last executing test programs: 7m1.401216763s ago: executing program 1 (id=962): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000840)}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x0) 7m1.302973666s ago: executing program 1 (id=964): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)=0x3) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$kcm(0x2, 0xa, 0x2) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000240), 0x140, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x80, 0xa, 0x0, 0x0, 0x0, 0x180, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x80, 0x0, 0x0, 0x2, 0x0, 0x1}) 7m0.752081847s ago: executing program 1 (id=965): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000100)={0x6, 0x800, 0x1fff, 0xffff, 0x0, "000401001000c602"}) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000c22fa0)=[{0x0}], 0x1, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x70, &(0x7f0000000580)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r4, 0x0, 0x0, 0x20000010) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r4, 0x84, 0x78, &(0x7f0000000600), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r6, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e00)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000610000005000400000000000900020073797a3100000000050005000200000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x24, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 6m59.611698848s ago: executing program 1 (id=966): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCGRAB(r0, 0x40044590, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'bridge0\x00'}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r2, &(0x7f00000002c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendto$inet(r2, &(0x7f0000000380)="11", 0x1, 0x40040, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0xb66f) sendmsg$inet(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="c9", 0x1}], 0x1}, 0x4004045) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000fe6000/0x14000)=nil, 0x14000, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/189, 0xbd, 0x0, 0x0}, &(0x7f0000000100)=0x40) 6m58.849946673s ago: executing program 1 (id=969): bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYBLOB="1500"/12, @ANYBLOB="e7"], 0x20) 6m58.425520411s ago: executing program 1 (id=972): openat$autofs(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = dup(r0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0x50, &(0x7f00000001c0)={@local, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x1a, 0x2c, 0x0, @remote, @local, {[@routing={0x2b, 0x0, 0x2, 0x1}], "b9365394fc379af00659ab39e65121dd3e8c"}}}}}, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r5) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r4, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x6, 0x2, 0x2, 0x0, 0xc6}) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r6, &(0x7f0000000780)=ANY=[@ANYBLOB="c20200007d00000005fa0000006a0000004000000000000000000000000000000010000000020000000000000000000000001f00046e6f6465767b6376666f7825ffffff8102000000000000000000000000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500003b595fcb14034354b9fd9ef196a51cd5157adc8106b494e11200fbe161e900000000000000000000f313f6005e00f8f67efb716dcf315ecaf385409ac65b9408679d2c3b9e1d52c3d6da9bf1995688dace6cde7ba4a400b4b0b4dbe64f64b1d63f26796dcbec498623d6a838c69a69dfce9cdd5906f174a666a8529a45773407dbdab2885baf050000000000b3016f6465762d6eb17b2300f9daa1ee23266ecf85fea65eb2d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae89480687bd7f3d7f298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238501000000aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9cf3ee3884002a91c54528b807a89ca184d16645f06188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f299f061f75b7797ce1e411ea918ebd888c1e156b8456931d2ea726ba9609d51a41dd3de304bd7c7ed0a456f0ae12516105c9478f7ded2dc47ec13c0f6af88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff000000000000007461b0ccaaa1933a0e8a826b14d4fcb2989ffaaa1acffa8054e9559dfae4697aa00b03b3d80e5524f8495fee7e8d88cb5a040302acb0d1260f2584db48e8d9064e8ce178ce396e85b97e4886444049810f", @ANYRES32=0x0, @ANYRES64=r4], 0x2c2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x0, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000000000007112370000000000950000000000000089e2d90aa1795cc26efb1dacf01150510936875c66d6a7d6eb12d4cdbc5c0ce0d29df91940d8ca08008e7aa5b3c9a10909d6e18b263131bf965f55746df5189a2e23905ae4dc5340e0eb74eb523d5b77a763cccb768b4453c8b1b1dd0a71983b5c2cfe11f3d30228772b0b798ebaf5abde2ce3ec34f8c6f13ee1f181ac563ba7a7edc9be94452da6d7eb67ae3243cb393245efd0dd21de9553cbd1a8516282de458c44d1ddae97af584de743d44ed18d20dd3b2c42cf1e8b27788dfc562367d46197198cd19fda89a6feca6c738b1d4b2522"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r7 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f010400000009058303"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r7, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) r8 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r8, 0x40304580, &(0x7f0000000300)={0x50, 0xffff, 0x0, {0x0, 0x68bd}, {}, @cond=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r9, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r1, 0x0, 0x0) socket(0x11, 0xa, 0x0) 6m43.106308582s ago: executing program 32 (id=972): openat$autofs(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = dup(r0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0x50, &(0x7f00000001c0)={@local, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x1a, 0x2c, 0x0, @remote, @local, {[@routing={0x2b, 0x0, 0x2, 0x1}], "b9365394fc379af00659ab39e65121dd3e8c"}}}}}, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r5) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r4, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x6, 0x2, 0x2, 0x0, 0xc6}) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r6, &(0x7f0000000780)=ANY=[@ANYBLOB="c20200007d00000005fa0000006a0000004000000000000000000000000000000010000000020000000000000000000000001f00046e6f6465767b6376666f7825ffffff8102000000000000000000000000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500003b595fcb14034354b9fd9ef196a51cd5157adc8106b494e11200fbe161e900000000000000000000f313f6005e00f8f67efb716dcf315ecaf385409ac65b9408679d2c3b9e1d52c3d6da9bf1995688dace6cde7ba4a400b4b0b4dbe64f64b1d63f26796dcbec498623d6a838c69a69dfce9cdd5906f174a666a8529a45773407dbdab2885baf050000000000b3016f6465762d6eb17b2300f9daa1ee23266ecf85fea65eb2d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae89480687bd7f3d7f298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238501000000aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9cf3ee3884002a91c54528b807a89ca184d16645f06188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f299f061f75b7797ce1e411ea918ebd888c1e156b8456931d2ea726ba9609d51a41dd3de304bd7c7ed0a456f0ae12516105c9478f7ded2dc47ec13c0f6af88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff000000000000007461b0ccaaa1933a0e8a826b14d4fcb2989ffaaa1acffa8054e9559dfae4697aa00b03b3d80e5524f8495fee7e8d88cb5a040302acb0d1260f2584db48e8d9064e8ce178ce396e85b97e4886444049810f", @ANYRES32=0x0, @ANYRES64=r4], 0x2c2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x0, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000000000007112370000000000950000000000000089e2d90aa1795cc26efb1dacf01150510936875c66d6a7d6eb12d4cdbc5c0ce0d29df91940d8ca08008e7aa5b3c9a10909d6e18b263131bf965f55746df5189a2e23905ae4dc5340e0eb74eb523d5b77a763cccb768b4453c8b1b1dd0a71983b5c2cfe11f3d30228772b0b798ebaf5abde2ce3ec34f8c6f13ee1f181ac563ba7a7edc9be94452da6d7eb67ae3243cb393245efd0dd21de9553cbd1a8516282de458c44d1ddae97af584de743d44ed18d20dd3b2c42cf1e8b27788dfc562367d46197198cd19fda89a6feca6c738b1d4b2522"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r7 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f010400000009058303"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r7, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) r8 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r8, 0x40304580, &(0x7f0000000300)={0x50, 0xffff, 0x0, {0x0, 0x68bd}, {}, @cond=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r9, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r1, 0x0, 0x0) socket(0x11, 0xa, 0x0) 2m41.18836692s ago: executing program 2 (id=1658): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000440)=ANY=[@ANYRES16=r1, @ANYBLOB="01002abd7000fedbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="570033008000de00ffffffffffff08021100000050505050505080000101000000000000640002450006"], 0x78}, 0x1, 0x0, 0x0, 0x880}, 0x0) 2m40.537513542s ago: executing program 2 (id=1659): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x81, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key(&(0x7f0000002100)='keyring\x00', 0x0, &(0x7f0000002180)="8ec5", 0x2, 0xfffffffffffffffb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) socket$netlink(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETLED(r4, 0x4b32, 0xf1a) sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0xe, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400100142603600e1208000b0000000401a80016000800014009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r5 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r5, &(0x7f00000000c0)=""/4096, 0x1000) keyctl$read(0xb, r5, &(0x7f00000010c0)=""/4096, 0x1000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getflags(r6, 0x401) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000020900010073797a3000ff000000000000090a010400000000000000000700000008000a40000000000900020073797a310000000008000640ffffff0008000540000000218c0000000c0a01030000000000000000070000090900020073797a31000000000900010073797a3000000000600003805c000080080003400000000250000b802c0001800a0001006c696d69740000001c0002800c00024000000000000000000c0001400000000000000003200001800a00010071756f7461000000100002800c0001400000000000000000140000001000010000000000000000000084000a"], 0x10c}}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 2m37.266606273s ago: executing program 2 (id=1671): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) sendmsg$802154_raw(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000040)="f11ac557", 0x4}}, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}, 0x535677bd}], 0x1, 0x40000000, 0x0) 2m35.736337266s ago: executing program 2 (id=1675): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a, 0x2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad724a1"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 2m34.738134347s ago: executing program 2 (id=1677): r0 = socket(0x10, 0x803, 0xfffffffc) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x0, 0x20}, 0x10) socket$inet6(0xa, 0x2, 0x3a) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc57"], &(0x7f0000000140)='GPL\x00'}, 0x94) r4 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)={r4, r3}) r6 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r6) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000000300)={0x0, 0xfffffffffffffe7a, r8}) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r6, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325842, 0x0, [], [0x2b8]}) 2m27.783649906s ago: executing program 2 (id=1693): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) rt_sigprocmask(0x1, 0x0, 0x0, 0x0) getpid() epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x58, r3, 0x1, 0x70bd2d, 0x1, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) 2m12.540691602s ago: executing program 33 (id=1693): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) rt_sigprocmask(0x1, 0x0, 0x0, 0x0) getpid() epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x58, r3, 0x1, 0x70bd2d, 0x1, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) 26.430991995s ago: executing program 4 (id=1899): socket$netlink(0x10, 0x3, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc018643a, &(0x7f0000000240)={0x10000001}) 16.074376849s ago: executing program 0 (id=1918): prctl$PR_SCHED_CORE(0x3e, 0x2000000000001, 0x0, 0x2, 0x0) mknod$loop(0x0, 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) fcntl$getflags(0xffffffffffffffff, 0x401) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x7ffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(0x0, 0x0, &(0x7f0000000540), 0x0, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b45, 0x1) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x2fd, 0xffff, 0x101, 0x300}}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) 16.014098539s ago: executing program 4 (id=1919): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'geneve1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newlink={0x194, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_AF_SPEC={0x174, 0x1a, 0x0, 0x1, [@AF_INET={0x40, 0x2, 0x0, 0x1, {0x3c, 0x1, 0x0, 0x1, [{0x8, 0x7}, {0x8, 0x18}, {0x8, 0x3}, {0x8, 0x9, 0x0, 0x0, 0x3}, {0x8, 0xc}, {0x8, 0x12}, {0x8, 0x1f}]}}, @AF_INET6={0x78, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IFLA_INET6_TOKEN={0x14, 0x7, @private2}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_BRIDGE={0x4}, @AF_INET6={0x4c, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x6}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x2f}, @IFLA_INET6_TOKEN={0x14, 0x7, @local}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x10}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xeb}]}, @AF_INET6={0x2c, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private0}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}]}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8, 0x3ffe}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x18, 0x0, 0x0, 0x54}]}}]}]}, 0x194}}, 0x0) 15.44424458s ago: executing program 0 (id=1920): waitid(0x0, 0x0, 0x0, 0x8, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000000)=0x59cc, 0x4) 15.39031666s ago: executing program 4 (id=1921): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, 0x0, &(0x7f0000000140)}, 0x20) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0), 0x4) close(r0) 15.311563903s ago: executing program 0 (id=1922): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x101000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 'queue0\x00', 0x1}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_dev$sg(0x0, 0x6f5e, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = msgget(0x0, 0x40) msgctl$MSG_INFO(r2, 0xc, &(0x7f00000000c0)=""/173) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1000080, 0x0) r3 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) r4 = syz_usb_connect(0x3, 0x24, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x32, 0x33, 0x7a, 0x8, 0x644, 0x8021, 0x4778, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x7, 0x30, 0xe, [{{0x9, 0x4, 0x1, 0x1, 0x0, 0xff, 0xbc, 0x54, 0x8}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000001ec0)={0x24, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0081000000000000000c"], 0x0, 0x0}, 0x0) syz_usb_control_io(r3, &(0x7f0000001380)={0x2c, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) 12.134466855s ago: executing program 5 (id=1926): r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000340)={0x28, 0x5, 0x0, 0x0, 0x0, 0x0, 0x100000001}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000008c0)={0x28, 0x7, 0x0, 0x0, &(0x7f0000ae0000/0x4000)=nil, 0x4000, 0x8}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(r0, 0x3ba0, &(0x7f0000019300)={0x48, 0x9, 0x0, 0x0, 0x9}) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r4, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r2}, 0x20) sendmmsg$inet6(r2, &(0x7f0000019300), 0x400000000000164, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x4, &(0x7f0000001ac0)=ANY=[@ANYBLOB="180100001c0000000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x27, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r5}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) 10.600304185s ago: executing program 3 (id=1928): socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_key_refresh_complete={{0x30, 0x3}, {0x8, 0xc9}}}, 0x6) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f0000000040)={0x1, @sdr={0x34325842, 0x7}}) 9.334026262s ago: executing program 3 (id=1929): socket$netlink(0x10, 0x3, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc018643a, &(0x7f0000000240)={0x10000001}) 8.942895025s ago: executing program 0 (id=1931): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000280)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) truncate(&(0x7f00000001c0)='./file0\x00', 0x100000000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e23, 0x6, @private1, 0xd1}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000000cc0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xcea, @remote, 0x4}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='j', 0x1}], 0x1}}], 0x1, 0x4000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000100)={r7, 0x1}, 0x8) close(0xffffffffffffffff) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r8, &(0x7f0000000380)="e6aebb12ee41b11d1e4d617d681744949b945f6601d49a", 0x17, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r8, 0x1) recvfrom(r8, 0x0, 0x0, 0x61, 0x0, 0x0) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r4, 0x0, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) 7.99009914s ago: executing program 4 (id=1932): waitid(0x0, 0x0, 0x0, 0x8, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000000)=0x59cc, 0x4) 7.220068787s ago: executing program 4 (id=1934): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)) gettid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fdffffee0000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00', 0x5}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000000000000000000000000000085000000050000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008008000b703000000009c8c850000006d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) sendto$inet6(r5, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r5, 0x1) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) 7.086451767s ago: executing program 6 (id=1935): r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x1}) io_setup(0x2ae1, &(0x7f0000000180)=0x0) eventfd2(0x10000, 0x0) io_submit(r2, 0x2, &(0x7f0000000600)=[0x0, 0x0]) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) mprotect(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x5) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_complete(r0) 6.456190528s ago: executing program 5 (id=1936): socket$nl_xfrm(0x10, 0x3, 0x6) socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f00000004c0), 0x14305, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r1, &(0x7f0000000200)={0xa, 0xffff, 0x0, @loopback}, 0x1c) r2 = socket(0xa, 0x5, 0x0) setsockopt$inet_int(r2, 0x0, 0x15, &(0x7f00000000c0)=0x80000000, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x20048010}, 0x24000000) set_robust_list(0x0, 0x0) close(r1) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xc001, 0x0) ioctl$TIOCGSERIAL(r4, 0x541e, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001780)=""/4070}) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0xa, 0x4, 0x1, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x0, 0x0}) 5.608210412s ago: executing program 6 (id=1937): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote, 0x3}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003340)=[{{&(0x7f0000000080)={0xa, 0x4e24, 0x200, @remote, 0x7}, 0x1c, 0x0}}], 0x1, 0x14000001) 5.501919122s ago: executing program 5 (id=1938): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x3c, r1, 0x431, 0x70bd28, 0xfffffffd, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_TX={0x5, 0x4, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x40) 5.096224307s ago: executing program 0 (id=1939): socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_key_refresh_complete={{0x30, 0x3}, {0x8, 0xc9}}}, 0x6) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f0000000040)={0x1, @sdr={0x34325842, 0x7}}) 4.963844575s ago: executing program 6 (id=1940): mkdir(&(0x7f0000000140)='./file1\x00', 0x1a0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000280)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0xee01, &(0x7f00000003c0)={0x0, 0x5, 0x1000, 0x472, 0x4000000000000000, 0xfffffffffffffffc, 0x23, 0x0, 0xfeff}) fchown(r0, 0xee01, 0x0) 4.742749671s ago: executing program 5 (id=1941): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000540)="0cc31a4098ddc80dadd3a0aa2bea9050d9f47bcde4cbb8170d3d61aabbdbd869e8a75ab95a3b8e8b960477dbbbbf5cb0fd4a98ea0032d054de676f19c5e1f84def57482d1b3eb94a2a1d3c0af33709610ece6cb54ae7f8c3ed385c3890244d348c9bcfb556ee478845ff23d8a9f2a492531e7c7ce719ef1983bdaf4008386323fc593be590321dbe51aa4ecabebf495efc0f722637337e20cc541399dc617deafa840b68f2b22e5f7c6afb3825871b966ab90a79a4d6d72f29a1e43abdf4d25f6352dfa26c57684224fdb0e14151550796aaa09b4669e71d9f4255f63905467b709f6d7185347a078538e4443f0dad324393274e857979db0a9e3894857aacabc2f2ccd9457fda98a520e2b8c83085a206c8aea9dd18a0b66c87b3b61f95fafed84303436c7ae3782f714dc364c10102788b02d3aed05cb29fe974b75e7bf53dfd2554d7b700dcbf24a6fa021732b747a2c7d6d2a649e1ca523f91ba57da29e6e5050da7ec9466884aea64349e0c65b40bd78fe25622a5f854d351fd3282e85e37989b73e1a3b9fe874ad7131850117f28a930f8fb5afe15040fd20cd9c861c95b2c1f9844ac1f8b3cd0a7f22269e235866414acb5f4d9d0b64301cd5b4e8c2da68caacd3f7dda0f325120ad99c05a55736067c87cceda7b850758e60ab8829b0dbfdc1ca8322e6716e643e00c2f665781461f08282a0aa366d9927036d685c3a721530dafe21e62906c5710c3214621d6374d9f5eef47eca1e5080e21510000009822a3bf99784f7b19e2dfaa7b8ba39dc5212c94585af38e7a50cbf6d619e3f1b8e4c17351203fa037ca4ce7ef32fd", 0x250, 0x4000, &(0x7f0000000180)=@caif=@rfm={0x25, 0x107ff, "6798c48f000000ec00"}, 0x80) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') setgroups(0x400000000000026f, &(0x7f0000000080)=[0x0, 0xee00]) read$FUSE(r3, &(0x7f0000003680)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$isdn(0x22, 0x2, 0x10) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, &(0x7f00000001c0), 0x8) listen(r4, 0x5) getsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, &(0x7f0000000440)=0x1, &(0x7f00000007c0)=0x4) 3.744299798s ago: executing program 0 (id=1942): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, 0x0, &(0x7f0000000140)}, 0x20) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0), 0x4) close(r0) 3.71006486s ago: executing program 3 (id=1943): prctl$PR_SCHED_CORE(0x3e, 0x2000000000001, 0x0, 0x2, 0x0) mknod$loop(0x0, 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) fcntl$getflags(0xffffffffffffffff, 0x401) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x7ffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(0x0, 0x0, &(0x7f0000000540), 0x0, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b45, 0x1) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x2fd, 0xffff, 0x101, 0x300}}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) 3.708929549s ago: executing program 4 (id=1944): syz_open_dev$video(&(0x7f0000000580), 0x7, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x68}, 0x8080) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) socket(0x10, 0x40000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x6, 0x142) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x80489439, 0x0) sched_setattr(0x0, 0x0, 0x0) r3 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r3, 0x0, 0x86) r4 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x0, 0x0) dup3(r4, r3, 0x0) fsmount(0xffffffffffffffff, 0x1, 0xf4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_int(r5, 0x29, 0x46, 0x0, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f00000000c0), 0x12) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_icmp_raw(0x2, 0x3, 0x1) 3.672269844s ago: executing program 6 (id=1945): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x3ff, 0x5}) r1 = eventfd(0x80000) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 2.951273866s ago: executing program 5 (id=1946): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x3, r1}, 0x14) 2.760197759s ago: executing program 3 (id=1947): r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x1}) io_setup(0x2ae1, &(0x7f0000000180)=0x0) eventfd2(0x10000, 0x0) io_submit(r2, 0x2, &(0x7f0000000600)=[0x0, 0x0]) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) mprotect(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x5) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_complete(r0) 2.466430638s ago: executing program 5 (id=1948): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080), r1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x75b08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e27}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSW2(r6, 0x80047456, 0x0) socket$inet(0x2, 0x3, 0x13) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$F2FS_IOC_MOVE_RANGE(r7, 0xc020f509, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f0000000740)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r7, 0xc0182101, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00000800000008048263d1cb392ee6262d168b33aca6c4419e26a06d31"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000040)='P') 2.340472427s ago: executing program 6 (id=1949): r0 = syz_io_uring_setup(0x26fe, &(0x7f0000000300)={0x0, 0xf36e, 0x10100, 0x0, 0x200034b}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=""/116, 0x74}], 0x1) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x28}}, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x14, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<'], 0x38}}, 0x4048000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.kill\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, 0x0) io_uring_enter(r0, 0x2d3e, 0x2936, 0x0, 0x0, 0x0) 2.08908053s ago: executing program 6 (id=1950): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) request_key(0x0, &(0x7f0000001ffb)={'syz', 0x1, 0xa}, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLAGS={0x6, 0x8, 0x3f}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @private=0xa010100}]}}}]}, 0x40}}, 0x4048084) 1.716242761s ago: executing program 3 (id=1951): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x0, "2e2b5aa4"}, @local=@item_4={0x3, 0x2, 0x0, "f85edaca"}, @main=@item_4={0x3, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000800), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSFLAG(r1, 0x4004480f, &(0x7f0000000000)=0x3) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) 0s ago: executing program 3 (id=1952): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r0}, 0x53) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = fsopen(&(0x7f0000000100)='nilfs2\x00', 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @func={0x2}]}, {0x0, [0x0, 0x2e]}}, 0x0, 0x40}, 0x28) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = timerfd_create(0x8, 0x0) timerfd_gettime(r2, &(0x7f00000000c0)) kernel console output (not intermixed with test programs): _hcd [ 434.851599][ T5929] usb 2-1: Using ep0 maxpacket: 8 [ 434.904688][ T5929] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 434.904719][ T5929] usb 2-1: config 179 has no interface number 0 [ 435.025498][ T5929] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 435.025532][ T5929] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 435.025548][ T5929] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 435.025564][ T5929] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 435.025607][ T5929] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 435.025631][ T5929] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.524955][ T9295] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 436.515792][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input42 [ 437.440926][ T5934] usb 3-1: device descriptor read/8, error -71 [ 437.558542][ T5934] usb usb3-port1: unable to enumerate USB device [ 440.170339][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.916764][ T5929] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 441.076566][ T5929] usb 1-1: Using ep0 maxpacket: 16 [ 441.120652][ T5929] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 441.145122][ T5929] usb 1-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 441.145142][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.145154][ T5929] usb 1-1: Product: syz [ 441.145161][ T5929] usb 1-1: Manufacturer: syz [ 441.145247][ T5929] usb 1-1: SerialNumber: syz [ 441.288389][ T5929] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input43 [ 443.468719][ T10] usb 1-1: USB disconnect, device number 13 [ 451.334435][ T9378] netlink: 36 bytes leftover after parsing attributes in process `syz.0.993'. [ 451.334455][ T9378] netlink: 36 bytes leftover after parsing attributes in process `syz.0.993'. [ 452.688428][ T5841] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 452.700288][ T5841] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 452.706721][ T5841] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 452.829552][ T5841] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 452.872777][ T5841] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 454.957715][ T5841] Bluetooth: hci5: command tx timeout [ 456.567516][ T5921] usb 2-1: USB disconnect, device number 26 [ 456.567531][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 456.567678][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 457.031015][ T9429] input: syz1 as /devices/virtual/input/input44 [ 457.045529][ T5841] Bluetooth: hci5: command tx timeout [ 457.127710][ T9429] netlink: 'syz.2.1006': attribute type 1 has an invalid length. [ 457.462118][ C1] vkms_vblank_simulate: vblank timer overrun [ 457.504302][ T9434] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 457.886118][ T9434] veth0_to_team: entered promiscuous mode [ 457.886148][ T9434] veth0_to_team: entered allmulticast mode [ 457.887302][ C1] vkms_vblank_simulate: vblank timer overrun [ 457.973317][ T9432] gretap1: entered allmulticast mode [ 458.183528][ C1] vkms_vblank_simulate: vblank timer overrun [ 459.128680][ T5841] Bluetooth: hci5: command tx timeout [ 459.163257][ T3589] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.767049][ C1] vkms_vblank_simulate: vblank timer overrun [ 460.431002][ C1] vkms_vblank_simulate: vblank timer overrun [ 460.867098][ C1] vkms_vblank_simulate: vblank timer overrun [ 461.170667][ C1] vkms_vblank_simulate: vblank timer overrun [ 461.409234][ T5841] Bluetooth: hci5: command tx timeout [ 462.052779][ T3589] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.734486][ T3589] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.328850][ T3589] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.399555][ T9385] chnl_net:caif_netlink_parms(): no params data found [ 464.906788][ T9385] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.906957][ T9385] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.907211][ T9385] bridge_slave_0: entered allmulticast mode [ 464.916783][ T9385] bridge_slave_0: entered promiscuous mode [ 464.924044][ T9385] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.924174][ T9385] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.924376][ T9385] bridge_slave_1: entered allmulticast mode [ 464.942368][ T9385] bridge_slave_1: entered promiscuous mode [ 465.698121][ T9385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 465.848203][ T9385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 468.050086][ T8094] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 468.207203][ T8094] usb 5-1: device descriptor read/64, error -71 [ 468.466742][ T8094] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 468.606523][ T8094] usb 5-1: device descriptor read/64, error -71 [ 468.747295][ T8094] usb usb5-port1: attempt power cycle [ 468.761990][ T3589] bridge_slave_1: left allmulticast mode [ 468.762189][ T3589] bridge_slave_1: left promiscuous mode [ 468.768390][ T3589] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.893978][ T3589] bridge_slave_0: left allmulticast mode [ 468.894016][ T3589] bridge_slave_0: left promiscuous mode [ 468.894286][ T3589] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.077199][ T9557] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1043'. [ 469.086644][ T8094] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 469.112889][ T8094] usb 5-1: device descriptor read/8, error -71 [ 469.147837][ T9559] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1044'. [ 469.348616][ T8094] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 469.368012][ T8094] usb 5-1: device descriptor read/8, error -71 [ 469.477011][ T8094] usb usb5-port1: unable to enumerate USB device [ 470.438374][ T9563] random: crng reseeded on system resumption [ 471.577679][ T3589] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 471.669764][ T3589] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 471.710637][ T3589] bond0 (unregistering): Released all slaves [ 471.853280][ T3589] bond1 (unregistering): Released all slaves [ 471.920845][ T9385] team0: Port device team_slave_0 added [ 472.129127][ T9559] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1044'. [ 472.129160][ T9559] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1044'. [ 472.177064][ T9385] team0: Port device team_slave_1 added [ 472.265729][ T9568] 9pnet_fd: Insufficient options for proto=fd [ 472.340916][ T9570] binder: 9569:9570 ioctl c0306201 0 returned -14 [ 472.341612][ T9570] binder: 9569:9570 ioctl c0306201 200000000240 returned -11 [ 472.666916][ T3589] tipc: Disabling bearer [ 472.747043][ T3589] tipc: Left network mode [ 473.206527][ T10] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 473.216750][ T9460] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 473.358754][ T10] usb 1-1: device descriptor read/64, error -71 [ 473.363857][ T9592] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1056'. [ 473.416930][ T9460] usb 3-1: Using ep0 maxpacket: 16 [ 473.418950][ T9460] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 473.418971][ T9460] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 473.428540][ T9460] usb 3-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 473.428571][ T9460] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.428592][ T9460] usb 3-1: Product: syz [ 473.428605][ T9460] usb 3-1: Manufacturer: syz [ 473.428627][ T9460] usb 3-1: SerialNumber: syz [ 473.626878][ T10] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 473.776544][ T10] usb 1-1: device descriptor read/64, error -71 [ 473.880753][ T9385] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 473.880769][ T9385] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 473.880797][ T9385] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 473.888474][ T9385] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 473.888489][ T9385] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 473.888515][ T9385] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 473.966458][ T10] usb usb1-port1: attempt power cycle [ 474.060179][ T45] usb 3-1: USB disconnect, device number 35 [ 474.316609][ T10] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 474.337368][ T10] usb 1-1: device descriptor read/8, error -71 [ 475.406528][ T10] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 475.437280][ T10] usb 1-1: device descriptor read/8, error -71 [ 475.439168][ T9602] binder: 9600:9602 ioctl c0306201 0 returned -14 [ 475.452312][ T9602] binder: 9600:9602 ioctl c0306201 200000000240 returned -11 [ 475.547083][ T10] usb usb1-port1: unable to enumerate USB device [ 475.581089][ T9608] capability: warning: `syz.3.1063' uses deprecated v2 capabilities in a way that may be insecure [ 476.388533][ T9620] ======================================================= [ 476.388533][ T9620] WARNING: The mand mount option has been deprecated and [ 476.388533][ T9620] and is ignored by this kernel. Remove the mand [ 476.388533][ T9620] option from the mount to silence this warning. [ 476.388533][ T9620] ======================================================= [ 476.389454][ T9620] new mount options do not match the existing superblock, will be ignored [ 477.139306][ T37] audit: type=1326 audit(1758946467.868:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139361][ T37] audit: type=1326 audit(1758946467.878:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139414][ T37] audit: type=1326 audit(1758946467.888:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=315 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139455][ T37] audit: type=1326 audit(1758946467.888:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139494][ T37] audit: type=1326 audit(1758946467.888:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139535][ T37] audit: type=1326 audit(1758946467.898:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139572][ T37] audit: type=1326 audit(1758946467.898:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139613][ T37] audit: type=1326 audit(1758946467.898:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139652][ T37] audit: type=1326 audit(1758946467.908:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.139692][ T37] audit: type=1326 audit(1758946467.928:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9616 comm="syz.3.1066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 477.231929][ T9629] 9pnet_fd: Insufficient options for proto=fd [ 477.467910][ T10] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 477.627551][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 477.629156][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 477.632775][ T10] usb 1-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 477.632804][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.632824][ T10] usb 1-1: Product: syz [ 477.632839][ T10] usb 1-1: Manufacturer: syz [ 477.632854][ T10] usb 1-1: SerialNumber: syz [ 477.891018][ T9385] hsr_slave_0: entered promiscuous mode [ 477.892413][ T9385] hsr_slave_1: entered promiscuous mode [ 477.892893][ T9385] debugfs: 'hsr0' already exists in 'hsr' [ 477.892908][ T9385] Cannot create hsr debugfs directory [ 477.894463][ T9637] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1070'. [ 477.971275][ T10] usb 1-1: USB disconnect, device number 18 [ 477.996868][ T3589] hsr_slave_0: left promiscuous mode [ 478.016627][ T3589] hsr_slave_1: left promiscuous mode [ 478.017839][ T3589] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 478.017934][ T3589] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 478.064001][ T3589] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 478.064035][ T3589] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 478.141080][ T3589] veth1_macvtap: left promiscuous mode [ 478.141343][ T3589] veth0_macvtap: left promiscuous mode [ 478.141689][ T3589] veth1_vlan: left promiscuous mode [ 478.142028][ T3589] veth0_vlan: left promiscuous mode [ 480.427221][ T3589] team0 (unregistering): Port device team_slave_1 removed [ 480.689688][ T3589] team0 (unregistering): Port device team_slave_0 removed [ 482.181887][ T9679] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1081'. [ 482.186620][ T8094] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 482.348306][ T8094] usb 1-1: Using ep0 maxpacket: 16 [ 482.354569][ T8094] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 482.385512][ T8094] usb 1-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 482.385545][ T8094] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.385565][ T8094] usb 1-1: Product: syz [ 482.385579][ T8094] usb 1-1: Manufacturer: syz [ 482.385594][ T8094] usb 1-1: SerialNumber: syz [ 482.721024][ T9460] usb 1-1: USB disconnect, device number 19 [ 483.824497][ T37] kauditd_printk_skb: 5 callbacks suppressed [ 483.824553][ T37] audit: type=1107 audit(1758946475.338:30): pid=9685 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='' [ 484.544234][ T8094] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 484.706496][ T8094] usb 1-1: Using ep0 maxpacket: 32 [ 484.709157][ T8094] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 484.709187][ T8094] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.731845][ T8094] usb 1-1: config 0 descriptor?? [ 484.823273][ T9697] 9pnet_fd: Insufficient options for proto=fd [ 484.936274][ T8094] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 485.063153][ T8094] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 485.103181][ T8094] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 485.103275][ T8094] usb 1-1: media controller created [ 485.341448][ T8094] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 486.613368][ T8094] az6027: usb out operation failed. (-71) [ 486.761773][ T9385] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 487.268426][ T8094] az6027: usb out operation failed. (-71) [ 487.268446][ T8094] stb0899_attach: Driver disabled by Kconfig [ 487.268456][ T8094] az6027: no front-end attached [ 487.268456][ T8094] [ 487.268903][ T8094] az6027: usb out operation failed. (-71) [ 487.268917][ T8094] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 487.282297][ T8094] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input45 [ 487.298720][ T8094] dvb-usb: schedule remote query interval to 400 msecs. [ 487.298745][ T8094] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 487.313446][ T8094] usb 1-1: USB disconnect, device number 20 [ 487.900626][ T9385] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 488.194007][ T9385] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 488.312134][ T8094] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 488.418219][ T9385] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 488.633291][ T3589] IPVS: stop unused estimator thread 0... [ 490.926109][ T9751] 9pnet_fd: Insufficient options for proto=fd [ 491.004181][ T9385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 491.189338][ T9385] 8021q: adding VLAN 0 to HW filter on device team0 [ 491.247615][ T6312] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.247790][ T6312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 491.308261][ T6796] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.308438][ T6796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 491.516664][ T5921] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 491.806581][ T5921] usb 1-1: Using ep0 maxpacket: 32 [ 491.811194][ T5921] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 491.811225][ T5921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.823684][ T5921] usb 1-1: config 0 descriptor?? [ 493.009750][ T5921] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 493.039121][ T5921] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 493.066794][ T5921] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 493.066852][ T5921] usb 1-1: media controller created [ 493.182133][ T5921] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 493.334557][ T5921] az6027: usb out operation failed. (-71) [ 493.343240][ T5921] az6027: usb out operation failed. (-71) [ 493.343258][ T5921] stb0899_attach: Driver disabled by Kconfig [ 493.343270][ T5921] az6027: no front-end attached [ 493.343270][ T5921] [ 493.343716][ T5921] az6027: usb out operation failed. (-71) [ 493.343731][ T5921] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 493.399130][ T5921] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input46 [ 493.430296][ T5921] dvb-usb: schedule remote query interval to 400 msecs. [ 493.430319][ T5921] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 493.453281][ T5921] usb 1-1: USB disconnect, device number 21 [ 493.961042][ T9385] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 493.997348][ T5921] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 494.254951][ T9798] fuse: Bad value for 'fd' [ 495.616616][ T9808] warning: `syz.0.1111' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 495.920611][ T9812] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1112'. [ 496.329941][ T9385] veth0_vlan: entered promiscuous mode [ 496.330503][ T9820] tipc: Started in network mode [ 496.330530][ T9820] tipc: Node identity aa62171d2b27, cluster identity 4711 [ 496.330727][ T9820] tipc: Enabled bearer , priority 0 [ 496.331811][ T9820] syzkaller0: entered promiscuous mode [ 496.331837][ T9820] syzkaller0: entered allmulticast mode [ 496.395634][ T9820] tipc: Resetting bearer [ 496.466746][ T9817] tipc: Resetting bearer [ 496.707585][ T9817] tipc: Disabling bearer [ 496.896468][ T5928] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 497.046435][ T5928] usb 5-1: Using ep0 maxpacket: 32 [ 497.049087][ T5928] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 497.049118][ T5928] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.082865][ T5928] usb 5-1: config 0 descriptor?? [ 497.936464][ T5928] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 497.944534][ T5928] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 497.945631][ T5928] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 497.945684][ T5928] usb 5-1: media controller created [ 498.031302][ T5928] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 498.125471][ T9385] veth1_vlan: entered promiscuous mode [ 498.157031][ T5928] az6027: usb out operation failed. (-71) [ 498.157458][ T5928] az6027: usb out operation failed. (-71) [ 498.157471][ T5928] stb0899_attach: Driver disabled by Kconfig [ 498.157482][ T5928] az6027: no front-end attached [ 498.157482][ T5928] [ 498.158714][ T5928] az6027: usb out operation failed. (-71) [ 498.158730][ T5928] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 498.165968][ T5928] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input47 [ 498.223572][ T5928] dvb-usb: schedule remote query interval to 400 msecs. [ 498.223596][ T5928] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 498.266836][ T5928] usb 5-1: USB disconnect, device number 28 [ 498.305550][ T9846] fuse: Bad value for 'fd' [ 498.336634][ T8094] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 498.373438][ T9385] veth0_macvtap: entered promiscuous mode [ 498.413431][ T9385] veth1_macvtap: entered promiscuous mode [ 498.425307][ T9848] tipc: Enabling of bearer rejected, failed to enable media [ 498.486162][ T9385] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 498.502132][ T8094] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 498.502180][ T8094] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 498.502206][ T8094] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.561818][ T9385] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 498.600855][ T8094] usb 3-1: config 0 descriptor?? [ 498.635000][ T1157] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.656249][ T1157] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.676788][ T1157] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.691123][ T1157] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.799216][ T5928] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 498.847649][ T8094] ath6kl: Failed to submit usb control message: -71 [ 498.847701][ T8094] ath6kl: unable to send the bmi data to the device: -71 [ 498.847717][ T8094] ath6kl: Unable to send get target info: -71 [ 498.881688][ T8094] ath6kl: Failed to init ath6kl core: -71 [ 498.882444][ T8094] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 498.917119][ T8094] usb 3-1: USB disconnect, device number 36 [ 499.122378][ T9857] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1124'. [ 503.109381][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.433586][ T9893] fuse: Bad value for 'fd' [ 504.182064][ T9896] tipc: Enabled bearer , priority 0 [ 504.182923][ T9899] syzkaller0: entered promiscuous mode [ 504.182944][ T9899] syzkaller0: entered allmulticast mode [ 504.431354][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 504.431376][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 504.541113][ T9891] tipc: Resetting bearer [ 504.820156][ T9891] tipc: Disabling bearer [ 505.078297][ T5841] Bluetooth: hci4: unexpected event for opcode 0x0809 [ 505.176480][ T9] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 505.260676][ T9925] fuse: Unknown parameter '0x0000000000000003' [ 505.330312][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 505.330342][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 505.330387][ T9] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 505.330411][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 505.344536][ T9] usb 3-1: config 0 descriptor?? [ 505.382834][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 505.518156][ T7131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 505.518171][ T7131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 505.923297][ T37] audit: type=1326 audit(1758946497.448:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.926240][ T37] audit: type=1326 audit(1758946497.448:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.938728][ T37] audit: type=1326 audit(1758946497.468:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.938783][ T37] audit: type=1326 audit(1758946497.468:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.938824][ T37] audit: type=1326 audit(1758946497.468:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.939119][ T37] audit: type=1326 audit(1758946497.468:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=333 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.952075][ T37] audit: type=1326 audit(1758946497.478:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 505.952125][ T37] audit: type=1326 audit(1758946497.478:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9939 comm="syz.4.1145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 506.006517][ T9] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 506.173103][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 506.175292][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 506.195981][ T9] usb 1-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 506.196013][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.196033][ T9] usb 1-1: Product: syz [ 506.196047][ T9] usb 1-1: Manufacturer: syz [ 506.196062][ T9] usb 1-1: SerialNumber: syz [ 506.355071][ T9] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input48 [ 508.524986][ T5908] usb 3-1: USB disconnect, device number 37 [ 510.847181][ T1233] usb 1-1: USB disconnect, device number 22 [ 513.879457][T10020] ref_ctr_offset mismatch. inode: 0x4c9 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x200000000400 [ 515.206900][T10034] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1164'. [ 520.862346][T10075] block nbd2: shutting down sockets [ 521.066238][T10093] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1185'. [ 521.066460][T10093] bridge_slave_1: left allmulticast mode [ 521.066489][T10093] bridge_slave_1: left promiscuous mode [ 521.066673][T10093] bridge0: port 2(bridge_slave_1) entered disabled state [ 521.324814][T10093] bridge_slave_0: left allmulticast mode [ 521.324835][T10093] bridge_slave_0: left promiscuous mode [ 521.325023][T10093] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.479910][T10099] IPVS: Error connecting to the multicast addr [ 523.636489][ T45] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 523.766497][ T45] usb 5-1: device descriptor read/64, error -71 [ 523.791110][T10108] fuse: Unknown parameter '0x0000000000000003' [ 524.006543][ T45] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 524.104004][T10118] netlink: 'syz.3.1189': attribute type 1 has an invalid length. [ 524.136498][ T45] usb 5-1: device descriptor read/64, error -71 [ 524.296136][ T45] usb usb5-port1: attempt power cycle [ 524.355246][T10121] gretap1: entered allmulticast mode [ 528.186526][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 528.312602][T10158] syz.0.1201 (10158) used greatest stack depth: 16824 bytes left [ 528.336558][ T10] usb 6-1: device descriptor read/64, error -71 [ 528.576443][ T10] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 528.706482][ T10] usb 6-1: device descriptor read/64, error -71 [ 528.851316][ T10] usb usb6-port1: attempt power cycle [ 528.952666][T10183] fuse: Bad value for 'fd' [ 529.328703][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 529.357310][ T10] usb 6-1: device descriptor read/8, error -71 [ 529.800564][ T10] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 530.318426][ T10] usb 6-1: device descriptor read/8, error -71 [ 530.470336][ T10] usb usb6-port1: unable to enumerate USB device [ 531.561625][T10216] syz.5.1212 (10216): drop_caches: 2 [ 532.272932][T10223] netlink: 'syz.3.1213': attribute type 1 has an invalid length. [ 535.818861][T10261] IPv6: sit1: Disabled Multicast RS [ 536.397455][ T45] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 536.766493][ T45] usb 1-1: device descriptor read/64, error -71 [ 537.006493][ T45] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 537.086488][ T9460] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 537.136603][ T45] usb 1-1: device descriptor read/64, error -71 [ 537.236512][ T9460] usb 3-1: Using ep0 maxpacket: 16 [ 537.239186][ T9460] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 537.239219][ T9460] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 537.243842][ T9460] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 537.243871][ T9460] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.243892][ T9460] usb 3-1: Product: syz [ 537.243907][ T9460] usb 3-1: Manufacturer: syz [ 537.243922][ T9460] usb 3-1: SerialNumber: syz [ 537.246938][ T45] usb usb1-port1: attempt power cycle [ 537.296585][ T9460] usb 3-1: config 0 descriptor?? [ 537.317438][ T9460] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 537.317482][ T9460] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 537.596657][ T45] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 537.633606][ T45] usb 1-1: device descriptor read/8, error -71 [ 537.866698][ T45] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 537.888025][ T45] usb 1-1: device descriptor read/8, error -71 [ 538.133141][ T45] usb usb1-port1: unable to enumerate USB device [ 538.136503][ T9460] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 538.138114][ T9460] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 539.766798][ T9460] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 539.767293][ T9460] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 539.767710][ T9460] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 539.768125][ T9460] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 539.768538][ T9460] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 539.768957][ T9460] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 539.800091][ T9460] usb 3-1: USB disconnect, device number 38 [ 540.166506][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 540.377135][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 541.080755][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 541.182070][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 541.182102][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.182123][ T10] usb 6-1: Product: syz [ 541.182138][ T10] usb 6-1: Manufacturer: syz [ 541.182152][ T10] usb 6-1: SerialNumber: syz [ 541.263187][ T10] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input49 [ 541.424922][T10307] syz.0.1235 (10307): drop_caches: 2 [ 541.496491][ T9460] usb 6-1: USB disconnect, device number 6 [ 543.116743][ T45] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 543.246487][ T45] usb 6-1: device descriptor read/64, error -71 [ 543.567987][ T45] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 543.696499][ T45] usb 6-1: device descriptor read/64, error -71 [ 543.812110][ T45] usb usb6-port1: attempt power cycle [ 543.953721][T10343] syz.4.1247 (10343): drop_caches: 2 [ 544.016543][ T5908] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 544.146508][ T45] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 544.167294][ T45] usb 6-1: device descriptor read/8, error -71 [ 544.170292][ T5908] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 544.170415][ T5908] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 544.170462][ T5908] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 544.170494][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.251415][ T5908] usb 3-1: config 0 descriptor?? [ 544.283220][ T5908] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 544.386525][ T5929] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 544.406587][ T45] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 544.427494][ T45] usb 6-1: device descriptor read/8, error -71 [ 544.536868][ T45] usb usb6-port1: unable to enumerate USB device [ 544.546612][ T5929] usb 1-1: Using ep0 maxpacket: 16 [ 544.548863][ T5929] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 544.551928][ T5929] usb 1-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 544.551955][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.551975][ T5929] usb 1-1: Product: syz [ 544.551989][ T5929] usb 1-1: Manufacturer: syz [ 544.552061][ T5929] usb 1-1: SerialNumber: syz [ 544.601474][ T5929] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input50 [ 544.798823][ T5929] usb 1-1: USB disconnect, device number 27 [ 545.655900][T10375] syz.0.1260 (10375): drop_caches: 2 [ 547.715688][T10396] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 547.900834][ T5929] usb 3-1: USB disconnect, device number 39 [ 548.986484][ T5921] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 549.689136][ T5921] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 549.689153][ T5921] usb 1-1: config 0 has no interface number 0 [ 549.690961][ T5921] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 549.690977][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.690988][ T5921] usb 1-1: Product: syz [ 549.690996][ T5921] usb 1-1: Manufacturer: syz [ 549.691003][ T5921] usb 1-1: SerialNumber: syz [ 549.697451][ T5921] usb 1-1: config 0 descriptor?? [ 549.943460][ T5921] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 549.946197][ T5921] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 549.953212][ T5921] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 549.953269][ T5921] usb 1-1: media controller created [ 549.999747][ T5921] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 550.265852][T10416] syz.4.1272 (10416): drop_caches: 2 [ 550.317599][ T5921] usb 1-1: DVB: registering adapter 1 frontend 0 (E3C EC100 DVB-T)... [ 550.362786][ T5921] dvbdev: dvb_create_media_entity: media entity 'E3C EC100 DVB-T' registered. [ 550.672104][ T5921] DVB: Unable to find symbol mxl5005s_attach() [ 550.805620][ T5921] usb 1-1: USB disconnect, device number 28 [ 551.837479][ T9460] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 552.078800][ T9460] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 552.078830][ T9460] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 552.078868][ T9460] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 552.078900][ T9460] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.099479][ T9460] usb 1-1: config 0 descriptor?? [ 552.939853][ T9460] usb 1-1: string descriptor 0 read error: -71 [ 552.962667][ T9460] usb 1-1: USB disconnect, device number 29 [ 554.749534][T10451] netlink: 'syz.5.1279': attribute type 21 has an invalid length. [ 554.749635][T10451] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1279'. [ 554.750691][T10451] netlink: 'syz.5.1279': attribute type 21 has an invalid length. [ 554.750749][T10451] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1279'. [ 555.577587][ T9460] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 555.706471][ T9460] usb 5-1: device descriptor read/64, error -71 [ 556.927622][ T9460] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 557.056464][ T9460] usb 5-1: device descriptor read/64, error -71 [ 557.247012][ T9460] usb usb5-port1: attempt power cycle [ 558.416478][ T9460] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 558.552984][ T9460] usb 5-1: device descriptor read/8, error -71 [ 563.400894][ T5841] Bluetooth: hci5: unexpected subevent 0x0c length: 1 < 5 [ 563.689490][T10533] netlink: 'syz.0.1304': attribute type 21 has an invalid length. [ 563.689591][T10533] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1304'. [ 563.690409][T10533] netlink: 'syz.0.1304': attribute type 21 has an invalid length. [ 563.690470][T10533] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1304'. [ 565.757183][ T5929] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 565.909252][ T5929] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 565.909284][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.035233][ T5929] usb 1-1: config 0 descriptor?? [ 566.962202][ T37] audit: type=1326 audit(1758946558.488:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.962320][ T37] audit: type=1326 audit(1758946558.488:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.986530][ T37] audit: type=1326 audit(1758946558.488:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.986589][ T37] audit: type=1326 audit(1758946558.488:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.986630][ T37] audit: type=1326 audit(1758946558.488:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.986670][ T37] audit: type=1326 audit(1758946558.488:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=315 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.986710][ T37] audit: type=1326 audit(1758946558.488:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 566.986750][ T37] audit: type=1326 audit(1758946558.488:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10569 comm="syz.3.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 567.830384][T10599] random: crng reseeded on system resumption [ 568.029366][T10582] netlink: 'syz.3.1326': attribute type 21 has an invalid length. [ 568.029645][T10582] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1326'. [ 568.030503][T10582] netlink: 'syz.3.1326': attribute type 21 has an invalid length. [ 568.030562][T10582] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1326'. [ 568.171253][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.487378][ T5952] usb 1-1: USB disconnect, device number 30 [ 569.496624][ T9460] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 569.740867][ T9460] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 569.740885][ T9460] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 569.740926][ T9460] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 569.740939][ T9460] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.745912][ T9460] usb 1-1: config 0 descriptor?? [ 569.770788][ T9460] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 569.770845][ T9460] dvb-usb: bulk message failed: -22 (3/0) [ 569.862615][ T9460] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 569.867503][ T9460] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 569.867558][ T9460] usb 1-1: media controller created [ 569.917332][ T9460] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 569.999748][ T5841] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 569.999867][ T5841] Bluetooth: hci5: Injecting HCI hardware error event [ 570.003623][ T5841] Bluetooth: hci5: hardware error 0x00 [ 570.052418][ T9460] dvb-usb: bulk message failed: -22 (6/0) [ 570.052496][ T9460] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 570.076291][ T9460] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input51 [ 570.116648][ T5153] Bluetooth: hci4: unexpected event for opcode 0x0005 [ 570.138814][ T9460] dvb-usb: schedule remote query interval to 150 msecs. [ 570.138846][ T9460] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 570.185189][ T9460] usb 1-1: USB disconnect, device number 31 [ 571.056880][ T9460] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 572.956449][ T5841] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 573.836993][ T5929] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 574.000603][ T5929] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.000633][ T5929] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 574.000687][ T5929] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 574.000711][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.060091][ T5929] usb 5-1: config 0 descriptor?? [ 574.074201][ T5929] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 574.074233][ T5929] dvb-usb: bulk message failed: -22 (3/0) [ 574.508920][ T5929] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 574.509813][ T5929] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 574.509847][ T5929] usb 5-1: media controller created [ 574.511351][ T5929] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 574.634682][ T5929] dvb-usb: bulk message failed: -22 (6/0) [ 574.634767][ T5929] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 574.661445][ T5929] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input52 [ 574.678341][ T5929] dvb-usb: schedule remote query interval to 150 msecs. [ 574.678363][ T5929] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 574.682761][ T5929] usb 5-1: USB disconnect, device number 36 [ 575.275954][ T5929] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 575.397130][ T37] audit: type=1326 audit(1758946566.928:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10673 comm="syz.0.1350" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f52c5bfeec9 code=0x7ffc0000 [ 575.397179][ T37] audit: type=1326 audit(1758946566.928:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10673 comm="syz.0.1350" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f52c5bfeec9 code=0x7ffc0000 [ 579.786618][ T5908] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 579.946588][ T5908] usb 5-1: Using ep0 maxpacket: 32 [ 579.949302][ T5908] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 579.949331][ T5908] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 579.989660][ T5908] usb 5-1: config 0 descriptor?? [ 580.430004][ T5908] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 581.250885][ T5908] usb 5-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 581.250916][ T5908] usb 5-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 583.186571][ T9460] usb 6-1: new full-speed USB device number 11 using dummy_hcd [ 583.418160][ T9460] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 583.418189][ T9460] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 583.418243][ T9460] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 583.418268][ T9460] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 583.464705][ T9460] usb 6-1: config 0 descriptor?? [ 583.474881][ T9460] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 583.474931][ T9460] dvb-usb: bulk message failed: -22 (3/0) [ 583.496153][ T9460] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 583.497827][ T9460] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 583.499102][ T9460] usb 6-1: media controller created [ 583.514198][ T9460] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 583.815049][ T9460] dvb-usb: bulk message failed: -22 (6/0) [ 583.815098][ T9460] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 583.824298][ T9460] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input53 [ 583.905305][ T9460] dvb-usb: schedule remote query interval to 150 msecs. [ 583.905323][ T9460] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 583.924345][ T9460] usb 6-1: USB disconnect, device number 11 [ 584.215608][ T9460] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 588.187196][ T9460] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 588.344990][ T9460] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.345019][ T9460] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 588.345076][ T9460] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 588.345098][ T9460] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.351195][ T9460] usb 6-1: config 0 descriptor?? [ 588.386573][ T45] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 588.417165][ T9460] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 588.417218][ T9460] dvb-usb: bulk message failed: -22 (3/0) [ 588.482112][ T9460] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 588.495141][ T9460] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 588.495200][ T9460] usb 6-1: media controller created [ 588.530390][ T9460] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 588.548760][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 588.551419][ T45] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 588.551437][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 588.554596][ T45] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 588.554691][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.554714][ T45] usb 1-1: Product: syz [ 588.554729][ T45] usb 1-1: Manufacturer: syz [ 588.554745][ T45] usb 1-1: SerialNumber: syz [ 588.560608][ T45] usb 1-1: config 0 descriptor?? [ 588.579130][ T45] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 588.579166][ T45] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 588.879065][ T9460] dvb-usb: bulk message failed: -22 (6/0) [ 588.882353][ T9460] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 588.923802][ T9460] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input54 [ 588.977842][ T9460] dvb-usb: schedule remote query interval to 150 msecs. [ 588.977865][ T9460] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 589.018987][ T9460] usb 6-1: USB disconnect, device number 12 [ 589.183626][ T45] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 589.189281][ T45] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 589.805090][ T9460] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 589.817352][ T45] em28xx 1-1:0.0: Unknown AC97 audio processor detected! [ 589.817649][ C1] raw-gadget.1 gadget.0: ignoring, device is not running [ 589.817802][ T45] em28xx 1-1:0.0: couldn't setup AC97 register 2 [ 589.818100][ C1] raw-gadget.1 gadget.0: ignoring, device is not running [ 589.818261][ T45] em28xx 1-1:0.0: couldn't setup AC97 register 4 [ 589.818555][ C1] raw-gadget.1 gadget.0: ignoring, device is not running [ 589.818706][ T45] em28xx 1-1:0.0: couldn't setup AC97 register 6 [ 589.819277][ T45] em28xx 1-1:0.0: couldn't setup AC97 register 54 [ 589.819696][ T45] em28xx 1-1:0.0: couldn't setup AC97 register 56 [ 589.899067][ T45] usb 1-1: USB disconnect, device number 32 [ 590.696337][ C0] vkms_vblank_simulate: vblank timer overrun [ 590.740625][ C0] vkms_vblank_simulate: vblank timer overrun [ 590.890324][ C0] vkms_vblank_simulate: vblank timer overrun [ 591.028093][ C0] vkms_vblank_simulate: vblank timer overrun [ 591.198926][ C0] vkms_vblank_simulate: vblank timer overrun [ 592.740711][ C0] vkms_vblank_simulate: vblank timer overrun [ 592.975386][ C0] vkms_vblank_simulate: vblank timer overrun [ 593.487208][T10840] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 594.676528][ T5952] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 597.374024][ T5952] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 597.374053][ T5952] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 597.374107][ T5952] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 597.374131][ T5952] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.363951][ T5952] usb 6-1: config 0 descriptor?? [ 598.541546][ T5952] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 598.541599][ T5952] dvb-usb: bulk message failed: -22 (3/0) [ 598.568050][ T5952] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 598.577013][ T5952] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 598.577147][ T5952] usb 6-1: media controller created [ 598.598986][ T5952] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 598.644598][ T5952] dvb-usb: bulk message failed: -22 (6/0) [ 598.644664][ T5952] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 598.711640][ T5952] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input55 [ 598.767006][ T5952] dvb-usb: schedule remote query interval to 150 msecs. [ 598.767028][ T5952] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 598.781808][ T5952] usb 6-1: USB disconnect, device number 13 [ 599.787253][ T5952] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 601.156717][ T45] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 601.366546][ T45] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 601.366615][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 601.366638][ T45] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 601.370362][ T45] usb 1-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 601.370394][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.370415][ T45] usb 1-1: Product: syz [ 601.370435][ T45] usb 1-1: Manufacturer: syz [ 601.370450][ T45] usb 1-1: SerialNumber: syz [ 601.487488][ T45] usb 1-1: config 0 descriptor?? [ 601.494610][ T45] usb 1-1: ucan: probing device on interface #0 [ 601.494635][ T45] usb 1-1: ucan: invalid EP count (1) [ 601.494652][ T45] usb 1-1: ucan: probe failed; try to update the device firmware [ 607.079283][ T9460] usb 1-1: USB disconnect, device number 33 [ 607.949394][ T5952] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 608.168306][ T5952] usb 6-1: Using ep0 maxpacket: 16 [ 608.175225][ T5952] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 608.175259][ T5952] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 608.213791][ T5952] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 608.213821][ T5952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.213842][ T5952] usb 6-1: Product: syz [ 608.213857][ T5952] usb 6-1: Manufacturer: syz [ 608.213871][ T5952] usb 6-1: SerialNumber: syz [ 608.264856][ T5952] usb 6-1: config 0 descriptor?? [ 608.280014][ T5952] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 608.280035][ T5952] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 608.929007][ T5952] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 608.929678][ T5952] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 609.538547][ T5952] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 609.538869][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 609.538960][ T5952] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 609.539359][ T5952] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 609.539648][ T5952] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 609.539936][ T5952] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 609.540228][ T5952] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 609.616894][ T5952] usb 6-1: USB disconnect, device number 14 [ 610.313320][T10951] IPv6: sit1: Disabled Multicast RS [ 612.908284][ T5841] Bluetooth: hci4: unexpected subevent 0x0c length: 1 < 5 [ 615.386117][T10999] IPv6: sit1: Disabled Multicast RS [ 620.281244][T11051] fuse: Bad value for 'group_id' [ 620.281258][T11051] fuse: Bad value for 'group_id' [ 629.608491][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 629.897313][T11118] fuse: Bad value for 'group_id' [ 629.897333][T11118] fuse: Bad value for 'group_id' [ 630.249758][T11125] netlink: 'syz.5.1488': attribute type 1 has an invalid length. [ 630.426554][ T10] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 630.588446][ T10] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 630.588482][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 630.588510][ T10] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 630.588522][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.648666][ T10] usb 3-1: config 0 descriptor?? [ 630.701810][ T10] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 633.531189][ T9] usb 3-1: USB disconnect, device number 40 [ 633.660060][T11155] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1502'. [ 636.120961][T11185] fuse: Bad value for 'group_id' [ 636.120981][T11185] fuse: Bad value for 'group_id' [ 636.316553][ T10] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 636.497407][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 636.501439][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 636.501459][ T10] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 636.501473][ T10] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 637.669928][ T10] usb 6-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 637.669953][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.669964][ T10] usb 6-1: Product: syz [ 637.669972][ T10] usb 6-1: Manufacturer: syz [ 637.669979][ T10] usb 6-1: SerialNumber: syz [ 637.673123][ T10] usb 6-1: config 0 descriptor?? [ 637.720257][T11184] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 637.769627][ T10] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 637.769676][ T10] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 637.769784][ T10] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 637.769827][ T10] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 637.769845][ T10] mcba_usb 6-1:0.0: Microchip CAN BUS Analyzer connected [ 637.982566][T11184] netlink: 'syz.5.1507': attribute type 1 has an invalid length. [ 638.074419][T11198] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1513'. [ 639.196430][ T5929] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 639.366458][ T5929] usb 1-1: Using ep0 maxpacket: 32 [ 639.368449][ T5929] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 639.368475][ T5929] usb 1-1: config 0 has no interface number 0 [ 639.368521][ T5929] usb 1-1: config 0 interface 89 has no altsetting 0 [ 639.370780][ T5929] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 639.370808][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 639.370834][ T5929] usb 1-1: Product: syz [ 639.370842][ T5929] usb 1-1: Manufacturer: syz [ 639.370850][ T5929] usb 1-1: SerialNumber: syz [ 639.436732][ T5929] usb 1-1: config 0 descriptor?? [ 639.443703][ T5929] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 639.443724][ T5929] em28xx 1-1:0.89: Video interface 89 found: bulk [ 640.159206][ T5929] em28xx 1-1:0.89: unknown em28xx chip ID (0) [ 640.659294][T11227] IPv6: sit1: Disabled Multicast RS [ 640.782164][ T5929] em28xx 1-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 640.782196][ T5929] em28xx 1-1:0.89: board has no eeprom [ 640.836459][ T5929] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67) [ 640.836494][ T5929] em28xx 1-1:0.89: analog set to bulk mode. [ 640.839163][ T9] em28xx 1-1:0.89: Registering V4L2 extension [ 640.874977][ T5929] usb 1-1: USB disconnect, device number 34 [ 640.884854][T11225] ptrace attach of "./syz-executor exec"[5835] was attempted by "./syz-executor exec"[11225] [ 640.885565][ T5929] em28xx 1-1:0.89: Disconnecting em28xx [ 640.980369][ T9] em28xx 1-1:0.89: Config register raw data: 0xffffffed [ 640.980393][ T9] em28xx 1-1:0.89: AC97 chip type couldn't be determined [ 640.980407][ T9] em28xx 1-1:0.89: No AC97 audio processor [ 641.024899][ T9] usb 1-1: Decoder not found [ 641.024914][ T9] em28xx 1-1:0.89: failed to create media graph [ 641.024945][ T9] em28xx 1-1:0.89: V4L2 device video103 deregistered [ 641.074875][ T9] em28xx 1-1:0.89: Registering snapshot button... [ 641.090456][ T9] input: em28xx snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.89/input/input58 [ 641.187939][ T9] em28xx 1-1:0.89: Remote control support is not available for this card. [ 641.200253][ T5929] em28xx 1-1:0.89: Closing input extension [ 641.215520][ T5929] em28xx 1-1:0.89: Deregistering snapshot button [ 641.313619][T11230] befs: (nbd4): No write support. Marking filesystem read-only [ 641.348399][T11230] befs: (nbd4): unable to read superblock [ 642.161148][T11241] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1525'. [ 642.249675][ T45] usb 6-1: USB disconnect, device number 15 [ 642.344093][ T45] mcba_usb 6-1:0.0 can0: device disconnected [ 642.364089][ T5929] em28xx 1-1:0.89: Freeing device [ 643.087376][ T5841] Bluetooth: hci2: unexpected subevent 0x0c length: 1 < 5 [ 645.599475][ T5908] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 645.599560][ T5908] dvb_usb_az6027 5-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 645.670600][ T5908] usb 5-1: USB disconnect, device number 37 [ 645.942790][T11285] IPVS: Error connecting to the multicast addr [ 646.786470][ T45] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 646.939870][ T45] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 646.939898][ T45] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 646.939921][ T45] usb 6-1: config 1 has no interface number 0 [ 646.939968][ T45] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 646.939995][ T45] usb 6-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 646.940023][ T45] usb 6-1: too many endpoints for config 1 interface 1 altsetting 1: 247, using maximum allowed: 30 [ 646.940076][ T45] usb 6-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 247 [ 646.943433][ T45] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 646.943462][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.943482][ T45] usb 6-1: Product: syz [ 646.943497][ T45] usb 6-1: Manufacturer: syz [ 646.943511][ T45] usb 6-1: SerialNumber: syz [ 647.456537][ T5908] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 647.538184][ T45] cdc_ncm 6-1:1.1: bind() failure [ 647.569762][ T45] usb 6-1: USB disconnect, device number 16 [ 647.706440][ T5908] usb 1-1: Using ep0 maxpacket: 16 [ 647.710107][ T5908] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 647.710137][ T5908] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 647.710163][ T5908] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 647.715306][ T5908] usb 1-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 647.715334][ T5908] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 647.715354][ T5908] usb 1-1: Product: syz [ 647.715369][ T5908] usb 1-1: Manufacturer: syz [ 647.715383][ T5908] usb 1-1: SerialNumber: syz [ 647.797189][ T5908] usb 1-1: config 0 descriptor?? [ 647.799816][T11307] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 647.843070][ T5908] mcba_usb 1-1:0.0 can0: failed tx_urb -90 [ 647.843121][ T5908] mcba_usb 1-1:0.0 can0: Failed to send cmd (169) [ 647.843233][ T5908] mcba_usb 1-1:0.0 can0: failed tx_urb -90 [ 647.843273][ T5908] mcba_usb 1-1:0.0 can0: Failed to send cmd (169) [ 647.843289][ T5908] mcba_usb 1-1:0.0: Microchip CAN BUS Analyzer connected [ 648.015821][T11305] netlink: 'syz.0.1540': attribute type 1 has an invalid length. [ 649.844364][T11330] IPVS: Error connecting to the multicast addr [ 651.998783][ T5841] Bluetooth: hci4: unexpected subevent 0x0c length: 1 < 5 [ 652.476277][T11360] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1552'. [ 652.857555][ T5499] mcba_usb 1-1:0.0 can0: bit-timing not yet defined [ 653.892599][ T9] usb 1-1: USB disconnect, device number 35 [ 653.954552][ T9] mcba_usb 1-1:0.0 can0: device disconnected [ 654.755784][ T5826] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 654.978607][ T5826] usb 3-1: Using ep0 maxpacket: 16 [ 654.985002][ T5826] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 654.985036][ T5826] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 654.998544][ T5826] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 654.998576][ T5826] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.998597][ T5826] usb 3-1: Product: syz [ 654.998612][ T5826] usb 3-1: Manufacturer: syz [ 654.998627][ T5826] usb 3-1: SerialNumber: syz [ 655.457434][ T5826] usb 3-1: config 0 descriptor?? [ 655.470998][ T5826] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 655.471034][ T5826] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 657.076523][ T5826] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 657.077039][ T5826] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 657.077452][ T5826] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 657.077469][ T5826] em28xx 3-1:0.0: No AC97 audio processor [ 657.108743][ T5826] usb 3-1: USB disconnect, device number 41 [ 657.110914][ T5826] em28xx 3-1:0.0: Disconnecting em28xx [ 657.167579][ T5826] em28xx 3-1:0.0: Freeing device [ 659.292792][ T37] audit: type=1326 audit(1758946650.008:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11418 comm="syz.5.1568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 659.292845][ T37] audit: type=1326 audit(1758946650.008:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11418 comm="syz.5.1568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 659.292888][ T37] audit: type=1326 audit(1758946650.018:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11418 comm="syz.5.1568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 659.292929][ T37] audit: type=1326 audit(1758946650.018:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11418 comm="syz.5.1568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 659.651753][T11428] ALSA: mixer_oss: invalid OSS volume '' [ 659.685697][T11428] syz.2.1569 (11428): drop_caches: 2 [ 661.806558][ T5929] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 661.996913][ T5929] usb 6-1: Using ep0 maxpacket: 16 [ 661.999081][ T5929] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 661.999100][ T5929] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 662.001613][ T5929] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 662.001631][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.001641][ T5929] usb 6-1: Product: syz [ 662.001649][ T5929] usb 6-1: Manufacturer: syz [ 662.001657][ T5929] usb 6-1: SerialNumber: syz [ 662.005121][ T5929] usb 6-1: config 0 descriptor?? [ 662.112379][ T5929] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 662.112400][ T5929] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 662.714113][ T5929] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 662.714633][ T5929] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 662.715102][ T5929] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 662.715112][ T5929] em28xx 6-1:0.0: No AC97 audio processor [ 664.289537][T11465] netlink: 'syz.3.1580': attribute type 21 has an invalid length. [ 664.358514][T11466] netlink: 'syz.3.1580': attribute type 21 has an invalid length. [ 664.458214][ T5826] usb 6-1: USB disconnect, device number 17 [ 664.459494][ T5826] em28xx 6-1:0.0: Disconnecting em28xx [ 664.493500][T11465] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1580'. [ 664.502050][T11466] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1580'. [ 664.686244][ T5826] em28xx 6-1:0.0: Freeing device [ 664.977244][ T5952] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 665.059791][T11477] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1584'. [ 665.143291][ T5952] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 665.143349][ T5952] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 665.143371][ T5952] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 665.146499][ T5952] usb 5-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 665.146526][ T5952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.146547][ T5952] usb 5-1: Product: syz [ 665.146563][ T5952] usb 5-1: Manufacturer: syz [ 665.146576][ T5952] usb 5-1: SerialNumber: syz [ 665.219526][ T5952] usb 5-1: config 0 descriptor?? [ 665.319378][ T5952] usb 5-1: ucan: probing device on interface #0 [ 665.319404][ T5952] usb 5-1: ucan: invalid EP count (1) [ 665.319420][ T5952] usb 5-1: ucan: probe failed; try to update the device firmware [ 665.776506][ T5929] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 666.156505][ T5929] usb 1-1: Using ep0 maxpacket: 16 [ 666.159494][ T5929] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 666.159516][ T5929] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 666.161859][ T5929] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 666.161877][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.161888][ T5929] usb 1-1: Product: syz [ 666.161895][ T5929] usb 1-1: Manufacturer: syz [ 666.161903][ T5929] usb 1-1: SerialNumber: syz [ 666.236277][ T5929] usb 1-1: config 0 descriptor?? [ 666.283969][ T5929] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 666.283992][ T5929] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 666.935392][ T5929] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 666.936048][ T5929] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 666.936963][ T5929] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 666.936983][ T5929] em28xx 1-1:0.0: No AC97 audio processor [ 666.950176][ T45] usb 5-1: USB disconnect, device number 38 [ 667.556734][ T5826] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 667.707872][ T5826] usb 3-1: Using ep0 maxpacket: 16 [ 667.709395][ T5826] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 667.709414][ T5826] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 667.890138][ T5826] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 667.890157][ T5826] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.890169][ T5826] usb 3-1: Product: syz [ 667.890176][ T5826] usb 3-1: Manufacturer: syz [ 667.890184][ T5826] usb 3-1: SerialNumber: syz [ 667.893265][ T5826] usb 3-1: config 0 descriptor?? [ 667.974001][ T5826] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 667.974024][ T5826] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 668.485083][T11514] netlink: 'syz.4.1598': attribute type 21 has an invalid length. [ 668.485179][T11514] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1598'. [ 668.516662][T11514] netlink: 'syz.4.1598': attribute type 21 has an invalid length. [ 668.516736][T11514] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1598'. [ 668.696046][ T5826] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 668.696845][ T5826] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 668.697520][ T5826] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 668.697538][ T5826] em28xx 3-1:0.0: No AC97 audio processor [ 668.832616][ T5826] usb 1-1: USB disconnect, device number 36 [ 668.858645][ T5826] em28xx 1-1:0.0: Disconnecting em28xx [ 668.894314][ T5826] em28xx 1-1:0.0: Freeing device [ 670.599124][T11529] input: syz1 as /devices/virtual/input/input59 [ 670.687003][ T5826] usb 3-1: USB disconnect, device number 42 [ 670.688347][ T5826] em28xx 3-1:0.0: Disconnecting em28xx [ 670.819093][ T5826] em28xx 3-1:0.0: Freeing device [ 672.985564][T11553] binder: 11552:11553 ioctl c0306201 0 returned -14 [ 673.246632][ T5826] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 673.484971][ T5952] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 673.515311][ T5826] usb 5-1: Using ep0 maxpacket: 16 [ 674.306413][ T5826] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 674.306448][ T5826] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 674.352621][ T5826] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 674.352640][ T5826] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.352651][ T5826] usb 5-1: Product: syz [ 674.352658][ T5826] usb 5-1: Manufacturer: syz [ 674.352666][ T5826] usb 5-1: SerialNumber: syz [ 674.408656][ T5826] usb 5-1: config 0 descriptor?? [ 674.469706][ T5952] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 674.469796][ T5952] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 674.469824][ T5952] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 674.469847][ T5952] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 674.469891][ T5952] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 674.469969][ T5952] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.568326][ T5952] usb 1-1: config 0 descriptor?? [ 674.575628][ T5826] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 674.575663][ T5826] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 675.024565][T11571] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1615'. [ 675.221056][ T5952] usbhid 1-1:0.0: can't add hid device: -71 [ 675.221176][ T5952] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 675.258820][ T5952] usb 1-1: USB disconnect, device number 37 [ 675.596709][ T5826] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 675.636477][ T5826] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 675.666694][ T5826] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 675.666715][ T5826] em28xx 5-1:0.0: No AC97 audio processor [ 677.492347][ T5952] usb 5-1: USB disconnect, device number 39 [ 677.494770][ T5952] em28xx 5-1:0.0: Disconnecting em28xx [ 677.499092][ T5952] em28xx 5-1:0.0: Freeing device [ 677.673521][T11598] binder: 11597:11598 ioctl c0306201 0 returned -14 [ 678.329888][T11592] netlink: 'syz.0.1620': attribute type 21 has an invalid length. [ 678.338195][T11592] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1620'. [ 678.876576][ T5826] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 679.030590][ T5826] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 679.030652][ T5826] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 679.030676][ T5826] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 679.033953][ T5826] usb 6-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 679.033971][ T5826] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.033982][ T5826] usb 6-1: Product: syz [ 679.033990][ T5826] usb 6-1: Manufacturer: syz [ 679.034001][ T5826] usb 6-1: SerialNumber: syz [ 679.041518][ T5826] usb 6-1: config 0 descriptor?? [ 679.147091][ T5826] usb 6-1: ucan: probing device on interface #0 [ 679.147119][ T5826] usb 6-1: ucan: invalid EP count (1) [ 679.147135][ T5826] usb 6-1: ucan: probe failed; try to update the device firmware [ 681.202555][ T9] usb 6-1: USB disconnect, device number 18 [ 682.999372][T11650] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1638'. [ 683.525143][T11661] netlink: 'syz.2.1641': attribute type 21 has an invalid length. [ 683.668851][T11661] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1641'. [ 688.018129][ T9] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 690.056259][ T9] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 690.056290][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.091328][ T9] usb 3-1: config 0 descriptor?? [ 690.697479][ T9] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 690.701516][ T9] [drm:udl_init] *ERROR* Selecting channel failed [ 690.714276][T11708] random: crng reseeded on system resumption [ 691.070342][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.078339][ T9] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 691.078357][ T9] [drm] Initialized udl on minor 2 [ 691.098783][ T9] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 691.099100][ T9] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 691.099740][ T5929] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 691.105704][ T5929] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 691.105805][ T5929] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 691.153885][ T9] usb 3-1: USB disconnect, device number 43 [ 691.955319][T11728] netlink: 'syz.2.1659': attribute type 21 has an invalid length. [ 691.955396][T11728] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1659'. [ 693.449281][ C1] vkms_vblank_simulate: vblank timer overrun [ 693.617846][ C1] vkms_vblank_simulate: vblank timer overrun [ 693.858807][ C1] vkms_vblank_simulate: vblank timer overrun [ 694.115542][ C1] vkms_vblank_simulate: vblank timer overrun [ 694.340241][ C1] vkms_vblank_simulate: vblank timer overrun [ 694.952765][ C1] vkms_vblank_simulate: vblank timer overrun [ 694.974206][T11755] ieee802154 phy1 wpan1: encryption failed: -22 [ 695.970644][ C1] vkms_vblank_simulate: vblank timer overrun [ 696.056508][ C1] vkms_vblank_simulate: vblank timer overrun [ 697.203002][ T5928] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 697.486511][ T5928] usb 6-1: Using ep0 maxpacket: 16 [ 697.490502][ T5928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 697.490531][ T5928] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 697.490557][ T5928] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 697.495716][ T5928] usb 6-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 697.495746][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.495769][ T5928] usb 6-1: Product: syz [ 697.495785][ T5928] usb 6-1: Manufacturer: syz [ 697.495800][ T5928] usb 6-1: SerialNumber: syz [ 697.585367][ T5928] usb 6-1: config 0 descriptor?? [ 697.586779][T11773] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 697.631117][ T5928] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 697.631169][ T5928] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 697.631278][ T5928] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 697.631321][ T5928] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 697.631339][ T5928] mcba_usb 6-1:0.0: Microchip CAN BUS Analyzer connected [ 697.750681][T11785] syz.4.1679 (11785): drop_caches: 2 [ 697.800005][T11773] netlink: 'syz.5.1676': attribute type 1 has an invalid length. [ 698.759864][ C1] vkms_vblank_simulate: vblank timer overrun [ 698.785733][ C1] vkms_vblank_simulate: vblank timer overrun [ 699.409360][ C1] vkms_vblank_simulate: vblank timer overrun [ 700.402383][ C1] vkms_vblank_simulate: vblank timer overrun [ 700.580134][ T1233] usb 6-1: USB disconnect, device number 19 [ 700.582045][ T1233] mcba_usb 6-1:0.0 can0: device disconnected [ 701.056987][T11814] random: crng reseeded on system resumption [ 701.157808][T11815] ieee802154 phy1 wpan1: encryption failed: -22 [ 703.220861][ T37] audit: type=1326 audit(1758946694.748:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11830 comm="syz.4.1690" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 703.222841][ T37] audit: type=1326 audit(1758946694.748:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11830 comm="syz.4.1690" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 703.228250][ T37] audit: type=1326 audit(1758946694.758:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11830 comm="syz.4.1690" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 703.230662][ T37] audit: type=1326 audit(1758946694.758:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11830 comm="syz.4.1690" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 703.233679][ T37] audit: type=1326 audit(1758946694.758:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11830 comm="syz.4.1690" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 703.235573][ T37] audit: type=1326 audit(1758946694.758:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11830 comm="syz.4.1690" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef22b5eec9 code=0x7ffc0000 [ 705.750432][T11852] IPVS: Error connecting to the multicast addr [ 708.113322][ T37] audit: type=1326 audit(1758946699.638:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11889 comm="syz.3.1702" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 708.113363][ T37] audit: type=1326 audit(1758946699.638:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11889 comm="syz.3.1702" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 708.113387][ T37] audit: type=1326 audit(1758946699.638:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11889 comm="syz.3.1702" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 708.113409][ T37] audit: type=1326 audit(1758946699.638:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11889 comm="syz.3.1702" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 712.098431][T11917] random: crng reseeded on system resumption [ 713.056012][ T5841] block nbd4: Receive control failed (result -32) [ 713.060100][T11921] block nbd4: shutting down sockets [ 713.615763][ T37] kauditd_printk_skb: 4 callbacks suppressed [ 713.615782][ T37] audit: type=1326 audit(1758946705.138:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 713.618146][ T37] audit: type=1326 audit(1758946705.148:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 713.619156][ T37] audit: type=1326 audit(1758946705.148:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 713.620262][ T37] audit: type=1326 audit(1758946705.148:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 713.622127][ T37] audit: type=1326 audit(1758946705.148:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 713.623088][ T37] audit: type=1326 audit(1758946705.148:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 713.625466][ T37] audit: type=1326 audit(1758946705.148:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11932 comm="syz.5.1713" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74ff3beec9 code=0x7ffc0000 [ 721.796956][T12000] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1731'. [ 722.346507][ T9460] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 722.519331][ T5153] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 722.539655][ T5153] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 722.541092][ T5153] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 722.542416][ T5153] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 722.545668][ T5153] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 722.575908][ T9460] usb 6-1: Using ep0 maxpacket: 16 [ 722.696549][ T9460] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 722.782915][ T9460] usb 6-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 722.782947][ T9460] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.782968][ T9460] usb 6-1: Product: syz [ 722.782982][ T9460] usb 6-1: Manufacturer: syz [ 722.782996][ T9460] usb 6-1: SerialNumber: syz [ 722.862441][ T9460] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input60 [ 723.178903][T12013] tipc: Enabled bearer , priority 0 [ 723.179914][T12013] syzkaller0: entered promiscuous mode [ 723.179940][T12013] syzkaller0: entered allmulticast mode [ 723.889385][T12015] tipc: Resetting bearer [ 724.430157][T12011] tipc: Resetting bearer [ 724.716498][ T5153] Bluetooth: hci3: command tx timeout [ 724.959548][T12011] tipc: Disabling bearer [ 725.232335][T12017] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1735'. [ 725.470026][ T45] usb 6-1: USB disconnect, device number 20 [ 725.596660][ T9] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 725.806535][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 725.809305][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x6D, changing to 0xD [ 725.809339][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 3840, setting to 64 [ 725.906930][ T9] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 725.906961][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.906982][ T9] usb 5-1: Product: syz [ 725.906997][ T9] usb 5-1: Manufacturer: syz [ 725.907012][ T9] usb 5-1: SerialNumber: syz [ 725.993489][ T9] usb 5-1: config 0 descriptor?? [ 726.026984][ T9] streamzap 5-1:0.0: streamzap_probe: endpoint doesn't match input device 020d [ 726.252139][ T9] usb 5-1: USB disconnect, device number 40 [ 726.513122][T12024] netlink: 'syz.5.1737': attribute type 21 has an invalid length. [ 726.548603][T12024] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1737'. [ 726.549241][T12024] netlink: 'syz.5.1737': attribute type 21 has an invalid length. [ 726.549331][T12024] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1737'. [ 726.797941][ T5153] Bluetooth: hci3: command tx timeout [ 728.886498][ T5153] Bluetooth: hci3: command tx timeout [ 729.084602][ T1157] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.084637][ T1157] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 729.654285][T12058] tipc: Enabling of bearer rejected, failed to enable media [ 729.736505][ T9] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 729.899088][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 729.899125][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 729.899151][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 729.899174][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 729.899218][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 729.899243][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.116521][ T9] usb 1-1: config 0 descriptor?? [ 730.153609][ T1157] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.153645][ T1157] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.558288][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 730.558409][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 730.734046][ C1] vkms_vblank_simulate: vblank timer overrun [ 730.788853][ T9] usb 1-1: USB disconnect, device number 38 [ 730.966444][ T5153] Bluetooth: hci3: command tx timeout [ 730.982974][ T1157] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.983015][ T1157] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 731.077442][ T45] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 731.226547][ T45] usb 6-1: Using ep0 maxpacket: 16 [ 731.229816][ T45] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 731.380413][ T45] usb 6-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice= 0.40 [ 731.380446][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.380467][ T45] usb 6-1: Product: syz [ 731.380482][ T45] usb 6-1: Manufacturer: syz [ 731.380496][ T45] usb 6-1: SerialNumber: syz [ 731.445278][ T45] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input61 [ 732.441819][ T1157] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 732.441842][ T1157] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 732.590680][T12079] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1751'. [ 732.912805][T12009] chnl_net:caif_netlink_parms(): no params data found [ 733.016851][ T9] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 733.186698][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 733.205010][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x6D, changing to 0xD [ 733.205031][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 3840, setting to 64 [ 733.217822][ T9] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 733.217853][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.217865][ T9] usb 5-1: Product: syz [ 733.217873][ T9] usb 5-1: Manufacturer: syz [ 733.217881][ T9] usb 5-1: SerialNumber: syz [ 733.299328][ T9] usb 5-1: config 0 descriptor?? [ 733.325059][ T9] streamzap 5-1:0.0: streamzap_probe: endpoint doesn't match input device 020d [ 733.507419][ T9] usb 6-1: USB disconnect, device number 21 [ 733.634157][ T5826] usb 5-1: USB disconnect, device number 41 [ 733.970184][ C1] vkms_vblank_simulate: vblank timer overrun [ 736.130703][T12104] tipc: Enabled bearer , priority 0 [ 736.473821][T12105] netlink: 'syz.5.1755': attribute type 21 has an invalid length. [ 736.482860][T12108] fuse: Unknown parameter 'group_i00000000000000000000' [ 736.537655][T12107] netlink: 'syz.5.1755': attribute type 21 has an invalid length. [ 736.641309][T12100] syzkaller0: entered promiscuous mode [ 736.641327][T12100] syzkaller0: entered allmulticast mode [ 736.758416][T12105] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1755'. [ 736.944653][T12112] tipc: Resetting bearer [ 736.961402][T12107] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1755'. [ 736.996030][T12099] tipc: Resetting bearer [ 737.126480][ T1233] tipc: Node number set to 3817847478 [ 737.267464][T12099] tipc: Disabling bearer [ 737.359784][ T37] audit: type=1326 audit(1758946728.878:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.359839][ T37] audit: type=1326 audit(1758946728.878:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.359878][ T37] audit: type=1326 audit(1758946728.878:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.359919][ T37] audit: type=1326 audit(1758946728.878:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.359956][ T37] audit: type=1326 audit(1758946728.878:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.359992][ T37] audit: type=1326 audit(1758946728.878:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.360029][ T37] audit: type=1326 audit(1758946728.878:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.360069][ T37] audit: type=1326 audit(1758946728.878:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12114 comm="syz.3.1758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 737.640331][T12009] bridge0: port 1(bridge_slave_0) entered blocking state [ 737.640411][T12009] bridge0: port 1(bridge_slave_0) entered disabled state [ 737.640581][T12009] bridge_slave_0: entered allmulticast mode [ 737.642542][T12009] bridge_slave_0: entered promiscuous mode [ 737.726783][T12009] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.726861][T12009] bridge0: port 2(bridge_slave_1) entered disabled state [ 737.727024][T12009] bridge_slave_1: entered allmulticast mode [ 737.737663][T12009] bridge_slave_1: entered promiscuous mode [ 739.422372][ C0] vkms_vblank_simulate: vblank timer overrun [ 739.446523][ T45] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 739.579662][T12135] netlink: 2384 bytes leftover after parsing attributes in process `syz.3.1764'. [ 739.619007][ T45] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 739.619042][ T45] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 739.619070][ T45] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 739.619093][ T45] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 739.619139][ T45] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 739.619163][ T45] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.722358][ T45] usb 6-1: config 0 descriptor?? [ 740.128777][ C0] vkms_vblank_simulate: vblank timer overrun [ 740.174458][ C0] vkms_vblank_simulate: vblank timer overrun [ 740.216617][ C0] vkms_vblank_simulate: vblank timer overrun [ 740.357571][ C0] vkms_vblank_simulate: vblank timer overrun [ 740.367019][ T45] usbhid 6-1:0.0: can't add hid device: -71 [ 740.367156][ T45] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 740.406202][ T45] usb 6-1: USB disconnect, device number 22 [ 740.519390][ C0] vkms_vblank_simulate: vblank timer overrun [ 740.654044][ C0] vkms_vblank_simulate: vblank timer overrun [ 740.714749][ C0] vkms_vblank_simulate: vblank timer overrun [ 741.097831][ C0] vkms_vblank_simulate: vblank timer overrun [ 741.142751][ C0] vkms_vblank_simulate: vblank timer overrun [ 741.225504][T12141] fuse: Invalid rootmode [ 741.371251][ T1157] team0: Port device bridge1 removed [ 741.600747][ T1157] team0: Port device bridge2 removed [ 742.092299][ C0] vkms_vblank_simulate: vblank timer overrun [ 742.342127][ C0] vkms_vblank_simulate: vblank timer overrun [ 742.725912][ T1157] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 742.757231][ T1157] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 742.793056][T12149] fuse: Unknown parameter 'group_i00000000000000000000' [ 742.820183][ T1157] bond0 (unregistering): Released all slaves [ 742.829745][ T1157] bond1 (unregistering): Released all slaves [ 743.208926][ T37] audit: type=1326 audit(1758946734.728:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.208978][ T37] audit: type=1326 audit(1758946734.728:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.209026][ T37] audit: type=1326 audit(1758946734.728:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.209065][ T37] audit: type=1326 audit(1758946734.728:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.209105][ T37] audit: type=1326 audit(1758946734.728:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.209141][ T37] audit: type=1326 audit(1758946734.728:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.209178][ T37] audit: type=1326 audit(1758946734.728:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.209216][ T37] audit: type=1326 audit(1758946734.728:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12151 comm="syz.3.1768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbe970eec9 code=0x7ffc0000 [ 743.511001][ T1157] tipc: Left network mode [ 743.627075][T12009] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 743.647677][T12009] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 744.483497][T12160] tipc: Enabling of bearer rejected, failed to enable media [ 744.596617][ T9460] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 744.788492][T12009] team0: Port device team_slave_0 added [ 744.819726][ T9460] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 744.819760][ T9460] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 744.819786][ T9460] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 744.819809][ T9460] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 744.819855][ T9460] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 744.819878][ T9460] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.823414][T12009] team0: Port device team_slave_1 added [ 744.896628][ T9460] usb 6-1: config 0 descriptor?? [ 745.326174][ T9460] usbhid 6-1:0.0: can't add hid device: -71 [ 745.326255][ T9460] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 745.343356][ T9460] usb 6-1: USB disconnect, device number 23 [ 745.441545][T12009] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 745.441562][T12009] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 745.441588][T12009] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 745.546893][T12009] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 745.546910][T12009] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 745.546937][T12009] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 747.284188][T12190] fuse: Unknown parameter 'group_id00000000000000000000' [ 749.493817][T12009] hsr_slave_0: entered promiscuous mode [ 749.499154][T12009] hsr_slave_1: entered promiscuous mode [ 749.500021][T12009] debugfs: 'hsr0' already exists in 'hsr' [ 749.500045][T12009] Cannot create hsr debugfs directory [ 749.500632][T12213] tipc: Enabling of bearer rejected, failed to enable media [ 751.825920][T12254] ALSA: mixer_oss: invalid OSS volume 'C' [ 751.939390][T12254] syz.5.1786 (12254): drop_caches: 2 [ 752.483877][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 752.856495][ T1157] hsr_slave_0: left promiscuous mode [ 752.909597][ T1157] hsr_slave_1: left promiscuous mode [ 752.910531][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 752.910558][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 752.977451][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 752.977484][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 753.148123][ T1157] veth1_macvtap: left promiscuous mode [ 753.148247][ T1157] veth0_macvtap: left promiscuous mode [ 753.148538][ T1157] veth1_vlan: left promiscuous mode [ 753.148754][ T1157] veth0_vlan: left promiscuous mode [ 754.025307][T12264] syz.0.1788 (12264): drop_caches: 2 [ 756.882993][ T1157] team0 (unregistering): Port device team_slave_1 removed [ 757.127819][ T1157] team0 (unregistering): Port device team_slave_0 removed [ 759.997445][T12272] tipc: Enabling of bearer rejected, failed to enable media [ 760.278855][T12283] ptrace attach of "./syz-executor exec"[5840] was attempted by "./syz-executor exec"[12283] [ 760.563180][T12287] fuse: Unknown parameter 'group_id00000000000000000000' [ 761.588812][T12290] befs: (nbd0): No write support. Marking filesystem read-only [ 761.594615][T12290] befs: (nbd0): unable to read superblock [ 765.192782][T12009] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 766.318723][T12009] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 766.529673][T12323] netlink: 176 bytes leftover after parsing attributes in process `syz.3.1802'. [ 766.587196][T12009] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 766.657495][T12325] fuse: Unknown parameter 'group_id00000000000000000000' [ 766.746144][T12009] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 767.673611][ T1157] IPVS: stop unused estimator thread 0... [ 767.756696][T12347] tipc: Enabling of bearer rejected, failed to enable media [ 767.808250][T12009] 8021q: adding VLAN 0 to HW filter on device bond0 [ 768.093840][T12009] 8021q: adding VLAN 0 to HW filter on device team0 [ 768.147276][T10658] bridge0: port 1(bridge_slave_0) entered blocking state [ 768.147455][T10658] bridge0: port 1(bridge_slave_0) entered forwarding state [ 768.150033][T10658] bridge0: port 2(bridge_slave_1) entered blocking state [ 768.150180][T10658] bridge0: port 2(bridge_slave_1) entered forwarding state [ 769.198772][T12357] block nbd4: not configured, cannot reconfigure [ 770.478424][ T5826] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 770.688995][ T5826] usb 5-1: Using ep0 maxpacket: 32 [ 770.695329][ T5826] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 770.695358][ T5826] usb 5-1: config 0 has no interface number 0 [ 770.695408][ T5826] usb 5-1: config 0 interface 89 has no altsetting 0 [ 770.701628][ T5826] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 770.701657][ T5826] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.701677][ T5826] usb 5-1: Product: syz [ 770.701690][ T5826] usb 5-1: Manufacturer: syz [ 770.701705][ T5826] usb 5-1: SerialNumber: syz [ 770.734058][ T5826] usb 5-1: config 0 descriptor?? [ 770.780061][ T5826] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 770.780100][ T5826] em28xx 5-1:0.89: Video interface 89 found: bulk [ 770.818904][T12378] netlink: 176 bytes leftover after parsing attributes in process `syz.5.1812'. [ 771.115931][T12385] fuse: Unknown parameter 'group_id00000000000000000000' [ 771.278361][ T5928] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 771.381592][ T5826] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 771.402301][T12009] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 771.436581][ T5928] usb 6-1: Using ep0 maxpacket: 8 [ 771.439257][ T5928] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 771.439289][ T5928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 3840, setting to 64 [ 771.442627][ T5928] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 771.442655][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.442676][ T5928] usb 6-1: Product: syz [ 771.442690][ T5928] usb 6-1: Manufacturer: syz [ 771.442705][ T5928] usb 6-1: SerialNumber: syz [ 771.518304][ T5928] usb 6-1: config 0 descriptor?? [ 771.539671][ T5928] streamzap 6-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 771.755443][ T5928] usb 6-1: USB disconnect, device number 24 [ 771.920823][ T5826] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 771.920853][ T5826] em28xx 5-1:0.89: board has no eeprom [ 771.976618][ T5826] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 771.976649][ T5826] em28xx 5-1:0.89: analog set to bulk mode. [ 772.013597][ T9460] em28xx 5-1:0.89: Registering V4L2 extension [ 772.051629][ T5826] usb 5-1: USB disconnect, device number 42 [ 772.053931][ T5826] em28xx 5-1:0.89: Disconnecting em28xx [ 772.221395][ T9460] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 772.221419][ T9460] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 772.221432][ T9460] em28xx 5-1:0.89: No AC97 audio processor [ 772.259367][ T9460] usb 5-1: Decoder not found [ 772.259387][ T9460] em28xx 5-1:0.89: failed to create media graph [ 772.259418][ T9460] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 772.388661][ T9460] em28xx 5-1:0.89: Registering snapshot button... [ 772.449360][T12419] tipc: Enabling of bearer rejected, failed to enable media [ 772.469325][T12009] veth0_vlan: entered promiscuous mode [ 772.490198][ T9460] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input62 [ 772.514229][ T9460] em28xx 5-1:0.89: Remote control support is not available for this card. [ 772.519934][ T5826] em28xx 5-1:0.89: Closing input extension [ 772.519960][ T5826] em28xx 5-1:0.89: Deregistering snapshot button [ 772.555993][T12009] veth1_vlan: entered promiscuous mode [ 773.851106][T12433] block nbd5: not configured, cannot reconfigure [ 773.871819][T12009] veth0_macvtap: entered promiscuous mode [ 773.891006][ T5826] em28xx 5-1:0.89: Freeing device [ 774.694424][T12009] veth1_macvtap: entered promiscuous mode [ 775.063758][T12009] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 775.119876][T12009] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 775.200100][ T57] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.200409][ T57] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.200661][ T57] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.201252][ T57] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.265123][T12455] fuse: Bad value for 'user_id' [ 775.265136][T12455] fuse: Bad value for 'user_id' [ 775.446624][ T9460] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 775.599323][ T9460] usb 5-1: Using ep0 maxpacket: 16 [ 775.601887][ T9460] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 775.601923][ T9460] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 775.601947][ T9460] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 775.619758][ T9460] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 775.619789][ T9460] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.619809][ T9460] usb 5-1: Product: syz [ 775.620505][ T9460] usb 5-1: Manufacturer: syz [ 775.620523][ T9460] usb 5-1: SerialNumber: syz [ 775.667740][ T9460] usb 5-1: config 0 descriptor?? [ 775.669104][T12459] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 775.827172][ T9460] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 775.827223][ T9460] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 775.827325][ T9460] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 775.827365][ T9460] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 775.827383][ T9460] mcba_usb 5-1:0.0: Microchip CAN BUS Analyzer connected [ 775.965368][T12459] netlink: 'syz.4.1826': attribute type 1 has an invalid length. [ 776.086901][T12469] ptrace attach of "./syz-executor exec"[5840] was attempted by "./syz-executor exec"[12469] [ 776.093076][T12469] befs: (nbd0): No write support. Marking filesystem read-only [ 776.093229][T12469] befs: (nbd0): unable to read superblock [ 776.148969][ T9363] usb 5-1: USB disconnect, device number 43 [ 776.186949][ T9363] mcba_usb 5-1:0.0 can0: device disconnected [ 776.303269][T12479] netlink: 176 bytes leftover after parsing attributes in process `syz.5.1830'. [ 776.399289][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 776.399310][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 776.596047][T12375] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 776.596069][T12375] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 776.676589][ T1233] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 776.836469][ T1233] usb 6-1: Using ep0 maxpacket: 8 [ 776.839322][ T1233] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 776.839355][ T1233] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 3840, setting to 64 [ 776.888315][ T1233] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 776.888346][ T1233] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.888367][ T1233] usb 6-1: Product: syz [ 776.888381][ T1233] usb 6-1: Manufacturer: syz [ 776.888396][ T1233] usb 6-1: SerialNumber: syz [ 776.948629][ T1233] usb 6-1: config 0 descriptor?? [ 776.978922][ T1233] streamzap 6-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 777.330065][ T5928] usb 6-1: USB disconnect, device number 25 [ 780.086526][ T5928] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 780.256703][ T5928] usb 5-1: Using ep0 maxpacket: 8 [ 780.262820][ T5928] usb 5-1: unable to get BOS descriptor or descriptor too short [ 780.264068][ T5928] usb 5-1: config 35 has an invalid interface number: 229 but max is 0 [ 780.264093][ T5928] usb 5-1: config 35 has no interface number 0 [ 780.264126][ T5928] usb 5-1: config 35 interface 229 has no altsetting 0 [ 780.267160][ T5928] usb 5-1: New USB device found, idVendor=0979, idProduct=0270, bcdDevice=dd.eb [ 780.267188][ T5928] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.267208][ T5928] usb 5-1: Product: syz [ 780.267221][ T5928] usb 5-1: Manufacturer: syz [ 780.267235][ T5928] usb 5-1: SerialNumber: syz [ 780.339960][T12523] fuse: Bad value for 'rootmode' [ 783.171121][ T5928] gspca_main: jeilinj-2.14.0 probing 0979:0270 [ 783.954077][ T5928] usb 5-1: USB disconnect, device number 44 [ 785.796531][ T9363] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 786.292312][ T9363] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 786.292399][ T9363] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 786.292452][ T9363] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 786.292566][ T9363] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 786.293901][ T9363] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 786.294561][ T9363] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.888612][ T5928] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 786.911565][ T9363] usb 5-1: config 0 descriptor?? [ 787.378942][ T5928] usb 6-1: Using ep0 maxpacket: 32 [ 787.398921][ T5928] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 787.398949][ T5928] usb 6-1: config 0 has no interface number 0 [ 787.398998][ T5928] usb 6-1: config 0 interface 89 has no altsetting 0 [ 787.425168][ T5928] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 787.425199][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 787.425219][ T5928] usb 6-1: Product: syz [ 787.425233][ T5928] usb 6-1: Manufacturer: syz [ 787.425248][ T5928] usb 6-1: SerialNumber: syz [ 787.480442][ T5928] usb 6-1: config 0 descriptor?? [ 787.710605][ T5928] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 787.710643][ T5928] em28xx 6-1:0.89: Video interface 89 found: bulk [ 787.818182][ T9363] usbhid 5-1:0.0: can't add hid device: -71 [ 787.818309][ T9363] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 787.840636][ T9363] usb 5-1: USB disconnect, device number 45 [ 788.298490][T12559] NILFS (loop6): device size too small [ 788.614148][ T5928] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 789.387323][ T5928] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 789.387364][ T5928] em28xx 6-1:0.89: board has no eeprom [ 789.537107][ T5928] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 789.537135][ T5928] em28xx 6-1:0.89: analog set to bulk mode. [ 789.538551][ T5929] em28xx 6-1:0.89: Registering V4L2 extension [ 789.617090][ T5928] usb 6-1: USB disconnect, device number 26 [ 789.619506][ T5928] em28xx 6-1:0.89: Disconnecting em28xx [ 790.766245][T12572] IPv6: sit1: Disabled Multicast RS [ 790.790806][ T5929] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 790.790831][ T5929] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 790.790845][ T5929] em28xx 6-1:0.89: No AC97 audio processor [ 790.793930][ T5929] usb 6-1: Decoder not found [ 790.793946][ T5929] em28xx 6-1:0.89: failed to create media graph [ 790.793975][ T5929] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 790.962145][ T5929] em28xx 6-1:0.89: Registering snapshot button... [ 791.106548][ T5929] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input63 [ 791.139540][ T5929] em28xx 6-1:0.89: Remote control support is not available for this card. [ 791.188284][ T5928] em28xx 6-1:0.89: Closing input extension [ 791.188314][ T5928] em28xx 6-1:0.89: Deregistering snapshot button [ 791.506508][ T5929] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 791.578261][ T5928] em28xx 6-1:0.89: Freeing device [ 791.659131][ T5929] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 791.659170][ T5929] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 791.659199][ T5929] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 791.659222][ T5929] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 791.659267][ T5929] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 791.659290][ T5929] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.738602][ T5929] usb 7-1: config 0 descriptor?? [ 792.508499][T12594] fuse: Bad value for 'user_id' [ 792.508519][T12594] fuse: Bad value for 'user_id' [ 792.979812][ T5929] usbhid 7-1:0.0: can't add hid device: -71 [ 792.979895][ T5929] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 792.982232][ T5929] usb 7-1: USB disconnect, device number 2 [ 795.674556][T12628] fuse: Bad value for 'user_id' [ 795.674578][T12628] fuse: Bad value for 'user_id' [ 796.508526][T12638] fuse: Unknown parameter 'use00000000000000000000' [ 798.964089][ C0] vkms_vblank_simulate: vblank timer overrun [ 799.464571][ C0] vkms_vblank_simulate: vblank timer overrun [ 799.875710][ C0] vkms_vblank_simulate: vblank timer overrun [ 800.428414][ T5921] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 800.576497][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 800.604250][ T5921] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 800.626687][ T5929] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 800.750043][ T5921] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 800.750062][ T5921] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.750073][ T5921] usb 6-1: Product: syz [ 800.750081][ T5921] usb 6-1: Manufacturer: syz [ 800.750092][ T5921] usb 6-1: SerialNumber: syz [ 800.753181][ T5921] usb 6-1: config 0 descriptor?? [ 800.798751][ T5921] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 800.798790][ T5921] usb 6-1: setting power ON [ 800.799277][ T5921] dvb-usb: bulk message failed: -22 (2/0) [ 800.819953][ T5929] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 800.820067][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 800.820102][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 800.820126][ T5929] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 800.820167][ T5929] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 800.820190][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 800.886581][ T5929] usb 5-1: config 0 descriptor?? [ 800.895073][ T5921] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 800.895954][ T5921] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 800.896013][ T5921] usb 6-1: media controller created [ 800.951586][ T5921] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 801.000562][T12659] dvb-usb: bulk message failed: -22 (3/0) [ 801.000590][T12659] dvb-usb: bulk message failed: -22 (3/0) [ 801.642094][ T5929] usbhid 5-1:0.0: can't add hid device: -71 [ 801.642177][ T5929] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 801.686827][ T5929] usb 5-1: USB disconnect, device number 46 [ 802.001421][ T5921] usb 6-1: selecting invalid altsetting 6 [ 802.001445][ T5921] usb 6-1: digital interface selection failed (-22) [ 802.001461][ T5921] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 802.013803][ T5921] usb 6-1: setting power OFF [ 802.014127][ T5921] dvb-usb: bulk message failed: -22 (2/0) [ 802.014146][ T5921] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 802.014159][ T5921] (NULL device *): no alternate interface [ 803.661595][ T5921] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 803.757370][ T5921] usb 6-1: USB disconnect, device number 27 [ 808.475787][ C0] vkms_vblank_simulate: vblank timer overrun [ 808.660702][T12721] ptrace attach of "./syz-executor exec"[12009] was attempted by "./syz-executor exec"[12721] [ 808.782226][T12726] befs: (nbd6): No write support. Marking filesystem read-only [ 808.786831][T12726] befs: (nbd6): unable to read superblock [ 808.959276][T12726] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 813.926598][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 816.760796][T12762] sctp: [Deprecated]: syz.6.1886 (pid 12762) Use of int in max_burst socket option. [ 816.760796][T12762] Use struct sctp_assoc_value instead [ 818.395353][T12779] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 824.860274][T12821] syz.6.1897 (12821): drop_caches: 2 [ 826.496109][ C0] vkms_vblank_simulate: vblank timer overrun [ 826.953604][ C0] vkms_vblank_simulate: vblank timer overrun [ 828.197940][ C0] vkms_vblank_simulate: vblank timer overrun [ 829.177159][ C0] vkms_vblank_simulate: vblank timer overrun [ 829.497912][ C0] vkms_vblank_simulate: vblank timer overrun [ 830.263439][ C0] vkms_vblank_simulate: vblank timer overrun [ 831.049232][T12857] ptrace attach of "./syz-executor exec"[9385] was attempted by "./syz-executor exec"[12857] [ 831.498631][ C0] vkms_vblank_simulate: vblank timer overrun [ 831.621604][ C0] vkms_vblank_simulate: vblank timer overrun [ 831.678507][ C0] vkms_vblank_simulate: vblank timer overrun [ 831.696074][ C0] vkms_vblank_simulate: vblank timer overrun [ 831.990530][ C0] vkms_vblank_simulate: vblank timer overrun [ 832.061161][ C0] vkms_vblank_simulate: vblank timer overrun [ 832.196555][T12868] befs: (nbd5): No write support. Marking filesystem read-only [ 832.299902][T12868] befs: (nbd5): unable to read superblock [ 834.677848][T12893] fuse: Bad value for 'fd' [ 837.526632][ T1233] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 837.909496][ T1233] usb 1-1: config 0 has no interfaces? [ 837.909531][ T1233] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 837.909553][ T1233] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 837.958495][ T1233] usb 1-1: config 0 descriptor?? [ 838.425152][T12913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 838.425692][T12913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 838.473867][T12910] ISOFS: Unable to identify CD-ROM format. [ 838.742385][T12920] ptrace attach of "./syz-executor exec"[9385] was attempted by "./syz-executor exec"[12920] [ 838.862221][T12922] befs: (nbd5): No write support. Marking filesystem read-only [ 838.871807][T12922] befs: (nbd5): unable to read superblock [ 842.988287][ T9460] usb 1-1: USB disconnect, device number 39 [ 843.837165][T12953] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 846.927697][T12973] Dead loop on virtual device ip6_vti0, fix it urgently! [ 848.818719][T12982] delete_channel: no stack [ 849.161385][T12998] ALSA: mixer_oss: invalid OSS volume '' [ 849.258232][T13002] syz.4.1944 (13002): drop_caches: 2 [ 849.996849][ T5908] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 850.146461][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 850.148415][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 850.148443][ T5908] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 850.148456][ T5908] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 850.151661][ T5908] usb 6-1: config 0 descriptor?? [ 850.278465][T13016] IPv6: sit1: Disabled Multicast RS [ 852.106233][ T5908] mcp2221 0003:04D8:00DD.0009: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 852.286637][ C0] ================================================================== [ 852.286659][ C0] BUG: KASAN: use-after-free in mcp2221_raw_event+0x106a/0x1240 [ 852.286695][ C0] Read of size 1 at addr ffff88804ccaffff by task ktimers/0/16 [ 852.286718][ C0] [ 852.286741][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 852.286769][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 852.286792][ C0] Call Trace: [ 852.286801][ C0] [ 852.286811][ C0] dump_stack_lvl+0x189/0x250 [ 852.286836][ C0] ? __kasan_check_byte+0x12/0x40 [ 852.286854][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 852.286871][ C0] ? lock_release+0x4b/0x3e0 [ 852.286890][ C0] ? __virt_addr_valid+0x4a5/0x5c0 [ 852.286903][ C0] print_report+0xca/0x240 [ 852.286919][ C0] ? mcp2221_raw_event+0x106a/0x1240 [ 852.286932][ C0] kasan_report+0x118/0x150 [ 852.286949][ C0] ? mcp2221_raw_event+0x106a/0x1240 [ 852.286965][ C0] mcp2221_raw_event+0x106a/0x1240 [ 852.286980][ C0] ? down_trylock+0x50/0xb0 [ 852.286993][ C0] hid_input_report+0x40f/0x530 [ 852.287012][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 852.287027][ C0] hid_irq_in+0x47e/0x6d0 [ 852.287043][ C0] __usb_hcd_giveback_urb+0x3b1/0x5e0 [ 852.287064][ C0] dummy_timer+0x89c/0x45a0 [ 852.287093][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 852.287120][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 852.287138][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 852.287154][ C0] __hrtimer_run_queues+0x552/0xd40 [ 852.287178][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 852.287196][ C0] ? ktime_get_update_offsets_now+0x3ab/0x3d0 [ 852.287214][ C0] hrtimer_run_softirq+0x1a3/0x2e0 [ 852.287227][ C0] handle_softirqs+0x22f/0x710 [ 852.287244][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 852.287262][ C0] run_ktimerd+0xcf/0x190 [ 852.287278][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 852.287295][ C0] ? schedule+0x91/0x360 [ 852.287313][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 852.287328][ C0] smpboot_thread_fn+0x53f/0xa60 [ 852.287343][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 852.287363][ C0] kthread+0x70e/0x8a0 [ 852.287381][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 852.287396][ C0] ? __pfx_kthread+0x10/0x10 [ 852.287415][ C0] ? __pfx_kthread+0x10/0x10 [ 852.287432][ C0] ret_from_fork+0x436/0x7d0 [ 852.287449][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 852.287466][ C0] ? __switch_to_asm+0x39/0x70 [ 852.287477][ C0] ? __switch_to_asm+0x33/0x70 [ 852.287488][ C0] ? __pfx_kthread+0x10/0x10 [ 852.287506][ C0] ret_from_fork_asm+0x1a/0x30 [ 852.287521][ C0] [ 852.287526][ C0] [ 852.287529][ C0] The buggy address belongs to the physical page: [ 852.287543][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ccaf [ 852.287558][ C0] flags: 0x80000000000000(node=0|zone=1) [ 852.287576][ C0] raw: 0080000000000000 0000000000000000 dead000000000122 0000000000000000 [ 852.287587][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 852.287594][ C0] page dumped because: kasan: bad access detected [ 852.287603][ C0] page_owner tracks the page as freed [ 852.287608][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 5831, tgid 5831 (syz-executor), ts 85541852508, free_ts 452565353173 [ 852.287639][ C0] post_alloc_hook+0x240/0x2a0 [ 852.287657][ C0] get_page_from_freelist+0x2119/0x21b0 [ 852.287668][ C0] __alloc_frozen_pages_noprof+0x181/0x370 [ 852.287679][ C0] alloc_pages_mpol+0xd1/0x380 [ 852.287695][ C0] alloc_pages_noprof+0xcf/0x1e0 [ 852.287710][ C0] __vmalloc_node_range_noprof+0x97d/0x12f0 [ 852.287728][ C0] vmalloc_user_noprof+0xad/0xf0 [ 852.287743][ C0] kcov_ioctl+0x58/0x650 [ 852.287756][ C0] __se_sys_ioctl+0xff/0x170 [ 852.287768][ C0] do_syscall_64+0xfa/0x3b0 [ 852.287779][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.287790][ C0] page last free pid 9290 tgid 9288 stack trace: [ 852.287797][ C0] __free_frozen_pages+0xb59/0xce0 [ 852.287813][ C0] vfree+0x2ad/0x470 [ 852.287827][ C0] kcov_close+0x2e/0x60 [ 852.287840][ C0] __fput+0x458/0xa80 [ 852.287850][ C0] task_work_run+0x1d4/0x260 [ 852.287860][ C0] do_exit+0x6b5/0x2300 [ 852.287869][ C0] do_group_exit+0x21c/0x2d0 [ 852.287879][ C0] get_signal+0x125e/0x1310 [ 852.287892][ C0] arch_do_signal_or_restart+0x9a/0x750 [ 852.287905][ C0] exit_to_user_mode_loop+0x75/0x110 [ 852.287920][ C0] do_syscall_64+0x2bd/0x3b0 [ 852.287930][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.287943][ C0] [ 852.287946][ C0] Memory state around the buggy address: [ 852.287953][ C0] ffff88804ccafe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 852.287961][ C0] ffff88804ccaff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 852.287970][ C0] >ffff88804ccaff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 852.287976][ C0] ^ [ 852.287983][ C0] ffff88804ccb0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 852.287992][ C0] ffff88804ccb0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 852.287998][ C0] ================================================================== [ 852.288009][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 852.288019][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 852.288034][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 852.288042][ C0] Call Trace: [ 852.288047][ C0] [ 852.288052][ C0] dump_stack_lvl+0x99/0x250 [ 852.288070][ C0] ? __asan_memcpy+0x40/0x70 [ 852.288083][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 852.288105][ C0] ? __pfx__printk+0x10/0x10 [ 852.288121][ C0] vpanic+0x281/0x750 [ 852.288140][ C0] ? __pfx_print_hex_dump+0x10/0x10 [ 852.288159][ C0] ? __pfx_vpanic+0x10/0x10 [ 852.288179][ C0] panic+0xb9/0xc0 [ 852.288196][ C0] ? __pfx_panic+0x10/0x10 [ 852.288213][ C0] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 852.288233][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 852.288254][ C0] ? mcp2221_raw_event+0x106a/0x1240 [ 852.288268][ C0] check_panic_on_warn+0x89/0xb0 [ 852.288280][ C0] ? mcp2221_raw_event+0x106a/0x1240 [ 852.288293][ C0] end_report+0x78/0x160 [ 852.288309][ C0] kasan_report+0x129/0x150 [ 852.288325][ C0] ? mcp2221_raw_event+0x106a/0x1240 [ 852.288340][ C0] mcp2221_raw_event+0x106a/0x1240 [ 852.288356][ C0] ? down_trylock+0x50/0xb0 [ 852.288368][ C0] hid_input_report+0x40f/0x530 [ 852.288387][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 852.288401][ C0] hid_irq_in+0x47e/0x6d0 [ 852.288417][ C0] __usb_hcd_giveback_urb+0x3b1/0x5e0 [ 852.288436][ C0] dummy_timer+0x89c/0x45a0 [ 852.288466][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 852.288486][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 852.288504][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 852.288520][ C0] __hrtimer_run_queues+0x552/0xd40 [ 852.288542][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 852.288560][ C0] ? ktime_get_update_offsets_now+0x3ab/0x3d0 [ 852.288577][ C0] hrtimer_run_softirq+0x1a3/0x2e0 [ 852.288589][ C0] handle_softirqs+0x22f/0x710 [ 852.288606][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 852.288624][ C0] run_ktimerd+0xcf/0x190 [ 852.288641][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 852.288657][ C0] ? schedule+0x91/0x360 [ 852.288675][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 852.288689][ C0] smpboot_thread_fn+0x53f/0xa60 [ 852.288704][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 852.288721][ C0] kthread+0x70e/0x8a0 [ 852.288740][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 852.288763][ C0] ? __pfx_kthread+0x10/0x10 [ 852.288783][ C0] ? __pfx_kthread+0x10/0x10 [ 852.288800][ C0] ret_from_fork+0x436/0x7d0 [ 852.288816][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 852.288834][ C0] ? __switch_to_asm+0x39/0x70 [ 852.288845][ C0] ? __switch_to_asm+0x33/0x70 [ 852.288856][ C0] ? __pfx_kthread+0x10/0x10 [ 852.288874][ C0] ret_from_fork_asm+0x1a/0x30 [ 852.288889][ C0] [ 852.289210][ C0] Kernel Offset: disabled