last executing test programs: 15m0.659348874s ago: executing program 0 (id=549): write(0xffffffffffffffff, 0x0, 0x0) add_key$user(&(0x7f0000000200), &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000480), 0x0, 0xffffffffffffffff) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x1, @empty, 'ip6gre0\x00'}}, 0x1e) setsockopt$RXRPC_SECURITY_KEYRING(0xffffffffffffffff, 0x110, 0x2, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x420001, 0x187) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) userfaultfd(0x801) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000140)=0x200000000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x25) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000340)=ANY=[@ANYBLOB="0500000040f8030003000040"]) write$vhost_msg_v2(r2, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00'}) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000540)={'veth1_macvtap\x00', 0xc26d}) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) read$midi(r1, &(0x7f0000000100)=""/37, 0x25) 14m59.120979303s ago: executing program 0 (id=553): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x4) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000180)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 14m59.015894986s ago: executing program 0 (id=557): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x2, 0x200000000000001, 0x106) syz_io_uring_setup(0x460, &(0x7f0000000480)={0x0, 0x40000020, 0x10, 0x2, 0x339}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x2f, 0x1, 0x0, 0x4}]}, 0x8) r3 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r3, 0x0, 0xd0, 0x0, &(0x7f00000001c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000008) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r4, 0x400448e6, &(0x7f0000000380)) ioctl$sock_bt_hci(r4, 0x400448e7, 0x0) 14m57.696079941s ago: executing program 0 (id=561): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r1 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x1010412, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, 0x0) 14m56.232592645s ago: executing program 0 (id=567): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000700000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x20) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5) write$binfmt_misc(r1, &(0x7f0000000240), 0xfffffecc) ioctl$TIOCL_PASTESEL(r1, 0x541c, &(0x7f0000000000)) 14m54.821798609s ago: executing program 0 (id=572): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r3, 0x0, 0x0, 0x0) r4 = socket$isdn(0x22, 0x2, 0x26) bind$isdn(r4, &(0x7f0000000080), 0x6) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f00000000c0)=0x58, 0x5) 14m54.569226215s ago: executing program 32 (id=572): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r3, 0x0, 0x0, 0x0) r4 = socket$isdn(0x22, 0x2, 0x26) bind$isdn(r4, &(0x7f0000000080), 0x6) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f00000000c0)=0x58, 0x5) 14m52.228164232s ago: executing program 3 (id=581): ioctl$SG_SET_COMMAND_Q(0xffffffffffffffff, 0x2271, 0x0) socket$inet(0x2, 0x1, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x24, @short}, 0xa, &(0x7f0000000080)={0x0}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r5 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) tkill(r5, 0xb) utimensat(0xffffffffffffff9c, &(0x7f00000003c0)='.\x00', 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) 14m48.714876958s ago: executing program 3 (id=589): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000e40)=ANY=[@ANYBLOB="200000002b000b0000000000fcdbdf250a0000000c00018006000000884804"], 0x20}}, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYRES64], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) read$char_usb(r0, 0x0, 0x0) 14m45.638915913s ago: executing program 3 (id=597): bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x14, r1, 0x731, 0x0, 0x0, {0x38}}, 0x14}, 0x1, 0x2}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$video4linux(&(0x7f0000000240), 0x6000000, 0x10401) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x1c9243, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f018581c0bc0065666765f36f0f33f0100a660f3a0cb9000000752066b9800000c00f3a32c632c6004000a50f01d70f0901", 0x32}], 0x1, 0x54, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x8000000000000000, 0x900000001, 0x800000000, 0x45b, 0x0, 0x0, 0x7, 0x5, 0x0, 0xfc, 0xfffffffdfffffffc, 0xfdfffffffffffffc, 0x0, 0x9, 0x4000000000000004, 0x767], 0xeeef0000, 0x80082}) ioctl$KVM_RUN(r5, 0xae80, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000100)={0x2, 0x0, 0x94, &(0x7f0000000040)={0x6, 0x2, 0xc}}) 14m40.878723816s ago: executing program 3 (id=604): r0 = socket(0x2, 0x2, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r4, 0x0, 0x0) dup(0xffffffffffffffff) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, 0x0) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r6 = memfd_create(&(0x7f0000000680)='\x103q}2\x9a\xce\xaf^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99\x18\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1f\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\tRJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd99C\x9fF\x9c[M=\xa0^\xa8\xed)\xe8Z\xe8\x9b&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xc9\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8ZmH\x98\xaeb\xa5B5)\x80m\xff\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6\x05\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x19\x06U)j!\x91\'\x98\xd2kFN\xfa\x80)O\xb9(!n\x9d\x13\x15\xf1\x1a\xb8y\x14l\xd1', 0x7) ioctl$FS_IOC_RESVSP(r6, 0x402c5828, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x762}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f00000003c0)={0x385200080, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e) 14m37.562755427s ago: executing program 3 (id=616): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e78, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0x80}}]}, {0x2}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x800}, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = socket(0x1e, 0x1, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, 0x0, &(0x7f0000000100)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) 14m33.649106082s ago: executing program 3 (id=623): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001000700000005000400030000000900020073797a3100"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010101}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) 14m17.63045217s ago: executing program 33 (id=623): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001000700000005000400030000000900020073797a3100"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010101}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) 11m28.973736474s ago: executing program 1 (id=1571): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000800"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r1, 0xe4}, 0x18) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNGETVNETLE(r2, 0x4010744d, &(0x7f0000000180)) 11m28.594126254s ago: executing program 1 (id=1575): epoll_create1(0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) epoll_create1(0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000002780), 0x0, 0x24004c41) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 11m27.653756341s ago: executing program 1 (id=1579): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009e0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32=r0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1, 0x0, 0x4}, 0x18) socket$tipc(0x1e, 0x5, 0x0) 11m26.65308602s ago: executing program 1 (id=1582): capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000000)={0x0, 0x9, 0x0, 0x0, 0x0, 0x8000}) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000340)={r2, 0x0, 0x0, 0x0, 0x1, [], [0x0, 0x7], [0x0, 0x80000002, 0x2], [0x0, 0x0, 0x1, 0x1]}) 11m26.427603083s ago: executing program 1 (id=1587): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000440)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) 11m25.23807549s ago: executing program 1 (id=1592): syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="0435"], 0x9) 11m9.25281944s ago: executing program 34 (id=1592): syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="0435"], 0x9) 2m34.732540505s ago: executing program 6 (id=3694): r0 = socket$inet6(0xa, 0x3, 0x38) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e24, 0x41200003, @mcast1, 0x5}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) io_uring_setup(0x7d4b, &(0x7f00000001c0)={0x0, 0xbaf3, 0x1, 0x2, 0x168}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000280)=@o_path={0x0, 0x0, 0x10}, 0x18) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x109443, 0x0) read(r2, 0x0, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xf338}], 0x1) 2m34.39701618s ago: executing program 6 (id=3695): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYBLOB="1700000700000000f6ffffff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETOWNER(r2, 0x400454cc, 0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f00000006c0)={r1, 0x58, &(0x7f0000000100)}, 0x87) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[]) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file5\x00', 0x2) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4}, 0x18) userfaultfd(0x400) r5 = mq_open(&(0x7f0000000000)='eth0\x00', 0x42, 0x0, 0x0) r6 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000080)) r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x11, 0x0) r8 = syz_io_uring_setup(0xd1, &(0x7f0000000480)={0x0, 0x41c3, 0x800, 0x0, 0x335}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000300)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r5, 0x3, 0x0}) io_uring_enter(r8, 0x47ba, 0x98f1, 0x20, 0x0, 0x0) mq_timedsend(r7, 0x0, 0x0, 0x6, 0x0) sendmmsg(r3, &(0x7f0000003e00)=[{{&(0x7f00000002c0)=@can={0x1d, r4}, 0x80, 0x0}}, {{&(0x7f00000001c0)=@ax25={{0x1d, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x4}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x80, 0x0}}], 0x2, 0x8084) 2m30.132528969s ago: executing program 6 (id=3712): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x22, &(0x7f00000001c0)=0x5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000003680)=@filter={'filter\x00', 0x42, 0x4, 0x460, 0xffffffff, 0x210, 0x318, 0x318, 0xffffffff, 0xffffffff, 0x408, 0x408, 0x408, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @private, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0xe8, 0x210, 0x1ba, {0x46010000, 0x2c000000000000}, [@common=@unspec=@limit={{0x48}, {0x0, 0xdf6, 0x0, 0x0, 0x0, 0x9}}, @common=@addrtype={{0x30}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, 'system_u:object_r:removable_device_t:s0\x00'}}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@TCPOPTSTRIP={0x40}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c0) 2m29.66215671s ago: executing program 6 (id=3715): syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESHEX, @ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x9013, 0x100, 0x4, 0x165}, &(0x7f0000000400)=0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000140)={&(0x7f0000001000)={[{0x0, 0x5, 0x3, 0x700}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r2, 0x0, 0x0, 0x0, 0x60, 0x1, {0x1}}) io_uring_enter(r3, 0x3517, 0x173d, 0x42, 0x0, 0x0) 2m24.538989293s ago: executing program 6 (id=3725): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='ramfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000900)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000100)='./file0\x00', 0x119000, 0x3c) mknodat$loop(r0, &(0x7f0000001600)='./file1\x00', 0xc000, 0x0) chdir(0x0) linkat(r0, &(0x7f0000000200)='./file1\x00', r0, &(0x7f0000000240)='./file0\x00', 0x0) rename(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./bus\x00') 2m23.497881772s ago: executing program 6 (id=3729): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0xc) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x58) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') read$FUSE(r0, &(0x7f0000000300)={0x2020}, 0x2020) mknod(&(0x7f00000002c0)='./file0\x00', 0x8000, 0x48) 2m8.364974681s ago: executing program 35 (id=3729): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0xc) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x58) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') read$FUSE(r0, &(0x7f0000000300)={0x2020}, 0x2020) mknod(&(0x7f00000002c0)='./file0\x00', 0x8000, 0x48) 10.986281522s ago: executing program 2 (id=4190): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000ac0)=@newtfilter={0x34, 0x28, 0xd27, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3, 0x9}, {}, {0x9, 0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x40c4) 10.434233265s ago: executing program 2 (id=4194): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) syz_usb_connect$uac1(0x4, 0x98, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003000000106b1d01014000010203010902860003010140750904000000010100000a24010600080201020904010000010200000904010101010200000b2402010c038f076d15630a24020198010f07347c09240202080001800209240201090108095909050109400206100507250100010700090402000001020000090402010101"], 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x60a80, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 8.658645533s ago: executing program 2 (id=4200): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) init_module(&(0x7f0000000500)=ANY=[@ANYBLOB="7f454c46022c0704090000000000000001003e000900000083000000000000004000000000000000ba0300000000000007000000030038000100010403000700000000600300000041f8000000000000fbffffffbfffffff7f0000000000000008000000000000000300000000000000c50400000000000024eb4eac75746856bf6ec924a5ac0ba7e99da40b2a32fad8121ba43831a44f5be7e6b2222dfb566ebd2fda9b221a03868ba8dbb302ea5ff26a5d4ff259a39680692571e15348f81ad7b3ecdf600053663bceee65fecfdcbc9a40351e6e5b18d7"], 0x78, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x900, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_open_dev$media(&(0x7f0000000640), 0x0, 0x0) ustat(0xfffffffffffffffd, &(0x7f0000000240)) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) preadv(r5, &(0x7f0000001d80)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x1, 0x9, 0x2) ioctl$MEDIA_IOC_ENUM_ENTITIES(r4, 0xc1007c01, &(0x7f0000000100)) 7.52589842s ago: executing program 2 (id=4203): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1801000000000000000000004b84ffec850000006d000000850000002a0000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r1, 0x5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @empty, 0xfffffffe}, 0x1c) close_range(r1, 0xffffffffffffffff, 0x0) 6.668792147s ago: executing program 8 (id=4206): r0 = socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x76, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'pimreg0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20048011}, 0x400c084) 5.983219183s ago: executing program 5 (id=4208): close(0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) timer_create(0x2, 0x0, &(0x7f0000000300)=0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x4c844) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000140)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000000c0)={"3c24139ed44aec57f2e2ad238a7b448ed886923c31d4b8affbf514fd00", r5}) mount(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000000)='ubifs\x00', 0x200000, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) chdir(&(0x7f00000000c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) creat(&(0x7f0000000580)='./file1\x00', 0x0) 5.52479736s ago: executing program 2 (id=4209): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x5, 0x0, &(0x7f0000000180)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x20) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000002c0)={0x2}) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) gettid() ioctl$VIDIOC_TRY_DECODER_CMD(0xffffffffffffffff, 0xc0585605, &(0x7f00000005c0)={0x1, 0x0, @raw_data=[0xb, 0x400008, 0x3002, 0x1, 0x8, 0x7f, 0xff, 0x6, 0x7, 0x8, 0x5, 0xd60, 0x80000004, 0x4, 0x1, 0xeb]}) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="6c6f636b206e6f6e6500c6818d0afe6e359d5c58c681fbbb74"], 0xa) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000280)='netlink_extack\x00', r4}, 0xfffffffffffffe5f) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'geneve1\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c00eee8140006001e0089e9aaa911d7c2290f0086dd1327c9166655e1be2cb9b1b141aba3f6c5609063382a0c1511fdf9435e3ffe46000000000000", 0x3e, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r7) sendmsg$ETHTOOL_MSG_DEBUG_SET(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100"], 0x44}}, 0x10) 5.3920855s ago: executing program 5 (id=4210): ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x12, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) sendmsg$inet6(r1, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)=[@hopopts={{0x70, 0x29, 0x36, {0x2c, 0xa, '\x00', [@jumbo={0xc2, 0x4, 0xfff}, @hao={0xc9, 0x10, @mcast1}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x9}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @generic={0x9, 0x1a, "b625f7266b68d7c2a12b8b3d103bcf4726dc8536c652321cf9c6"}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@local, r3}}}, @hopopts_2292={{0x28, 0x29, 0x36, {0x8, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x8c, 0x800}}, @pad1]}}}, @dstopts={{0x60, 0x29, 0x37, {0x2c, 0x8, '\x00', [@calipso={0x7, 0x40, {0x2, 0xe, 0x1c, 0x0, [0xfffffffffffffffd, 0x4, 0x100, 0xcb9, 0xffffffffffff8001, 0x10, 0x3]}}]}}}, @rthdrdstopts={{0x68, 0x29, 0x37, {0x89, 0x9, '\x00', [@enc_lim={0x4, 0x1, 0x9}, @padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0x3, 0x32, "2a95a3fe98f0dbbf0fd2cbd28fa12c2c0374c26d1d5afaeff8e386edad1575859fe3a621afc248c07893c8d027078799b533"}]}}}], 0x188}, 0x4000015) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001, 0x81}, 0x8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @loopback={0xff00000000000000}, 0x10000}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 5.190266018s ago: executing program 7 (id=4211): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/wireless\x00') prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) preadv(r0, &(0x7f00000026c0)=[{0x0}], 0x1, 0x15f, 0x0) 4.692294884s ago: executing program 4 (id=4212): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_MASTER={0x8, 0xa, r1}]}, 0x28}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 4.078038419s ago: executing program 7 (id=4213): r0 = socket$inet6(0xa, 0x3, 0x38) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000040)=0xeffe, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e24, 0x41200003, @mcast1, 0x5}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) io_uring_setup(0x7d4b, &(0x7f00000001c0)={0x0, 0xbaf3, 0x1, 0x2, 0x168}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000280)=@o_path={0x0, 0x0, 0x10}, 0x18) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x109443, 0x0) read(r2, 0x0, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xf338}], 0x1) 3.886322908s ago: executing program 5 (id=4214): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYBLOB="1700000700000000f6ffffff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETOWNER(r2, 0x400454cc, 0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f00000006c0)={r1, 0x58, &(0x7f0000000100)}, 0x87) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file5\x00', 0x2) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4}, 0x18) userfaultfd(0x400) r5 = mq_open(&(0x7f0000000000)='eth0\x00', 0x42, 0x0, 0x0) r6 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000080)) r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x11, 0x0) r8 = syz_io_uring_setup(0xd1, 0x0, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000300)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r5, 0x3, 0x0}) io_uring_enter(r8, 0x47ba, 0x98f1, 0x20, 0x0, 0x0) mq_timedsend(r7, 0x0, 0x0, 0x6, 0x0) sendmmsg(r3, &(0x7f0000003e00)=[{{&(0x7f00000002c0)=@can={0x1d, r4}, 0x80, 0x0}}, {{&(0x7f00000001c0)=@ax25={{0x1d, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x4}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x80, 0x0}}], 0x2, 0x8084) 3.855564691s ago: executing program 7 (id=4215): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000ac0)=@newtfilter={0x34, 0x28, 0xd27, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3, 0x9}, {}, {0x9, 0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x40c4) 3.845897784s ago: executing program 4 (id=4216): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1}, 0xc) r2 = syz_io_uring_setup(0x497, &(0x7f0000000200)={0x0, 0x4661, 0x0, 0x3, 0x8b}, &(0x7f0000000400)=0x0, &(0x7f0000000380)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x0, 0x0}) io_uring_enter(r2, 0x40f9, 0x217, 0xa5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$pagemap(0x0, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffed3) 3.797934622s ago: executing program 2 (id=4217): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair(0x1, 0x80001, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket(0x2, 0x80805, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x7, &(0x7f0000000200)=0x1, 0x4) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x4004885) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000004c00)=""/102392, 0x18ff8) socket(0x2b, 0xd, 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_GET(r4, 0x4b72, &(0x7f00000000c0)={0x1, 0x4000001, 0x24e, 0x20, 0x2f, &(0x7f0000000e40)}) pwrite64(r1, 0x0, 0x0, 0x7) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x40, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4044004) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2.671357067s ago: executing program 4 (id=4218): prlimit64(0x0, 0x7, &(0x7f0000000140)={0x8, 0x8b}, 0x0) epoll_create1(0x0) 2.660187691s ago: executing program 5 (id=4219): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2.659039878s ago: executing program 7 (id=4220): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xd2f0}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x0, 0x7a}, 0x8) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) lsm_list_modules(0x0, 0xffffffffffffffff, 0x0) r4 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x8080, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x1a) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$EVIOCGPROP(r5, 0x40047438, &(0x7f0000000180)=""/246) write$binfmt_aout(r5, &(0x7f0000000340)=ANY=[@ANYBLOB="c02102"], 0x20) userfaultfd(0x80801) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="cc00000077e7b633de7197709190b9556efa8e82af0d25986b00177cc92c95526c78a0a74bcb1c2db1b1f48b10cd9f300ba8305c4925d52aa46e8417e5c2be48c4209711adf35cd9e0f88e44cb21eb0735eeab7e5f5ea6f7a29b62b48c496460090005ee9d0a8d66a7aee96d25e2", @ANYRES16=0x0], 0xcc}, 0x1, 0x0, 0x0, 0x4004050}, 0x4000000) sendmsg$netlink(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100001f0001000000000000000000040100804c"], 0x114}], 0x1}, 0x0) 2.489209464s ago: executing program 8 (id=4221): r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x48, r0, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x29, 0x33, @action_no_ack={{{0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}, {0x9}, @broadcast, @device_a, @initial, {0x2, 0x4}, @value=@ver_80211n={0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}}, @addba_resp={0x3, 0x1, {0x3, 0x26, {0x0, 0x0, 0xe, 0x4}, 0x2}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 2.391882709s ago: executing program 4 (id=4222): epoll_create1(0x0) eventfd2(0x3, 0x1) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) socket$unix(0x1, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r3, @ANYBLOB="080002"], 0x40}}, 0x8080) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) 1.430713485s ago: executing program 5 (id=4223): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x20002) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = open(0x0, 0x30000, 0x1b0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, 0x0, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, 0x0, 0x4802) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000480), 0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) 1.429099405s ago: executing program 7 (id=4224): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/wireless\x00') prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) preadv(r0, &(0x7f00000026c0)=[{0x0}], 0x1, 0x15f, 0x0) 1.4284652s ago: executing program 8 (id=4225): r0 = socket$inet6(0xa, 0x3, 0x38) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000040)=0xeffe, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e24, 0x41200003, @mcast1, 0x5}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) io_uring_setup(0x7d4b, &(0x7f00000001c0)={0x0, 0xbaf3, 0x1, 0x2, 0x168}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000280)=@o_path={0x0, 0x0, 0x10}, 0x18) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x109443, 0x0) read(r2, 0x0, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xf338}], 0x1) 1.427611738s ago: executing program 4 (id=4226): syz_open_dev$vim2m(0x0, 0x2000000f5, 0x2) syz_open_dev$sndpcmc(0x0, 0x0, 0xa340658bc40d4f52) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) getdents64(r0, &(0x7f0000000480)=""/243, 0xf3) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_udp(0x2, 0x2, 0x0) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000800)=ANY=[@ANYBLOB="7c0000007d01000000630000000900000000010000000300000000000000000015290b000000ff07000000000000000000000300237d5d010026280073797374656d5f753a6f626a6563745f723a72656d6f7661626c655f646576696365d952bbd58141e8feb15b296fc49a5f743a7330000400235b212f040047504c00", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYRES32=r3], 0x7c) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f00000003c0)={0x0, 0x1, {0x2, 0x0, 0x9, 0x2, 0xb3}, 0x3}) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@allocspi={0x100, 0x16, 0x1, 0x70bd2b, 0x25dfdbfe, {{{@in=@private=0xa010101, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e23, 0x0, 0x4e24, 0x0, 0xa, 0x80, 0x20, 0x1d}, {@in6=@local, 0x4d9, 0x33}, @in=@dev={0xac, 0x14, 0x14, 0x10}, {0x8, 0x7b5, 0x0, 0x6, 0x9, 0xfffffffffffffffa, 0xffffffff, 0x3}, {0x2, 0x3, 0x1, 0xfffffffffffffffa}, {0x0, 0x10001, 0xfffffff9}, 0x70bd2a, 0x0, 0x0, 0x2, 0x6, 0x1}, 0x8, 0x74f}, [@XFRMA_IF_ID={0x8, 0x1f, 0x4}]}, 0x100}, 0x1, 0x0, 0x0, 0x10}, 0x400c8c0) 1.095339682s ago: executing program 8 (id=4227): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000080)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYBLOB="010025bd7000ffdbdf253b00000008000300", @ANYRES32=r1, @ANYBLOB="29003300d0980700ffffffffffff080211000000505050505050020004"], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x44050) 833.295391ms ago: executing program 4 (id=4228): socket$netlink(0x10, 0x3, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x5) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_init(0x202, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0x79a8, 0x8, 0x1, 0x5000032f}, &(0x7f00000006c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 794.012661ms ago: executing program 8 (id=4229): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x4001) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000001c0)={0x1c, r1, 0x800, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000400)="25eed0aee8c79f49b53c108367401019c41e56367aa3f23916ddf42df6a5ca47adc0f14939ee362a401f6425b5933ed45ac2e4089f33e87ea4fa53cb6f37fa25746f5805cefb6f78a3d525962f72cff39e3fd9074e3260c84fdfced1c00ba3c8cfcd6220a22b568b9ea6d0e366394ae3490b19d046c22e484b0aa11954836b45d4047ab5007b7b758a16f51f05661f02e1cc365db0bf3b54c3c468a8b5462008bc5ffb9db10bed599639774620b78184ada2301d9d494c2c7622d859213c2d7cc96412661b8f8afb818669f98776b43d6f8c598c00e43ade1e0808a35608882523edf4820dc6b1de1a71cb3dcec7265acaaeab264a1082660423eaf763e3d5e6756b9d2e4115906f4284e5e11388dae00c59c49d5bdc02592fbd96f69a586c8e6f36af50d6de76993809225f4a7dfbd1e7feee4438420c40ee1587ef9279cba9847f32d185f2405d680fd8776df5edc7c149279dc808c693dab77ec90071fff6b0b63f5eaadf5e2118dbeebbeb235b90b8b1b871af2ebc579d404578310950526b7be662a9d89be66d6a02522e7352357c02c3a56f8ff816331bd070041ba511613602956381e6d78b645d02dbc77a188168b6312a0998fe17cfd2940c8e5d39e5a95c50f8b0cee4a9c145b23997f830c08fe2e8af162363f4e14d78fd1275af0192483de50d521d85ed5dd21e51e9fba69d7c208ae998c914f5a2393f0594abb1228eb6df78d022707d2e705854e20338e898482ced2d8b853d8cd972bf7d2df97c7fbc2fffb60e9ec9335bf4e98c6d53244dabe2d1d038c75476b620b9263bda96ec2c61f3306dfcfb9f023c3c9678e0ef245b8c3de356f4c4dfe2d791e213b592f8106467517bd0eb3be609108ac41507edb9029c1975fe0c08e461b66b0850a9faf160e658fd770266fa0c70deab155084869592563fe0c136728a2999c6a5d40891a0de089cec58b1ffe2d40e44513b3d51c8c34935b75a351d0d7f9049e6e488585c819437a4e7b338cd5772a744fe79a21327f919ef4bdb9936a5dccd353a45e2642b8cad7aea0152de1d15577c37eff9fc206115e1ed9612183f5aa55ba23b2e2b77432f038b3cc3f0c189414de1402b002ba4464448d74fac86d1ab674a4eb3d8b6e8af11ee37145026fdedb952097fa069ddd516a76c8a647c0faf5a47a75a7294b0eba99291457e4614f0e985bd363de3593590e6f303e511220ce37e1e66711dac26dadaa5f26ab172ef6c7a2f53ed66c0813867e1d53e769efafac557c3977836517f216c53625d8752073fed32346d274613fef1f874d71a632a48220978d6efbf4fb938a46777f05b10cc71d1996772e2536a22b171e2cabffb9099e73026e56210a6162140681048fa9e55388619d83278ea60e5421eaade222b61237aae0d6684f19e090d88da58d0", 0x3f1, 0x4000, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000240)={[0x8, 0x5, 0x1, 0x3, 0x9, 0x9, 0x9, 0x9, 0x21, 0x7, 0x9380000, 0x8, 0x6, 0x9, 0x1, 0x6], 0x80a0000, 0x291842}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000180)="0f7512660fe0860800d9fa0f01cb660f38808403003ea40f16d50f20000f01c867d1d6", 0x23}], 0x1, 0x10, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000cc0)={0x0, 0x21c}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 754.82387ms ago: executing program 5 (id=4230): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYBLOB="1700000700000000f6ffffff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETOWNER(r2, 0x400454cc, 0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f00000006c0)={r1, 0x58, &(0x7f0000000100)}, 0x87) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file5\x00', 0x2) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4}, 0x18) userfaultfd(0x400) r5 = mq_open(&(0x7f0000000000)='eth0\x00', 0x42, 0x0, 0x0) r6 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000080)) r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x11, 0x0) r8 = syz_io_uring_setup(0xd1, 0x0, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000300)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r5, 0x3, 0x0}) io_uring_enter(r8, 0x47ba, 0x98f1, 0x20, 0x0, 0x0) mq_timedsend(r7, 0x0, 0x0, 0x6, 0x0) sendmmsg(r3, &(0x7f0000003e00)=[{{&(0x7f00000002c0)=@can={0x1d, r4}, 0x80, 0x0}}, {{&(0x7f00000001c0)=@ax25={{0x1d, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x4}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x80, 0x0}}], 0x2, 0x8084) 152.933211ms ago: executing program 7 (id=4231): openat(0xffffffffffffff9c, 0x0, 0x0, 0x72) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) 0s ago: executing program 8 (id=4232): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000300)={0x0, 0x9c}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) io_uring_setup(0x93d, &(0x7f0000000080)={0x0, 0x70e6, 0x2, 0x2, 0x119}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r4, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x9}}, 0x40) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee00}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010101, 0x4d5, 0x32}, 0x0, @in6=@loopback, 0x1, 0x3, 0x0, 0xb7, 0x1fb, 0xffffffff}}, 0xe8) bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) sendmmsg(r0, &(0x7f0000000180), 0x400000000000077, 0x7600) kernel console output (not intermixed with test programs): video103 deregistered [ 767.207584][T14123] em28xx 7-1:0.89: Registering snapshot button... [ 767.223214][T14123] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input39 [ 767.262829][T14123] em28xx 7-1:0.89: Remote control support is not available for this card. [ 767.362879][ T48] em28xx 7-1:0.89: Closing input extension [ 767.368746][ T48] em28xx 7-1:0.89: Deregistering snapshot button [ 767.451160][ T48] em28xx 7-1:0.89: Freeing device [ 768.051574][T14123] hid-generic 0002:0081:0005.0014: item fetching failed at offset 7/27 [ 768.063158][T14123] hid-generic 0002:0081:0005.0014: probe with driver hid-generic failed with error -22 [ 768.237550][T15400] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2974'. [ 768.507226][T14123] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 769.612817][T14123] usb 7-1: Using ep0 maxpacket: 32 [ 769.665042][T14123] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 769.770294][T14123] usb 7-1: config 0 has no interface number 0 [ 769.843027][T14123] usb 7-1: config 0 interface 89 has no altsetting 0 [ 769.932967][T14123] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 770.035440][T14123] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.132319][T14123] usb 7-1: Product: syz [ 770.172971][T14123] usb 7-1: Manufacturer: syz [ 770.208413][T14123] usb 7-1: SerialNumber: syz [ 770.260441][T14123] usb 7-1: config 0 descriptor?? [ 770.271964][T14123] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 770.311979][T14123] em28xx 7-1:0.89: Video interface 89 found: bulk [ 770.328979][T15422] syzkaller0: entered promiscuous mode [ 770.338706][T15422] syzkaller0: entered allmulticast mode [ 770.596476][T15428] Invalid source name [ 770.600840][T15428] UBIFS error (pid: 15428): cannot open "/dev/sg0", error -22 [ 770.711466][T15431] input: syz0 as /devices/virtual/input/input40 [ 770.760399][T15369] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 771.592664][T14123] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 772.378000][T15369] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 772.795357][T15369] usb 6-1: New USB device found, idVendor=056e, idProduct=00e6, bcdDevice= 0.00 [ 772.804573][T15369] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.814989][T15369] usb 6-1: config 0 descriptor?? [ 773.145574][T14123] em28xx 7-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 773.153759][T14123] em28xx 7-1:0.89: board has no eeprom [ 773.220178][T14123] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 773.244900][T12831] Bluetooth: hci5: unexpected event for opcode 0x0c25 [ 773.314908][T14123] em28xx 7-1:0.89: analog set to bulk mode. [ 773.361638][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 773.387613][ T5897] em28xx 7-1:0.89: Registering V4L2 extension [ 773.405431][T14123] usb 7-1: USB disconnect, device number 23 [ 773.539761][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 773.553197][ T5897] em28xx 7-1:0.89: reading from i2c device at 0x4a failed (error=-19) [ 774.342244][T14123] em28xx 7-1:0.89: Disconnecting em28xx [ 774.383369][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 774.406071][ T5897] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 774.421488][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 774.435828][ T5897] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 774.522433][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 774.529445][ T5897] em28xx 7-1:0.89: No AC97 audio processor [ 774.543357][ T30] audit: type=1400 audit(1753818141.614:899): avc: denied { read } for pid=15454 comm="syz.2.2995" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 774.653769][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 774.670573][ T5897] usb 7-1: Decoder not found [ 774.692185][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 774.700398][ T5897] em28xx 7-1:0.89: failed to create media graph [ 774.730148][ T5897] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 774.736902][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 774.757103][ T5897] em28xx 7-1:0.89: Registering snapshot button... [ 774.763595][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.178456][ T5897] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input41 [ 775.189322][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.197124][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.205736][ T5897] em28xx 7-1:0.89: Remote control support is not available for this card. [ 775.215681][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.223303][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.230311][T14123] em28xx 7-1:0.89: Closing input extension [ 775.236134][T14123] em28xx 7-1:0.89: Deregistering snapshot button [ 775.242623][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.249581][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.257546][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.270090][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.277064][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.286594][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.293616][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.300612][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.307567][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.322883][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.363002][T14123] em28xx 7-1:0.89: Freeing device [ 775.375851][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.385281][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.392800][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.406849][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.418642][T15464] Invalid source name [ 775.422645][T15464] UBIFS error (pid: 15464): cannot open "/dev/sg0", error -22 [ 775.534512][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.549197][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 775.566967][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.048514][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.071806][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.079233][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.091784][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.103076][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.110408][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.118446][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.125648][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.137000][T15469] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 776.145846][T15469] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 776.156451][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.229617][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.243146][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.256321][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.338518][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.388367][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.441594][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.493153][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.546354][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.565237][ T48] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 776.604707][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.667808][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.703795][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.817270][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.838934][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 776.850043][ T48] usb 5-1: Using ep0 maxpacket: 32 [ 777.331990][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.348904][ T48] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 777.370018][T14123] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 777.389386][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.409051][ T48] usb 5-1: config 0 has no interface number 0 [ 777.519037][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.536284][ T48] usb 5-1: config 0 interface 89 has no altsetting 0 [ 777.580454][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.595655][T14123] usb 7-1: Using ep0 maxpacket: 32 [ 777.615397][ T48] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 777.625296][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.632446][T14123] usb 7-1: unable to get BOS descriptor or descriptor too short [ 777.656823][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.679620][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.692538][T14123] usb 7-1: config 0 has an invalid interface number: 143 but max is 0 [ 777.707227][ T48] usb 5-1: Product: syz [ 777.716048][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.724982][T14123] usb 7-1: config 0 has no interface number 0 [ 777.733326][ T48] usb 5-1: Manufacturer: syz [ 777.738098][ T48] usb 5-1: SerialNumber: syz [ 777.749990][T14123] usb 7-1: config 0 interface 143 has no altsetting 0 [ 777.756873][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.783532][ T48] usb 5-1: config 0 descriptor?? [ 777.788607][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.799241][T14123] usb 7-1: New USB device found, idVendor=13b1, idProduct=0041, bcdDevice=b0.69 [ 777.814246][ T48] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 777.823932][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.834077][T14123] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.847940][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.855203][ T48] em28xx 5-1:0.89: Video interface 89 found: bulk [ 777.864355][T14123] usb 7-1: Product: syz [ 777.877451][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 777.884926][T14123] usb 7-1: Manufacturer: syz [ 777.907302][T14123] usb 7-1: SerialNumber: syz [ 777.930208][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 778.009815][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 778.037941][T14123] r8152-cfgselector 7-1: Unknown version 0x0000 [ 778.084536][T14123] r8152-cfgselector 7-1: config 0 descriptor?? [ 778.093839][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 778.114235][T14123] r8152 7-1:0.143: Expected endpoints are not found [ 778.121040][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 778.138223][T15369] elecom 0003:056E:00E6.0015: unknown main item tag 0x0 [ 778.157041][T15369] elecom 0003:056E:00E6.0015: hidraw0: USB HID v0.00 Device [HID 056e:00e6] on usb-dummy_hcd.5-1/input0 [ 778.187308][T15369] usb 6-1: USB disconnect, device number 39 [ 778.317628][ T5913] r8152-cfgselector 7-1: USB disconnect, device number 24 [ 778.469557][ T48] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 778.585771][T15499] overlayfs: failed to resolve './file1': -2 [ 779.213162][ T48] em28xx 5-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 779.489991][ T48] em28xx 5-1:0.89: board has no eeprom [ 779.760280][ T48] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 779.791850][ T48] em28xx 5-1:0.89: analog set to bulk mode. [ 779.861417][T15369] em28xx 5-1:0.89: Registering V4L2 extension [ 779.944937][ T48] usb 5-1: USB disconnect, device number 40 [ 779.995586][T15520] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3016'. [ 780.008001][T15520] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 780.016752][T15520] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 780.026178][T15520] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 780.029603][ T48] em28xx 5-1:0.89: Disconnecting em28xx [ 780.035407][T15520] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 780.069563][T15369] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 780.077355][T15520] vxlan0: entered promiscuous mode [ 780.182150][T15369] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 780.214702][T15369] em28xx 5-1:0.89: No AC97 audio processor [ 780.733929][T15369] usb 5-1: Decoder not found [ 780.746325][T15369] em28xx 5-1:0.89: failed to create media graph [ 780.775196][T15369] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 780.795711][T15369] em28xx 5-1:0.89: Registering snapshot button... [ 780.803415][T15369] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input42 [ 780.835816][T15369] em28xx 5-1:0.89: Remote control support is not available for this card. [ 780.858498][T15528] fuse: Unknown parameter '0x0000000000000003' [ 780.920496][ T48] em28xx 5-1:0.89: Closing input extension [ 780.926414][ T48] em28xx 5-1:0.89: Deregistering snapshot button [ 780.959336][ T48] em28xx 5-1:0.89: Freeing device [ 780.983668][ T5913] hid-generic 0002:0081:0005.0016: item fetching failed at offset 7/27 [ 780.994228][ T5913] hid-generic 0002:0081:0005.0016: probe with driver hid-generic failed with error -22 [ 783.160110][ T5913] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 783.320376][ T5913] usb 7-1: Using ep0 maxpacket: 32 [ 783.337179][ T5913] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 783.396362][ T5913] usb 7-1: config 0 has no interface number 0 [ 783.432972][ T5913] usb 7-1: config 0 interface 89 has no altsetting 0 [ 783.452317][ T5913] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 783.463446][ T5913] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.481471][T15560] fuse: Invalid rootmode [ 783.487204][ T5913] usb 7-1: Product: syz [ 783.507623][ T5913] usb 7-1: Manufacturer: syz [ 783.518199][ T5913] usb 7-1: SerialNumber: syz [ 783.686581][ T5913] usb 7-1: config 0 descriptor?? [ 783.697914][ T5913] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 783.709630][ T5913] em28xx 7-1:0.89: Video interface 89 found: bulk [ 784.132336][T15568] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3032'. [ 784.590288][ T5913] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 784.614753][T15572] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3034'. [ 785.162285][T14123] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 785.650696][ T5913] em28xx 7-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 785.697131][ T5913] em28xx 7-1:0.89: board has no eeprom [ 785.802065][T14123] usb 5-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 785.813190][T14123] usb 5-1: config 0 interface 0 has no altsetting 0 [ 785.829814][T14123] usb 5-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 785.852872][T14123] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.991133][T14123] usb 5-1: config 0 descriptor?? [ 786.000320][ T5913] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 786.008163][ T5913] em28xx 7-1:0.89: analog set to bulk mode. [ 786.180138][ T9] em28xx 7-1:0.89: Registering V4L2 extension [ 786.212316][T15583] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 786.235664][ T5913] usb 7-1: USB disconnect, device number 25 [ 786.353658][ T5913] em28xx 7-1:0.89: Disconnecting em28xx [ 786.366110][ T9] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 786.394149][ T9] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 786.435149][ T9] em28xx 7-1:0.89: No AC97 audio processor [ 786.463053][ T9] usb 7-1: Decoder not found [ 786.475464][ T9] em28xx 7-1:0.89: failed to create media graph [ 786.489988][ T9] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 786.540661][ T9] em28xx 7-1:0.89: Registering snapshot button... [ 786.595795][ T9] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input43 [ 786.633718][T14123] uclogic 0003:5543:0042.0017: item fetching failed at offset 0/3 [ 786.657505][T14123] uclogic 0003:5543:0042.0017: parse failed [ 786.680034][T14123] uclogic 0003:5543:0042.0017: probe with driver uclogic failed with error -22 [ 786.694655][ T9] em28xx 7-1:0.89: Remote control support is not available for this card. [ 786.724231][T15602] fuse: Invalid rootmode [ 786.752893][ T5913] em28xx 7-1:0.89: Closing input extension [ 786.763988][ T5913] em28xx 7-1:0.89: Deregistering snapshot button [ 786.939452][T14123] usb 5-1: USB disconnect, device number 41 [ 786.964283][ T5913] em28xx 7-1:0.89: Freeing device [ 787.487775][T15608] Invalid source name [ 787.491873][T15608] UBIFS error (pid: 15608): cannot open "/dev/sg0", error -22 [ 787.631269][ T976] hid-generic 0002:0081:0005.0018: item fetching failed at offset 7/27 [ 787.755106][ T976] hid-generic 0002:0081:0005.0018: probe with driver hid-generic failed with error -22 [ 788.051045][T15622] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3048'. [ 788.457456][T15623] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3049'. [ 789.612396][T15639] fuse: Unknown parameter 'group_i00000000000000000000' [ 790.135041][T15645] input: syz0 as /devices/virtual/input/input44 [ 791.025113][T15656] hub 2-0:1.0: USB hub found [ 791.030955][T15656] hub 2-0:1.0: 1 port detected [ 791.402140][T15659] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3062'. [ 791.574097][ T30] audit: type=1400 audit(1753818158.664:900): avc: denied { write } for pid=15663 comm="syz.5.3063" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 792.021437][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 792.031049][ T5832] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 792.041078][ T5832] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 792.049886][ T5832] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 792.059786][T15557] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 792.118174][ T5832] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 792.239007][T15670] lo speed is unknown, defaulting to 1000 [ 792.563834][T15557] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.484020][ T5832] Bluetooth: hci0: command tx timeout [ 794.908895][T15557] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 795.475842][T15557] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 795.709213][T15670] chnl_net:caif_netlink_parms(): no params data found [ 796.690101][ T5832] Bluetooth: hci0: command tx timeout [ 797.447694][T15670] bridge0: port 1(bridge_slave_0) entered blocking state [ 797.450066][ T48] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 797.458079][T15670] bridge0: port 1(bridge_slave_0) entered disabled state [ 797.474097][T15670] bridge_slave_0: entered allmulticast mode [ 797.488637][T15670] bridge_slave_0: entered promiscuous mode [ 797.514198][T15670] bridge0: port 2(bridge_slave_1) entered blocking state [ 797.525438][T15670] bridge0: port 2(bridge_slave_1) entered disabled state [ 797.535755][T15670] bridge_slave_1: entered allmulticast mode [ 797.555848][T15670] bridge_slave_1: entered promiscuous mode [ 797.661530][ T48] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 797.676397][ T48] usb 7-1: config 0 has no interfaces? [ 797.690344][ T48] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 797.716293][ T48] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.749107][ T48] usb 7-1: config 0 descriptor?? [ 798.281109][ T5913] hid-generic 0002:0081:0005.0019: item fetching failed at offset 7/27 [ 798.289851][ T5913] hid-generic 0002:0081:0005.0019: probe with driver hid-generic failed with error -22 [ 798.636692][T14123] usb 7-1: USB disconnect, device number 26 [ 798.719233][ T5832] Bluetooth: hci0: command tx timeout [ 798.936381][T15557] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 798.975225][T15557] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 798.989522][T15557] bond0 (unregistering): Released all slaves [ 799.245221][T15770] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3088'. [ 799.553292][T15670] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 799.586182][T15754] syzkaller0: entered promiscuous mode [ 799.611935][T15754] syzkaller0: entered allmulticast mode [ 799.687494][T15777] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3089'. [ 799.721588][T15770] IPVS: Error joining to the multicast group [ 799.728274][T15557] k›*·]‘: left promiscuous mode [ 799.762406][T15670] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 799.968352][T15557] tipc: Disabling bearer [ 799.980297][T15557] tipc: Disabling bearer [ 799.988281][T15557] tipc: Disabling bearer [ 800.020036][T15557] tipc: Left network mode [ 800.586520][T15670] team0: Port device team_slave_0 added [ 800.790013][ T5832] Bluetooth: hci0: command tx timeout [ 801.160627][T15670] team0: Port device team_slave_1 added [ 801.707082][T15799] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3094'. [ 801.806672][T15802] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3093'. [ 803.035161][T15799] tmpfs: Bad value for 'mpol' [ 803.329765][T15799] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3094'. [ 803.430895][T15670] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 803.437861][T15670] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 803.468462][T15670] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 803.481637][T15670] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 803.488601][T15670] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 803.516683][T15670] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 804.682330][T15670] hsr_slave_0: entered promiscuous mode [ 804.693116][T15670] hsr_slave_1: entered promiscuous mode [ 805.135726][T15670] debugfs: 'hsr0' already exists in 'hsr' [ 805.141574][T15670] Cannot create hsr debugfs directory [ 805.148406][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.156359][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.164150][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.171934][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.179674][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.187593][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.195389][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.203284][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.212273][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.220160][T15823] netlink: 'syz.5.3101': attribute type 3 has an invalid length. [ 805.755245][T15557] hsr_slave_0: left promiscuous mode [ 805.769009][T15557] hsr_slave_1: left promiscuous mode [ 805.780573][T15557] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 805.803269][T15557] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 806.804619][T15858] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3109'. [ 806.933510][ T30] audit: type=1400 audit(1753818174.024:901): avc: denied { write } for pid=15859 comm="syz.2.3110" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 807.032048][T15557] team0 (unregistering): Port device team_slave_1 removed [ 807.096573][T15557] team0 (unregistering): Port device team_slave_0 removed [ 807.404317][T15836] syzkaller0: entered promiscuous mode [ 807.418460][T15836] syzkaller0: entered allmulticast mode [ 807.450490][ T976] lo speed is unknown, defaulting to 1000 [ 807.473116][ T976] infiniband syz0: ib_query_port failed (-19) [ 810.172127][ T5832] Bluetooth: Frame is too long (len 18, expected len 4) [ 810.612462][T15896] syzkaller0: entered promiscuous mode [ 810.618392][T15896] syzkaller0: entered allmulticast mode [ 810.916333][T15670] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 810.961631][T15670] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 811.014248][T15670] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 811.054949][T15670] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 811.614784][T15919] Invalid source name [ 811.618957][T15919] UBIFS error (pid: 15919): cannot open "/dev/sg0", error -22 [ 811.987382][T15670] 8021q: adding VLAN 0 to HW filter on device bond0 [ 812.125657][T15927] validate_nla: 43 callbacks suppressed [ 812.125675][T15927] netlink: 'syz.6.3132': attribute type 4 has an invalid length. [ 812.253344][T15670] 8021q: adding VLAN 0 to HW filter on device team0 [ 812.275334][ T8102] bridge0: port 1(bridge_slave_0) entered blocking state [ 812.282477][ T8102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 812.828274][T15557] bridge0: port 2(bridge_slave_1) entered blocking state [ 812.835392][T15557] bridge0: port 2(bridge_slave_1) entered forwarding state [ 812.894897][T15670] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 813.124498][T15948] syzkaller0: entered promiscuous mode [ 813.148550][T15948] syzkaller0: entered allmulticast mode [ 813.151705][T15949] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3136'. [ 815.739173][T15670] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 816.559028][T15983] fuse: Unknown parameter 'user_i00000000000000000000' [ 816.647388][T15670] veth0_vlan: entered promiscuous mode [ 816.664242][T15670] veth1_vlan: entered promiscuous mode [ 816.804914][T15670] veth0_macvtap: entered promiscuous mode [ 816.953685][T15993] 9pnet: Unknown protocol version 9p200 [ 817.276405][T15670] veth1_macvtap: entered promiscuous mode [ 817.296434][T15670] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 817.308410][T15670] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 817.334010][T15670] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.360135][T15670] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.380103][T15670] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.403968][T15670] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.547039][T15999] syzkaller0: entered promiscuous mode [ 817.552674][T15999] syzkaller0: entered allmulticast mode [ 817.817761][T10441] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 817.856341][T10441] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 817.897711][ T5966] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 817.906375][ T5966] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 817.920132][T16008] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3153'. [ 819.876694][ T30] audit: type=1400 audit(1753818186.944:902): avc: denied { getopt } for pid=16030 comm="syz.6.3158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 820.528817][T16039] 9pnet: Unknown protocol version 9p200 [ 821.307002][T16044] syzkaller0: entered promiscuous mode [ 821.316068][T16044] syzkaller0: entered allmulticast mode [ 821.588886][T16054] 9pnet: Found fid 0 not clunked [ 821.630240][ T30] audit: type=1400 audit(1753818188.714:903): avc: denied { mount } for pid=16055 comm="syz.5.3168" name="/" dev="pstore" ino=3187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 821.690409][ T48] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 821.736748][T16066] fuse: Bad value for 'user_id' [ 821.760405][T16066] fuse: Bad value for 'user_id' [ 821.938330][ T48] usb 5-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 821.948646][ T48] usb 5-1: config 0 interface 0 has no altsetting 0 [ 821.978356][ T48] usb 5-1: New USB device found, idVendor=05ac, idProduct=027a, bcdDevice= 0.00 [ 822.007461][ T48] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 822.160719][ T48] usb 5-1: config 0 descriptor?? [ 822.560239][ T48] usbhid 5-1:0.0: can't add hid device: -71 [ 822.566774][ T48] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 822.633842][ T48] usb 5-1: USB disconnect, device number 42 [ 823.220844][T16090] Invalid source name [ 823.231565][T16090] UBIFS error (pid: 16090): cannot open "/dev/sg0", error -22 [ 823.857486][T16095] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3179'. [ 824.930485][T16107] fuse: Bad value for 'user_id' [ 824.938771][T16107] fuse: Bad value for 'user_id' [ 825.060029][ T48] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 825.259962][ T48] usb 6-1: Using ep0 maxpacket: 32 [ 825.268803][ T48] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 825.288913][ T48] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 825.309544][ T48] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 825.407982][ T48] usb 6-1: config 0 descriptor?? [ 825.416878][ T48] hub 6-1:0.0: bad descriptor, ignoring hub [ 825.434345][ T48] hub 6-1:0.0: probe with driver hub failed with error -5 [ 825.447550][ T48] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 826.534756][ T5832] Bluetooth: Frame is too long (len 18, expected len 4) [ 828.232531][ T5913] usb 6-1: reset high-speed USB device number 40 using dummy_hcd [ 828.262869][ T5913] usb 6-1: device reset changed ep0 maxpacket size! [ 828.306858][ T5913] usb 6-1: USB disconnect, device number 40 [ 828.662215][ T5913] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 828.821322][ T5913] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 828.841292][ T5913] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 828.865122][ T5913] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 828.879702][ T5832] Bluetooth: hci5: unexpected event for opcode 0x0c25 [ 828.914306][ T5913] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.948192][ T5913] usb 6-1: config 0 descriptor?? [ 829.737044][T16172] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3205'. [ 830.340038][ T30] audit: type=1400 audit(1753818197.404:904): avc: denied { shutdown } for pid=16188 comm="syz.7.3209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 830.409982][ T976] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 831.144167][ T5913] usb 6-1: USB disconnect, device number 41 [ 831.211713][ T976] usb 7-1: Using ep0 maxpacket: 32 [ 831.218246][ T976] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 831.230276][ T976] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 831.250616][ T976] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 831.260551][ T976] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.277658][ T976] usb 7-1: config 0 descriptor?? [ 831.297501][ T976] hub 7-1:0.0: USB hub found [ 831.832039][ T976] hub 7-1:0.0: config failed, can't read hub descriptor (err -22) [ 831.898169][ T5913] hid-generic 0002:0081:0005.001A: item fetching failed at offset 7/27 [ 831.999159][ T5913] hid-generic 0002:0081:0005.001A: probe with driver hid-generic failed with error -22 [ 832.243493][ T976] usbhid 7-1:0.0: can't add hid device: -71 [ 832.304435][ T976] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 832.360942][ T976] usb 7-1: USB disconnect, device number 27 [ 832.503076][T16218] tipc: Started in network mode [ 832.507953][T16218] tipc: Node identity 7f000001, cluster identity 4711 [ 832.515134][T16218] tipc: Enabled bearer , priority 10 [ 832.670027][T14123] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 832.872991][T14123] usb 6-1: Using ep0 maxpacket: 8 [ 832.923204][T14123] usb 6-1: unable to get BOS descriptor or descriptor too short [ 832.980406][T14123] usb 6-1: config 2 has an invalid interface number: 194 but max is 0 [ 832.990078][T14123] usb 6-1: config 2 has no interface number 0 [ 833.030258][T14123] usb 6-1: config 2 interface 194 has no altsetting 0 [ 833.052521][T14123] usb 6-1: New USB device found, idVendor=06cb, idProduct=0002, bcdDevice=22.b9 [ 833.078622][T14123] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.099657][T14123] usb 6-1: Product: syz [ 833.108056][T14123] usb 6-1: Manufacturer: syz [ 833.141709][T14123] usb 6-1: SerialNumber: syz [ 833.179846][T16229] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3222'. [ 833.196828][ T5832] Bluetooth: hci5: unexpected cc 0x0c58 length: 4 > 2 [ 833.205173][ T5832] Bluetooth: hci5: unexpected event for opcode 0x0c58 [ 833.438235][T14123] usb 6-1: selecting invalid altsetting 1 [ 833.445547][T14123] usb 6-1: Can not set alternate setting to 1, error: -22 [ 833.456334][T14123] synaptics_usb 6-1:2.194: probe with driver synaptics_usb failed with error -22 [ 833.488015][T14123] usb 6-1: USB disconnect, device number 42 [ 833.631062][ T48] tipc: Node number set to 2130706433 [ 833.826991][T16232] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3223'. [ 836.472752][ T976] hid-generic 0002:0081:0005.001B: item fetching failed at offset 7/27 [ 836.594763][ T976] hid-generic 0002:0081:0005.001B: probe with driver hid-generic failed with error -22 [ 837.322710][T16262] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3233'. [ 838.030137][ T5832] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 838.039931][ T5832] Bluetooth: hci5: Injecting HCI hardware error event [ 838.047945][ T5832] Bluetooth: hci5: hardware error 0x00 [ 838.741139][T16275] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3236'. [ 839.233868][T16283] set match dimension is over the limit! [ 840.412253][ T5832] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 841.299971][ T976] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 841.980061][ T976] usb 7-1: Using ep0 maxpacket: 32 [ 841.999368][ T976] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 842.019778][ T976] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 842.030145][ T976] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 842.039196][ T976] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.256463][ T976] usb 7-1: config 0 descriptor?? [ 842.699035][ T5832] Bluetooth: Frame is too long (len 18, expected len 4) [ 843.057637][ T976] hub 7-1:0.0: USB hub found [ 843.182506][ T976] hub 7-1:0.0: config failed, can't read hub descriptor (err -22) [ 843.245798][T16331] fuse: Unknown parameter '0x0000000000000003' [ 843.468242][ T976] usbhid 7-1:0.0: can't add hid device: -71 [ 843.480906][ T976] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 843.996118][ T976] usb 7-1: USB disconnect, device number 28 [ 844.480041][ T48] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 844.694467][ T30] audit: type=1400 audit(1753818211.714:905): avc: denied { map } for pid=16351 comm="syz.4.3263" path="socket:[54640]" dev="sockfs" ino=54640 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 845.302329][ T30] audit: type=1400 audit(1753818212.324:906): avc: denied { cmd } for pid=16351 comm="syz.4.3263" path="socket:[54640]" dev="sockfs" ino=54640 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 845.500214][ T48] usb 6-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 845.500949][T16358] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3264'. [ 845.509274][ T48] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.610824][ T48] usb 6-1: config 0 descriptor?? [ 845.669918][ T48] usb 6-1: selecting invalid altsetting 1 [ 846.032111][ T48] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 846.112201][T16373] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=16373 comm=syz.5.3259 [ 847.585082][ T976] usb 6-1: USB disconnect, device number 43 [ 847.668851][T16387] binder: 16383:16387 unknown command 0 [ 847.692246][T16387] binder: 16383:16387 ioctl c0306201 2000000003c0 returned -22 [ 847.939960][ T30] audit: type=1400 audit(1753818214.824:907): avc: denied { call } for pid=16383 comm="syz.6.3274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 849.521593][T16407] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3280'. [ 850.889988][T14123] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 851.111620][T14123] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 851.131036][T14123] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.143566][T14123] usb 5-1: config 0 descriptor?? [ 851.193710][ T5832] Bluetooth: hci3: command 0x0406 tx timeout [ 851.211117][T14123] usb 5-1: selecting invalid altsetting 1 [ 851.611491][T16435] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=16435 comm=syz.4.3286 [ 852.009168][T14123] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 852.029100][T16437] overlayfs: failed to resolve './file0': -2 [ 853.100142][T14123] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 853.250020][T14123] usb 6-1: Using ep0 maxpacket: 8 [ 853.257454][T14123] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 853.268599][T14123] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 853.278527][T14123] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 853.288268][T14123] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 853.299446][T14123] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 853.309570][T14123] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 853.320254][T14123] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 853.330047][T14123] usb 6-1: config 0 descriptor?? [ 853.335607][T16446] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 853.705795][T14123] usb 5-1: USB disconnect, device number 43 [ 855.034099][ T5834] Bluetooth: hci4: Opcode 0x0c03 failed: -71 [ 855.068175][ T9] usb 6-1: USB disconnect, device number 44 [ 855.090254][ T48] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 855.270344][ T48] usb 5-1: Using ep0 maxpacket: 16 [ 855.287694][ T48] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 855.318852][ T48] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 855.373677][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 1794, setting to 1024 [ 855.410326][ T48] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 855.426733][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 855.438089][T16481] overlayfs: failed to resolve './file1': -2 [ 855.462246][ T48] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 855.492666][ T48] usb 5-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 855.515381][ T48] usb 5-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice=c6.c3 [ 855.531938][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.541141][ T48] usb 5-1: Product: syz [ 855.545416][ T48] usb 5-1: Manufacturer: syz [ 855.553210][ T48] usb 5-1: SerialNumber: syz [ 855.721220][ T48] usb 5-1: config 0 descriptor?? [ 855.778268][T16473] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 855.869790][ T48] iuu_phoenix 5-1:0.0: iuu_phoenix converter detected [ 856.081840][ T48] usb 5-1: iuu_phoenix converter now attached to ttyUSB0 [ 856.308537][T16492] fuse: Unknown parameter 'fd0x0000000000000003' [ 856.511751][T14123] usb 5-1: USB disconnect, device number 44 [ 856.712335][T14123] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 856.722832][T14123] iuu_phoenix 5-1:0.0: device disconnected [ 856.750739][ T5958] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 856.948814][ T5958] usb 6-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 856.961047][ T5958] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 856.972465][ T5958] usb 6-1: config 0 descriptor?? [ 856.980389][ T5958] usb 6-1: selecting invalid altsetting 1 [ 857.014830][ T5958] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 857.052174][ T5834] Bluetooth: Frame is too long (len 18, expected len 4) [ 857.708724][T16505] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=16505 comm=syz.5.3313 [ 858.460117][ T48] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 858.471791][T16521] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3321'. [ 859.389964][ T48] usb 7-1: Using ep0 maxpacket: 8 [ 859.443999][T11500] usb 6-1: USB disconnect, device number 45 [ 859.821738][ T48] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 860.435312][ T48] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 860.597884][ T48] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.779438][ T48] usb 7-1: config 0 descriptor?? [ 861.434452][ T48] usbhid 7-1:0.0: can't add hid device: -71 [ 861.675726][ T48] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 861.690395][ T48] usb 7-1: USB disconnect, device number 29 [ 861.948171][T16551] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3328'. [ 862.006776][ T5834] Bluetooth: hci2: unexpected cc 0x0c58 length: 4 > 2 [ 862.014431][ T5834] Bluetooth: hci2: unexpected event for opcode 0x0c58 [ 862.540509][T16560] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3332'. [ 866.570056][ T5834] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 866.578740][ T5834] Bluetooth: hci2: Injecting HCI hardware error event [ 866.587363][ T5834] Bluetooth: hci2: hardware error 0x00 [ 867.989079][T16594] hub 2-0:1.0: USB hub found [ 867.994569][T16594] hub 2-0:1.0: 1 port detected [ 868.754498][T16604] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3344'. [ 870.446114][ T5834] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 870.587941][ T5970] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 870.598669][ T5970] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.725819][ T5970] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 871.871174][ T5970] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 871.904544][ T5970] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.922985][ T5970] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 871.978639][ T976] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 872.004671][T16637] fuse: Unknown parameter '00000000000000000000' [ 872.033129][ T5970] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.044136][ T5970] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.077242][ T5970] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 872.155570][ T976] usb 6-1: Using ep0 maxpacket: 32 [ 872.179122][ T976] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 872.233529][ T976] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 872.267424][ T976] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 872.320726][ T976] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 873.259683][ T976] usb 6-1: config 0 descriptor?? [ 873.302604][ T976] hub 6-1:0.0: USB hub found [ 873.369705][ T5970] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 873.428073][ T5970] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 873.630117][ T5970] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 875.036670][ T976] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 875.133358][ T976] usbhid 6-1:0.0: can't add hid device: -71 [ 875.170298][T16664] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3361'. [ 875.251051][ T976] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 876.035966][ T976] usb 6-1: USB disconnect, device number 46 [ 876.378091][ T5970] bridge_slave_1: left allmulticast mode [ 876.412734][ T5970] bridge_slave_1: left promiscuous mode [ 876.458014][ T5970] bridge0: port 2(bridge_slave_1) entered disabled state [ 876.480267][ T5970] bridge_slave_0: left allmulticast mode [ 876.491194][ T5970] bridge_slave_0: left promiscuous mode [ 876.498490][T16682] hub 2-0:1.0: USB hub found [ 876.504247][T16682] hub 2-0:1.0: 1 port detected [ 876.537548][ T5970] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.240032][T14123] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 877.496149][ T5834] Bluetooth: hci0: Unable to find connection with handle 0xfcc9 [ 877.713734][T14123] usb 3-1: Using ep0 maxpacket: 32 [ 877.724874][T14123] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 877.736843][T14123] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 877.749953][T14123] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 877.759090][T14123] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.788126][T14123] usb 3-1: config 0 descriptor?? [ 878.113890][T14123] hub 3-1:0.0: USB hub found [ 878.329635][T14123] hub 3-1:0.0: config failed, can't read hub descriptor (err -90) [ 879.172921][ T5970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 879.306136][T14123] usbhid 3-1:0.0: can't add hid device: -71 [ 879.375060][T14123] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 879.399002][ T5970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 879.415844][ T5970] bond0 (unregistering): Released all slaves [ 879.431195][T14123] usb 3-1: USB disconnect, device number 25 [ 880.987814][T16735] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=16735 comm=syz.2.3385 [ 882.229095][T16745] fuse: Invalid rootmode [ 882.240294][ T5970] hsr_slave_0: left promiscuous mode [ 882.255271][ T5970] hsr_slave_1: left promiscuous mode [ 882.280590][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 882.288045][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 882.373612][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 882.430228][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 882.496795][ T5970] veth1_macvtap: left promiscuous mode [ 882.509790][ T5970] veth0_macvtap: left promiscuous mode [ 882.723479][ T5970] veth1_vlan: left promiscuous mode [ 882.838248][ T5970] veth0_vlan: left promiscuous mode [ 884.663560][ T5970] team0 (unregistering): Port device team_slave_1 removed [ 884.742923][ T5970] team0 (unregistering): Port device team_slave_0 removed [ 886.467388][T16790] fuse: Invalid rootmode [ 887.050038][ T5318] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 887.255292][ T5318] usb 7-1: Using ep0 maxpacket: 16 [ 887.512776][ T5318] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 887.805448][ T5318] usb 7-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 887.848789][ T5318] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 887.893140][ T5832] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 887.901982][ T5832] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 887.910140][ T5832] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 887.918380][ T5832] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 887.926517][ T5832] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 887.969102][ T5318] usb 7-1: config 0 descriptor?? [ 888.449737][ T5318] usbhid 7-1:0.0: can't add hid device: -71 [ 888.455893][ T5318] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 888.487197][ T5318] usb 7-1: USB disconnect, device number 30 [ 888.605850][ T30] audit: type=1400 audit(1753818255.694:908): avc: denied { read append } for pid=16814 comm="syz.7.3413" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 888.653594][ T30] audit: type=1400 audit(1753818255.724:909): avc: denied { ioctl } for pid=16814 comm="syz.7.3413" path="/327/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 888.754717][ T30] audit: type=1800 audit(1753818255.724:910): pid=16816 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.7.3413" name="/" dev="9p" ino=2 res=0 errno=0 [ 889.102946][T16824] fuse: Invalid rootmode [ 889.597130][ T5970] bond0 (unregistering): Released all slaves [ 889.818488][ T5970] : left promiscuous mode [ 889.947759][T16842] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3419'. [ 889.956806][T16842] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3419'. [ 890.003936][ T5832] Bluetooth: hci4: command tx timeout [ 890.322504][ T5970] tipc: Disabling bearer [ 890.344341][ T5970] tipc: Disabling bearer [ 890.366114][ T5970] tipc: Left network mode [ 891.259759][ T5970] hsr_slave_0: left promiscuous mode [ 891.267462][ T5970] hsr_slave_1: left promiscuous mode [ 891.282783][ T5970] veth1_macvtap: left promiscuous mode [ 892.188805][ T5970] veth0_macvtap: left promiscuous mode [ 892.195124][ T5970] veth1_vlan: left promiscuous mode [ 892.200602][ T5832] Bluetooth: hci4: command tx timeout [ 892.230631][ T5970] veth0_vlan: left promiscuous mode [ 892.355624][T14123] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 892.451547][T16869] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3427'. [ 892.510384][ T48] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 892.530500][T14123] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 892.543600][T14123] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.559833][T14123] usb 5-1: config 0 descriptor?? [ 892.573207][T14123] usb 5-1: selecting invalid altsetting 1 [ 892.628957][T14123] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 892.690122][ T48] usb 3-1: Using ep0 maxpacket: 16 [ 892.700781][ T48] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 892.712061][ T48] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 892.721152][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.735346][ T48] usb 3-1: config 0 descriptor?? [ 892.791091][T14123] usb 5-1: USB disconnect, device number 45 [ 893.151620][ T48] usbhid 3-1:0.0: can't add hid device: -71 [ 893.158290][ T48] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 893.170418][ T48] usb 3-1: USB disconnect, device number 26 [ 893.281296][T16806] chnl_net:caif_netlink_parms(): no params data found [ 893.437921][T16806] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.445521][T16806] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.453373][T16806] bridge_slave_0: entered allmulticast mode [ 893.460227][T16806] bridge_slave_0: entered promiscuous mode [ 893.532264][T16806] bridge0: port 2(bridge_slave_1) entered blocking state [ 893.552887][T16806] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.576798][T16806] bridge_slave_1: entered allmulticast mode [ 893.591942][T16806] bridge_slave_1: entered promiscuous mode [ 893.646986][T16806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 893.703536][T16806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 893.819751][T16893] Invalid source name [ 893.823989][T16893] UBIFS error (pid: 16893): cannot open "/dev/sg0", error -22 [ 894.050185][ T5970] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 894.069182][ T5970] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 894.230716][ T5832] Bluetooth: hci4: command tx timeout [ 895.175216][ T5970] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.187785][ T5970] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.209266][ T30] audit: type=1400 audit(1753818262.294:911): avc: denied { append } for pid=16899 comm="syz.4.3436" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 895.238663][ T30] audit: type=1400 audit(1753818262.324:912): avc: denied { map } for pid=16899 comm="syz.4.3436" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 895.242927][T16806] team0: Port device team_slave_0 added [ 895.263322][ T30] audit: type=1400 audit(1753818262.324:913): avc: denied { execute } for pid=16899 comm="syz.4.3436" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 895.824521][T16806] team0: Port device team_slave_1 added [ 895.858627][ T5970] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.869189][ T5970] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.910664][ T48] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 896.221740][ T48] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 896.233341][ T5970] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 896.234258][ T48] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 21568, setting to 1024 [ 896.261339][ T5970] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.733779][T16806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 896.743969][ T5832] Bluetooth: hci4: command tx timeout [ 896.749659][ T48] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 896.764313][ T48] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 896.767771][T16806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 896.773649][ T48] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.773708][ T48] usb 3-1: Product: syz [ 896.773741][ T48] usb 3-1: Manufacturer: syz [ 896.773791][ T48] usb 3-1: SerialNumber: syz [ 896.776409][ T48] usb 3-1: config 0 descriptor?? [ 896.839732][T16896] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 896.882486][T16896] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 896.981048][T16806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 897.033803][T16806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 897.050567][T16806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 897.103486][T16806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 897.234354][T16895] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 897.241825][T16895] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 897.249139][ T5318] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 897.305471][T16806] hsr_slave_0: entered promiscuous mode [ 897.322500][T16806] hsr_slave_1: entered promiscuous mode [ 897.404152][ T5318] usb 7-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 897.433810][ T5318] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.444318][ T5318] usb 7-1: config 0 descriptor?? [ 897.464769][ T48] Error reading MAC address [ 897.466371][ T5318] usb 7-1: selecting invalid altsetting 1 [ 897.490656][ T5970] bridge_slave_1: left allmulticast mode [ 897.497118][ T48] usb 3-1: USB disconnect, device number 27 [ 897.505239][ T5318] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 897.507294][ T5970] bridge_slave_1: left promiscuous mode [ 897.526047][ T5970] bridge0: port 2(bridge_slave_1) entered disabled state [ 897.544535][ T5970] bridge_slave_0: left allmulticast mode [ 897.551526][ T5970] bridge_slave_0: left promiscuous mode [ 897.558100][ T5970] bridge0: port 1(bridge_slave_0) entered disabled state [ 897.882601][T16917] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=16917 comm=syz.6.3439 [ 898.740804][T16923] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3441'. [ 899.538859][ T5970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 899.549725][ T5970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 899.562080][ T5970] bond0 (unregistering): Released all slaves [ 899.574487][ T5970] bond1 (unregistering): Released all slaves [ 899.609958][ T5913] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 899.676814][ T5970] tipc: Disabling bearer [ 899.687440][ T5970] tipc: Left network mode [ 899.830189][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 899.857594][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 900.830275][ T5913] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 900.839345][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.223716][ T5318] usb 7-1: USB disconnect, device number 31 [ 901.259134][ T5913] usb 5-1: config 0 descriptor?? [ 901.673945][ T5318] usb 7-1: new low-speed USB device number 32 using dummy_hcd [ 901.910186][T16949] netlink: 'syz.2.3448': attribute type 4 has an invalid length. [ 901.918041][T16949] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3448'. [ 901.983136][ T5913] usbhid 5-1:0.0: can't add hid device: -71 [ 901.990747][ T5913] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 902.033161][T16950] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3448'. [ 902.120479][T16948] tmpfs: Bad value for 'mpol' [ 902.130026][T16948] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3448'. [ 902.146643][ T5318] usb 7-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 902.156531][ T5913] usb 5-1: USB disconnect, device number 46 [ 902.162608][ T5318] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.185099][ T5318] usb 7-1: config 0 descriptor?? [ 902.290272][ T5970] hsr_slave_0: left promiscuous mode [ 902.302215][ T5970] hsr_slave_1: left promiscuous mode [ 902.309845][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 902.320182][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 902.330736][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 902.338826][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 902.365108][ T5970] veth1_macvtap: left promiscuous mode [ 902.371310][ T5970] veth0_macvtap: left promiscuous mode [ 902.376894][ T5970] veth1_vlan: left promiscuous mode [ 902.382571][ T5970] veth0_vlan: left promiscuous mode [ 903.020242][ T5318] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 903.248788][ T5318] asix 7-1:0.0: probe with driver asix failed with error -32 [ 903.468972][ T5970] team0 (unregistering): Port device team_slave_1 removed [ 903.505468][ T5970] team0 (unregistering): Port device team_slave_0 removed [ 903.838003][T16806] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 903.849755][T16806] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 903.901627][T16806] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 903.917943][T16806] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 904.192283][T16974] hub 2-0:1.0: USB hub found [ 904.199226][T16974] hub 2-0:1.0: 1 port detected [ 904.435832][ T5318] usb 7-1: USB disconnect, device number 32 [ 904.598772][T16806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 904.641184][T16806] 8021q: adding VLAN 0 to HW filter on device team0 [ 904.675283][T10434] bridge0: port 1(bridge_slave_0) entered blocking state [ 904.682408][T10434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 905.125540][ T5913] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 905.695360][T10434] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.702552][T10434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 906.405820][ T5913] usb 3-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 907.003972][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.015329][ T5913] usb 3-1: config 0 descriptor?? [ 907.023013][ T5913] usb 3-1: selecting invalid altsetting 1 [ 907.051798][ T5913] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 907.564135][T17009] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=17009 comm=syz.2.3456 [ 908.123982][T16806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 908.380134][ T976] usb 5-1: new low-speed USB device number 47 using dummy_hcd [ 908.899028][ T48] usb 3-1: USB disconnect, device number 28 [ 909.142524][ T976] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 909.153645][T17030] netlink: 'syz.7.3468': attribute type 4 has an invalid length. [ 909.178264][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.207329][ T976] usb 5-1: config 0 descriptor?? [ 909.927793][T16806] veth0_vlan: entered promiscuous mode [ 909.943231][T16806] veth1_vlan: entered promiscuous mode [ 910.130681][ T976] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 910.598859][ T976] asix 5-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 910.609449][ T976] asix 5-1:0.0: probe with driver asix failed with error -61 [ 910.646543][T16806] veth0_macvtap: entered promiscuous mode [ 910.656722][T16806] veth1_macvtap: entered promiscuous mode [ 910.678297][T16806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 910.697677][T16806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 910.746712][T16806] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.756381][T16806] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.765329][T16806] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.775855][T16806] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 911.004954][T15557] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 911.016161][T15557] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 911.031862][T17058] fuse: Unknown parameter 'user_i00000000000000000000' [ 911.075023][ T5970] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 911.085960][ T5970] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 911.479926][ T5913] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 911.661491][ T5913] usb 6-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 911.690100][ T5913] usb 6-1: config 0 interface 0 has no altsetting 0 [ 911.697016][ T5913] usb 6-1: New USB device found, idVendor=05ac, idProduct=027a, bcdDevice= 0.00 [ 911.708372][ T5913] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.720623][ T5953] hid-generic 0002:0081:0005.001C: item fetching failed at offset 7/27 [ 911.756492][ T5913] usb 6-1: config 0 descriptor?? [ 911.778311][ T5953] hid-generic 0002:0081:0005.001C: probe with driver hid-generic failed with error -22 [ 911.978191][T17074] netlink: 'syz.6.3479': attribute type 4 has an invalid length. [ 912.038492][ T5953] usb 5-1: USB disconnect, device number 47 [ 912.406982][ T5953] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 912.509947][T17081] input input45: cannot allocate more than FF_MAX_EFFECTS effects [ 912.609977][ T5953] usb 5-1: Using ep0 maxpacket: 32 [ 912.656647][ T5953] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 912.671537][ T5953] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 912.681683][ T5953] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 912.693136][T17084] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3483'. [ 912.702426][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.725224][ T5953] usb 5-1: config 0 descriptor?? [ 912.741713][ T5953] hub 5-1:0.0: USB hub found [ 912.948800][ T5953] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 913.493758][ T5953] usbhid 5-1:0.0: can't add hid device: -71 [ 913.534530][ T5953] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 913.652610][ T5953] usb 5-1: USB disconnect, device number 48 [ 915.157666][T17110] netlink: 'syz.6.3491': attribute type 4 has an invalid length. [ 915.786584][ T5913] usbhid 6-1:0.0: can't add hid device: -71 [ 915.827577][ T5913] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 915.865801][ T5913] usb 6-1: USB disconnect, device number 47 [ 916.838040][T17134] netlink: 27 bytes leftover after parsing attributes in process `syz.5.3499'. [ 917.612176][ T5897] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 917.650479][ T976] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 917.753002][ T5832] Bluetooth: hci0: command 0x0406 tx timeout [ 917.790154][ T5897] usb 7-1: Using ep0 maxpacket: 32 [ 917.800138][ T9] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 917.801654][ T5897] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 917.824066][ T5897] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 917.835728][ T5897] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 917.845568][ T5897] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 917.855374][ T976] usb 5-1: Using ep0 maxpacket: 32 [ 917.861527][ T5897] usb 7-1: config 0 descriptor?? [ 917.868306][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 917.869209][ T5897] hub 7-1:0.0: USB hub found [ 917.888700][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 917.905996][ T976] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 917.922020][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 917.942952][ T976] usb 5-1: config 0 descriptor?? [ 917.957216][ T976] hub 5-1:0.0: USB hub found [ 917.970162][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 917.982221][ T9] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 918.001378][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.024111][ T9] usb 6-1: config 0 descriptor?? [ 918.069432][ T5897] hub 7-1:0.0: 1 port detected [ 918.180356][ T976] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 918.243439][ T9] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 918.283484][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 918.300663][ T9] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 918.312268][ T9] usb 6-1: media controller created [ 918.334781][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 918.453418][ T9] az6027: usb out operation failed. (-71) [ 918.463572][ T9] az6027: usb out operation failed. (-71) [ 918.475342][ T9] stb0899_attach: Driver disabled by Kconfig [ 918.482108][ T9] az6027: no front-end attached [ 918.482108][ T9] [ 918.497087][ T9] az6027: usb out operation failed. (-71) [ 918.497117][ T9] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 918.497953][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input46 [ 918.502251][ T9] dvb-usb: schedule remote query interval to 400 msecs. [ 918.502263][ T9] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 918.504542][ T9] usb 6-1: USB disconnect, device number 48 [ 918.556124][ T9] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 918.595409][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 918.602868][ T976] usbhid 5-1:0.0: can't add hid device: -32 [ 918.608883][ T976] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 918.643043][ T976] usb 5-1: USB disconnect, device number 49 [ 918.684877][ T5897] usb 7-1: USB disconnect, device number 33 [ 919.068245][T17153] 9pnet: Found fid 0 not clunked [ 920.301357][ T9] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 920.651489][ T9] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 920.670106][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.680262][ T9] usb 5-1: config 0 descriptor?? [ 920.712101][ T9] usb 5-1: selecting invalid altsetting 1 [ 921.229638][ T9] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 921.490840][T17185] blktrace: Concurrent blktraces are not allowed on sg0 [ 921.980284][ T48] usb 7-1: new low-speed USB device number 34 using dummy_hcd [ 922.780426][ T48] usb 7-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 922.795264][ T48] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.805785][ T48] usb 7-1: config 0 descriptor?? [ 922.944987][ T30] audit: type=1400 audit(1753818290.034:914): avc: denied { setopt } for pid=17197 comm="syz.5.3522" lport=48544 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 922.968592][ C0] vkms_vblank_simulate: vblank timer overrun [ 923.063451][T17201] netlink: 180 bytes leftover after parsing attributes in process `syz.5.3522'. [ 923.723074][ T30] audit: type=1400 audit(1753818290.064:915): avc: denied { write } for pid=17197 comm="syz.5.3522" lport=48544 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 923.750285][ T5913] usb 5-1: USB disconnect, device number 50 [ 923.805383][T17205] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3525'. [ 923.947934][ T48] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 923.961555][ T48] asix 7-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 923.974235][ T48] asix 7-1:0.0: probe with driver asix failed with error -61 [ 925.450957][T17229] overlayfs: missing 'workdir' [ 925.469150][ T48] usb 7-1: USB disconnect, device number 34 [ 926.539992][ T5913] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 926.876417][T17244] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3537'. [ 926.959970][ T5913] usb 5-1: Using ep0 maxpacket: 16 [ 926.979600][ T5913] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 927.020003][ T5913] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 927.043514][ T5913] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 927.064152][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.113930][ T5913] usb 5-1: config 0 descriptor?? [ 927.840150][ T5953] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 928.125181][ T5953] usb 3-1: Using ep0 maxpacket: 32 [ 928.133164][ T5953] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 928.146943][ T5953] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 928.156943][ T5953] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 928.250322][ T48] usb 7-1: new low-speed USB device number 35 using dummy_hcd [ 928.267091][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.327628][ T5953] usb 3-1: config 0 descriptor?? [ 928.334769][ T5953] hub 3-1:0.0: USB hub found [ 928.481540][ T48] usb 7-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 928.491873][ T48] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.502501][ T48] usb 7-1: config 0 descriptor?? [ 928.637254][ T5953] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 929.174077][ T48] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 929.211587][ T5897] usb 5-1: USB disconnect, device number 51 [ 929.233748][ T48] asix 7-1:0.0: probe with driver asix failed with error -32 [ 929.385572][T17283] fuse: Bad value for 'fd' [ 929.460989][ T5953] usbhid 3-1:0.0: can't add hid device: -71 [ 929.466989][ T5953] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 929.512282][ T5953] usb 3-1: USB disconnect, device number 29 [ 931.040819][T17298] fuse: Bad value for 'fd' [ 931.069297][T14123] usb 7-1: USB disconnect, device number 35 [ 931.103424][T17296] netlink: 'syz.7.3554': attribute type 4 has an invalid length. [ 931.112188][T17296] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3554'. [ 931.137273][T17296] tmpfs: Bad value for 'mpol' [ 931.143905][T17296] netlink: 52 bytes leftover after parsing attributes in process `syz.7.3554'. [ 931.291864][ T5834] Bluetooth: hci0: unexpected cc 0x0c58 length: 4 > 2 [ 931.299987][ T5834] Bluetooth: hci0: unexpected event for opcode 0x0c58 [ 931.769968][T14123] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 933.032089][T14123] usb 3-1: Using ep0 maxpacket: 16 [ 933.051594][T14123] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 933.061979][T14123] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 933.080033][T14123] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 933.089142][T14123] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 933.252270][T14123] usb 3-1: config 0 descriptor?? [ 935.151933][T14123] usb 3-1: USB disconnect, device number 30 [ 935.350303][ T5834] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 935.360180][ T5834] Bluetooth: hci0: Injecting HCI hardware error event [ 935.368494][ T5834] Bluetooth: Frame is too long (len 18, expected len 4) [ 935.377407][ T5832] Bluetooth: hci0: hardware error 0x00 [ 935.586608][T17354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3571'. [ 936.499338][T17361] netlink: 27 bytes leftover after parsing attributes in process `syz.4.3574'. [ 937.510122][ T5832] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 939.230271][ T5953] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 939.235568][T17388] overlayfs: failed to resolve './file1': -2 [ 939.272629][ T5913] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 939.400521][ T5953] usb 5-1: Using ep0 maxpacket: 16 [ 939.411184][ T5953] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 939.422667][ T5953] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 939.436848][ T5953] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 939.473430][ T5913] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 939.483739][ T5913] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 939.491526][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.530665][ T5913] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 939.540088][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.546346][ T5953] usb 5-1: config 0 descriptor?? [ 939.585547][ T5913] usb 3-1: config 0 descriptor?? [ 941.033565][T17406] fuse: Unknown parameter '0x0000000000000005' [ 941.810102][ T30] audit: type=1400 audit(1753818308.474:916): avc: denied { accept } for pid=17403 comm="syz.5.3587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 941.984251][ T5913] usb 3-1: USB disconnect, device number 31 [ 941.990777][T14123] usb 5-1: USB disconnect, device number 52 [ 942.148318][T17427] hub 2-0:1.0: USB hub found [ 942.161875][T17427] hub 2-0:1.0: 1 port detected [ 942.180552][T17425] fuse: Unknown parameter '0x0000000000000003' [ 942.544847][T17437] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3596'. [ 945.188387][ T5318] hid-generic 0002:0081:0005.001D: item fetching failed at offset 7/27 [ 945.205702][ T5318] hid-generic 0002:0081:0005.001D: probe with driver hid-generic failed with error -22 [ 945.990039][ T5318] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 946.206897][T17472] ubi31: attaching mtd0 [ 946.224348][T17472] ubi31: scanning is finished [ 946.481034][ T5318] usb 3-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 946.490314][ T5318] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.500473][ T5318] usb 3-1: config 0 descriptor?? [ 946.509489][ T5318] usb 3-1: selecting invalid altsetting 1 [ 946.551156][T17472] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 946.627561][ T5318] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 946.703922][T17478] netlink: 'syz.7.3608': attribute type 1 has an invalid length. [ 947.418550][T17492] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3613'. [ 947.428683][T17492] IPVS: Error joining to the multicast group [ 948.657760][ T5953] usb 3-1: USB disconnect, device number 32 [ 949.087137][ T30] audit: type=1400 audit(1753818316.174:917): avc: denied { mount } for pid=17506 comm="syz.2.3617" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 949.137133][T17507] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3617'. [ 949.732340][ T30] audit: type=1400 audit(1753818316.804:918): avc: denied { unmount } for pid=14810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 949.903432][ T5832] Bluetooth: hci1: unexpected cc 0x0c58 length: 4 > 2 [ 949.911710][ T5832] Bluetooth: hci1: unexpected event for opcode 0x0c58 [ 949.958827][ T30] audit: type=1400 audit(1753818317.044:919): avc: denied { create } for pid=17522 comm="syz.6.3623" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 950.136810][ T30] audit: type=1400 audit(1753818317.074:920): avc: denied { sys_admin } for pid=17522 comm="syz.6.3623" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 951.654808][T17537] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3626'. [ 953.271398][T17537] IPVS: Error joining to the multicast group [ 953.465471][T17556] PKCS8: Unsupported PKCS#8 version [ 953.629158][T17560] Invalid ELF section header size [ 953.636758][ T30] audit: type=1400 audit(1753818320.714:921): avc: denied { module_load } for pid=17559 comm="syz.7.3636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 953.976506][T17569] 9pnet_virtio: no channels available for device syz [ 954.764152][ T5832] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 954.772880][ T5832] Bluetooth: hci1: Injecting HCI hardware error event [ 954.786076][ T5832] Bluetooth: hci1: hardware error 0x00 [ 955.855961][T17579] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3641'. [ 956.205289][ T30] audit: type=1400 audit(1753818323.294:922): avc: denied { read } for pid=17590 comm="syz.7.3645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 956.258249][ T30] audit: type=1400 audit(1753818323.344:923): avc: denied { setopt } for pid=17590 comm="syz.7.3645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 956.278028][ T5834] Bluetooth: hci4: unexpected cc 0x0c58 length: 4 > 2 [ 956.348352][ T30] audit: type=1400 audit(1753818323.434:924): avc: denied { ioctl } for pid=17590 comm="syz.7.3645" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0xaed5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 957.664066][T17624] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3657'. [ 957.841632][ T5832] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 958.817236][T17641] netlink: 'syz.4.3661': attribute type 21 has an invalid length. [ 959.508426][T17644] Bluetooth: MGMT ver 1.23 [ 960.116683][T17657] hub 2-0:1.0: USB hub found [ 960.124898][T17657] hub 2-0:1.0: 1 port detected [ 960.368458][ T5832] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 960.377568][ T5832] Bluetooth: hci4: Injecting HCI hardware error event [ 960.386449][ T5832] Bluetooth: hci4: hardware error 0x00 [ 961.432403][ T48] hid-generic 0002:0081:0005.001E: item fetching failed at offset 7/27 [ 961.452794][ T48] hid-generic 0002:0081:0005.001E: probe with driver hid-generic failed with error -22 [ 961.900027][ T9] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 962.472684][ T5832] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 962.571453][T17691] netlink: 'syz.6.3680': attribute type 4 has an invalid length. [ 962.579171][T17691] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3680'. [ 962.593043][T17691] netlink: 52 bytes leftover after parsing attributes in process `syz.6.3680'. [ 962.741357][ T9] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 962.750832][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.762316][ T9] usb 5-1: config 0 descriptor?? [ 962.772044][ T9] usb 5-1: selecting invalid altsetting 1 [ 962.859625][ T30] audit: type=1400 audit(1753818329.934:925): avc: denied { getopt } for pid=17689 comm="syz.5.3681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 963.318880][ T9] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 963.400549][T17704] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=17704 comm=syz.4.3676 [ 964.714862][ T5953] usb 5-1: USB disconnect, device number 53 [ 966.269986][ T30] audit: type=1400 audit(1753818333.294:926): avc: denied { create } for pid=17725 comm="syz.2.3691" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 966.331317][T17738] afs: Unknown parameter '' [ 966.478352][ T30] audit: type=1400 audit(1753818333.564:927): avc: denied { unlink } for pid=14810 comm="syz-executor" name="file0" dev="tmpfs" ino=1002 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 966.529445][T17750] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3700'. [ 967.369962][ T9] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 967.532224][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 967.644097][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 967.793064][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 967.815313][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 967.842699][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 967.872771][ T9] usb 5-1: config 0 descriptor?? [ 967.881929][ T9] hub 5-1:0.0: USB hub found [ 968.112186][T17777] overlayfs: failed to resolve './file0': -2 [ 968.128562][T17777] overlayfs: missing 'lowerdir' [ 968.443462][ T9] hub 5-1:0.0: 1 port detected [ 969.096101][ T9] hub 5-1:0.0: hub_ext_port_status failed (err = -71) [ 969.106398][ T9] usb 5-1: Failed to suspend device, error -71 [ 969.190280][T17787] netlink: 'syz.2.3709': attribute type 64 has an invalid length. [ 969.198284][T17787] netlink: 'syz.2.3709': attribute type 4 has an invalid length. [ 969.206243][T17787] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3709'. [ 969.450146][T17791] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3710'. [ 969.462268][T17791] IPVS: Error joining to the multicast group [ 969.645271][ T92] usb 5-1: USB disconnect, device number 54 [ 970.332375][T17794] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=17794 comm=syz.7.3698 [ 970.469131][T17802] Invalid source name [ 970.473828][T17802] UBIFS error (pid: 17802): cannot open "/dev/sg0", error -22 [ 971.524493][T17817] 9pnet_virtio: no channels available for device syz [ 971.957939][T17818] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3717'. [ 972.541872][ T976] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 972.843064][T17831] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3721'. [ 972.853507][T17831] IPVS: Error joining to the multicast group [ 973.341070][ T976] usb 6-1: Using ep0 maxpacket: 16 [ 973.362434][ T976] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 973.470432][ T976] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 974.603175][ T976] usb 6-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 974.650579][ T976] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 974.697525][T17844] afs: Unknown parameter '' [ 975.870533][ T976] usb 6-1: config 0 descriptor?? [ 975.903624][ T976] usb 6-1: can't set config #0, error -71 [ 975.930814][ T976] usb 6-1: USB disconnect, device number 49 [ 976.022154][T17854] overlayfs: failed to clone upperpath [ 976.898139][T17860] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3728'. [ 978.209580][T17882] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3732'. [ 978.220274][T17882] IPVS: Error joining to the multicast group [ 979.365239][T17898] netlink: 'syz.2.3739': attribute type 4 has an invalid length. [ 979.373168][T17898] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3739'. [ 979.398563][T17898] tmpfs: Bad value for 'mpol' [ 979.414748][T17898] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3739'. [ 979.908074][T17903] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 980.286314][T17913] netlink: 27 bytes leftover after parsing attributes in process `syz.5.3744'. [ 982.207175][T17946] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3755'. [ 982.230841][ T5318] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 982.380165][ T5318] usb 5-1: Using ep0 maxpacket: 16 [ 982.393081][ T5318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 982.419815][ T5318] usb 5-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 982.433704][T17955] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3758'. [ 982.458817][ T5318] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.505344][ T5318] usb 5-1: config 0 descriptor?? [ 983.664091][ T5318] usbhid 5-1:0.0: can't add hid device: -71 [ 983.674158][ T5318] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 983.685673][ T5318] usb 5-1: USB disconnect, device number 55 [ 985.515198][T17984] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 985.809920][ T92] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 985.979912][ T92] usb 3-1: Using ep0 maxpacket: 16 [ 985.989794][ T92] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 986.002926][ T92] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 986.002950][ T92] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 986.014478][ T92] usb 3-1: config 0 descriptor?? [ 986.030667][ T92] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 986.987317][T18009] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3774'. [ 987.003492][T18009] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 987.012688][T18009] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 987.021862][T18009] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 987.031206][T18009] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 987.040548][T18009] vxlan0: entered promiscuous mode [ 988.794785][ T9] usb 3-1: USB disconnect, device number 33 [ 988.844225][T18028] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 989.199153][T18034] netlink: 'syz.4.3783': attribute type 4 has an invalid length. [ 989.207032][T18034] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3783'. [ 989.219941][T18034] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3783'. [ 989.230822][T18034] tmpfs: Bad value for 'mpol' [ 989.235950][T18034] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3783'. [ 990.102772][T18043] Invalid ELF header magic: != ELF [ 990.498139][ T976] hid-generic 0002:0081:0005.001F: item fetching failed at offset 7/27 [ 990.573684][ T976] hid-generic 0002:0081:0005.001F: probe with driver hid-generic failed with error -22 [ 992.630309][ T976] usb 3-1: new low-speed USB device number 34 using dummy_hcd [ 993.145731][T18068] 9pnet: Found fid 0 not clunked [ 993.189951][ T976] usb 3-1: device descriptor read/64, error -71 [ 993.214168][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 993.233861][ T5834] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 993.242477][ T5834] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 993.268390][ T5834] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 993.276610][ T5834] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 993.430087][ T976] usb 3-1: new low-speed USB device number 35 using dummy_hcd [ 993.492369][T18075] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3795'. [ 993.590433][ T976] usb 3-1: device descriptor read/64, error -71 [ 994.147245][ T976] usb usb3-port1: attempt power cycle [ 994.262985][T18070] chnl_net:caif_netlink_parms(): no params data found [ 994.492363][T18070] bridge0: port 1(bridge_slave_0) entered blocking state [ 994.499682][T18070] bridge0: port 1(bridge_slave_0) entered disabled state [ 994.507029][T18070] bridge_slave_0: entered allmulticast mode [ 994.514542][T18070] bridge_slave_0: entered promiscuous mode [ 994.585828][T18070] bridge0: port 2(bridge_slave_1) entered blocking state [ 994.593051][T18070] bridge0: port 2(bridge_slave_1) entered disabled state [ 994.630805][ T976] usb 3-1: new low-speed USB device number 36 using dummy_hcd [ 994.645520][T18070] bridge_slave_1: entered allmulticast mode [ 994.667255][ T976] usb 3-1: device descriptor read/8, error -71 [ 994.833662][T18070] bridge_slave_1: entered promiscuous mode [ 995.049994][ T976] usb 3-1: new low-speed USB device number 37 using dummy_hcd [ 995.120301][T18098] netlink: 27 bytes leftover after parsing attributes in process `syz.7.3801'. [ 995.120625][ T976] usb 3-1: device descriptor read/8, error -71 [ 995.258965][T18101] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3800'. [ 995.270496][T18101] IPVS: Error joining to the multicast group [ 995.381162][ T5834] Bluetooth: hci2: command tx timeout [ 995.456874][T18070] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 995.583040][ T976] usb usb3-port1: unable to enumerate USB device [ 995.606448][T18070] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 995.722857][T18106] netlink: 'syz.7.3803': attribute type 64 has an invalid length. [ 995.732604][T18106] netlink: 'syz.7.3803': attribute type 4 has an invalid length. [ 995.740448][T18106] netlink: 152 bytes leftover after parsing attributes in process `syz.7.3803'. [ 995.759440][T18070] team0: Port device team_slave_0 added [ 995.772710][T18070] team0: Port device team_slave_1 added [ 995.852560][T18070] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 995.868979][T18070] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 995.959211][T18070] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 995.998906][T18070] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 996.010046][T18070] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 996.543672][T18070] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 996.924082][T18070] hsr_slave_0: entered promiscuous mode [ 996.935438][T18070] hsr_slave_1: entered promiscuous mode [ 996.944669][T18070] debugfs: 'hsr0' already exists in 'hsr' [ 996.951698][T18070] Cannot create hsr debugfs directory [ 997.440281][ T5834] Bluetooth: hci2: command tx timeout [ 998.545285][T18070] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 998.576204][T18070] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 998.596944][T18070] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 998.707934][T18070] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 998.751520][T18144] netlink: 27 bytes leftover after parsing attributes in process `syz.5.3813'. [ 998.987380][T18154] overlayfs: failed to resolve './file0': -2 [ 999.043049][T18155] overlayfs: missing 'lowerdir' [ 999.519917][ T5834] Bluetooth: hci2: command tx timeout [ 999.574067][T18070] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1000.088165][ T30] audit: type=1400 audit(1753818366.744:928): avc: denied { map } for pid=18157 comm="syz.5.3814" path="/dev/comedi0" dev="devtmpfs" ino=1276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1000.166599][T18070] 8021q: adding VLAN 0 to HW filter on device team0 [ 1000.497946][T10434] bridge0: port 1(bridge_slave_0) entered blocking state [ 1000.505134][T10434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1000.556516][T10434] bridge0: port 2(bridge_slave_1) entered blocking state [ 1000.563700][T10434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1001.314802][T18178] fuse: Bad value for 'fd' [ 1001.583618][T18171] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3817'. [ 1001.605183][ T5834] Bluetooth: hci2: command tx timeout [ 1001.872198][T18171] IPVS: Error joining to the multicast group [ 1002.608064][T18194] input: syz0 as /devices/virtual/input/input47 [ 1002.625208][ T30] audit: type=1400 audit(1753818369.644:929): avc: denied { setattr } for pid=18189 comm="syz.5.3821" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 1002.976277][T18198] overlayfs: missing 'lowerdir' [ 1003.185929][T18070] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1004.731892][T18228] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3830'. [ 1004.742769][T18228] IPVS: Error joining to the multicast group [ 1005.175386][T18070] veth0_vlan: entered promiscuous mode [ 1005.210477][T18070] veth1_vlan: entered promiscuous mode [ 1005.364386][T18070] veth0_macvtap: entered promiscuous mode [ 1005.389315][T18070] veth1_macvtap: entered promiscuous mode [ 1005.492823][T18070] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1005.509214][T18070] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1005.519665][T18070] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1005.535039][T18070] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1005.553973][T18070] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1005.674991][T18070] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.338974][ T5970] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1006.353068][ T5970] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1006.557597][T10441] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1006.585259][T10441] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1007.106556][ T30] audit: type=1400 audit(1753818374.194:930): avc: denied { mounton } for pid=18070 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 1008.119965][T14123] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1008.187289][T18266] batman_adv: batadv0: Adding interface: gretap1 [ 1008.210001][T18266] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1008.433416][T18266] batman_adv: batadv0: Interface activated: gretap1 [ 1008.551187][T18272] bridge0: port 2(bridge_slave_1) entered disabled state [ 1008.560536][T18272] bridge0: port 1(bridge_slave_0) entered disabled state [ 1008.649892][T14123] usb 9-1: Using ep0 maxpacket: 16 [ 1008.656656][T14123] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1008.676336][T14123] usb 9-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 1008.687089][T14123] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1008.700576][T14123] usb 9-1: config 0 descriptor?? [ 1008.717817][T14123] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 1009.585803][T18282] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3842'. [ 1009.595405][T18282] IPVS: Error joining to the multicast group [ 1010.406440][T18295] fuse: Bad value for 'fd' [ 1011.044775][T14123] usb 9-1: USB disconnect, device number 2 [ 1011.351053][T18294] 9pnet_virtio: no channels available for device syz [ 1012.093827][T18308] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3850'. [ 1012.644079][ T30] audit: type=1400 audit(1753818379.724:931): avc: denied { getopt } for pid=18303 comm="syz.4.3849" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1012.721720][ T30] audit: type=1400 audit(1753818379.804:932): avc: denied { mount } for pid=18315 comm="syz.2.3852" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1013.600438][T14123] IPVS: starting estimator thread 0... [ 1013.798570][T18328] IPVS: using max 41 ests per chain, 98400 per kthread [ 1013.879047][T18329] netlink: 'syz.2.3855': attribute type 4 has an invalid length. [ 1013.887088][T18329] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3855'. [ 1013.985695][T18332] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3855'. [ 1014.463603][T18326] tmpfs: Bad value for 'mpol' [ 1014.468779][T18326] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3855'. [ 1014.568225][T18341] 9pnet: Found fid 0 not clunked [ 1015.380849][T18354] ubi31: attaching mtd0 [ 1015.438101][T18354] ubi31: scanning is finished [ 1016.180992][T18354] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1017.126390][T18375] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1017.841967][T18380] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3870'. [ 1017.854021][T18381] bridge0: port 2(bridge_slave_1) entered disabled state [ 1017.861366][T18381] bridge0: port 1(bridge_slave_0) entered disabled state [ 1018.926830][T18402] ubi31: attaching mtd0 [ 1018.937693][T18402] ubi31: scanning is finished [ 1018.949992][ T5832] Bluetooth: Frame is too long (len 18, expected len 4) [ 1019.267117][T18402] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1019.787837][T18388] 9pnet: Found fid 0 not clunked [ 1020.001530][T18422] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3883'. [ 1020.587024][T18422] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3883'. [ 1020.918167][T18428] block device autoloading is deprecated and will be removed. [ 1020.933555][T18428] syz.2.3886: attempt to access beyond end of device [ 1020.933555][T18428] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1021.149992][ T5832] Bluetooth: hci3: unexpected cc 0x203e length: 2 > 1 [ 1021.156997][ T5832] Bluetooth: hci3: unexpected event for opcode 0x203e [ 1022.307185][T18452] overlayfs: failed to resolve './file0': -2 [ 1022.362897][T18454] overlayfs: missing 'lowerdir' [ 1023.329938][ T976] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1023.782167][ T976] usb 3-1: Using ep0 maxpacket: 8 [ 1023.910066][ T976] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 1023.932608][ T976] usb 3-1: config 179 has no interface number 0 [ 1023.960043][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1024.519698][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1024.537219][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1024.550137][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1024.573913][ T976] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1024.638551][ T976] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1024.676796][ T976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1024.706011][T18464] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1024.822086][T18485] Invalid ELF section header size [ 1025.789644][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1025.798933][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1025.857877][ T976] usb 3-1: USB disconnect, device number 38 [ 1026.984592][T18514] overlayfs: failed to resolve './file0': -2 [ 1027.040453][T18515] overlayfs: missing 'lowerdir' [ 1027.389932][ T976] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1028.282968][ T976] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1028.382776][ T976] usb 5-1: config 0 has no interfaces? [ 1028.429413][ T976] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 1028.493477][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1028.623148][ T976] usb 5-1: config 0 descriptor?? [ 1028.675487][ T976] IPVS: starting estimator thread 0... [ 1028.837431][ T976] usb 5-1: USB disconnect, device number 56 [ 1028.860381][T18530] IPVS: using max 39 ests per chain, 93600 per kthread [ 1029.319061][T18545] Invalid ELF section header size [ 1030.154660][T18547] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1033.026750][ T30] audit: type=1400 audit(1753818400.114:933): avc: denied { read write } for pid=18581 comm="syz.4.3932" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1033.139948][ T30] audit: type=1400 audit(1753818400.114:934): avc: denied { open } for pid=18581 comm="syz.4.3932" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1034.541650][T18594] 9pnet_virtio: no channels available for device syz [ 1035.761828][T18605] Invalid ELF section header size [ 1036.439895][ T976] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1037.444044][ T30] audit: type=1400 audit(1753818404.534:935): avc: denied { create } for pid=18621 comm="syz.8.3942" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1037.684999][ T976] usb 5-1: Using ep0 maxpacket: 16 [ 1037.750101][ T5953] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1037.768622][ T976] usb 5-1: config 0 has no interfaces? [ 1037.777042][ T976] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1037.798853][ T976] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.809570][ T976] usb 5-1: Product: syz [ 1037.813804][ T976] usb 5-1: Manufacturer: syz [ 1037.818399][ T976] usb 5-1: SerialNumber: syz [ 1037.825161][ T976] usb 5-1: config 0 descriptor?? [ 1038.531042][ T5953] usb 9-1: Using ep0 maxpacket: 16 [ 1038.537552][ T5953] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1038.549202][ T5953] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1038.595072][ T92] usb 5-1: USB disconnect, device number 57 [ 1038.610518][ T5953] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1038.693085][ T5953] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1038.703305][ T5953] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.726011][ T5953] usb 9-1: config 0 descriptor?? [ 1039.820164][T18642] random: crng reseeded on system resumption [ 1039.862249][ T30] audit: type=1400 audit(1753818406.834:936): avc: denied { read } for pid=18621 comm="syz.8.3942" path="socket:[66095]" dev="sockfs" ino=66095 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1040.506043][ T30] audit: type=1400 audit(1753818406.904:937): avc: denied { write } for pid=18621 comm="syz.8.3942" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1040.530944][ T30] audit: type=1400 audit(1753818407.594:938): avc: denied { ioctl } for pid=18621 comm="syz.8.3942" path="socket:[66095]" dev="sockfs" ino=66095 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1040.638677][ T5953] input: HID 0955:7214 Haptics as /devices/virtual/input/input48 [ 1040.766132][ T5953] shield 0003:0955:7214.0020: Registered Thunderstrike controller [ 1040.824165][ T5953] shield 0003:0955:7214.0020: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.8-1/input0 [ 1041.090057][ T5318] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1041.340028][ T5318] usb 3-1: Using ep0 maxpacket: 16 [ 1041.348930][ T5318] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1041.362568][ T5318] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1041.384613][ T5318] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1041.407696][ T5318] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 1041.427519][ T5318] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1041.448876][ T5318] usb 3-1: config 0 descriptor?? [ 1041.901408][ T48] shield 0003:0955:7214.0020: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN [ 1041.983550][ T48] shield 0003:0955:7214.0020: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 1042.020498][ T5953] usb 9-1: reset high-speed USB device number 3 using dummy_hcd [ 1042.025207][ T5318] usbhid 3-1:0.0: can't add hid device: -71 [ 1042.044002][ T48] shield 0003:0955:7214.0020: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 1042.060747][ T5318] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1042.085313][ T5318] usb 3-1: USB disconnect, device number 39 [ 1042.210193][ T48] shield 0003:0955:7214.0020: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1042.320605][ T5953] usb 9-1: device descriptor read/64, error -32 [ 1043.495598][ T5953] usb 9-1: reset high-speed USB device number 3 using dummy_hcd [ 1043.785404][T18681] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3961'. [ 1044.009940][ T5318] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1044.463376][T14123] usb 9-1: USB disconnect, device number 3 [ 1045.060005][ T5318] usb 3-1: Using ep0 maxpacket: 8 [ 1045.078377][ T5318] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 1045.095153][ T5318] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 1045.136434][ T5318] usb 3-1: config 0 has no interface number 0 [ 1045.158380][ T5318] usb 3-1: config 0 interface 21 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1045.192669][ T5318] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1045.206369][ T5318] usb 3-1: New USB device strings: Mfr=31, Product=1, SerialNumber=0 [ 1045.229866][ T5318] usb 3-1: Product: syz [ 1045.234068][ T5318] usb 3-1: Manufacturer: syz [ 1045.278374][ T5318] usb 3-1: config 0 descriptor?? [ 1045.615094][T18699] : entered promiscuous mode [ 1046.162718][ T976] usb 3-1: USB disconnect, device number 40 [ 1046.649888][T14123] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1046.809893][T14123] usb 5-1: Using ep0 maxpacket: 16 [ 1046.816766][T14123] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1046.828459][T14123] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1046.838349][T14123] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1046.851328][T14123] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 1046.860432][T14123] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1046.874685][T14123] usb 5-1: config 0 descriptor?? [ 1047.312205][ C1] raw-gadget.0 gadget.4: ignoring, device is not running [ 1047.320163][T14123] usbhid 5-1:0.0: can't add hid device: -71 [ 1047.326214][T14123] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1048.287108][T14123] usb 5-1: USB disconnect, device number 58 [ 1048.352923][T18721] hub 2-0:1.0: USB hub found [ 1048.357773][T18721] hub 2-0:1.0: 1 port detected [ 1050.295694][ T5953] usb 3-1: new low-speed USB device number 41 using dummy_hcd [ 1050.449465][T18744] overlayfs: failed to resolve './file0': -2 [ 1050.471415][T18744] overlayfs: missing 'lowerdir' [ 1050.493649][ T5953] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1050.759080][T18745] netlink: 'syz.5.3982': attribute type 1 has an invalid length. [ 1050.769586][T18745] netlink: 224 bytes leftover after parsing attributes in process `syz.5.3982'. [ 1050.993414][ T5953] usb 3-1: config 0 has no interfaces? [ 1051.035905][ T5953] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1051.096627][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1051.154365][ T5953] usb 3-1: config 0 descriptor?? [ 1052.089660][T18770] hub 2-0:1.0: USB hub found [ 1052.094483][T18770] hub 2-0:1.0: 1 port detected [ 1053.095236][ T976] usb 3-1: USB disconnect, device number 41 [ 1053.867457][ T5832] Bluetooth: Frame is too long (len 18, expected len 4) [ 1056.354563][T18800] Invalid ELF section header size [ 1059.150828][T18831] Invalid ELF section header size [ 1060.352587][T18834] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1060.561439][T18837] 9pnet: Found fid 0 not clunked [ 1061.289249][T18850] Invalid ELF section header size [ 1062.032889][T18851] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1062.165791][T18862] netlink: 'syz.7.4014': attribute type 1 has an invalid length. [ 1062.183157][T18862] netlink: 224 bytes leftover after parsing attributes in process `syz.7.4014'. [ 1063.286481][T14123] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 1063.501254][T14123] usb 6-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 1063.525515][T14123] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1063.556332][T14123] usb 6-1: config 0 descriptor?? [ 1063.577337][T14123] usb 6-1: selecting invalid altsetting 1 [ 1063.920445][T14123] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1066.758821][T18910] Invalid ELF section header size [ 1068.007089][T18930] overlayfs: failed to resolve './file0': -2 [ 1068.100326][T18926] overlayfs: missing 'lowerdir' [ 1068.866286][T14123] usb 6-1: USB disconnect, device number 50 [ 1069.147003][T18942] overlayfs: failed to resolve './file0': -2 [ 1070.121832][T18949] Invalid source name [ 1070.125838][T18949] UBIFS error (pid: 18949): cannot open "/dev/sg0", error -22 [ 1070.196107][T18956] netlink: 'syz.2.4038': attribute type 1 has an invalid length. [ 1070.211650][T18956] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4038'. [ 1071.245045][T18971] Invalid ELF section header size [ 1072.492880][T18981] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1073.080258][ T976] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1073.107788][T19001] overlayfs: failed to resolve './file0': -2 [ 1074.030986][ T976] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 1074.837317][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1074.850880][ T976] usb 5-1: config 0 descriptor?? [ 1074.861593][ T976] usb 5-1: selecting invalid altsetting 1 [ 1074.887221][ T976] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1077.700784][ T976] usb 5-1: USB disconnect, device number 59 [ 1078.080059][T19057] overlayfs: failed to resolve './file0': -2 [ 1078.736710][T19067] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4070'. [ 1080.265926][T19083] Invalid ELF section header size [ 1081.118287][T19084] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1081.282369][T19094] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4078'. [ 1081.855794][T19095] hub 2-0:1.0: USB hub found [ 1081.873079][T19095] hub 2-0:1.0: 1 port detected [ 1081.899597][T19098] bridge0: port 2(bridge_slave_1) entered disabled state [ 1081.906923][T19098] bridge0: port 1(bridge_slave_0) entered disabled state [ 1082.532528][T19115] 9pnet: Found fid 0 not clunked [ 1084.595218][T19144] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4094'. [ 1084.610002][T17054] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1084.875170][T17054] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1084.896254][T17054] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1084.975792][T19152] 9pnet_virtio: no channels available for device syz [ 1085.356620][T17054] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1085.365766][T17054] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1085.376180][T17054] usb 5-1: config 0 descriptor?? [ 1085.917139][T19174] Invalid ELF section header size [ 1087.112422][T14123] usb 5-1: USB disconnect, device number 60 [ 1087.252452][T19182] netlink: 27 bytes leftover after parsing attributes in process `syz.5.4107'. [ 1088.319491][T19200] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4116'. [ 1088.510419][T19207] ubi31: attaching mtd0 [ 1088.530272][T19207] ubi31: scanning is finished [ 1088.756444][T19207] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1088.809886][T14123] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1088.953109][T19213] Invalid source name [ 1088.957241][T19213] UBIFS error (pid: 19213): cannot open "/dev/sg0", error -22 [ 1088.969942][T14123] usb 9-1: Using ep0 maxpacket: 8 [ 1089.011524][T14123] usb 9-1: config index 0 descriptor too short (expected 6427, got 27) [ 1089.027335][T14123] usb 9-1: config 0 has an invalid interface number: 21 but max is 0 [ 1089.079603][T14123] usb 9-1: config 0 has no interface number 0 [ 1089.086241][T14123] usb 9-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0x12, changing to 0x2 [ 1089.098491][T14123] usb 9-1: config 0 interface 21 altsetting 0 endpoint 0x2 has an invalid bInterval 162, changing to 11 [ 1089.110176][T14123] usb 9-1: config 0 interface 21 altsetting 0 endpoint 0x2 has invalid maxpacket 17903, setting to 1024 [ 1089.244506][T14123] usb 9-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1089.275150][T14123] usb 9-1: New USB device strings: Mfr=31, Product=1, SerialNumber=0 [ 1089.370402][T14123] usb 9-1: Product: syz [ 1089.690039][T14123] usb 9-1: Manufacturer: syz [ 1089.707241][T14123] usb 9-1: config 0 descriptor?? [ 1089.716749][T19196] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1090.312554][T14123] usb 9-1: USB disconnect, device number 4 [ 1090.442514][T19230] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4123'. [ 1090.519933][T17054] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 1090.597616][T19235] netlink: 27 bytes leftover after parsing attributes in process `syz.7.4125'. [ 1090.672920][T17054] usb 6-1: Using ep0 maxpacket: 32 [ 1090.789902][T17054] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1090.872631][T17054] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1090.985314][T17054] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1091.093020][T17054] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1091.268182][T17054] usb 6-1: config 0 descriptor?? [ 1091.462275][T17054] hub 6-1:0.0: USB hub found [ 1092.625384][T19250] Invalid source name [ 1092.629401][T19250] UBIFS error (pid: 19250): cannot open "/dev/sg0", error -22 [ 1092.773994][T17054] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 1092.851090][T17054] usbhid 6-1:0.0: can't add hid device: -71 [ 1092.877948][T17054] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1092.940758][T17054] usb 6-1: USB disconnect, device number 51 [ 1093.176503][T19277] ubi31: attaching mtd0 [ 1093.194873][T19277] ubi31: scanning is finished [ 1094.043028][T19277] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1094.967329][T19289] Invalid ELF section header size [ 1095.289101][T19290] Invalid ELF section header size [ 1095.905228][T19310] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=19310 comm=syz.2.4148 [ 1099.731098][T19330] ubi31: attaching mtd0 [ 1099.736566][T19330] ubi31: scanning is finished [ 1099.764754][T19337] 9pnet_fd: Insufficient options for proto=fd [ 1099.799875][T14123] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1099.799895][T19330] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1099.815051][T19330] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1099.823079][T19330] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1099.830139][T19330] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 1099.837590][T19330] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1099.844581][T19330] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1099.852838][T19330] ubi31: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 2222853120 [ 1099.862909][T19330] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1099.880482][T19338] ubi31: background thread "ubi_bgt31d" started, PID 19338 [ 1101.030028][T14123] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1101.070198][T14123] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1101.079600][T14123] usb 9-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1101.135155][T14123] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1101.255829][T19347] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=19347 comm=syz.4.4159 [ 1101.274884][T14123] usb 9-1: config 0 descriptor?? [ 1102.925755][T14123] usb 9-1: USB disconnect, device number 5 [ 1104.365234][T19390] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=19390 comm=syz.8.4174 [ 1105.923184][T19407] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4177'. [ 1107.439375][T19424] 9pnet_fd: Insufficient options for proto=fd [ 1108.501250][T19433] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4184'. [ 1108.514901][T19432] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4183'. [ 1109.542001][T19449] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4190'. [ 1111.350301][ T5832] Bluetooth: Frame is too long (len 18, expected len 4) [ 1111.787808][T19480] Invalid ELF section header size [ 1112.630245][T19484] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1114.250796][T19501] netlink: 'syz.4.4204': attribute type 4 has an invalid length. [ 1114.268726][T19501] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4204'. [ 1114.921163][T19497] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4204'. [ 1114.948976][T19497] tmpfs: Bad value for 'mpol' [ 1114.954245][T19497] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4204'. [ 1115.009084][T19519] No source specified [ 1116.352814][T19521] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4209'. [ 1117.418031][T19549] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4215'. [ 1117.590990][ T5832] Bluetooth: hci2: command 0x0406 tx timeout [ 1118.094699][T19564] netlink: 180 bytes leftover after parsing attributes in process `syz.7.4220'. [ 1119.073952][T19574] hub 2-0:1.0: USB hub found [ 1119.079515][T19574] hub 2-0:1.0: 1 port detected [ 1121.345786][T19598] [ 1121.348279][T19598] ============================= [ 1121.353246][T19598] WARNING: suspicious RCU usage [ 1121.358126][T19598] 6.16.0-syzkaller-00857-gced1b9e0392d #0 Not tainted [ 1121.364967][T19598] ----------------------------- [ 1121.369861][T19598] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 1121.378411][T19598] [ 1121.378411][T19598] other info that might help us debug this: [ 1121.378411][T19598] [ 1121.388758][T19598] [ 1121.388758][T19598] rcu_scheduler_active = 2, debug_locks = 1 [ 1121.396955][T19598] 1 lock held by syz.7.4231/19598: [ 1121.402133][T19598] #0: ffffffff8e5c4480 (rcu_read_lock_trace){....}-{0:0}, at: bpf_prog_test_run_syscall+0x344/0x780 [ 1121.413151][T19598] [ 1121.413151][T19598] stack backtrace: [ 1121.419082][T19598] CPU: 0 UID: 0 PID: 19598 Comm: syz.7.4231 Not tainted 6.16.0-syzkaller-00857-gced1b9e0392d #0 PREEMPT(full) [ 1121.419108][T19598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1121.419119][T19598] Call Trace: [ 1121.419128][T19598] [ 1121.419137][T19598] dump_stack_lvl+0x16c/0x1f0 [ 1121.419164][T19598] lockdep_rcu_suspicious+0x166/0x260 [ 1121.419201][T19598] get_callchain_entry+0x278/0x3f0 [ 1121.419233][T19598] get_perf_callchain+0xdb/0x760 [ 1121.419264][T19598] ? __pfx_get_perf_callchain+0x10/0x10 [ 1121.419304][T19598] __bpf_get_stack+0x4f5/0xa10 [ 1121.419339][T19598] ? __pfx___bpf_get_stack+0x10/0x10 [ 1121.419365][T19598] ? rcu_is_watching+0x12/0xc0 [ 1121.419389][T19598] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1121.419411][T19598] ? lockdep_hardirqs_on+0x7c/0x110 [ 1121.419436][T19598] bpf_get_stack+0x32/0x40 [ 1121.419464][T19598] bpf_get_stack_raw_tp+0x1dd/0x280 [ 1121.419491][T19598] bpf_prog_d43750871481577d+0x46/0x4e [ 1121.419509][T19598] bpf_prog_test_run_syscall+0x3b0/0x780 [ 1121.419540][T19598] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 1121.419567][T19598] ? fput+0x70/0xf0 [ 1121.419589][T19598] ? __bpf_prog_get+0x97/0x2a0 [ 1121.419612][T19598] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 1121.419638][T19598] __sys_bpf+0x1707/0x4ea0 [ 1121.419673][T19598] ? __pfx_futex_wake+0x10/0x10 [ 1121.419696][T19598] ? __pfx___sys_bpf+0x10/0x10 [ 1121.419721][T19598] ? __schedule+0x1181/0x5dd0 [ 1121.419748][T19598] ? do_futex+0x122/0x350 [ 1121.419765][T19598] ? __pfx_do_futex+0x10/0x10 [ 1121.419795][T19598] ? xfd_validate_state+0x61/0x180 [ 1121.419824][T19598] __x64_sys_bpf+0x78/0xc0 [ 1121.419849][T19598] ? lockdep_hardirqs_on+0x7c/0x110 [ 1121.419871][T19598] do_syscall_64+0xcd/0x4c0 [ 1121.419896][T19598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.419915][T19598] RIP: 0033:0x7f3b2478e9a9 [ 1121.419930][T19598] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1121.419948][T19598] RSP: 002b:00007f3b225f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1121.419966][T19598] RAX: ffffffffffffffda RBX: 00007f3b249b6160 RCX: 00007f3b2478e9a9 [ 1121.419978][T19598] RDX: 0000000000000010 RSI: 0000200000000740 RDI: 000000000000000a [ 1121.419989][T19598] RBP: 00007f3b24810d69 R08: 0000000000000000 R09: 0000000000000000 [ 1121.419999][T19598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1121.420010][T19598] R13: 0000000000000000 R14: 00007f3b249b6160 R15: 00007ffdd6f50688 [ 1121.420035][T19598] [ 1122.109896][ T5318] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1122.350437][ T5318] usb 5-1: Using ep0 maxpacket: 16 [ 1122.390712][ T5318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1122.406168][ T5318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1122.416754][ T5318] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1122.431973][ T5318] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1122.441150][ T5318] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.458120][ T5318] usb 5-1: config 0 descriptor?? [ 1124.500038][ T5318] usbhid 5-1:0.0: can't add hid device: -71 [ 1124.506048][ T5318] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1124.562239][ T5318] usb 5-1: USB disconnect, device number 61