ 273.677134][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 283.142848][ T8201] netlink: 'syz.1.1218': attribute type 10 has an invalid length.