last executing test programs: 10m12.125038907s ago: executing program 32 (id=7857): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/igmp\x00') pread64(r3, &(0x7f0000000180)=""/15, 0xf, 0x40000000000000b6) (fail_nth: 2) 8m27.607564786s ago: executing program 0 (id=8208): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x103802, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mount(0x0, &(0x7f0000000140)='./cgroup\x00', 0x0, 0x345c14ed3863a686, 0x0) r4 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000500)={0x0, 0x0, @ioapic={0x1cccd2002, 0x5, 0x9, 0x1, 0x0, [{0x6, 0x2, 0x6, '\x00', 0x1}, {0x2, 0x6, 0x3, '\x00', 0xf}, {0x3, 0xc, 0x1}, {0x0, 0x40, 0x5, '\x00', 0x8}, {0xf8, 0x5, 0x4, '\x00', 0xc0}, {0x40, 0x9, 0x10, '\x00', 0x9b}, {0x0, 0xf7, 0x0, '\x00', 0x6}, {0x5, 0x6, 0xe1, '\x00', 0x40}, {0x9, 0x6, 0x5, '\x00', 0x1}, {0x8, 0x7, 0x9d, '\x00', 0x61}, {0x2, 0x9e, 0x3, '\x00', 0x9}, {0x80, 0x9, 0x81, '\x00', 0x7}, {0x5, 0x6, 0x9, '\x00', 0x8c}, {0x3, 0xfa, 0x9, '\x00', 0xf}, {0x76, 0x7, 0x8, '\x00', 0x5}, {0x1, 0x9, 0x1, '\x00', 0xc}, {0x4, 0x8, 0xfb, '\x00', 0x6}, {0x5, 0x2, 0x6, '\x00', 0x9}, {0x1, 0xb, 0xe, '\x00', 0x80}, {0x7, 0x2, 0x2, '\x00', 0x8}, {0x3, 0x9, 0x7, '\x00', 0x10}, {0x7, 0x81, 0x0, '\x00', 0x7}, {0x7, 0x10, 0x7, '\x00', 0x81}, {0xbc, 0x2, 0x5, '\x00', 0x1}]}}) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010180e5002a6550a0be", @ANYRES32, @ANYBLOB="040046001c0051801800008011000100"/32], 0x3c}, 0x1, 0x0, 0x0, 0x200040c0}, 0x48800) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r4, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="4cb2000056", @ANYRES32=0x0, @ANYBLOB='\f\x00X\x00\t\x00\x00\x00\x00\x00\x00\x00\f\x00X\x009\x00\x00\x00\x00\x00\x00\x00\f\x00X\x00d\x00\x00\x00\x00\x00\x00\x00\f\x00X\x00z\x00\x00\x00\x00\x00\x00\x00'], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) mkdirat(0xffffffffffffff9c, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)={0x34, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x14, 0x0, 0x1, [@nested={0x8, 0x4, 0x0, 0x1, [@nested={0x4, 0x2}]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f00006b6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f00000000c0)="baf80c66b880649f8c66efbafc0cb0f6ee66b8010000000f01c10f07f30fc25888e90fed63000f0179bb3664360fc76eae0fae300f017b0b660f1805"}], 0x1, 0x64, 0x0, 0x51) 8m24.792106717s ago: executing program 0 (id=8212): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r0, 0x2285, 0x0) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea000fff5f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) 8m24.40353753s ago: executing program 0 (id=8216): openat$dsp(0xffffffffffffff9c, &(0x7f0000000300), 0x208000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x181042, 0x94) pwrite64(r0, &(0x7f00000000c0)='\"', 0x1, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async, rerun: 32) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x1000000000, 0x7, 0xfa11, 0xffffffff}, 0x0) (async) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) (async) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) (async) ptrace$ARCH_GET_CPUID(0x1e, r4, 0x0, 0x1011) ioctl$UI_DEV_CREATE(r3, 0x5501) (async, rerun: 32) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002100)='/proc/bus/input/devices\x00', 0x0, 0x0) (async, rerun: 32) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async, rerun: 64) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000000/0x1000)=nil, 0x3000}) (async, rerun: 64) read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) (async) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) (async) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) clock_adjtime(0x6, &(0x7f00000003c0)={0x7, 0x9, 0x800000380001, 0x6794, 0xfffffffffffffff9, 0x25, 0x800000000000009, 0x0, 0xc, 0x6, 0x7, 0xfff, 0xfffffffffffff04f, 0x3ff, 0x200000080000000, 0xfffffffffffffff8, 0xfffffffffffffffb, 0x100000000000005, 0x0, 0x100, 0x6, 0x1, 0x5, 0x3, 0x34, 0x8}) (async, rerun: 64) clock_adjtime(0x0, &(0x7f0000000900)={0x6, 0x20000000e, 0xf, 0x0, 0xf, 0x8000000000000000, 0xe, 0x2, 0x9, 0x4, 0x5, 0x8000000000000000, 0xc, 0x4, 0x7, 0x9, 0x8, 0x3, 0x8, 0x80000000, 0xffffffffffbffffe, 0x5, 0x7, 0x7, 0x3, 0x6}) (async, rerun: 64) socket$nl_xfrm(0x10, 0x3, 0x6) 8m21.690027594s ago: executing program 0 (id=8222): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000240)={0x4, &(0x7f00000003c0)=[{0x3ff, 0xff, 0x40, 0x9}]}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x5, &(0x7f0000000040)=ANY=[], 0x0}, 0x94) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000200)=0x1, 0x4) connect$unix(r1, &(0x7f0000000300)=@abs={0x3, 0x0, 0xe21}, 0x6e) syz_open_dev$video4linux(&(0x7f0000000080), 0x200000000000, 0x400400) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x0, 0x1}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000000000ffdbdf252d"], 0x1c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x2, &(0x7f00000004c0)={&(0x7f0000001b00)=ANY=[@ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x20000040) r7 = syz_io_uring_setup(0x2f17, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000540), &(0x7f0000000140)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, &(0x7f00000005c0)=ANY=[@ANYBLOB="009ebb7700eda2bf6059e7ab5ca52630c9bea181717fdf2a8bd462038d38b1793d8a8b45ec380627960c2276a809270ce68b981ff0d3479a45a3ba32001650206bed2b3ce41f8d26a47d20352ff74c167b6c"], 0x118) syz_emit_ethernet(0x8e, &(0x7f0000000780)=ANY=[@ANYBLOB="aaaaaaaaaaaa4910075ad2b986dd604dd7080058060020010000000000000000000000000001fe8000000000000000000000000000aa8400000000000000000100000000f5002b0400000000000004016a0401200401920001000710000000000000000004018000000000000000000040010000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="600200029078000002040000"], 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r8, 0x0) io_uring_enter(r7, 0x2d3e, 0x0, 0xa, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000400)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000580)={0x98, 0x0, &(0x7f0000000940)=[@request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000840)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x7, 0x2000001, 0x38}}, &(0x7f0000000500)={0x0, 0x18, 0x30}}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000680)={@fd={0x66642a85, 0x0, r7}, @ptr={0x70742a85, 0x0, &(0x7f0000000a00)=""/184, 0xb8, 0x0, 0x25}, @ptr={0x70742a85, 0x40000002, &(0x7f00000020c0)=""/4101, 0x1005, 0x4000000, 0x3e}}, &(0x7f00000008c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) bind$bt_hci(r3, &(0x7f0000000000)={0x27, 0x0, 0x3}, 0x6) getpgid(0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000380)={{0x1, 0x1, 0x18}, './file0\x00'}) mkdirat(r8, &(0x7f00000002c0)='./file0\x00', 0x13) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) getsockopt$inet_buf(r7, 0x0, 0x11, &(0x7f0000000700)=""/88, &(0x7f00000000c0)=0x58) 8m20.56779488s ago: executing program 0 (id=8229): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[@ANYBLOB="bbd28ddcfbbbaaaaaaaaaa0086dd60003a0400047300f58000000000000000000000000000bbff020000000000000000000000000001"], 0x0) dup3(r1, r0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000002c0)='hostfs\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000280)='./bus\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000730000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0xc3100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 8m19.482675964s ago: executing program 0 (id=8234): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000140)={'geneve1\x00', &(0x7f0000000240)=@ethtool_sset_info={0x37, 0x6513, 0x401, [0x1, 0x2f, 0x2, 0x400, 0x9, 0x2, 0x0, 0x8b, 0x3ff]}}) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000680)={0x28, 0x7, r1, 0x0, &(0x7f0000000300)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0xffffffffffffff5a, 0x2}) r2 = io_uring_setup(0x7fc0, &(0x7f0000000000)={0x0, 0x3, 0x40}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r2, 0xb, &(0x7f0000000280), 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r2, 0xc, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000300)="a0", 0x1, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r4, 0x21) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000004c0), 0x1, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000500)={&(0x7f0000000340)="1271694bdd65df887f636c9494a4adf0ca84350bfb57e1fd95d559", &(0x7f0000000900)=""/4096, &(0x7f0000000380)="debd22faa100573eb0aa78899bb65c99869580fa140ab5b39588f6a4094f02ac969cb799b4e00b38adbf2131fb20de8d4e21c160e750bfc253b361c53d414984b185ce2dc4f7e5f4de0e7ec4d8e45c3b858d3c6543fe989e4d9e07c2fc37e11cada58256fc127da41bd341a346b42f5ddd3e74aa0d432ab86e0c77e18bfc7b28b6bad43f59c60574764db94b88cbc472cdd76b44ad580c031cdcd7bec39ffe30f4", &(0x7f0000000480)="002413ca04777071c2564812d3237e4ecf29b21d1e35995a804b695d2fc000bc745ce9cdfa4655ce", 0x2, r5}, 0x38) r6 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000800)="3504000030000511d25a80648c63940d0324fc60040035400c0002000200002037153e373f04018006041000450055d64a12f76710989a119052acaa1100da3e813fa6ba1eb693d93f699e37af0d43f908fa7d995a8feb85d6a4e1b691276cd9561767309099f86f8e9e71fa51bde29f19b06fb9b3ba96da0e93d5a4024c1747fff68092705b44bb48dd2db4f3127aab13b4af0554957da6c0e03db227b65d459fa5c1232d7b62f12b65354b7e7fd32998da02ae0dc28942ec82d97191d0b68697", 0xc1}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000800)=ANY=[], 0x32600) r8 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000540)={{0x1, 0x1, 0x18}, './file1\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x0) fchdir(r9) r10 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0x84142, 0x0) pwritev2(r10, &(0x7f0000000100)=[{&(0x7f0000000000)="ff", 0x1}], 0x1, 0xfffffff7, 0x2, 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x11, r7, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, 0x0, &(0x7f00000000c0)) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3cb7325c1f7f1941e254e41dc418c933d4825f8108a454d9af3e873f9b9a045ffcb918f38d5ddd9a3fd8c27751558400c424584ab6df9d41657a1d387a5a3cf0e45f9e36b7e1da8bea77ade7bc38fbf666c75cff1199ce4700d3c251ab406ab59cdd2f24389b5205cd9b10ee2aac164062c33696c651ae8a59247d68c02d41c14b0e616e4948b6dc80b2ec682535d0ed48c4c53c40b478f093e503a00a69ba6b9d8bfeb1b490ed4e83e5a25b0d3309cc6cb5408f542fda247738000000000000", @ANYRES16=r11, @ANYBLOB="000825bd7000fadbdf250affdd0008000300796b833986dce6b103c6645d1e4dbb8136329088440266901141803e7309e6f9034b214349ad16d2bbd1009cda4fec95796a1e43dced48", @ANYBLOB="1b42bbaa09063a84154fcf894c8a35ae6d7aff204252622aac6ae65d0e77632c36cc5bf6ae57c184d0505333d8031b3fe1439382debcd4411ba8451e3f79359f6fde5caabf158119b8bc8572298049ccaaae5f7ab0d72227e03aae279ce98a865bd67f64e40b1e32099a21224021a488f9a45b3295b9dabf4784d6df4d1e1821795dafd647da00bf41a97d4ffd2bbe44d233fd5e59331060de13db9047e363ed7bc3cb9ceea65718eb8fa1d7a94a3b9f9ef1f2750bdcdbd0b48a8edd668fdb0245c06f0179aa5f97df72c56d15bc232cd23748d38ffaa687608d3a9899c20bf4877c0c5de0150735a8903733c0847d5435bc44514daaaf43d9ce82bfe8ad", @ANYBLOB="2cdc0fb649c14a34cde1d0337f9389df3861df0bedae08d592c8db37f7b23e9c6e9c76207a929eedf6c33b8358763b82a0941e756d6604f843e8100575368634fa29c7ddbf0619f89f323d76e92d3874b692ba6e87db89dcbd862df73ecaaa9cbe712ff424db424192db43b6038599dc1affd0decfd2e18f59c6f22bd72f8c016819cac53f2d450fbf1840ed"], 0x1c}, 0x1, 0x0, 0x0, 0x24048800}, 0x20000845) 8m4.438588278s ago: executing program 33 (id=8234): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000140)={'geneve1\x00', &(0x7f0000000240)=@ethtool_sset_info={0x37, 0x6513, 0x401, [0x1, 0x2f, 0x2, 0x400, 0x9, 0x2, 0x0, 0x8b, 0x3ff]}}) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000680)={0x28, 0x7, r1, 0x0, &(0x7f0000000300)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0xffffffffffffff5a, 0x2}) r2 = io_uring_setup(0x7fc0, &(0x7f0000000000)={0x0, 0x3, 0x40}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r2, 0xb, &(0x7f0000000280), 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r2, 0xc, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000300)="a0", 0x1, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r4, 0x21) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000004c0), 0x1, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000500)={&(0x7f0000000340)="1271694bdd65df887f636c9494a4adf0ca84350bfb57e1fd95d559", &(0x7f0000000900)=""/4096, &(0x7f0000000380)="debd22faa100573eb0aa78899bb65c99869580fa140ab5b39588f6a4094f02ac969cb799b4e00b38adbf2131fb20de8d4e21c160e750bfc253b361c53d414984b185ce2dc4f7e5f4de0e7ec4d8e45c3b858d3c6543fe989e4d9e07c2fc37e11cada58256fc127da41bd341a346b42f5ddd3e74aa0d432ab86e0c77e18bfc7b28b6bad43f59c60574764db94b88cbc472cdd76b44ad580c031cdcd7bec39ffe30f4", &(0x7f0000000480)="002413ca04777071c2564812d3237e4ecf29b21d1e35995a804b695d2fc000bc745ce9cdfa4655ce", 0x2, r5}, 0x38) r6 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000800)="3504000030000511d25a80648c63940d0324fc60040035400c0002000200002037153e373f04018006041000450055d64a12f76710989a119052acaa1100da3e813fa6ba1eb693d93f699e37af0d43f908fa7d995a8feb85d6a4e1b691276cd9561767309099f86f8e9e71fa51bde29f19b06fb9b3ba96da0e93d5a4024c1747fff68092705b44bb48dd2db4f3127aab13b4af0554957da6c0e03db227b65d459fa5c1232d7b62f12b65354b7e7fd32998da02ae0dc28942ec82d97191d0b68697", 0xc1}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000800)=ANY=[], 0x32600) r8 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000540)={{0x1, 0x1, 0x18}, './file1\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x0) fchdir(r9) r10 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0x84142, 0x0) pwritev2(r10, &(0x7f0000000100)=[{&(0x7f0000000000)="ff", 0x1}], 0x1, 0xfffffff7, 0x2, 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x11, r7, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, 0x0, &(0x7f00000000c0)) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3cb7325c1f7f1941e254e41dc418c933d4825f8108a454d9af3e873f9b9a045ffcb918f38d5ddd9a3fd8c27751558400c424584ab6df9d41657a1d387a5a3cf0e45f9e36b7e1da8bea77ade7bc38fbf666c75cff1199ce4700d3c251ab406ab59cdd2f24389b5205cd9b10ee2aac164062c33696c651ae8a59247d68c02d41c14b0e616e4948b6dc80b2ec682535d0ed48c4c53c40b478f093e503a00a69ba6b9d8bfeb1b490ed4e83e5a25b0d3309cc6cb5408f542fda247738000000000000", @ANYRES16=r11, @ANYBLOB="000825bd7000fadbdf250affdd0008000300796b833986dce6b103c6645d1e4dbb8136329088440266901141803e7309e6f9034b214349ad16d2bbd1009cda4fec95796a1e43dced48", @ANYBLOB="1b42bbaa09063a84154fcf894c8a35ae6d7aff204252622aac6ae65d0e77632c36cc5bf6ae57c184d0505333d8031b3fe1439382debcd4411ba8451e3f79359f6fde5caabf158119b8bc8572298049ccaaae5f7ab0d72227e03aae279ce98a865bd67f64e40b1e32099a21224021a488f9a45b3295b9dabf4784d6df4d1e1821795dafd647da00bf41a97d4ffd2bbe44d233fd5e59331060de13db9047e363ed7bc3cb9ceea65718eb8fa1d7a94a3b9f9ef1f2750bdcdbd0b48a8edd668fdb0245c06f0179aa5f97df72c56d15bc232cd23748d38ffaa687608d3a9899c20bf4877c0c5de0150735a8903733c0847d5435bc44514daaaf43d9ce82bfe8ad", @ANYBLOB="2cdc0fb649c14a34cde1d0337f9389df3861df0bedae08d592c8db37f7b23e9c6e9c76207a929eedf6c33b8358763b82a0941e756d6604f843e8100575368634fa29c7ddbf0619f89f323d76e92d3874b692ba6e87db89dcbd862df73ecaaa9cbe712ff424db424192db43b6038599dc1affd0decfd2e18f59c6f22bd72f8c016819cac53f2d450fbf1840ed"], 0x1c}, 0x1, 0x0, 0x0, 0x24048800}, 0x20000845) 7m49.533070368s ago: executing program 2 (id=8334): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_io_uring_setup(0x49f, 0x0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x208000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r2, &(0x7f00000002c0)='./file1\x00', 0xc000, 0x0) linkat(r2, &(0x7f0000000100)='./file1\x00', r2, &(0x7f0000000240)='./file0\x00', 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x68, 0x0, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x1}, [@CTA_PROTOINFO={0x8, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4}}, @CTA_SYNPROXY={0x34, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SYNPROXY_TSOFF={0x8}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x9}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x3}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x100}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x6}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x404}, @CTA_LABELS_MASK={0x8, 0x17, [0x6]}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x100}, 0xc040) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x4080) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r5 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x3, 0x400246}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x2}) io_uring_enter(r5, 0x4c6e, 0xc67a, 0x8, 0x0, 0x0) getsockopt$inet_sctp_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x8) r8 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x2180, 0x0) ioctl$COMEDI_INSN(r8, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x0, 0x4}) 7m48.49687299s ago: executing program 2 (id=8339): r0 = socket$nl_generic(0x10, 0x3, 0x10) getpid() r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000fc0)={0x2c, r3, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x9, 0x13, @udp='udp:syz2\x00'}}}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) 7m47.354035075s ago: executing program 2 (id=8342): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400b5000000000400000000", @ANYRES32=0x0, @ANYBLOB="00000000001400001c00128009000100626f6e64000000"], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FWMARK={0x8, 0x12, 0x2ab2}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x8000010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600007842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_init_net_socket$x25(0x9, 0x5, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd604dd31800140600fe880000000000000000000000000001fe8000000000000000000000000000aa00004001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="3aa3000490780000"], 0x0) r3 = syz_genetlink_get_family_id$nfc(&(0x7f00000028c0), r2) ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f00000003c0)={0x1, {0x6, 0x0, 0x80000000, 0x8}, {0x3, 0x1, 0x1, 0x81}, {0x9, 0x9}}) sendmsg$NFC_CMD_SE_IO(r2, &(0x7f0000002ac0)={&(0x7f0000002880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000002a80)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="110025bd7000fbdbdf251b00000008000100", @ANYRES32=0x0, @ANYBLOB="040019000800150000003af2c6ad869a9d417819a457aa262fef0000"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008080) socket(0x400000000010, 0x3, 0x0) chdir(&(0x7f0000000380)='./file0\x00') r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000800)={'syzkaller0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000100)=@gcm_128={{0x304}, "224427a0094dd132", "327cfef4c63eccd7547ac056f55d976c", '\x00', "ae2762aee2d84113"}, 0x28) recvmmsg$unix(r7, &(0x7f0000000e00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12000, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) 7m47.082431325s ago: executing program 2 (id=8345): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xb0, 0x0, [{{0x9, 0x4, 0x0, 0xfa, 0xff, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xf4f6, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x3, 0x0, 0x9}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mkdir(&(0x7f0000002200)='./file0\x00', 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x103) mount$9p_rdma(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[]) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4`\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f\xff\xff\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x2145c89, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000140)='./file0/../file0\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x31a1802, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0xc) 7m43.53488808s ago: executing program 2 (id=8355): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[@ANYBLOB="bbd28ddcfbbbaaaaaaaaaa0086dd60003a0400047300f58000000000000000000000000000bbff020000000000000000000000000001"], 0x0) dup3(r1, r0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000002c0)='hostfs\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000280)='./bus\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000730000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0xc3100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 7m42.541470799s ago: executing program 2 (id=8357): syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x34, 0x3, 0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}, {0x0}], 0x2}, 0x0, 0x40000000, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/201, 0xc9}], 0x1) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000200)=[{0x30, 0x4, 0x0, 0x2}]}, 0xffffffffffffff0e) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0xc, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(0xffffffffffffffff, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 7m26.818214422s ago: executing program 34 (id=8357): syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x34, 0x3, 0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}, {0x0}], 0x2}, 0x0, 0x40000000, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/201, 0xc9}], 0x1) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000200)=[{0x30, 0x4, 0x0, 0x2}]}, 0xffffffffffffff0e) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0xc, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(0xffffffffffffffff, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 1m49.294006813s ago: executing program 1 (id=9864): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) r2 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendfile(r2, r0, 0x0, 0x80000000) 1m47.272578622s ago: executing program 1 (id=9870): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="180000000000000000000000008e27cedf55ceadb0000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100003040000000000000000f2000000", @ANYRES32=0x0, @ANYRES32=r1], 0x50}, 0x1, 0xba01}, 0x0) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 1m47.163025407s ago: executing program 1 (id=9871): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x6e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc00, @remote, 0xffffffff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x0) sendfile(r3, r0, 0x0, 0x80000000) 1m44.777861262s ago: executing program 1 (id=9879): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x34, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x4}, @NFTA_BITWISE_MASK={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xfc}}, 0x0) 1m43.767070038s ago: executing program 1 (id=9882): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 1m43.048498567s ago: executing program 1 (id=9886): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000001680)) r1 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_ERR(0xffffffffffffffff, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000000)={0x0, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f00000000c0)=0x1) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904"], 0x0) 1m43.028707903s ago: executing program 4 (id=9887): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x10}, 0x1) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m41.747445448s ago: executing program 4 (id=9890): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x28, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x28}}, 0x0) 1m41.683594109s ago: executing program 4 (id=9891): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100088}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$alg(r4, 0x0, 0x0, 0x40810) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r6}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x10) sendmsg$NFNL_MSG_CTHELPER_DEL(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="5600000002090104000000000000000005000007240002000c000280050001000600000014000180080001000a010101080002007f000001"], 0x38}, 0x1, 0x0, 0x0, 0x24000001}, 0x4000) 1m40.329034466s ago: executing program 4 (id=9895): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0xa, 0xfe, 0x8001}]}) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000140)}], 0x1) 1m40.160673757s ago: executing program 4 (id=9897): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 1m40.126718067s ago: executing program 4 (id=9898): socket$nl_generic(0x10, 0x3, 0x10) mincore(&(0x7f0000bfe000/0x400000)=nil, 0x400000, &(0x7f0000000200)=""/133) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) prlimit64(0x0, 0xe, &(0x7f0000002440)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) add_key$keyring(0x0, &(0x7f00000023c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x18000000000002a0, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0x1, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x50) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x90b6c87a770e7f78}, 0xc, &(0x7f00000002c0)={&(0x7f0000000400)={0x54, r5, 0x400, 0x70bd2b, 0x1, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffa}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x38, 0xa}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8010}, 0xc000) ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000240)='|') socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r6, 0x10f, 0x8a, &(0x7f00000000c0), 0x4) 1m27.921152617s ago: executing program 35 (id=9886): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000001680)) r1 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_ERR(0xffffffffffffffff, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000000)={0x0, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f00000000c0)=0x1) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904"], 0x0) 1m25.028372266s ago: executing program 36 (id=9898): socket$nl_generic(0x10, 0x3, 0x10) mincore(&(0x7f0000bfe000/0x400000)=nil, 0x400000, &(0x7f0000000200)=""/133) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) prlimit64(0x0, 0xe, &(0x7f0000002440)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) add_key$keyring(0x0, &(0x7f00000023c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x18000000000002a0, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0x1, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x50) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x90b6c87a770e7f78}, 0xc, &(0x7f00000002c0)={&(0x7f0000000400)={0x54, r5, 0x400, 0x70bd2b, 0x1, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffa}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x38, 0xa}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8010}, 0xc000) ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000240)='|') socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r6, 0x10f, 0x8a, &(0x7f00000000c0), 0x4) 1m14.392550184s ago: executing program 9 (id=9938): openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48) 1m11.730858613s ago: executing program 9 (id=9967): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[@ANYBLOB="bbd28ddcfbbbaaaaaaaaaa0086dd60003a0400047300f58000000000000000000000000000bbff020000000000000000000000000001"], 0x0) dup3(r1, r0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 1m10.493502808s ago: executing program 9 (id=9971): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000000)=""/188, 0xbc) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/74, 0x4a) read$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(r0) 52.024338788s ago: executing program 37 (id=9971): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000000)=""/188, 0xbc) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/74, 0x4a) read$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(r0) 40.933209034s ago: executing program 5 (id=10024): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000440)=@file={0x1, './file0\x00'}, 0x180000000000000) sendmmsg$unix(r1, &(0x7f0000006040)=[{{&(0x7f0000000340)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000740)="acaaa37b3d1dc9a61129e6ef2c6e2323c34aff0cf7343e5339b82d622653bb407ea0fdaf1ff4b78c47e379c8471f9b514ff02a5f1e48cf5dc4f6edd9420a123bec480d95e9a79213c5f8e897ba420bba2985447aaa1c2a8fc637cb445f7b1a8952ff85c567daeed41fe50e7ad5fa68b4bff1d609c3dd5f1c689471f52a5b04b4c9b54673f2fe71d1ab2207f09ddabe5cb7b4ae32ce6ca573a44a26da1b89e6ac96a4f87250a680ea2312e136", 0xac}, {&(0x7f0000000900)="df9296958f08db9d98c215033d2a5d2a65bd0af88bfb5b20a11c7922012c983c7f9fa921cb59d578c581cd787f848212863513f9b7a0f13a98c84e2b0220de2f2d0bad50c2da91b7abf8", 0x4a}, {&(0x7f0000000800)="e0e41029d76b30e2760fd0db85127438f5c993f93c92e81433fad3e467a9d2f4f63b700493a6ac579ed838d9a9", 0x2d}], 0x3, &(0x7f0000001e80)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [r1]}}, @cred={{0x1c}}], 0x58, 0x20000014}}, {{&(0x7f0000004500)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000004580)=[{&(0x7f0000004640)="ec74ad0c2b0d6cde290fc9eec8bd5b895c3d8b8c4e7c0f41394af51e8556cec0edb29f0f9f8bb1805c64cdf7cde144e76d2e6006db5387d37f175a0c2c49df104bd3c96d9fbf", 0x46}], 0x1, &(0x7f00000047c0)=[@rights={{0x18, 0x1, 0x1, [r0, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [r1, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0, 0x20004080}}, {{&(0x7f00000048c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000004f40)=[{&(0x7f0000004940)}, {0x0}, {&(0x7f00000049c0)="ec7d4e2237dfb859a5a7511ca1b292a2bf9853d4efb4250fac981f5ba095d9566793afd77ba43b2d7f4e981680d8fa240c3a41b41f9297abda30b9d0525c4990b2e190f93c382f69c03f0554ed4e92d33fb2b2ba10b30212d0c93cd7ee9ca1145b8bc81b2d2a6a999452882825fba1940ee41640fee66151641b62b77e3c04ec29c1db88d8cadbca195044fbaaf24958aa12f4ee6ed0f96caa011ffe27a61d9b8017df32f2682a842d87b9009ccadc", 0xaf}, {&(0x7f0000004a80)="f0650abc2b0808d11be7e4df5b276692a7f42eef50fdfcf99861082fe2d2e610080dc8bb99e34132d93c0a25588920ca23f533b683d390fc42d54cf6543427c0c5ed83244e6ba6f8ca37bb19", 0x4c}, {&(0x7f0000004b00)="dc74a38559fdd0b013cd83861395365cf9a85b8f1508c82394700e772b0fcf2e4ce7cfe431ee7004cb1d752960838cf576333a88fb00a0fb771c795b684629841216953bf311af06e75d03af63a81c591f814f0a97f62acde0511614c7015819bd8dbdf6720c71638f64ee13e4ab88fa513a487cde9b9e267a38a969c6e2fa1cbcaf963c2e8e5c4c37a788d53fbfc780b2ab7932499b6efd89acebf38d2da03e6cb5", 0xa2}, {&(0x7f0000004bc0)="2ecc943b6ff6ec37bb2fb9f054f82c1523ada580054bc0a7fea5f914fcfd1bfcc3da4e1ea0f58bc9d741731914be4feff2ebe38d731fe4dd55ac6d780d98ad145139e571e2d879cc6620220cf8a6af06e21141f0b8711f38de83dff79b0285bc031498bad0966c66a1398f351a45f0cce3d552cc992aae1f9230203dfd8ac0590f421b4ed65c13d14af4d3b6da8be0f1cecae3465d084e991fe5b8a41b", 0x9d}, {&(0x7f0000004c80)="309eaa4288dc849afd4bfa8aa7913f1d9d4af865e429ac72129499a841b82ec3f19cd21efcf3c8a66ac1f16c917d721c81b90983ea0584ed3b121baa29b6edb70c1becbe91b88264ebef355e71ce29d4da698d0607fae41ed071a810ace7b161b25cad03de9a3a86606c52f026c587d9b0fe96d0135d928e4c16bb820c822297afb8ff2da92a47623b0c8a0f55fae47d4d27f5b0d61e3290b500034fa2ec882bb90c3b27881d122e3500be62667c69a780fc3a056f0a7e9767e637013eea0eda8a1098faf1553cfc5f9dd0d05da5beb0c50be6b4a2b575c78d07cb362a483441c9", 0xe1}, {&(0x7f0000004d80)="2da15a90f27940284bc5455a3c5075f48be1816b5b6bbff6ac0e4163c45fc6261baafea2cd47a57e919f6e514dd696757943f6c911a0276e2d2deb3ded4e5dc5e96b3d42a96e8d4203d1ce378b1530422d741ed775990dd83c76ae608c868427f91465077a30884ee4b2b2ed5707920938ec21c88d70014bf3acc23a83e050ea09b75d8c3b2a912a5fb77fa78c803cff19f2613bde792adfad1c37934a138efbbf26423e164768f6cb8861be35d53238d713f12a5d57c939a6922873d99a5f9d38ab5ef15735b3aec8d4352499b796e7137caa3fce746c73363d1997731537aafb5c423ac621d68cf96b", 0xea}, {&(0x7f0000004e80)="30909e46b2fc3ba158b2ccce79a1818b132a86a92d7e4d090121e0f47a37272cad6c4209127faf3d5ff14ec1f8d9969321c157cc04ade78b7d77b79d5b152475064f7f983be2dd26ad3f4080165c7166e591670ce6aa9702a0d541b41ef9ce123f1af7f0978bcf73caab8accc42add79a663079e404668cb4850e8641c687d2b70cde22f48ad85", 0x87}], 0x9, &(0x7f0000005080)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x20, 0x400000c0}}, {{0x0, 0x0, &(0x7f0000005340)=[{&(0x7f00000050c0)}, {&(0x7f0000005100)="1dca2e6300455f967936e88047ba74814d020aac20659239bd17c9960ae64a088deb8e5181a4e30f1c02aeea875e39c98d1537482c6808c6b2f6efa980c300a5dbbd334e0c50c3cc7da5f13468d4f55f1c40b5b0fcc158ca2a9f5a93ce2631624b9b15cdc37fb6a1ab35a0340e0041d4d537417bf67e9ce53fc7217c4d99331c82ad379fced70089e960c3aee22a48994b287d49b3f3f74f", 0x98}, {&(0x7f00000051c0)="2eef9beee91faca1d38b3ffcf6a5802ddcf296e88c2deb7bcd92b16644063ae1b92277c45edc8598bf3bf628d7c970b7ade3412fa051f9d3deae17d6a4b1c6058675a0cbae10b90e6509a822320b80c540d17b908d664b8eaed981d5435ea697756b2bccb012", 0x66}, {&(0x7f0000005240)="1bdfaae6c909eae32c52aa1ef5aa0558f42aa5161521c268bd46d366e388e084d60012af715162dd2405a5714acc02d5b9786f6b70db37841dbf354cbab7728f11650e9aef25d08a081efcac03", 0x4d}, {&(0x7f00000052c0)="01bb189702a13ea8ca50e7710a5b0e291c70f796e4c1136fca78228ea4856237a4507922a0debdd0c5ac46f3d010d99a2ec24c1687c15234a7d343609acfb739c0afcb7ac1108d701b24345a18fb65dc3b01b4f029a9b288f04668f29607371f4b42dd580bcaf5332c", 0x69}], 0x5, &(0x7f0000005480)=[@cred={{0x1c}}], 0x20, 0x44040}}, {{&(0x7f00000054c0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000005780)=[{&(0x7f0000005540)="3731358c47c4bcddb0298f662a6166604865ccda2ac80e339087652006f639b5feb084b06b935d32e72b9eb6759e05e886c81c34c74b2427abdeb45a18e1b18ec497d006454c6cdd01f202382a6fb61a76323014af605191ceea2285623ed2347415072f8eafa9b5aeae581d551580af7933d6e3db875f95254fc8452ffe75d409075805023789ff0d", 0x89}, {&(0x7f0000005600)="f7a7791e1ece1dc489847c4920b244f5451084509bcdab629e93ccdf8f843c81af21a9b38eacd5fb9e02e3898eacfe04336d46045ab18707a6a8b87245c1f4ed607da506574013570f950793a8944665210f737defa86a1f918189f6b935be2e47d7665eb8964d1096b2e8b2c0c7659eccf540d8c4b6b9ca73eac220f8b8fa541183e4ee0fd0f07182709c864d67d672a85a02b8591c437af1006cc0f9960ddbc1d2a4496f0c158e598ec568b3ac6b7032062c6b331577f6b59d8e83cd42532085e592c3b0c9e4ebe5ef3336e7ebd52e8ad48e", 0xd3}, {&(0x7f0000005700)="8b253f547767b29052dfcc36a4b5bd549ade2fa15e1b07108b7c23fb86cb7c7b08905b4af3d0705cd3e505644b308b7c966a6a11d27825dd0173f2f4537dec33381e7fa21c7eeb5e5b0e462c828eabaaf7c8d2962ab0a0a3f406fad1af4d39f0e3794b172584674c7cc3b07a611615344bb5caf2bf3f3398f69bc1a4", 0x7c}], 0x3, &(0x7f0000005a00)=ANY=[@ANYBLOB="1c00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001800"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32], 0x88, 0x80}}, {{&(0x7f0000005ac0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005c40)=[{&(0x7f0000005b40)="ed54f2ccb79e6cee433bc2fc0ff3d303588325307be82b4a720ea6055924b72339ee250137dbee6dd01e6359a93bea549b36fc99a07bba2efe56ff74616bdd856e5518ad248c86e0c282", 0x4a}, {&(0x7f0000005bc0)="f6c06001643580aec15811d644e54b4e3dcb55710e688acebf5e96", 0x1b}, {&(0x7f0000005c00)="fa7f68198e", 0x5}], 0x3, &(0x7f0000005d40)=ANY=[@ANYBLOB="187c", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000034000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0xe8, 0x20008080}}, {{&(0x7f0000005e40)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005ec0), 0x0, &(0x7f0000005f80)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [r0, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x98, 0x4000801}}], 0x7, 0x0) recvmmsg(r0, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)=""/38, 0x26}], 0x1, &(0x7f0000000240)=""/214, 0xd6}}, {{&(0x7f00000006c0)=@ethernet={0x0, @random}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/100, 0x64}], 0x1, &(0x7f0000000500)=""/161, 0xa1}, 0x8}, {{&(0x7f0000000640)=@un=@abs, 0x80, &(0x7f0000001ec0), 0x0, &(0x7f00000005c0)=""/4, 0x4}, 0xa888}, {{&(0x7f0000000b40)=@alg, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000bc0)=""/195, 0xc3}], 0x1, &(0x7f0000000d00)=""/4096, 0x1000}, 0x4f74}], 0x4, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet(0x2, 0x3, 0x9) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000000)=0x7b, 0x4) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000780), 0x20000, 0x0) epoll_pwait2(r4, &(0x7f0000001d80)=[{}], 0x1, 0x0, 0x0, 0x0) mknodat$null(0xffffffffffffff9c, 0x0, 0xb0a54e68b1cdafda, 0x103) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000004340)=""/102376, 0x18fe8) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x540, 0xd2) close(r6) socket$phonet_pipe(0x23, 0x5, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r6, 0x0, 0xc1) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x11d) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x1000, 0xffffff81) r8 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r8, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) 39.709334121s ago: executing program 7 (id=10027): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000780)={{0x12, 0x1, 0x110, 0xec, 0x3, 0x7e, 0x8, 0x9fb, 0xebbe, 0xd48d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x7, 0x0, 0xf0, 0x9, [{{0x9, 0x4, 0xc0, 0x7, 0x1, 0x97, 0x78, 0x37, 0x3, [], [{{0x9, 0x5, 0x1, 0x2, 0x20, 0x80, 0x7, 0x2}}]}}]}}]}}, 0x0) 37.994573789s ago: executing program 8 (id=10031): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r1 = dup(r0) r2 = syz_io_uring_setup(0x4e1, &(0x7f0000000380)={0x0, 0x33f8, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x100a}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) clock_nanosleep(0xfffffff2, 0xca9a3b, &(0x7f0000000000)={0x77359400}, 0xfffffffffffffffe) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) bind$packet(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 37.175942672s ago: executing program 5 (id=10033): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffffffc, 0x3, 0x2, 0x9, 0x9, "ea7174ddcf0fc7010002f7ffd2a2d97500", 0x2, 0x1}) r1 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x30, r3, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x30}}, 0x0) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x14) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r4, 0x100000000000f7) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r5}, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000025000a20000000000a01030000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000003740000001e0a01020000000000000000010000000900020073797a32000000003400038030000080090006400000000024000b802000018007000100637400001400"], 0xe4}}, 0x0) r8 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) bpf$MAP_CREATE(0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) bpf$MAP_LOOKUP_ELEM(0x2, 0x0, 0x0) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000100)=0x1, 0x12) ioctl$KDDELIO(r4, 0x4b35, 0x7fffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') 36.987311126s ago: executing program 8 (id=10034): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="20ffff"], 0x0, 0x0}) 36.946778886s ago: executing program 3 (id=9993): getpid() r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) move_pages(r1, 0x0, 0x0, 0x0, 0x0, 0x4) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmctl$IPC_STAT(0x0, 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x1, 0x88200) r4 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r4, 0x0, 0x0) r5 = fsopen(&(0x7f0000000100)='zonefs\x00', 0x1) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f0000000500)={0x0, &(0x7f0000000280)}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000040)={0x200, 0x0, 0x0, &(0x7f00000003c0)=[0x7], &(0x7f00000000c0)=[0x0], &(0x7f0000000180)=[0x31], 0x0, 0xff}) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, 0x0, &(0x7f0000000180)='%(,c\xbe\xfbL:', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpgid(0x0) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(0xffffffffffffffff, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000fc0)={0x2c, r7, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x9, 0x13, @udp='udp:syz2\x00'}}}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) 36.900150361s ago: executing program 5 (id=10035): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, 0x0, 0x0, 0x0}) 36.595850257s ago: executing program 7 (id=10036): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0/file0/file0/file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050c100000000000224e0000", 0x58}], 0x1) 35.611611343s ago: executing program 7 (id=10037): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r2, 0x0, 0x0, 0x4100, 0x0, 0x0) 35.538921238s ago: executing program 6 (id=10038): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000002c0)={'syz0\x00', {0x4, 0x9, 0x5}, 0x1a, [0x2249, 0x8da1, 0x6a, 0x3, 0x6, 0x4, 0x101, 0x7, 0x9c, 0x3ff, 0x998, 0x81, 0xfff42cea, 0x6, 0xc1e2, 0x5, 0x8, 0x9, 0x89d3, 0xc3, 0x7dd5, 0x7, 0x8, 0x9, 0x0, 0x4f, 0xfff, 0x9, 0x78, 0x5, 0x7, 0x1, 0x5, 0x0, 0x6, 0x10000, 0x1, 0x7f, 0x3, 0x8001, 0xa, 0x0, 0x4, 0x0, 0x1, 0x0, 0x80000000, 0xfffffffd, 0x1, 0xa, 0x9, 0x8001, 0x0, 0x8, 0x4, 0x1, 0x1, 0x80c, 0x7fffffff, 0x9, 0x58cc4f84, 0x8001, 0x7, 0x17c], [0xfffffff7, 0x3, 0x400, 0x2, 0x500, 0x8, 0x5, 0x8, 0x6, 0x7, 0x0, 0x5, 0x6e83cd60, 0x69, 0x4f55, 0x0, 0x4, 0x7, 0x8, 0x1, 0x5, 0x6, 0x2, 0x8, 0x51, 0x2, 0xbd, 0xffff18d9, 0xffffac2f, 0x9, 0xfffffff7, 0x8, 0x7, 0x80000000, 0xfffffffb, 0x6, 0xfffffc8f, 0xe0, 0x6d, 0xf, 0x6, 0x3, 0x5, 0x1, 0x3e8, 0x9, 0x5, 0x5, 0x3, 0x1, 0x7a, 0x7fff, 0x3, 0x1, 0x3, 0x8, 0x0, 0x4, 0xffff, 0x2, 0x200, 0x1, 0x0, 0x2], [0x3, 0x7, 0x9, 0xfffffffd, 0xe, 0x3, 0xffffffa2, 0x2, 0xffffb394, 0x400, 0x100, 0x4, 0x35c000, 0x4, 0xfff, 0x401, 0x3b, 0x10, 0x5, 0x10000, 0x3, 0x80, 0x7ff, 0x14, 0x8001, 0xff, 0xa, 0x8, 0x973, 0x5, 0x7, 0x4, 0x9, 0x7, 0x7, 0x2, 0x3, 0x7, 0x8, 0x2, 0x8a4, 0x5, 0x81, 0x101, 0x9, 0x5cd0, 0x3, 0x5, 0x28, 0x8, 0x1, 0x800, 0x5, 0x1, 0x7, 0xc81d, 0xffffffff, 0x1ff, 0x7dff41ea, 0x5, 0xca, 0x8, 0x6bb, 0xc], [0x7, 0x65, 0xfdfffffa, 0xe, 0x23c3, 0x8, 0x8, 0xffffffff, 0x7, 0x40, 0xfffffff8, 0x3, 0x7fff, 0x9e83, 0x81, 0x5, 0x1000, 0x8, 0x0, 0x7, 0x9, 0x0, 0x667e, 0x3, 0xee8, 0xd1, 0xd, 0x40, 0x80, 0x4, 0xd, 0x200, 0x7, 0x47, 0x7, 0x4, 0x7, 0x9, 0xfffffffd, 0x7, 0x89, 0x80, 0x80000000, 0xab6, 0x3ff, 0x8, 0x800, 0x8001, 0xfffffffc, 0x401, 0x1ff, 0x40, 0xb, 0x2, 0x6, 0x9, 0x2df1, 0xfffffff7, 0x183, 0x8, 0xe, 0x82, 0x8, 0x5]}, 0x45c) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0x7c}}, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f406", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 35.470003978s ago: executing program 6 (id=10039): syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x34, 0x3, 0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}, {0x0}], 0x2}, 0x0, 0x40000000, 0x1}) r0 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace$peek(0x3, r4, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0xc, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(r0, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 35.468820562s ago: executing program 3 (id=10040): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x6e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc00, @remote, 0xffffffff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendfile(r3, r0, 0x0, 0x80000000) 34.342706533s ago: executing program 7 (id=10041): r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000024002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x6e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc00, @remote, 0xffffffff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendfile(r3, r0, 0x0, 0x80000000) 33.791077818s ago: executing program 6 (id=10042): openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x2c2) socket$nl_audit(0x10, 0x3, 0x9) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}}, 0x0) 33.714805192s ago: executing program 8 (id=10043): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005e9eb4104c053800f516010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 33.651328896s ago: executing program 6 (id=10044): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$rds(r1, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0xf00}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x39}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) ioprio_set$uid(0x3, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x100000530) sendmsg$rds(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffffffffffff29, 0x0, 0x0, 0x5855}, 0x40) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0xffffffff, 0x3}, 0x20) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x12) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, 0x0, 0x0) 33.401124437s ago: executing program 7 (id=10045): socket$nl_generic(0x10, 0x3, 0x10) mincore(&(0x7f0000bfe000/0x400000)=nil, 0x400000, &(0x7f0000000200)=""/133) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) prlimit64(0x0, 0xe, &(0x7f0000002440)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) add_key$keyring(0x0, &(0x7f00000023c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x90b6c87a770e7f78}, 0xc, &(0x7f00000002c0)={&(0x7f0000000400)={0x54, r4, 0x400, 0x70bd2b, 0x1, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffa}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x38, 0xa}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8010}, 0xc000) ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000240)='|') socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x8a, &(0x7f00000000c0), 0x4) 32.622475602s ago: executing program 6 (id=10046): connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) syz_usb_connect(0x0, 0x46, &(0x7f0000000000)=ANY=[], 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000240)='/dev/comedi3\x00', 0x81, 0x0) r1 = socket(0x25, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast5-avx\x00'}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000001280)="b7f2288a9119", 0x6) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) ioctl$RTC_ALM_SET(r5, 0x40247007, 0x0) accept$alg(r4, 0x0, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x400c840) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x3, 0xeb25, @private2}, 0x1c) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='io\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000eb9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000ca0000/0x2000)=nil, 0x0}, 0x68) read$FUSE(r7, &(0x7f00000012c0)={0x2020}, 0x2020) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000740)="93", 0x1}, {&(0x7f0000000300)="9eb08695bfb6c00c84b009b27c130a20b39a5a92433e532a0bc72fa6b2b6de11958bc7c52cbbdf95928da713798bdc3a33cac1222de0295470eb3d507fc035842b1e0bda3203109dc3f592df4c51c229be37a98dc2bf6bdee9a0ec11e44ac9abfd15", 0x62}], 0x2) socket$inet_sctp(0x2, 0x5, 0x84) syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') 32.459617486s ago: executing program 3 (id=10047): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x88}}, 0x0) 32.449673064s ago: executing program 5 (id=10048): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x430, @local, 0x9}, 0x1c) sendto$inet6(r3, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) 32.393460328s ago: executing program 3 (id=10049): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000002c0)={'syz0\x00', {0x4, 0x9, 0x5}, 0x1a, [0x2249, 0x8da1, 0x6a, 0x3, 0x6, 0x4, 0x101, 0x7, 0x9c, 0x3ff, 0x998, 0x81, 0xfff42cea, 0x6, 0xc1e2, 0x5, 0x8, 0x9, 0x89d3, 0xc3, 0x7dd5, 0x7, 0x8, 0x9, 0x0, 0x4f, 0xfff, 0x9, 0x78, 0x5, 0x7, 0x1, 0x5, 0x0, 0x6, 0x10000, 0x1, 0x7f, 0x3, 0x8001, 0xa, 0x0, 0x4, 0x0, 0x1, 0x0, 0x80000000, 0xfffffffd, 0x1, 0xa, 0x9, 0x8001, 0x0, 0x8, 0x4, 0x1, 0x1, 0x80c, 0x7fffffff, 0x9, 0x58cc4f84, 0x8001, 0x7, 0x17c], [0xfffffff7, 0x3, 0x400, 0x2, 0x500, 0x8, 0x5, 0x8, 0x6, 0x7, 0x0, 0x5, 0x6e83cd60, 0x69, 0x4f55, 0x0, 0x4, 0x7, 0x8, 0x1, 0x5, 0x6, 0x2, 0x8, 0x51, 0x2, 0xbd, 0xffff18d9, 0xffffac2f, 0x9, 0xfffffff7, 0x8, 0x7, 0x80000000, 0xfffffffb, 0x6, 0xfffffc8f, 0xe0, 0x6d, 0xf, 0x6, 0x3, 0x5, 0x1, 0x3e8, 0x9, 0x5, 0x5, 0x3, 0x1, 0x7a, 0x7fff, 0x3, 0x1, 0x3, 0x8, 0x0, 0x4, 0xffff, 0x2, 0x200, 0x1, 0x0, 0x2], [0x3, 0x7, 0x9, 0xfffffffd, 0xe, 0x3, 0xffffffa2, 0x2, 0xffffb394, 0x400, 0x100, 0x4, 0x35c000, 0x4, 0xfff, 0x401, 0x3b, 0x10, 0x5, 0x10000, 0x3, 0x80, 0x7ff, 0x14, 0x8001, 0xff, 0xa, 0x8, 0x973, 0x5, 0x7, 0x4, 0x9, 0x7, 0x7, 0x2, 0x3, 0x7, 0x8, 0x2, 0x8a4, 0x5, 0x81, 0x101, 0x9, 0x5cd0, 0x3, 0x5, 0x28, 0x8, 0x1, 0x800, 0x5, 0x1, 0x7, 0xc81d, 0xffffffff, 0x1ff, 0x7dff41ea, 0x5, 0xca, 0x8, 0x6bb, 0xc], [0x7, 0x65, 0xfdfffffa, 0xe, 0x23c3, 0x8, 0x8, 0xffffffff, 0x7, 0x40, 0xfffffff8, 0x3, 0x7fff, 0x9e83, 0x81, 0x5, 0x1000, 0x8, 0x0, 0x7, 0x9, 0x0, 0x667e, 0x3, 0xee8, 0xd1, 0xd, 0x40, 0x80, 0x4, 0xd, 0x200, 0x7, 0x47, 0x7, 0x4, 0x7, 0x9, 0xfffffffd, 0x7, 0x89, 0x80, 0x80000000, 0xab6, 0x3ff, 0x8, 0x800, 0x8001, 0xfffffffc, 0x401, 0x1ff, 0x40, 0xb, 0x2, 0x6, 0x9, 0x2df1, 0xfffffff7, 0x183, 0x8, 0xe, 0x82, 0x8, 0x5]}, 0x45c) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0x7c}}, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 32.195892185s ago: executing program 3 (id=10050): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) syz_usb_connect(0x5, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x24, 0xa1, 0x71, 0x8, 0x5ac, 0x921d, 0xd3ea, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa6, 0x1, 0x0, 0x3, 0xe9, 0x0, 0x3}}]}}]}}, 0x0) sendmmsg$sock(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="15", 0x1}], 0x1}}], 0x1, 0x40001) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000a80)}) close_range(r1, 0xffffffffffffffff, 0x0) 31.596322548s ago: executing program 7 (id=10051): unshare(0x22020400) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 31.497353727s ago: executing program 5 (id=10052): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x6e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc00, @remote, 0xffffffff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendfile(r3, r0, 0x0, 0x80000000) 31.465470047s ago: executing program 8 (id=10053): syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x34, 0x3, 0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}, {0x0}], 0x2}, 0x0, 0x40000000, 0x1}) r0 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace$peek(0x3, r4, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0xc, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(r0, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 30.553221407s ago: executing program 8 (id=10054): openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x2c2) socket$nl_audit(0x10, 0x3, 0x9) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}}, 0x0) 30.267634842s ago: executing program 8 (id=10055): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, 0x0, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r3, &(0x7f0000000240)=[{&(0x7f0000000000)="f1", 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) recvmmsg(r2, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 29.967727279s ago: executing program 3 (id=10056): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x6e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc00, @remote, 0xffffffff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendfile(r3, r0, 0x0, 0x80000000) 29.539986777s ago: executing program 5 (id=10057): socket$nl_generic(0x10, 0x3, 0x10) mincore(&(0x7f0000bfe000/0x400000)=nil, 0x400000, &(0x7f0000000200)=""/133) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) prlimit64(0x0, 0xe, &(0x7f0000002440)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) add_key$keyring(0x0, &(0x7f00000023c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)) 29.226130406s ago: executing program 6 (id=10058): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x5, 0x0) sched_setscheduler(0x0, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) syz_open_procfs(0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x28040085) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) timerfd_create(0x7, 0x80000) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x1, @empty, 'ip6gre0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407000000c00000001d440000000000006b0a00fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x853, 0x313, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0xe, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x7, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) 492.627383ms ago: executing program 38 (id=10051): unshare(0x22020400) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 235.195353ms ago: executing program 39 (id=10058): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x5, 0x0) sched_setscheduler(0x0, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) syz_open_procfs(0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x28040085) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) timerfd_create(0x7, 0x80000) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x1, @empty, 'ip6gre0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407000000c00000001d440000000000006b0a00fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x853, 0x313, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0xe, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x7, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) 133.523943ms ago: executing program 40 (id=10055): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, 0x0, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r3, &(0x7f0000000240)=[{&(0x7f0000000000)="f1", 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) recvmmsg(r2, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 74.693125ms ago: executing program 41 (id=10057): socket$nl_generic(0x10, 0x3, 0x10) mincore(&(0x7f0000bfe000/0x400000)=nil, 0x400000, &(0x7f0000000200)=""/133) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) prlimit64(0x0, 0xe, &(0x7f0000002440)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) add_key$keyring(0x0, &(0x7f00000023c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)) 0s ago: executing program 42 (id=10056): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x6e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc00, @remote, 0xffffffff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendfile(r3, r0, 0x0, 0x80000000) kernel console output (not intermixed with test programs): ld solve the problem. [ 2624.327454][ T5254] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2624.386043][ T5254] hsr_slave_0: entered promiscuous mode [ 2624.395673][ T5254] hsr_slave_1: entered promiscuous mode [ 2624.413421][ T5254] debugfs: 'hsr0' already exists in 'hsr' [ 2624.422308][ T5254] Cannot create hsr debugfs directory [ 2624.445036][T32211] Bluetooth: hci2: command tx timeout [ 2625.387818][ T5254] netdevsim netdevsim4 netdevsim0 (unregistering): left allmulticast mode [ 2625.930675][ T5311] netlink: 20 bytes leftover after parsing attributes in process `syz.5.9268'. [ 2626.093807][ T5311] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9268'. [ 2626.131811][ T5254] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 2626.169603][ T5254] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 2626.227444][ T5254] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 2626.292707][ T5254] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 2626.501413][ T5254] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2626.524989][T32211] Bluetooth: hci2: command tx timeout [ 2626.679479][ T5254] 8021q: adding VLAN 0 to HW filter on device team0 [ 2627.140759][ T3094] bridge0: port 1(bridge_slave_0) entered blocking state [ 2627.147924][ T3094] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2627.157147][ T3094] bridge0: port 2(bridge_slave_1) entered blocking state [ 2627.164252][ T3094] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2627.501816][ T5254] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2627.517724][T10400] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 2628.417281][T10400] usb 7-1: Using ep0 maxpacket: 8 [ 2628.451010][T10400] usb 7-1: config 162 has an invalid interface number: 166 but max is 0 [ 2628.464963][T10400] usb 7-1: config 162 has no interface number 0 [ 2628.523784][T10400] usb 7-1: config 162 interface 166 has no altsetting 0 [ 2628.543049][T10400] usb 7-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=d3.ea [ 2628.554994][T10400] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2628.562969][T10400] usb 7-1: Product: syz [ 2628.570306][T10400] usb 7-1: Manufacturer: syz [ 2628.575990][T10400] usb 7-1: SerialNumber: syz [ 2628.605369][T32211] Bluetooth: hci2: command tx timeout [ 2628.877841][T10400] appledisplay 7-1:162.166: Could not find int-in endpoint [ 2628.941270][ T5364] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2628.972026][T10400] usbhid 7-1:162.166: couldn't find an input interrupt endpoint [ 2629.080011][T10400] usb 7-1: USB disconnect, device number 23 [ 2629.732426][ T5254] veth0_vlan: entered promiscuous mode [ 2629.827838][ T5254] veth1_vlan: entered promiscuous mode [ 2629.862189][ T5254] veth0_macvtap: entered promiscuous mode [ 2629.872031][ T5254] veth1_macvtap: entered promiscuous mode [ 2629.894524][ T5254] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2629.918078][ T5254] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2629.933478][ T3097] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2629.972147][ T3097] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2630.062093][ T3097] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2630.102972][ T3098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2630.104881][T14933] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2630.142481][ T3098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2630.161626][ T3097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2630.170461][ T3097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2630.685268][T32211] Bluetooth: hci2: command tx timeout [ 2630.776891][ T5381] netlink: 'syz.4.9247': attribute type 10 has an invalid length. [ 2630.893061][ T5381] team0: Port device dummy0 added [ 2631.277919][ T5391] netlink: 'syz.5.9286': attribute type 10 has an invalid length. [ 2633.915078][T23039] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 2634.064952][T23039] usb 7-1: Using ep0 maxpacket: 8 [ 2634.083018][T23039] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2634.103580][T23039] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2634.129327][T23039] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2634.714344][T23039] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2634.725172][T23039] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2634.745453][T23039] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2634.761278][T23039] usb 7-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=14.a8 [ 2634.771781][T23039] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2634.779894][T23039] usb 7-1: Product: syz [ 2634.787485][T23039] usb 7-1: Manufacturer: syz [ 2634.792456][T23039] usb 7-1: SerialNumber: syz [ 2634.801207][T23039] usb 7-1: config 0 descriptor?? [ 2635.015016][T10400] usb 7-1: USB disconnect, device number 24 [ 2635.947967][ T5466] netlink: 20 bytes leftover after parsing attributes in process `syz.7.9310'. [ 2635.957324][ T5466] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9310'. [ 2638.528786][ T5497] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9321'. [ 2638.805141][T23039] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 2638.816678][T10400] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 2639.434844][T10400] usb 7-1: Using ep0 maxpacket: 8 [ 2639.439938][T23039] usb 5-1: Using ep0 maxpacket: 8 [ 2639.446616][T23039] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 2639.455200][T23039] usb 5-1: config 179 has no interface number 0 [ 2639.461507][T10400] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2639.471665][T23040] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 2639.480123][T23039] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 2639.492189][T10400] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2639.501181][T23039] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 2639.512953][T23039] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 7 [ 2639.533074][T10400] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2639.547474][T10400] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2639.556958][T23039] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 9272, setting to 1024 [ 2639.568768][T23039] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2639.584118][T10400] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2639.594381][T10400] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2639.605466][T23039] usb 5-1: config 179 interface 65 has no altsetting 0 [ 2639.618760][T10400] usb 7-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=14.a8 [ 2639.632266][T10400] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2639.640360][T23040] usb 6-1: Using ep0 maxpacket: 32 [ 2639.645515][T23039] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 2639.663388][T10400] usb 7-1: Product: syz [ 2639.675854][T23039] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2639.741360][T23040] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2639.777089][T10400] usb 7-1: Manufacturer: syz [ 2639.791892][T23040] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2639.803210][T10400] usb 7-1: SerialNumber: syz [ 2639.818326][T10400] usb 7-1: config 0 descriptor?? [ 2639.823410][T23040] usb 6-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.00 [ 2639.832969][T23040] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2639.847043][T23040] usb 6-1: config 0 descriptor?? [ 2640.051472][T22211] usb 7-1: USB disconnect, device number 25 [ 2641.600543][T23039] usb 5-1: USB disconnect, device number 18 [ 2641.804325][ T5536] netlink: 32 bytes leftover after parsing attributes in process `syz.7.9335'. [ 2642.698792][T23040] usbhid 6-1:0.0: can't add hid device: -71 [ 2642.721477][T23040] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2642.940876][T22177] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 2642.942859][T23040] usb 6-1: USB disconnect, device number 24 [ 2643.274935][T22177] usb 2-1: Using ep0 maxpacket: 8 [ 2643.377256][T22177] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2643.392187][T22177] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2643.429547][T22177] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 2643.590580][T22177] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 [ 2643.593623][ T5537] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9334'. [ 2643.602900][T22177] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2643.612294][ T5537] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9334'. [ 2643.701722][T22177] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2643.720333][T22177] usb 2-1: Product: syz [ 2643.743768][T22177] usb 2-1: Manufacturer: syz [ 2643.797515][T22177] usb 2-1: SerialNumber: syz [ 2643.863062][ T5560] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9342'. [ 2644.030577][T22177] cdc_ncm 2-1:1.0: bind() failure [ 2644.054740][T22177] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 2644.077136][T22177] cdc_ncm 2-1:1.1: bind() failure [ 2644.092860][T22177] usb 2-1: USB disconnect, device number 125 [ 2644.105014][T22211] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 2644.254892][T22211] usb 5-1: Using ep0 maxpacket: 8 [ 2645.229092][T22211] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 2645.263796][T22211] usb 5-1: config 179 has no interface number 0 [ 2645.292496][T22211] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 2645.343745][T22211] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 2645.520706][T22211] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 2645.532536][T22211] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 2645.544026][T22211] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2645.557708][T22211] usb 5-1: config 179 interface 65 has no altsetting 0 [ 2645.564673][T22211] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 2645.575180][T22211] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2645.599365][T22211] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input102 [ 2645.714874][T23040] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 2646.466083][T23040] usb 7-1: config 7 has an invalid interface number: 192 but max is 0 [ 2646.474465][T23040] usb 7-1: config 7 has no interface number 0 [ 2646.484827][T23040] usb 7-1: config 7 interface 192 has no altsetting 0 [ 2646.502518][T23040] usb 7-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 2646.511747][T23040] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2646.525072][T23040] usb 7-1: Product: syz [ 2646.531841][T23040] usb 7-1: Manufacturer: syz [ 2646.541936][T23040] usb 7-1: SerialNumber: syz [ 2646.826657][T23040] usb 7-1: USB disconnect, device number 26 [ 2647.109509][ T5599] overlayfs: overlapping lowerdir path [ 2647.374185][T22211] usb 5-1: USB disconnect, device number 19 [ 2647.380180][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 2649.490411][ T5624] hub 9-0:1.0: USB hub found [ 2649.500077][ T5624] hub 9-0:1.0: 1 port detected [ 2649.781006][ T5634] netlink: 'syz.6.9365': attribute type 10 has an invalid length. [ 2649.918671][ T645] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 2650.197532][ T5634] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 2650.227435][ T5640] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.9367'. [ 2650.335049][ T645] usb 2-1: Using ep0 maxpacket: 8 [ 2650.363632][ T645] usb 2-1: config 162 has an invalid interface number: 166 but max is 0 [ 2650.372207][ T645] usb 2-1: config 162 has no interface number 0 [ 2650.387640][ T645] usb 2-1: config 162 interface 166 has no altsetting 0 [ 2650.495113][T22211] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 2650.525613][ T645] usb 2-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=d3.ea [ 2650.575241][ T645] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2650.790293][ T645] usb 2-1: Product: syz [ 2650.794483][ T645] usb 2-1: Manufacturer: syz [ 2650.799561][ T645] usb 2-1: SerialNumber: syz [ 2650.837707][T22211] usb 6-1: Using ep0 maxpacket: 8 [ 2650.859874][T22211] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 2650.868407][T22211] usb 6-1: config 179 has no interface number 0 [ 2650.883147][T22211] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 2650.903124][T22211] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 2650.973482][T22211] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 2651.229336][ T645] appledisplay 2-1:162.166: Could not find int-in endpoint [ 2651.237103][ T645] usbhid 2-1:162.166: couldn't find an input interrupt endpoint [ 2651.257886][T22211] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 2651.487294][T22211] usb 6-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2651.494886][ T645] usb 2-1: USB disconnect, device number 126 [ 2651.501208][T22211] usb 6-1: config 179 interface 65 has no altsetting 0 [ 2651.514247][T22211] usb 6-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 2651.523741][T22211] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2651.557844][T22211] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input103 [ 2651.600384][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2651.609626][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2651.840650][ T5659] netlink: 12 bytes leftover after parsing attributes in process `syz.7.9372'. [ 2651.864863][ T5659] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9372'. [ 2653.071698][ T5673] hub 9-0:1.0: USB hub found [ 2653.078448][ T5673] hub 9-0:1.0: 1 port detected [ 2653.538610][T22212] usb 6-1: USB disconnect, device number 25 [ 2653.544585][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 2653.702271][ T5681] binder_alloc: 5674: binder_alloc_buf, no vma [ 2654.245557][ T5679] netlink: 'syz.6.9379': attribute type 10 has an invalid length. [ 2654.539106][ T5698] netlink: 'syz.1.9386': attribute type 72 has an invalid length. [ 2654.557029][ T5698] netlink: 732 bytes leftover after parsing attributes in process `syz.1.9386'. [ 2655.384845][ T645] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 2655.683994][ T645] usb 5-1: Using ep0 maxpacket: 8 [ 2655.692029][ T645] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2655.710640][ T645] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2655.721616][ T645] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2655.732640][ T645] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2655.764541][ T645] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2655.784892][ T645] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2655.808321][ T645] usb 5-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=14.a8 [ 2655.817958][ T645] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2655.837324][ T645] usb 5-1: Product: syz [ 2655.843999][ T645] usb 5-1: Manufacturer: syz [ 2655.851543][ T645] usb 5-1: SerialNumber: syz [ 2655.857655][ T5714] netlink: 212408 bytes leftover after parsing attributes in process `syz.7.9392'. [ 2655.873386][ T645] usb 5-1: config 0 descriptor?? [ 2656.090234][T22177] usb 5-1: USB disconnect, device number 20 [ 2656.205108][T22212] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 2656.364903][T22212] usb 6-1: Using ep0 maxpacket: 16 [ 2656.371420][T22212] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 2656.383543][T22212] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2656.396072][T22212] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2656.405447][T22212] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2656.413420][T22212] usb 6-1: Product: syz [ 2656.417595][T22212] usb 6-1: Manufacturer: syz [ 2656.422182][T22212] usb 6-1: SerialNumber: syz [ 2656.429605][T22212] usb 6-1: config 0 descriptor?? [ 2656.437945][T22212] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2656.451121][T22212] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 2656.822678][ T5730] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9398'. [ 2656.833588][ T5730] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9398'. [ 2657.117162][ T5736] binder_alloc: 5727: binder_alloc_buf, no vma [ 2657.280006][T22212] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 2657.291660][T22212] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 2657.946097][T22177] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 2658.184621][T22212] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 2658.193343][T22212] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 2658.292118][T22212] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 2658.299447][T22212] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 2658.315119][T22212] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 2658.328834][T22212] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 2658.335369][T22177] usb 7-1: Using ep0 maxpacket: 8 [ 2658.381172][T22177] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2658.389503][T22212] usb 6-1: USB disconnect, device number 26 [ 2658.444216][T22177] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2658.761139][T22177] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 2658.772063][T22177] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 [ 2658.784621][T22177] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2658.797839][T22177] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2658.807236][T22177] usb 7-1: Product: syz [ 2658.811806][T22177] usb 7-1: Manufacturer: syz [ 2658.819641][T22177] usb 7-1: SerialNumber: syz [ 2660.035265][T22211] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 2660.394971][T22211] usb 5-1: Using ep0 maxpacket: 32 [ 2660.540563][ T5773] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2661.356082][T22177] cdc_ncm 7-1:1.0: bind() failure [ 2661.498648][T22177] cdc_ncm 7-1:1.1: CDC Union missing and no IAD found [ 2661.589050][T22177] cdc_ncm 7-1:1.1: bind() failure [ 2661.622392][T22211] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2661.679445][T22211] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2661.689650][T22177] usb 7-1: USB disconnect, device number 27 [ 2661.712795][T22211] usb 5-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.00 [ 2661.724365][T22211] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2661.744289][T22211] usb 5-1: config 0 descriptor?? [ 2661.762956][ T5779] netlink: 'syz.6.9412': attribute type 10 has an invalid length. [ 2661.959099][T22211] usbhid 5-1:0.0: can't add hid device: -71 [ 2661.974059][T22211] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2662.012424][T22211] usb 5-1: USB disconnect, device number 21 [ 2663.001880][ T5805] netlink: 732 bytes leftover after parsing attributes in process `syz.7.9418'. [ 2665.392900][ T5837] netlink: 'syz.7.9425': attribute type 10 has an invalid length. [ 2665.614858][T23039] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 2665.694828][ T645] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 2665.764879][T23039] usb 7-1: Using ep0 maxpacket: 32 [ 2665.786480][T23039] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2665.826035][T23039] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2665.854913][ T645] usb 2-1: Using ep0 maxpacket: 32 [ 2665.862541][T23039] usb 7-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.00 [ 2665.878642][ T645] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2665.898701][T23039] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2665.914654][ T645] usb 2-1: too many endpoints for config 0 interface 0 altsetting 5: 69, using maximum allowed: 30 [ 2665.935925][T23039] usb 7-1: config 0 descriptor?? [ 2665.948333][ T645] usb 2-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 69 [ 2666.009190][ T645] usb 2-1: config 0 interface 0 has no altsetting 0 [ 2666.017356][ T645] usb 2-1: New USB device found, idVendor=152d, idProduct=0539, bcdDevice= 0.00 [ 2666.026691][ T645] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 2666.037457][ T645] usb 2-1: SerialNumber: syz [ 2666.050616][ T645] usb 2-1: config 0 descriptor?? [ 2666.066780][ T645] usb-storage 2-1:0.0: USB Mass Storage device detected [ 2666.090736][ T645] usb-storage 2-1:0.0: Quirks match for vid 152d pid 0539: 4000000 [ 2666.326118][T22177] usb 2-1: USB disconnect, device number 127 [ 2669.166696][T23039] usbhid 7-1:0.0: can't add hid device: -71 [ 2669.200016][T23039] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 2669.275068][T23039] usb 7-1: USB disconnect, device number 28 [ 2669.954675][T23040] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 2670.446173][T23040] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 2670.454506][T23040] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2670.476041][T23040] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 2670.487712][T23040] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 2670.514810][T23040] usb 5-1: Manufacturer: syz [ 2670.528415][T23040] usb 5-1: config 0 descriptor?? [ 2670.535126][T23040] igorplugusb 5-1:0.0: incorrect number of endpoints [ 2671.209893][T22177] usb 5-1: USB disconnect, device number 22 [ 2672.823079][T22177] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 2672.976135][T22177] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 2672.999409][T22177] usb 2-1: config 0 has no interface number 0 [ 2673.025093][T22177] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 2673.103828][T22177] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2673.127445][T22177] usb 2-1: config 0 descriptor?? [ 2673.144422][T22177] usb 2-1: selecting invalid altsetting 1 [ 2673.161162][T22177] dvb_ttusb_budget: ttusb_init_controller: error [ 2673.286093][T22177] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 2673.713308][T22177] DVB: Unable to find symbol cx22700_attach() [ 2674.060963][T22177] DVB: Unable to find symbol tda10046_attach() [ 2674.100683][T22177] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 2674.127199][T22177] usb 2-1: USB disconnect, device number 2 [ 2674.814426][T23039] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 2674.966823][T23039] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 2674.982672][T23039] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2675.015889][T23039] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 2675.037367][T23039] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 2675.177503][T23039] usb 6-1: Manufacturer: syz [ 2675.275538][T23039] usb 6-1: config 0 descriptor?? [ 2675.438393][T23039] igorplugusb 6-1:0.0: incorrect number of endpoints [ 2675.606889][T23039] usb 6-1: USB disconnect, device number 27 [ 2680.372585][ T5912] Set syz1 is full, maxelem 65536 reached [ 2680.595414][T23039] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 2680.790968][T23039] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2680.873786][T23039] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2680.903275][T23039] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2680.934348][T23039] usb 6-1: config 0 descriptor?? [ 2680.963162][T23039] pwc: Askey VC010 type 2 USB webcam detected. [ 2681.454907][T23039] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2681.461922][T23039] pwc: recv_control_msg error -32 req 02 val 2700 [ 2681.470490][T23039] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2681.482883][T23039] pwc: recv_control_msg error -32 req 04 val 1000 [ 2681.508892][T23039] pwc: recv_control_msg error -32 req 04 val 1300 [ 2681.537896][T23039] pwc: recv_control_msg error -32 req 04 val 1400 [ 2682.459801][T23039] pwc: recv_control_msg error -32 req 02 val 2000 [ 2682.473759][T23039] pwc: recv_control_msg error -71 req 02 val 2100 [ 2682.481441][T23039] pwc: recv_control_msg error -71 req 04 val 1500 [ 2682.501014][T23039] pwc: recv_control_msg error -71 req 02 val 2500 [ 2682.515229][T23039] pwc: recv_control_msg error -71 req 02 val 2400 [ 2682.528986][T23039] pwc: recv_control_msg error -71 req 02 val 2600 [ 2682.540014][T23039] pwc: recv_control_msg error -71 req 02 val 2900 [ 2682.559296][T23039] pwc: recv_control_msg error -71 req 02 val 2800 [ 2682.574291][ T6040] fuse: Bad value for 'fd' [ 2682.587945][T23039] pwc: recv_control_msg error -71 req 04 val 1100 [ 2682.615173][T23039] pwc: recv_control_msg error -71 req 04 val 1200 [ 2682.633018][T23039] pwc: Registered as video103. [ 2682.649033][T23039] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input104 [ 2682.701342][T23039] usb 6-1: USB disconnect, device number 28 [ 2685.128159][ T6057] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9498'. [ 2685.137701][ T6057] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9498'. [ 2685.520989][ T6072] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9503'. [ 2686.419957][ T6080] fuse: Bad value for 'fd' [ 2687.902244][ T6104] netlink: 'syz.7.9513': attribute type 10 has an invalid length. [ 2688.813084][ T6118] netlink: 'syz.7.9516': attribute type 10 has an invalid length. [ 2690.484947][T23039] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 2690.654332][T23039] usb 7-1: Using ep0 maxpacket: 32 [ 2690.706662][T23039] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 2690.783413][T23039] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2691.167560][T23039] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2691.194806][T23039] usb 7-1: Product: syz [ 2691.198991][T23039] usb 7-1: Manufacturer: syz [ 2691.203585][T23039] usb 7-1: SerialNumber: syz [ 2691.239348][T23039] usb 7-1: config 0 descriptor?? [ 2691.245544][ T6134] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 2691.500752][ T6148] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9527'. [ 2691.710888][T22212] usb 7-1: USB disconnect, device number 29 [ 2692.861448][T23039] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 2693.224784][T23039] usb 5-1: Using ep0 maxpacket: 32 [ 2693.231607][T23039] usb 5-1: config 0 has an invalid interface number: 48 but max is 0 [ 2693.242714][T23039] usb 5-1: config 0 has no interface number 0 [ 2693.273960][T23039] usb 5-1: config 0 interface 48 altsetting 7 bulk endpoint 0x6 has invalid maxpacket 64 [ 2693.283961][T23040] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 2693.319449][T23039] usb 5-1: config 0 interface 48 has no altsetting 0 [ 2693.342721][T23039] usb 5-1: New USB device found, idVendor=1ae7, idProduct=0525, bcdDevice=74.d5 [ 2693.352095][T23039] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2693.530131][T23039] usb 5-1: Product: syz [ 2693.534662][T23039] usb 5-1: Manufacturer: syz [ 2693.546380][T23039] usb 5-1: SerialNumber: syz [ 2693.551071][T23040] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 2693.559211][T23040] usb 6-1: config 0 has no interface number 0 [ 2693.567712][T23039] usb 5-1: config 0 descriptor?? [ 2693.572827][T23040] usb 6-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2693.584855][ T6158] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 2693.686729][T23039] HFC-S_USB 5-1:0.48: probe with driver HFC-S_USB failed with error -5 [ 2693.701474][T23040] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 2693.777625][T23040] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 2693.794593][T23040] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 2693.803710][T23040] usb 6-1: Product: syz [ 2693.834405][T23040] usb 6-1: SerialNumber: syz [ 2693.883226][T23040] usb 6-1: config 0 descriptor?? [ 2693.892658][T23039] usb 5-1: USB disconnect, device number 23 [ 2693.920539][ T6160] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 2693.952536][T23040] cm109 6-1:0.8: invalid payload size 64, expected 4 [ 2694.015438][T23040] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input105 [ 2695.199784][ T6044] Set syz1 is full, maxelem 65536 reached [ 2695.721896][ T6184] netlink: 'syz.7.9540': attribute type 10 has an invalid length. [ 2695.741475][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2695.743181][T22212] usb 6-1: USB disconnect, device number 29 [ 2695.748439][ C0] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 2695.785128][T22212] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 2695.815181][ T6187] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.9541'. [ 2695.841709][ T6192] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9542'. [ 2696.145039][T22211] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 2696.365141][T22211] usb 2-1: Using ep0 maxpacket: 8 [ 2696.371774][T22211] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 2696.386619][T22211] usb 2-1: config 179 has no interface number 0 [ 2696.393668][T22211] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 2696.407651][T22211] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 2696.421638][T22211] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 2696.432899][ T6206] hub 9-0:1.0: USB hub found [ 2696.433089][T22211] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 2696.442046][ T6206] hub 9-0:1.0: 1 port detected [ 2696.462193][T22211] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2696.477943][T22211] usb 2-1: config 179 interface 65 has no altsetting 0 [ 2696.484933][T22211] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 2696.494285][T22211] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2696.827129][T22211] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input106 [ 2698.164819][T23039] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 2698.459513][ T6232] netlink: 'syz.5.9557': attribute type 10 has an invalid length. [ 2698.477249][T23039] usb 7-1: Using ep0 maxpacket: 8 [ 2698.506278][T23039] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 2698.515536][T23039] usb 7-1: config 0 has no interface number 0 [ 2698.521689][T23039] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2698.532797][T23039] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2698.542588][T23039] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2698.628429][T23039] usb 7-1: config 0 descriptor?? [ 2698.642253][T23039] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2698.733198][ T2123] usb 2-1: USB disconnect, device number 3 [ 2698.739104][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 2699.404619][ T6245] hub 9-0:1.0: USB hub found [ 2699.414301][ T6245] hub 9-0:1.0: 1 port detected [ 2699.992131][T23039] usb 7-1: USB disconnect, device number 30 [ 2700.934595][ T6271] netlink: 'syz.7.9570': attribute type 10 has an invalid length. [ 2701.944853][T22211] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 2702.107554][T22211] usb 6-1: Using ep0 maxpacket: 8 [ 2702.125194][ T6280] netlink: 52 bytes leftover after parsing attributes in process `syz.7.9573'. [ 2702.136508][T22211] usb 6-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 2702.165212][T22211] usb 6-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 2702.224912][T22211] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2702.243212][T22211] usb 6-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 2702.282851][T22211] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2702.310762][T22211] usb 6-1: config 0 descriptor?? [ 2702.393372][ T6288] hub 9-0:1.0: USB hub found [ 2702.399245][ T6288] hub 9-0:1.0: 1 port detected [ 2702.804259][ T6276] CIFS mount error: No usable UNC path provided in device string! [ 2702.804259][ T6276] [ 2702.814319][ T6276] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 2702.827000][T22211] usbhid 6-1:0.0: can't add hid device: -71 [ 2702.832978][T22211] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2702.850357][T22211] usb 6-1: USB disconnect, device number 30 [ 2702.917809][ T2123] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 2703.235725][ T2123] usb 7-1: Using ep0 maxpacket: 8 [ 2703.244404][ T2123] usb 7-1: config 162 has an invalid interface number: 166 but max is 0 [ 2703.253962][ T2123] usb 7-1: config 162 has no interface number 0 [ 2703.263578][ T2123] usb 7-1: config 162 interface 166 has no altsetting 0 [ 2703.272416][ T2123] usb 7-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=d3.ea [ 2703.281751][ T2123] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2703.289843][ T2123] usb 7-1: Product: syz [ 2703.294144][ T2123] usb 7-1: Manufacturer: syz [ 2703.301067][ T2123] usb 7-1: SerialNumber: syz [ 2703.445014][T22211] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 2703.640978][T22211] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 2703.709869][T22211] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2703.808950][T22211] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 2703.834126][T22211] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 2703.857653][ T2123] appledisplay 7-1:162.166: Could not find int-in endpoint [ 2703.867971][ T6305] hub 9-0:1.0: USB hub found [ 2703.872713][ T6305] hub 9-0:1.0: 1 port detected [ 2703.885603][ T2123] usbhid 7-1:162.166: couldn't find an input interrupt endpoint [ 2703.894287][T22211] usb 5-1: Manufacturer: syz [ 2703.925818][T22211] usb 5-1: config 0 descriptor?? [ 2703.937547][T22211] igorplugusb 5-1:0.0: incorrect number of endpoints [ 2703.957314][ T2123] usb 7-1: USB disconnect, device number 31 [ 2704.152348][T17264] usb 5-1: USB disconnect, device number 24 [ 2704.157831][ T6316] netlink: 52 bytes leftover after parsing attributes in process `syz.7.9586'. [ 2704.904853][T12892] Bluetooth: hci1: command 0x0406 tx timeout [ 2705.616424][ T645] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 2706.039272][ T645] usb 5-1: config 7 has an invalid interface number: 192 but max is 0 [ 2706.050636][ T645] usb 5-1: config 7 has no interface number 0 [ 2706.063784][ T645] usb 5-1: config 7 interface 192 has no altsetting 0 [ 2706.120176][ T645] usb 5-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 2706.134603][ T645] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2706.161313][ T6349] netlink: 52 bytes leftover after parsing attributes in process `syz.1.9598'. [ 2706.312562][ T6346] netlink: 'syz.6.9597': attribute type 10 has an invalid length. [ 2706.323218][ T6346] team0: Port device dummy0 added [ 2706.334047][ T645] usb 5-1: Product: syz [ 2706.339100][ T645] usb 5-1: Manufacturer: syz [ 2706.343696][ T645] usb 5-1: SerialNumber: syz [ 2707.688842][ T6361] hub 9-0:1.0: USB hub found [ 2707.694875][ T6361] hub 9-0:1.0: 1 port detected [ 2707.874080][ T645] usb 5-1: USB disconnect, device number 25 [ 2708.185016][T23040] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 2708.344876][T23040] usb 6-1: Using ep0 maxpacket: 8 [ 2708.351248][T23040] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 2708.359292][T23040] usb 6-1: config 0 has no interface number 0 [ 2708.366191][T23040] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2708.375963][T23040] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2708.385061][T23040] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2708.394207][T23040] usb 6-1: config 0 descriptor?? [ 2708.400532][T23040] iowarrior 6-1:0.1: no interrupt-in endpoint found [ 2708.782533][T23040] usb 6-1: USB disconnect, device number 31 [ 2709.859507][ T6390] netlink: 'syz.4.9611': attribute type 10 has an invalid length. [ 2709.878122][ T6390] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 2710.393143][ T6400] hub 9-0:1.0: USB hub found [ 2710.399027][ T6400] hub 9-0:1.0: 1 port detected [ 2711.135568][T23040] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 2711.314835][T23040] usb 6-1: Using ep0 maxpacket: 16 [ 2711.411761][T23040] usb 6-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 2711.423754][T23040] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2711.436147][T23040] usb 6-1: Product: syz [ 2711.440893][T23040] usb 6-1: Manufacturer: syz [ 2711.501785][T23040] usb 6-1: SerialNumber: syz [ 2711.853406][T23040] usb 6-1: config 0 descriptor?? [ 2712.731516][T23040] visor 6-1:0.0: Sony Clie 3.5 converter detected [ 2712.939694][T23040] usb 6-1: clie_3_5_startup: get config number bad return length: 0 [ 2712.948484][T23040] visor 6-1:0.0: probe with driver visor failed with error -5 [ 2712.971650][ T6429] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9626'. [ 2712.995646][ T6429] bridge_slave_1: left allmulticast mode [ 2713.001406][ T6429] bridge_slave_1: left promiscuous mode [ 2713.009938][ T6429] bridge0: port 2(bridge_slave_1) entered disabled state [ 2713.028555][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2713.035519][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2713.061239][ T6429] bridge_slave_0: left allmulticast mode [ 2713.068675][ T6429] bridge_slave_0: left promiscuous mode [ 2713.074974][ T6429] bridge0: port 1(bridge_slave_0) entered disabled state [ 2713.186110][T23039] usb 6-1: USB disconnect, device number 32 [ 2713.262718][ T6435] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2715.142763][ T6443] hub 9-0:1.0: USB hub found [ 2715.148711][ T6443] hub 9-0:1.0: 1 port detected [ 2715.525214][ T645] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 2715.658090][ T6442] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 2715.774901][ T6442] File: /dev/nullb0 PID: 6442 Comm: syz.7.9630 [ 2715.856876][ T645] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2715.884850][ T645] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2715.928460][ T645] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2715.959410][ T645] usb 2-1: config 0 descriptor?? [ 2715.969610][ T6449] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9634'. [ 2715.979627][ T645] pwc: Askey VC010 type 2 USB webcam detected. [ 2717.099873][ T645] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2717.215285][ T645] pwc: recv_control_msg error -32 req 02 val 2700 [ 2717.253347][ T645] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2717.920991][ T645] pwc: recv_control_msg error -32 req 04 val 1000 [ 2717.930715][ T645] pwc: recv_control_msg error -32 req 04 val 1300 [ 2717.947514][ T645] pwc: recv_control_msg error -32 req 04 val 1400 [ 2718.108388][ T645] pwc: recv_control_msg error -32 req 02 val 2000 [ 2718.557789][ T645] pwc: recv_control_msg error -71 req 04 val 1500 [ 2718.805960][ T645] pwc: recv_control_msg error -71 req 02 val 2500 [ 2718.814638][ T645] pwc: recv_control_msg error -71 req 02 val 2400 [ 2718.829232][ T645] pwc: recv_control_msg error -71 req 02 val 2600 [ 2718.845169][ T645] pwc: recv_control_msg error -71 req 02 val 2900 [ 2718.857511][ T645] pwc: recv_control_msg error -71 req 02 val 2800 [ 2718.872212][ T645] pwc: recv_control_msg error -71 req 04 val 1100 [ 2718.891954][ T645] pwc: recv_control_msg error -71 req 04 val 1200 [ 2718.900818][ T645] pwc: Registered as video103. [ 2718.906364][ T645] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input107 [ 2718.930589][ T645] usb 2-1: USB disconnect, device number 4 [ 2719.094923][T32211] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 2719.568244][ T6501] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9647'. [ 2719.897105][T22177] usb 7-1: new full-speed USB device number 32 using dummy_hcd [ 2720.173097][T22177] usb 7-1: config 7 has an invalid interface number: 192 but max is 0 [ 2720.848196][T22177] usb 7-1: config 7 has no interface number 0 [ 2720.854325][T22177] usb 7-1: config 7 interface 192 has no altsetting 0 [ 2720.960907][T22177] usb 7-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 2721.026015][T22177] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2721.069689][T22177] usb 7-1: Product: syz [ 2721.073873][T22177] usb 7-1: Manufacturer: syz [ 2721.087813][T22177] usb 7-1: SerialNumber: syz [ 2722.012165][ T6444] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 2722.154758][ T6527] hub 9-0:1.0: USB hub found [ 2722.157408][T22177] usb 7-1: USB disconnect, device number 32 [ 2722.169503][ T6527] hub 9-0:1.0: 1 port detected [ 2722.221134][ T6444] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2722.233543][ T6444] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2722.398227][ T6444] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2722.412936][ T6444] usb 6-1: config 0 descriptor?? [ 2722.444697][ T6444] pwc: Askey VC010 type 2 USB webcam detected. [ 2722.939016][ T6444] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2722.955686][ T6444] pwc: recv_control_msg error -32 req 02 val 2700 [ 2722.964501][ T6444] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2722.971744][ T6444] pwc: recv_control_msg error -32 req 04 val 1000 [ 2723.143842][ T6444] pwc: recv_control_msg error -32 req 04 val 1300 [ 2723.163447][ T6444] pwc: recv_control_msg error -32 req 04 val 1400 [ 2723.201805][ T6444] pwc: recv_control_msg error -32 req 02 val 2000 [ 2723.298480][ T6542] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9658'. [ 2723.308034][ T6542] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9658'. [ 2723.317116][T10400] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 2723.440940][ T6444] pwc: recv_control_msg error -71 req 04 val 1500 [ 2723.447534][ T2123] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 2723.461144][ T6444] pwc: recv_control_msg error -71 req 02 val 2500 [ 2723.469317][ T6444] pwc: recv_control_msg error -71 req 02 val 2400 [ 2723.480169][ T6444] pwc: recv_control_msg error -71 req 02 val 2600 [ 2723.554919][T10400] usb 5-1: Using ep0 maxpacket: 8 [ 2723.598962][ T6444] pwc: recv_control_msg error -71 req 02 val 2900 [ 2723.636097][ T2123] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2724.348555][T10400] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2724.367191][T10400] usb 5-1: config 8 has an invalid descriptor of length 86, skipping remainder of the config [ 2724.378035][T10400] usb 5-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 2724.384832][ T2123] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2724.396241][ T6444] pwc: recv_control_msg error -71 req 02 val 2800 [ 2724.398122][T10400] usb 5-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 2724.415387][T10400] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2724.428790][T10400] usb 5-1: Product: syz [ 2724.440160][T10400] usb 5-1: Manufacturer: syz [ 2724.445100][T10400] usb 5-1: SerialNumber: syz [ 2724.448158][ T2123] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2724.458116][ T6444] pwc: recv_control_msg error -71 req 04 val 1100 [ 2724.522321][ T6444] pwc: recv_control_msg error -71 req 04 val 1200 [ 2724.538263][ T2123] usb 7-1: config 0 descriptor?? [ 2724.573220][ T6444] pwc: Registered as video103. [ 2724.592567][ T2123] pwc: Askey VC010 type 2 USB webcam detected. [ 2724.632442][ T6444] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input108 [ 2724.663904][ T6444] usb 6-1: USB disconnect, device number 33 [ 2725.167787][ T2123] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2725.204651][ T2123] pwc: recv_control_msg error -32 req 02 val 2700 [ 2725.222616][ T2123] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2725.229983][ T2123] pwc: recv_control_msg error -32 req 04 val 1000 [ 2725.239207][ T2123] pwc: recv_control_msg error -32 req 04 val 1300 [ 2725.247649][ T2123] pwc: recv_control_msg error -32 req 04 val 1400 [ 2725.268725][ T6547] netlink: 'syz.5.9663': attribute type 10 has an invalid length. [ 2725.476771][ T2123] pwc: recv_control_msg error -71 req 02 val 2100 [ 2725.539532][ T2123] pwc: recv_control_msg error -71 req 04 val 1500 [ 2725.555455][ T2123] pwc: recv_control_msg error -71 req 02 val 2500 [ 2725.589126][ T2123] pwc: recv_control_msg error -71 req 02 val 2400 [ 2725.612967][ T2123] pwc: recv_control_msg error -71 req 02 val 2600 [ 2725.671841][ T2123] pwc: recv_control_msg error -71 req 02 val 2900 [ 2725.693738][ T2123] pwc: recv_control_msg error -71 req 02 val 2800 [ 2725.724891][ T2123] pwc: recv_control_msg error -71 req 04 val 1100 [ 2725.746994][ T2123] pwc: recv_control_msg error -71 req 04 val 1200 [ 2725.811384][ T2123] pwc: Registered as video103. [ 2725.819796][ T2123] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input109 [ 2725.838444][ T2123] usb 7-1: USB disconnect, device number 33 [ 2726.764771][ T6568] hub 9-0:1.0: USB hub found [ 2726.771299][ T6568] hub 9-0:1.0: 1 port detected [ 2726.999169][T10400] usb 5-1: USB disconnect, device number 26 [ 2727.240619][ T6580] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9672'. [ 2727.655059][ T2123] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 2727.835044][ T2123] usb 6-1: Using ep0 maxpacket: 8 [ 2727.844111][ T2123] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 2727.852533][ T2123] usb 6-1: config 0 has no interface number 0 [ 2727.859817][ T2123] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2727.870891][ T2123] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2727.880165][ T2123] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2727.890322][ T2123] usb 6-1: config 0 descriptor?? [ 2727.901172][ T2123] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2728.225464][T23039] usb 6-1: USB disconnect, device number 34 [ 2728.975144][ T6600] netlink: 'syz.4.9680': attribute type 10 has an invalid length. [ 2729.960535][ T6610] netlink: 40 bytes leftover after parsing attributes in process `syz.5.9684'. [ 2730.774910][T23039] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 2730.988179][T23039] usb 5-1: Using ep0 maxpacket: 16 [ 2731.003265][T23039] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 2731.012462][T23039] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2731.022329][T23039] usb 5-1: Product: syz [ 2731.026971][T23039] usb 5-1: Manufacturer: syz [ 2731.031589][T23039] usb 5-1: SerialNumber: syz [ 2731.040849][T23039] usb 5-1: config 0 descriptor?? [ 2731.048391][T23039] visor 5-1:0.0: Sony Clie 3.5 converter detected [ 2731.771066][T23039] usb 5-1: clie_3_5_startup: get config number bad return length: 0 [ 2731.782808][T23039] visor 5-1:0.0: probe with driver visor failed with error -5 [ 2732.726251][ T6647] pim6reg1: entered promiscuous mode [ 2732.744838][ T6647] pim6reg1: entered allmulticast mode [ 2733.002091][ T2123] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 2733.175913][ T2123] usb 7-1: Using ep0 maxpacket: 8 [ 2733.191568][ T2123] usb 7-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 2733.204220][ T2123] usb 7-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 2733.219604][ T2123] usb 7-1: config 0 interface 0 has no altsetting 0 [ 2733.228761][ T2123] usb 7-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 2733.228817][ T6659] netlink: 40 bytes leftover after parsing attributes in process `syz.7.9697'. [ 2733.238433][ T2123] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2733.409864][ T2123] usb 7-1: config 0 descriptor?? [ 2733.801414][ T6668] netlink: 'syz.5.9701': attribute type 10 has an invalid length. [ 2734.061350][ T6670] CIFS mount error: No usable UNC path provided in device string! [ 2734.061350][ T6670] [ 2734.071445][ T6670] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 2734.167515][T22177] usb 5-1: USB disconnect, device number 27 [ 2734.232079][ T6673] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9702'. [ 2734.445032][ T6673] bridge_slave_1: left allmulticast mode [ 2734.450704][ T6673] bridge_slave_1: left promiscuous mode [ 2734.526756][ T6673] bridge0: port 2(bridge_slave_1) entered disabled state [ 2734.704332][ T6673] bridge_slave_0: left allmulticast mode [ 2734.738406][ T2123] usbhid 7-1:0.0: can't add hid device: -71 [ 2734.763382][ T6673] bridge_slave_0: left promiscuous mode [ 2734.802973][ T2123] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 2734.830730][ T6673] bridge0: port 1(bridge_slave_0) entered disabled state [ 2734.921485][ T2123] usb 7-1: USB disconnect, device number 34 [ 2736.424812][ T645] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 2737.255211][T23039] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 2737.365451][ T645] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2737.388840][ T645] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2737.398829][ T645] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2737.425816][ T645] usb 7-1: config 0 descriptor?? [ 2737.445943][ T645] pwc: Askey VC010 type 2 USB webcam detected. [ 2737.455062][T23039] usb 6-1: Using ep0 maxpacket: 16 [ 2737.471289][T23039] usb 6-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 2737.481133][T23039] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2737.493208][T23039] usb 6-1: Product: syz [ 2737.497386][T23039] usb 6-1: Manufacturer: syz [ 2737.504920][T23039] usb 6-1: SerialNumber: syz [ 2737.515647][T23039] usb 6-1: config 0 descriptor?? [ 2737.523076][T23039] visor 6-1:0.0: Sony Clie 3.5 converter detected [ 2737.727737][T23039] usb 6-1: clie_3_5_startup: get config number bad return length: 0 [ 2737.746661][T23039] visor 6-1:0.0: probe with driver visor failed with error -5 [ 2737.869957][ T645] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2737.880327][ T645] pwc: recv_control_msg error -32 req 02 val 2700 [ 2737.887610][ T645] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2737.896901][ T645] pwc: recv_control_msg error -32 req 04 val 1000 [ 2737.905599][ T645] pwc: recv_control_msg error -32 req 04 val 1300 [ 2737.914401][ T645] pwc: recv_control_msg error -32 req 04 val 1400 [ 2738.024809][T22177] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 2738.121989][ T645] pwc: recv_control_msg error -71 req 02 val 2100 [ 2738.131884][ T645] pwc: recv_control_msg error -71 req 04 val 1500 [ 2738.138621][ T645] pwc: recv_control_msg error -71 req 02 val 2500 [ 2738.145823][ T645] pwc: recv_control_msg error -71 req 02 val 2400 [ 2738.152478][ T645] pwc: recv_control_msg error -71 req 02 val 2600 [ 2738.159774][ T645] pwc: recv_control_msg error -71 req 02 val 2900 [ 2738.167455][ T645] pwc: recv_control_msg error -71 req 02 val 2800 [ 2738.174188][ T645] pwc: recv_control_msg error -71 req 04 val 1100 [ 2738.176288][T22177] usb 5-1: config 7 has an invalid interface number: 192 but max is 0 [ 2738.181335][ T645] pwc: recv_control_msg error -71 req 04 val 1200 [ 2738.189082][T22177] usb 5-1: config 7 has no interface number 0 [ 2738.198812][ T645] pwc: Registered as video103. [ 2738.201535][T22177] usb 5-1: config 7 interface 192 has no altsetting 0 [ 2738.214678][ T645] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input110 [ 2738.214979][T22177] usb 5-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 2738.224896][T22177] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2738.238202][ T645] usb 7-1: USB disconnect, device number 35 [ 2738.242133][T22177] usb 5-1: Product: syz [ 2738.251985][T22177] usb 5-1: Manufacturer: syz [ 2738.256605][T22177] usb 5-1: SerialNumber: syz [ 2738.292128][ T6708] pim6reg1: entered promiscuous mode [ 2738.298665][ T6708] pim6reg1: entered allmulticast mode [ 2738.486352][T22177] usb 5-1: USB disconnect, device number 28 [ 2739.566492][ T6719] netlink: 'syz.4.9718': attribute type 10 has an invalid length. [ 2740.055795][ T645] usb 6-1: USB disconnect, device number 35 [ 2742.404822][T22177] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 2742.925560][T22177] usb 6-1: Using ep0 maxpacket: 8 [ 2742.944240][T22177] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 2742.985735][T22177] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2742.993875][T22177] usb 6-1: Product: syz [ 2742.998258][T22177] usb 6-1: Manufacturer: syz [ 2743.008916][T22177] usb 6-1: SerialNumber: syz [ 2743.028568][T22177] usb 6-1: config 0 descriptor?? [ 2743.059678][T10400] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 2743.272766][T22177] usb 6-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 2743.594879][T10400] usb 7-1: Using ep0 maxpacket: 32 [ 2743.611044][T10400] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 2743.625502][T10400] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2743.636682][T10400] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2743.645375][T10400] usb 7-1: Product: syz [ 2743.649578][T10400] usb 7-1: Manufacturer: syz [ 2743.654215][T10400] usb 7-1: SerialNumber: syz [ 2743.661030][T10400] usb 7-1: config 0 descriptor?? [ 2743.666715][ T6744] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2743.807706][T22177] usb write operation failed. (-71) [ 2743.814123][T22177] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2743.825027][T22177] dvbdev: DVB: registering new adapter (Terratec H7) [ 2743.833467][T22177] usb 6-1: media controller created [ 2743.839207][T22177] usb read operation failed. (-71) [ 2743.844571][T22177] usb write operation failed. (-71) [ 2743.851077][T22177] dvb_usb_az6007 6-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 2743.862046][T22177] usb 6-1: USB disconnect, device number 36 [ 2743.880566][T10400] usb 7-1: USB disconnect, device number 36 [ 2745.344789][ T6789] netlink: 16 bytes leftover after parsing attributes in process `syz.7.9738'. [ 2745.804815][T32211] Bluetooth: hci2: command 0x0406 tx timeout [ 2746.029584][ T6804] netlink: 12 bytes leftover after parsing attributes in process `syz.5.9742'. [ 2746.042797][ T6804] netlink: 20 bytes leftover after parsing attributes in process `syz.5.9742'. [ 2747.369875][T10400] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 2748.431267][T10400] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 2748.440703][T10400] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 2748.449682][T10400] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2748.463198][T10400] usb 2-1: config 220 has no interface number 2 [ 2748.469645][T10400] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2748.484404][T10400] usb 2-1: config 220 interface 0 has no altsetting 0 [ 2748.492337][T10400] usb 2-1: config 220 interface 76 has no altsetting 0 [ 2748.520950][T10400] usb 2-1: config 220 interface 1 has no altsetting 0 [ 2748.532629][T10400] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2748.578038][T10400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2748.589038][T10400] usb 2-1: Product: syz [ 2748.593272][T10400] usb 2-1: Manufacturer: syz [ 2748.597965][T10400] usb 2-1: SerialNumber: syz [ 2748.754817][ T6444] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 2748.883543][T10400] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 2748.916153][ T6444] usb 6-1: Using ep0 maxpacket: 8 [ 2748.918303][T10400] usb 2-1: No valid video chain found. [ 2748.925123][ T6444] usb 6-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 2748.937608][T10400] usb 2-1: selecting invalid altsetting 0 [ 2748.952335][ T6444] usb 6-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 2748.962397][T10400] usb 2-1: selecting invalid altsetting 0 [ 2748.965868][ T6444] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2748.978240][ T6444] usb 6-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 2748.982807][T10400] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 2748.987412][ T6444] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2749.009203][ T6444] usb 6-1: config 0 descriptor?? [ 2749.029542][T10400] usb 2-1: USB disconnect, device number 5 [ 2749.217497][ T6838] hub 9-0:1.0: USB hub found [ 2749.218356][T22177] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 2749.231102][ T6838] hub 9-0:1.0: 1 port detected [ 2749.655110][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9755'. [ 2749.689536][T22177] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 2749.716790][T22177] usb 7-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 2749.725753][T22177] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2749.736959][T22177] usb 7-1: config 220 has no interface number 2 [ 2749.749086][T22177] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2749.764612][T22177] usb 7-1: config 220 interface 0 has no altsetting 0 [ 2749.780945][T22177] usb 7-1: config 220 interface 76 has no altsetting 0 [ 2749.789246][ T6844] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9756'. [ 2749.801585][ T6845] CIFS mount error: No usable UNC path provided in device string! [ 2749.801585][ T6845] [ 2749.812035][ T6845] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 2749.896998][T22177] usb 7-1: config 220 interface 1 has no altsetting 0 [ 2750.022685][T22177] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2750.073013][T22177] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2750.109002][T22177] usb 7-1: Product: syz [ 2750.113331][T22177] usb 7-1: Manufacturer: syz [ 2750.155557][T22177] usb 7-1: SerialNumber: syz [ 2750.420107][T22177] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 2750.825084][ T6444] usbhid 6-1:0.0: can't add hid device: -71 [ 2750.831184][T22177] usb 7-1: No valid video chain found. [ 2750.855012][ T6444] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2750.878903][T22177] usb 7-1: selecting invalid altsetting 0 [ 2750.891247][ T6444] usb 6-1: USB disconnect, device number 37 [ 2750.913744][T22177] usb 7-1: selecting invalid altsetting 0 [ 2750.920023][T22177] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 2751.009353][T22177] usb 7-1: USB disconnect, device number 37 [ 2751.916234][T22211] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 2752.086278][T22211] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 2752.096925][T22211] usb 7-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 2752.114667][T22211] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2752.140179][T22211] usb 7-1: config 220 has no interface number 2 [ 2752.160723][T22211] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2752.204305][T22211] usb 7-1: config 220 interface 0 has no altsetting 0 [ 2752.227272][T22211] usb 7-1: config 220 interface 76 has no altsetting 0 [ 2752.266667][T22211] usb 7-1: config 220 interface 1 has no altsetting 0 [ 2752.299750][T22211] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2752.309818][T22211] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2752.324170][T22211] usb 7-1: Product: syz [ 2752.341042][T22211] usb 7-1: Manufacturer: syz [ 2752.348851][T22211] usb 7-1: SerialNumber: syz [ 2752.360971][ T6881] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9768'. [ 2752.434767][T23040] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 2752.554873][T10400] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 2752.568732][T22211] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 2752.575497][T22211] usb 7-1: No valid video chain found. [ 2752.580983][T22211] usb 7-1: selecting invalid altsetting 0 [ 2752.591804][T22211] usb 7-1: selecting invalid altsetting 0 [ 2752.596173][T23040] usb 2-1: Using ep0 maxpacket: 8 [ 2752.597662][T22211] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 2752.606958][T23040] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 2752.613618][T22211] usb 7-1: USB disconnect, device number 38 [ 2752.625638][T23040] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2752.633800][T23040] usb 2-1: Product: syz [ 2752.640690][T23040] usb 2-1: Manufacturer: syz [ 2752.645322][T23040] usb 2-1: SerialNumber: syz [ 2752.650971][T23040] usb 2-1: config 0 descriptor?? [ 2752.704883][ T645] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 2752.724970][T10400] usb 6-1: Using ep0 maxpacket: 8 [ 2752.731784][T10400] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 2752.739871][T10400] usb 6-1: config 0 has no interface number 0 [ 2752.746116][T10400] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2752.757013][T10400] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2752.766154][T10400] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2752.776300][T10400] usb 6-1: config 0 descriptor?? [ 2752.785571][T10400] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2752.861618][T23040] usb read operation failed. (-71) [ 2752.867284][T23040] usb write operation failed. (-71) [ 2752.872862][T23040] usb write operation failed. (-71) [ 2752.878124][ T645] usb 5-1: Using ep0 maxpacket: 8 [ 2752.883689][T23040] usb write operation failed. (-71) [ 2752.889359][T23040] usb 2-1: dvb_usb_v2: found a 'Terratec H7' in cold state [ 2752.897420][ T645] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 2752.907409][T23040] usb 2-1: Direct firmware load for dvb-usb-terratec-h7-az6007.fw failed with error -2 [ 2752.917161][ T645] usb 5-1: config 179 has no interface number 0 [ 2752.923491][ T645] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 2752.934963][T23040] usb 2-1: Falling back to sysfs fallback for: dvb-usb-terratec-h7-az6007.fw [ 2752.947067][ T645] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 2752.961241][ T645] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 2752.972843][ T645] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 2752.984526][ T645] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2752.991252][T22211] usb 6-1: USB disconnect, device number 38 [ 2752.998085][ T645] usb 5-1: config 179 interface 65 has no altsetting 0 [ 2753.010996][ T645] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 2753.020038][ T645] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2753.032088][ T645] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input111 [ 2753.405092][ T645] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 2753.594873][ T645] usb 7-1: Using ep0 maxpacket: 8 [ 2753.601612][ T645] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 2753.609894][ T645] usb 7-1: config 0 has no interface number 0 [ 2753.617335][ T645] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2753.635516][ T645] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2753.672405][ T645] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2753.713522][ T645] usb 7-1: config 0 descriptor?? [ 2753.727432][ T645] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2753.943187][ T6902] netlink: 'syz.7.9773': attribute type 10 has an invalid length. [ 2754.533060][ T6908] hub 9-0:1.0: USB hub found [ 2754.541319][ T6908] hub 9-0:1.0: 1 port detected [ 2754.705333][ T645] usb 7-1: USB disconnect, device number 39 [ 2755.034899][ T6912] netlink: 'syz.7.9777': attribute type 10 has an invalid length. [ 2755.623560][T22211] usb 5-1: USB disconnect, device number 30 [ 2755.623691][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 2756.173416][ T6934] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2757.115011][T22211] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 2757.624807][T22211] usb 7-1: Using ep0 maxpacket: 8 [ 2757.631678][T22211] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 2757.770640][T22211] usb 7-1: config 0 has no interface number 0 [ 2757.777588][T22211] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2757.788575][T22211] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2757.803089][T22211] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2757.835186][T22211] usb 7-1: config 0 descriptor?? [ 2757.863874][T22211] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2758.058886][T22211] usb 7-1: USB disconnect, device number 40 [ 2760.814783][T22212] usb 7-1: new full-speed USB device number 41 using dummy_hcd [ 2760.986166][T22212] usb 7-1: config 7 has an invalid interface number: 192 but max is 0 [ 2760.994353][T22212] usb 7-1: config 7 has no interface number 0 [ 2761.080537][T22212] usb 7-1: config 7 interface 192 has no altsetting 0 [ 2761.090729][T22212] usb 7-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 2761.105013][T22212] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2761.585457][T22212] usb 7-1: Product: syz [ 2761.593803][T22212] usb 7-1: Manufacturer: syz [ 2761.602004][T22212] usb 7-1: SerialNumber: syz [ 2761.871651][T22212] usb 7-1: USB disconnect, device number 41 [ 2764.571580][ T7026] netlink: 'syz.6.9812': attribute type 10 has an invalid length. [ 2765.804009][ T689] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 2765.814932][ T645] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 2765.954925][ T689] usb 5-1: Using ep0 maxpacket: 8 [ 2765.961188][ T689] usb 5-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 2765.972280][ T689] usb 5-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 2765.985480][ T645] usb 7-1: Using ep0 maxpacket: 32 [ 2765.990625][ T689] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2765.997409][ T689] usb 5-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 2766.007041][ T689] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2766.017196][ T645] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2766.028328][ T689] usb 5-1: config 0 descriptor?? [ 2766.033342][ T645] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2766.043315][ T645] usb 7-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.00 [ 2766.054333][ T645] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2766.063564][ T645] usb 7-1: config 0 descriptor?? [ 2766.068568][T10400] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 2766.226644][T10400] usb 6-1: config 7 has an invalid interface number: 192 but max is 0 [ 2766.234932][T10400] usb 6-1: config 7 has no interface number 0 [ 2766.241009][T10400] usb 6-1: config 7 interface 192 has no altsetting 0 [ 2766.249515][T10400] usb 6-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 2766.259782][T10400] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2766.267862][T10400] usb 6-1: Product: syz [ 2766.272034][T10400] usb 6-1: Manufacturer: syz [ 2766.276704][T10400] usb 6-1: SerialNumber: syz [ 2766.495635][T10400] usb 6-1: USB disconnect, device number 39 [ 2766.521562][ T7044] CIFS mount error: No usable UNC path provided in device string! [ 2766.521562][ T7044] [ 2766.538597][ T7044] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 2766.901802][ T689] usbhid 5-1:0.0: can't add hid device: -71 [ 2766.909985][ T689] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2766.922265][ T689] usb 5-1: USB disconnect, device number 31 [ 2769.015508][ T645] usbhid 7-1:0.0: can't add hid device: -71 [ 2769.021515][ T645] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 2769.031395][ T645] usb 7-1: USB disconnect, device number 42 [ 2769.383492][ T7076] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9827'. [ 2769.520297][T22212] usb 6-1: new full-speed USB device number 40 using dummy_hcd [ 2770.470348][T22212] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 2770.480890][T22212] usb 6-1: config 0 has no interface number 0 [ 2770.491301][T22212] usb 6-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2770.544548][T22212] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 2770.557513][T22212] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 2770.640882][ T7094] binder_alloc: 7089: binder_alloc_buf, no vma [ 2770.649840][ T645] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 2770.981645][T22212] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 2770.993575][T22212] usb 6-1: Product: syz [ 2770.999703][T22212] usb 6-1: SerialNumber: syz [ 2771.007148][T22212] usb 6-1: config 0 descriptor?? [ 2771.012828][ T7061] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 2771.127010][T22212] cm109 6-1:0.8: invalid payload size 64, expected 4 [ 2771.142094][T22212] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input112 [ 2771.529613][ T645] usb 5-1: Using ep0 maxpacket: 32 [ 2771.590517][ T645] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 2771.602389][ T645] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2771.618952][ T645] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2771.636748][ T645] usb 5-1: Product: syz [ 2771.641773][ T645] usb 5-1: Manufacturer: syz [ 2771.646818][ T645] usb 5-1: SerialNumber: syz [ 2771.657869][ T645] usb 5-1: config 0 descriptor?? [ 2771.663563][ T7088] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2772.462625][ T7108] netlink: 'syz.6.9835': attribute type 10 has an invalid length. [ 2772.647418][ T645] usb 5-1: USB disconnect, device number 32 [ 2772.882291][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2772.889509][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2772.896765][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2772.901088][T10400] usb 6-1: USB disconnect, device number 40 [ 2772.903712][ C1] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 2772.932545][T10400] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 2773.264819][T10400] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 2773.424856][T10400] usb 6-1: Using ep0 maxpacket: 8 [ 2773.439783][T10400] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 2773.455332][T10400] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2773.473541][T10400] usb 6-1: Product: syz [ 2773.483263][T10400] usb 6-1: Manufacturer: syz [ 2773.562280][T10400] usb 6-1: SerialNumber: syz [ 2773.784090][ T7125] binder_alloc: 7120: binder_alloc_buf, no vma [ 2773.988830][T10400] usb 6-1: config 0 descriptor?? [ 2774.545041][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2774.551344][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2774.762856][ T7131] netlink: 'syz.4.9843': attribute type 10 has an invalid length. [ 2775.337548][T10400] usb 6-1: dvb_usb_v2: found a 'Terratec H7' in cold state [ 2775.577528][T22212] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 2775.736065][T22212] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2775.746318][T22212] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2775.755395][T22212] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2775.764582][T22212] usb 7-1: config 0 descriptor?? [ 2775.771270][T22212] pwc: Askey VC010 type 2 USB webcam detected. [ 2776.174579][T22212] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2776.181627][T22212] pwc: recv_control_msg error -32 req 02 val 2700 [ 2776.188699][T22212] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2776.195695][T22212] pwc: recv_control_msg error -32 req 04 val 1000 [ 2776.202595][T22212] pwc: recv_control_msg error -32 req 04 val 1300 [ 2776.209583][T22212] pwc: recv_control_msg error -32 req 04 val 1400 [ 2776.216726][T22212] pwc: recv_control_msg error -32 req 02 val 2000 [ 2776.438265][T22212] pwc: recv_control_msg error -71 req 04 val 1500 [ 2776.478685][T22212] pwc: recv_control_msg error -71 req 02 val 2500 [ 2776.485580][T22212] pwc: recv_control_msg error -71 req 02 val 2400 [ 2776.492395][T22212] pwc: recv_control_msg error -71 req 02 val 2600 [ 2776.502499][T22212] pwc: recv_control_msg error -71 req 02 val 2900 [ 2776.510473][T22212] pwc: recv_control_msg error -71 req 02 val 2800 [ 2776.517610][T22212] pwc: recv_control_msg error -71 req 04 val 1100 [ 2776.524360][T22212] pwc: recv_control_msg error -71 req 04 val 1200 [ 2776.541171][T22212] pwc: Registered as video103. [ 2776.547908][T22212] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input113 [ 2776.587392][T22212] usb 7-1: USB disconnect, device number 43 [ 2778.484757][ T7043] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 2778.655895][ T7178] netlink: 'syz.1.9858': attribute type 10 has an invalid length. [ 2778.690447][ T7178] team0: Port device dummy0 added [ 2778.837754][ T7043] usb 7-1: Using ep0 maxpacket: 16 [ 2778.856241][ T7043] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 2778.874968][ T7043] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2778.940470][ T7181] netlink: 48 bytes leftover after parsing attributes in process `syz.1.9859'. [ 2778.967794][ T7181] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9859'. [ 2778.981383][ T7043] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2779.001110][ T7043] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2779.038626][ T7043] usb 7-1: Product: syz [ 2779.059360][ T7043] usb 7-1: Manufacturer: syz [ 2779.071366][ T7043] usb 7-1: SerialNumber: syz [ 2779.154972][ T7043] usb 7-1: config 0 descriptor?? [ 2779.162400][ T7043] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2779.171706][ T7043] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 2779.785513][ T7043] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 2779.792338][ T7043] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 2780.460293][ T7043] em28xx 7-1:0.0: Unknown AC97 audio processor detected! [ 2781.094774][ T7043] em28xx 7-1:0.0: couldn't setup AC97 register 2 [ 2781.112188][ T7043] em28xx 7-1:0.0: couldn't setup AC97 register 4 [ 2782.011816][ T7210] netlink: 32 bytes leftover after parsing attributes in process `syz.7.9868'. [ 2782.021541][ T7043] em28xx 7-1:0.0: couldn't setup AC97 register 54 [ 2782.028422][ T7043] em28xx 7-1:0.0: couldn't setup AC97 register 56 [ 2782.041023][ T7043] usb 7-1: USB disconnect, device number 44 [ 2782.060771][ T7213] netlink: 48 bytes leftover after parsing attributes in process `syz.1.9870'. [ 2782.070609][ T7213] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9870'. [ 2784.231543][ T7230] netlink: 'syz.7.9876': attribute type 10 has an invalid length. [ 2784.267275][ T7230] team0: Port device dummy0 added [ 2785.614343][ T7246] netlink: 'syz.4.9881': attribute type 10 has an invalid length. [ 2786.066025][ T7253] hub 9-0:1.0: USB hub found [ 2786.087509][ T7253] hub 9-0:1.0: 1 port detected [ 2789.256281][ T7286] binder: BINDER_SET_CONTEXT_MGR already set [ 2789.262988][ T7286] binder: 7281:7286 ioctl 4018620d 200000000040 returned -16 [ 2792.656222][ T7320] netlink: 'syz.6.9909': attribute type 10 has an invalid length. [ 2793.175340][T22177] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 2793.336195][T22177] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 2793.345038][T22177] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2793.355331][T22177] usb 7-1: config 220 has no interface number 2 [ 2793.361587][T22177] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2793.374698][T22177] usb 7-1: config 220 interface 0 has no altsetting 0 [ 2793.381453][T22177] usb 7-1: config 220 interface 76 has no altsetting 0 [ 2793.388323][T22177] usb 7-1: config 220 interface 1 has no altsetting 0 [ 2793.396950][T22177] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2793.406081][T22177] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2793.414032][T22177] usb 7-1: Product: syz [ 2793.418193][T22177] usb 7-1: Manufacturer: syz [ 2793.422765][T22177] usb 7-1: SerialNumber: syz [ 2793.633599][T22177] usb 7-1: selecting invalid altsetting 0 [ 2793.639808][T22177] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 2793.646651][T22177] usb 7-1: No valid video chain found. [ 2793.657909][T22177] usb 7-1: selecting invalid altsetting 0 [ 2793.663636][T22177] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 2793.675428][T22177] usb 7-1: USB disconnect, device number 45 [ 2796.036693][ T7334] netlink: 'syz.5.9914': attribute type 10 has an invalid length. [ 2797.184840][T22177] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 2798.073805][T22177] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 2798.265990][T22177] usb 7-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 2798.275393][T22177] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2798.289818][T22177] usb 7-1: config 220 has no interface number 2 [ 2798.296153][T22177] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2798.309303][T22177] usb 7-1: config 220 interface 0 has no altsetting 0 [ 2798.320188][T22177] usb 7-1: config 220 interface 76 has no altsetting 0 [ 2798.327250][T22177] usb 7-1: config 220 interface 1 has no altsetting 0 [ 2798.336032][T22177] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2798.345614][T22177] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2798.353603][T22177] usb 7-1: Product: syz [ 2798.359673][T22177] usb 7-1: Manufacturer: syz [ 2798.364302][T22177] usb 7-1: SerialNumber: syz [ 2798.688237][T22177] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 2798.694734][T22177] usb 7-1: No valid video chain found. [ 2798.700842][T22177] usb 7-1: selecting invalid altsetting 0 [ 2798.756347][T22177] usb 7-1: selecting invalid altsetting 0 [ 2798.762238][T22177] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 2798.775144][T22177] usb 7-1: USB disconnect, device number 46 [ 2799.136432][ T7361] netlink: 20 bytes leftover after parsing attributes in process `syz.7.9924'. [ 2799.145808][ T7361] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9924'. [ 2799.494734][ T645] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 2799.644778][ T645] usb 7-1: Using ep0 maxpacket: 16 [ 2799.652954][ T645] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 2799.664758][ T645] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2799.713845][ T645] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2799.722996][ T645] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2799.731198][ T645] usb 7-1: Product: syz [ 2799.735437][ T645] usb 7-1: Manufacturer: syz [ 2799.740031][ T645] usb 7-1: SerialNumber: syz [ 2799.754646][ T645] usb 7-1: config 0 descriptor?? [ 2799.762551][ T645] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2799.771885][ T645] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 2800.372023][ T645] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 2800.379297][ T645] em28xx 7-1:0.0: Config register raw data: 0x56 [ 2800.579815][ T645] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 2800.587014][ T645] em28xx 7-1:0.0: No AC97 audio processor [ 2801.657817][T32211] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2801.667170][T32211] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2801.678552][T32211] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2801.691354][T32211] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2801.699645][T32211] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2801.751410][ T7376] lo speed is unknown, defaulting to 1000 [ 2801.846083][ T3097] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2801.984311][ T3097] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2802.078940][ T3097] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2802.103402][ T7376] chnl_net:caif_netlink_parms(): no params data found [ 2802.133555][ T3097] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2802.210354][ T7376] bridge0: port 1(bridge_slave_0) entered blocking state [ 2802.218437][ T7376] bridge0: port 1(bridge_slave_0) entered disabled state [ 2802.225726][ T7376] bridge_slave_0: entered allmulticast mode [ 2802.232400][ T7376] bridge_slave_0: entered promiscuous mode [ 2802.239991][ T7376] bridge0: port 2(bridge_slave_1) entered blocking state [ 2802.247274][ T7376] bridge0: port 2(bridge_slave_1) entered disabled state [ 2802.254415][ T7376] bridge_slave_1: entered allmulticast mode [ 2802.261657][ T7376] bridge_slave_1: entered promiscuous mode [ 2802.278073][T22177] usb 7-1: USB disconnect, device number 47 [ 2802.296312][T22177] em28xx 7-1:0.0: Disconnecting em28xx [ 2802.308083][T22177] em28xx 7-1:0.0: Freeing device [ 2802.374829][ T7376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2802.410200][ T7376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2802.725031][T22177] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 2802.898244][T22177] usb 7-1: Using ep0 maxpacket: 8 [ 2802.907179][T22177] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 2802.924754][T22177] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2802.932889][T22177] usb 7-1: Product: syz [ 2802.940533][T22177] usb 7-1: Manufacturer: syz [ 2802.953983][T22177] usb 7-1: SerialNumber: syz [ 2802.965668][T22177] usb 7-1: config 0 descriptor?? [ 2803.176063][T22177] usb read operation failed. (-32) [ 2803.189829][T22177] usb write operation failed. (-71) [ 2803.204924][T22177] usb write operation failed. (-71) [ 2803.221861][T22177] usb write operation failed. (-71) [ 2803.239337][T22177] usb 7-1: dvb_usb_v2: found a 'Terratec H7' in cold state [ 2803.251614][ T3097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2803.265319][ T3097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2803.282192][ T3097] bond0 (unregistering): Released all slaves [ 2803.370485][ T7376] team0: Port device team_slave_0 added [ 2803.400520][ T7376] team0: Port device team_slave_1 added [ 2803.497640][ T7376] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2803.504644][ T7376] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2803.533612][ T7376] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2803.720217][ T7376] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2803.747791][T12892] Bluetooth: hci1: command tx timeout [ 2803.783194][ T7376] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2803.858681][ T7376] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2803.929955][ T7376] hsr_slave_0: entered promiscuous mode [ 2803.936347][ T7376] hsr_slave_1: entered promiscuous mode [ 2803.944500][ T7376] debugfs: 'hsr0' already exists in 'hsr' [ 2803.950559][ T7376] Cannot create hsr debugfs directory [ 2804.051983][ T3097] hsr_slave_0: left promiscuous mode [ 2804.063994][ T3097] hsr_slave_1: left promiscuous mode [ 2804.172358][ T3097] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2804.190312][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2804.238261][ T3097] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2804.262403][ T7405] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 2804.422203][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2804.488813][ T3097] veth1_macvtap: left promiscuous mode [ 2804.494419][ T3097] veth0_macvtap: left promiscuous mode [ 2804.504606][ T3097] veth1_vlan: left promiscuous mode [ 2804.514580][ T7405] File: /dev/nullb0 PID: 7405 Comm: syz.6.9936 [ 2804.524825][ T3097] veth0_vlan: left promiscuous mode [ 2805.036615][T32211] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2805.120091][T32211] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2805.133196][T32211] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2805.141076][T32211] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2805.149071][T32211] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2805.814325][T12892] Bluetooth: hci1: command tx timeout [ 2805.992621][ T3097] team0 (unregistering): Port device team_slave_1 removed [ 2806.308850][ T3097] team0 (unregistering): Port device team_slave_0 removed [ 2806.535728][ T7431] netlink: 'syz.6.9943': attribute type 10 has an invalid length. [ 2807.134267][ T3097] team0 (unregistering): Port device dummy0 removed [ 2807.260994][T12892] Bluetooth: hci2: command tx timeout [ 2807.798014][ T7414] lo speed is unknown, defaulting to 1000 [ 2807.885362][T12892] Bluetooth: hci1: command tx timeout [ 2807.943247][ T7376] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 2807.954246][ T7376] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 2807.977858][ T7376] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 2808.079978][ T7376] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 2808.109754][ T7414] chnl_net:caif_netlink_parms(): no params data found [ 2808.151805][ T7448] netlink: 32 bytes leftover after parsing attributes in process `syz.7.9948'. [ 2808.378762][ T7458] netlink: 'syz.7.9949': attribute type 10 has an invalid length. [ 2808.630788][ T7414] bridge0: port 1(bridge_slave_0) entered blocking state [ 2808.639318][ T7414] bridge0: port 1(bridge_slave_0) entered disabled state [ 2808.646857][ T7414] bridge_slave_0: entered allmulticast mode [ 2808.654477][ T7414] bridge_slave_0: entered promiscuous mode [ 2808.663794][ T7414] bridge0: port 2(bridge_slave_1) entered blocking state [ 2808.671451][ T7414] bridge0: port 2(bridge_slave_1) entered disabled state [ 2808.680073][ T7414] bridge_slave_1: entered allmulticast mode [ 2808.687743][ T7414] bridge_slave_1: entered promiscuous mode [ 2808.712897][ T7414] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2808.724574][ T7414] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2808.758110][ T7414] team0: Port device team_slave_0 added [ 2808.797022][ T3097] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2808.816611][ T7414] team0: Port device team_slave_1 added [ 2808.839442][ T7414] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2808.850202][ T7414] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2808.876284][ T7414] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2808.889589][ T7414] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2808.896616][ T7414] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2808.923655][ T7414] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2808.965790][ T3097] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2808.991790][ T7414] hsr_slave_0: entered promiscuous mode [ 2808.998973][ T7414] hsr_slave_1: entered promiscuous mode [ 2809.042993][ T3097] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2809.111937][ T3097] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2809.149386][ T7376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2809.172143][ T7376] 8021q: adding VLAN 0 to HW filter on device team0 [ 2809.185147][ T3094] bridge0: port 1(bridge_slave_0) entered blocking state [ 2809.192250][ T3094] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2809.237785][ T3094] bridge0: port 2(bridge_slave_1) entered blocking state [ 2809.244905][ T3094] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2809.279266][ T7414] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 2809.297286][ T7414] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 2809.313164][ T7414] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 2809.326574][T12892] Bluetooth: hci2: command tx timeout [ 2809.340489][ T7414] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 2809.582034][ T3097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2809.592128][ T3097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2809.601937][ T3097] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 2809.610768][ T3097] bond0 (unregistering): Released all slaves [ 2809.771672][ T7414] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2809.838419][ T7414] 8021q: adding VLAN 0 to HW filter on device team0 [ 2809.854060][T14935] bridge0: port 1(bridge_slave_0) entered blocking state [ 2809.861234][T14935] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2809.901301][ T3097] hsr_slave_0: left promiscuous mode [ 2809.907991][ T3097] hsr_slave_1: left promiscuous mode [ 2809.913614][ T3097] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2809.921033][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2809.929110][ T3097] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2809.936724][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2809.952843][ T3097] veth1_macvtap: left promiscuous mode [ 2809.958852][ T3097] veth0_macvtap: left promiscuous mode [ 2809.964361][ T3097] veth1_vlan: left promiscuous mode [ 2809.969707][ T3097] veth0_vlan: left promiscuous mode [ 2809.976047][T12892] Bluetooth: hci1: command tx timeout [ 2810.321023][ T3097] team0 (unregistering): Port device team_slave_1 removed [ 2810.357385][ T3097] team0 (unregistering): Port device team_slave_0 removed [ 2810.586472][ T3097] team0 (unregistering): Port device dummy0 removed [ 2810.711289][T14935] bridge0: port 2(bridge_slave_1) entered blocking state [ 2810.718429][T14935] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2810.729952][ T7376] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2811.248178][ T7414] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2811.340283][ T7376] veth0_vlan: entered promiscuous mode [ 2811.376519][ T7376] veth1_vlan: entered promiscuous mode [ 2811.406202][T12892] Bluetooth: hci2: command tx timeout [ 2811.614040][ T7376] veth0_macvtap: entered promiscuous mode [ 2811.635991][ T7376] veth1_macvtap: entered promiscuous mode [ 2811.743459][ T7376] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2812.378112][ T7376] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2812.472087][ T3094] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2812.513630][ T3094] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2812.608335][ T3094] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2812.624629][ T3094] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2812.773130][ T7414] veth0_vlan: entered promiscuous mode [ 2813.041867][ T7414] veth1_vlan: entered promiscuous mode [ 2813.276616][ T3097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2813.302922][ T7414] veth0_macvtap: entered promiscuous mode [ 2813.309936][ T3097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2813.368791][ T7414] veth1_macvtap: entered promiscuous mode [ 2813.456606][ T3094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2813.485798][T12892] Bluetooth: hci2: command tx timeout [ 2813.500587][ T3094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2813.512009][ T7414] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2813.542775][ T7414] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2813.569592][ T3097] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2813.592884][ T3097] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2813.663260][ T3097] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2813.690114][ T3097] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2814.005621][ T3097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2814.100704][ T3097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2814.179968][ T3097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2814.191805][ T3097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2814.825875][ T2123] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 2815.583528][T23040] usb 2-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 2815.694716][T10400] usb 6-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 2815.760988][T10400] dvb_usb_az6007 6-1:0.0: probe with driver dvb_usb_az6007 failed with error -2 [ 2815.781018][T23040] dvb_usb_az6007 2-1:0.0: probe with driver dvb_usb_az6007 failed with error -110 [ 2815.977027][T10400] usb 6-1: USB disconnect, device number 41 [ 2816.211849][ T2123] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2816.225534][T22177] usb 7-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 2816.255643][ T2123] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2816.288857][T23040] usb 2-1: USB disconnect, device number 6 [ 2817.215393][ T2123] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2817.229712][T22177] dvb_usb_az6007 7-1:0.0: probe with driver dvb_usb_az6007 failed with error -2 [ 2817.242404][ T2123] usb 9-1: config 0 descriptor?? [ 2817.248020][T22177] usb 7-1: USB disconnect, device number 48 [ 2817.527914][ T2123] usb 9-1: can't set config #0, error -71 [ 2817.576414][ T2123] usb 9-1: USB disconnect, device number 2 [ 2819.706591][ T2123] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 2819.877935][ T2123] usb 9-1: device descriptor read/64, error -71 [ 2820.155227][ T2123] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 2820.354780][ T2123] usb 9-1: device descriptor read/64, error -71 [ 2820.474430][ T2123] usb usb9-port1: attempt power cycle [ 2820.915303][ T2123] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 2820.949637][ T2123] usb 9-1: device descriptor read/8, error -71 [ 2820.957881][ T7578] binder: BINDER_SET_CONTEXT_MGR already set [ 2820.963906][ T7578] binder: 7571:7578 ioctl 4018620d 200000000040 returned -16 [ 2821.675882][ T2123] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 2821.710279][ T2123] usb 9-1: device descriptor read/8, error -71 [ 2822.302630][ T2123] usb usb9-port1: unable to enumerate USB device [ 2823.069535][ T7602] netlink: 'syz.5.9985': attribute type 10 has an invalid length. [ 2823.624783][ T2123] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 2823.774771][T10400] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 2823.784721][ T2123] usb 7-1: Using ep0 maxpacket: 16 [ 2823.791393][ T2123] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 2823.791558][ T7611] No control pipe specified [ 2823.804295][ T2123] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2823.822721][ T2123] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2823.831996][ T2123] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2823.844227][ T2123] usb 7-1: Product: syz [ 2823.851385][ T2123] usb 7-1: Manufacturer: syz [ 2823.864716][ T2123] usb 7-1: SerialNumber: syz [ 2823.876612][ T2123] usb 7-1: config 0 descriptor?? [ 2823.887635][ T2123] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2823.897502][ T2123] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 2823.927860][T10400] usb 6-1: Using ep0 maxpacket: 32 [ 2823.941616][T10400] usb 6-1: config 0 has an invalid interface number: 146 but max is 0 [ 2823.952036][T10400] usb 6-1: config 0 has no interface number 0 [ 2823.960276][T10400] usb 6-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2823.973993][T10400] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 2823.989123][T10400] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 2824.000540][T10400] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 2824.013909][T10400] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 2824.029569][T10400] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2824.041975][T10400] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2824.055930][T10400] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 19968, setting to 1024 [ 2824.070675][T10400] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2824.082331][T10400] usb 6-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2824.100962][T10400] usb 6-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 2824.110223][T10400] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2824.121261][T10400] usb 6-1: Product: syz [ 2824.125543][T10400] usb 6-1: Manufacturer: syz [ 2824.130166][T10400] usb 6-1: SerialNumber: syz [ 2824.140732][T10400] usb 6-1: config 0 descriptor?? [ 2824.149193][ T7608] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 2824.156671][ T7608] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 2824.166713][T10400] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 2824.175550][T10400] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 2824.186535][T10400] scsi host1: microtekX6 [ 2824.491028][ T2123] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 2824.664319][ T2123] em28xx 7-1:0.0: Config register raw data: 0x56 [ 2824.878394][ T2123] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 2824.920225][ T2123] em28xx 7-1:0.0: No AC97 audio processor [ 2835.888817][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2835.895183][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2837.126918][T22212] usb 7-1: USB disconnect, device number 49 [ 2837.142618][T22212] em28xx 7-1:0.0: Disconnecting em28xx [ 2837.174603][T22212] em28xx 7-1:0.0: Freeing device [ 2838.365234][T10400] usb 6-1: USB disconnect, device number 42 [ 2838.474049][T13247] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2838.499336][T13247] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2838.600532][T13247] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2838.611581][T13247] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2838.619067][T13247] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2838.733132][ T7642] lo speed is unknown, defaulting to 1000 [ 2838.828293][T14935] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2840.189469][T14935] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2840.449667][ T7642] chnl_net:caif_netlink_parms(): no params data found [ 2840.613539][T14935] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2840.695696][T13247] Bluetooth: hci4: command tx timeout [ 2840.922655][T10400] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 2841.111047][T14935] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2841.313638][ T7679] hub 9-0:1.0: USB hub found [ 2841.319723][ T7679] hub 9-0:1.0: 1 port detected [ 2841.385956][T10400] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 2841.396008][T10400] usb 6-1: config 0 has no interface number 0 [ 2841.403321][T10400] usb 6-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2841.419515][T10400] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 2841.482173][T10400] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 2841.513778][T10400] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 2841.533150][ T7642] bridge0: port 1(bridge_slave_0) entered blocking state [ 2841.540554][ T7642] bridge0: port 1(bridge_slave_0) entered disabled state [ 2841.553652][T10400] usb 6-1: Product: syz [ 2841.570390][T10400] usb 6-1: SerialNumber: syz [ 2841.570532][ T7642] bridge_slave_0: entered allmulticast mode [ 2841.582099][T10400] usb 6-1: config 0 descriptor?? [ 2841.587588][ T7666] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 2841.601582][T10400] cm109 6-1:0.8: invalid payload size 64, expected 4 [ 2841.624257][ T7642] bridge_slave_0: entered promiscuous mode [ 2841.639648][T10400] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input114 [ 2841.724521][ T7642] bridge0: port 2(bridge_slave_1) entered blocking state [ 2841.768275][ T7642] bridge0: port 2(bridge_slave_1) entered disabled state [ 2841.770106][ T7684] hub 9-0:1.0: USB hub found [ 2841.783605][ T7684] hub 9-0:1.0: 1 port detected [ 2842.016575][ T7642] bridge_slave_1: entered allmulticast mode [ 2842.045823][ T7642] bridge_slave_1: entered promiscuous mode [ 2842.169611][ T7642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2842.187488][ T7642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2842.290559][ T7642] team0: Port device team_slave_0 added [ 2842.324876][ T7642] team0: Port device team_slave_1 added [ 2842.457978][ T7642] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2842.482540][ T7642] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2842.594009][ T7642] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2842.660242][ T7642] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2842.673971][ T7642] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2842.712658][ T7642] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2842.765138][T13247] Bluetooth: hci4: command tx timeout [ 2842.817702][ T7642] hsr_slave_0: entered promiscuous mode [ 2842.829049][ T7642] hsr_slave_1: entered promiscuous mode [ 2842.835635][ T7642] debugfs: 'hsr0' already exists in 'hsr' [ 2842.841544][ T7642] Cannot create hsr debugfs directory [ 2842.850755][T14935] bridge_slave_1: left allmulticast mode [ 2842.857434][T14935] bridge_slave_1: left promiscuous mode [ 2842.863566][T14935] bridge0: port 2(bridge_slave_1) entered disabled state [ 2842.877218][T14935] bridge_slave_0: left allmulticast mode [ 2842.882956][T14935] bridge_slave_0: left promiscuous mode [ 2842.891572][T14935] bridge0: port 1(bridge_slave_0) entered disabled state [ 2843.522703][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.529883][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.537044][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.544377][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.551517][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.559033][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.566699][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.573947][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.584344][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.591569][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2843.608305][T10400] usb 6-1: USB disconnect, device number 43 [ 2843.614228][ C0] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 2843.625635][T10400] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 2844.491655][T14935] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2844.558494][T14935] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2844.568275][T14935] bond0 (unregistering): Released all slaves [ 2844.854863][T13247] Bluetooth: hci4: command tx timeout [ 2845.575379][ T7700] netlink: 20 bytes leftover after parsing attributes in process `syz.6.10011'. [ 2845.591791][ T7700] netlink: 4 bytes leftover after parsing attributes in process `syz.6.10011'. [ 2845.682369][T14935] hsr_slave_0: left promiscuous mode [ 2845.689693][T14935] hsr_slave_1: left promiscuous mode [ 2845.698854][T14935] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2845.706998][T14935] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2845.721539][T14935] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2845.733975][T14935] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2845.813355][T14935] veth1_macvtap: left promiscuous mode [ 2845.824755][T14935] veth0_macvtap: left promiscuous mode [ 2845.836569][T14935] veth1_vlan: left promiscuous mode [ 2845.841951][T14935] veth0_vlan: left promiscuous mode [ 2845.918372][ T7718] autofs: Unknown parameter '0x0000000000000000' [ 2846.314887][ T2123] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 2846.322903][T22211] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 2846.339764][T10400] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 2846.390669][T14935] team0 (unregistering): Port device team_slave_1 removed [ 2846.428600][T14935] team0 (unregistering): Port device team_slave_0 removed [ 2846.484945][ T2123] usb 9-1: Using ep0 maxpacket: 8 [ 2846.490087][T22211] usb 6-1: Using ep0 maxpacket: 32 [ 2846.500122][ T2123] usb 9-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 2846.511454][ T2123] usb 9-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 2846.515193][T10400] usb 7-1: Using ep0 maxpacket: 32 [ 2846.529507][ T2123] usb 9-1: config 0 interface 0 has no altsetting 0 [ 2846.536454][T22211] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 2846.543602][T10400] usb 7-1: config 0 has an invalid interface number: 146 but max is 0 [ 2846.547041][ T2123] usb 9-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 2846.565296][ T2123] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2846.569433][T10400] usb 7-1: config 0 has no interface number 0 [ 2846.576095][T22211] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2846.583731][T10400] usb 7-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2846.589381][T22211] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2846.614183][ T2123] usb 9-1: config 0 descriptor?? [ 2846.617222][T10400] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 2846.619345][T22211] usb 6-1: Product: syz [ 2846.638320][T22211] usb 6-1: Manufacturer: syz [ 2846.642969][T22211] usb 6-1: SerialNumber: syz [ 2846.647841][T10400] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 2846.649717][T22211] usb 6-1: config 0 descriptor?? [ 2846.665079][ T7724] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 2846.672146][T10400] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 2846.692815][T10400] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 2846.704517][T10400] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2846.714448][T10400] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2846.724560][T10400] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 19968, setting to 1024 [ 2846.735842][T10400] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2846.746014][T10400] usb 7-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2846.761347][T10400] usb 7-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 2846.772500][T10400] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2846.780910][T10400] usb 7-1: Product: syz [ 2846.785101][T10400] usb 7-1: Manufacturer: syz [ 2846.790029][T10400] usb 7-1: SerialNumber: syz [ 2846.800356][T10400] usb 7-1: config 0 descriptor?? [ 2846.807206][ T7720] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2846.814510][ T7720] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2846.839030][T10400] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 2846.848097][T10400] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 2846.881139][T10400] scsi host1: microtekX6 [ 2846.924767][T13247] Bluetooth: hci4: command tx timeout [ 2847.028231][T10400] usb 6-1: USB disconnect, device number 44 [ 2847.666911][ T2123] usbhid 9-1:0.0: can't add hid device: -71 [ 2847.688219][ T2123] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 2847.710551][ T2123] usb 9-1: USB disconnect, device number 7 [ 2848.392097][ T7744] netlink: 'syz.7.10023': attribute type 10 has an invalid length. [ 2848.771409][ T7642] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2849.237570][ T7642] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2849.271157][ T7642] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2849.293511][ T7642] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2849.563471][ T7642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2849.713736][ T7642] 8021q: adding VLAN 0 to HW filter on device team0 [ 2849.748737][ T3098] bridge0: port 1(bridge_slave_0) entered blocking state [ 2849.755817][ T3098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2849.868400][ T7762] netlink: 20 bytes leftover after parsing attributes in process `syz.5.10024'. [ 2849.887172][ T3098] bridge0: port 2(bridge_slave_1) entered blocking state [ 2849.894293][ T3098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2849.923377][ T7762] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10024'. [ 2849.950368][T22177] usb 7-1: USB disconnect, device number 50 [ 2850.018445][ T7768] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10028'. [ 2850.059314][ T7768] netlink: 4 bytes leftover after parsing attributes in process `syz.6.10028'. [ 2850.155164][ T7750] netlink: 20 bytes leftover after parsing attributes in process `syz.8.10025'. [ 2850.164718][ T7750] netlink: 4 bytes leftover after parsing attributes in process `syz.8.10025'. [ 2851.026479][ T7642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2851.243495][ T7642] veth0_vlan: entered promiscuous mode [ 2851.347027][ T7642] veth1_vlan: entered promiscuous mode [ 2851.414521][ T7642] veth0_macvtap: entered promiscuous mode [ 2851.427898][ T7642] veth1_macvtap: entered promiscuous mode [ 2851.511354][ T7642] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2851.528037][ T7642] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2851.552419][T14935] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2851.564720][T14935] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2851.696228][T14935] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2851.810265][T14935] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2851.872014][T14935] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2851.891854][T14935] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2852.072764][ T3098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2852.087774][ T3098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2852.342859][ T7791] netlink: 32 bytes leftover after parsing attributes in process `syz.5.10033'. [ 2852.584869][T23039] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 2852.704862][T22177] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 2852.886430][T23039] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2852.897149][T23039] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2852.900180][T22177] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2852.906412][T23039] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2853.338268][T23039] usb 9-1: config 0 descriptor?? [ 2853.370725][T23039] pwc: Askey VC010 type 2 USB webcam detected. [ 2853.377764][T22177] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2853.390966][T22177] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2853.415845][T22177] usb 6-1: config 0 descriptor?? [ 2853.437345][T22177] pwc: Askey VC010 type 2 USB webcam detected. [ 2853.885868][T22177] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2853.896400][T22177] pwc: recv_control_msg error -32 req 02 val 2700 [ 2853.936164][T22177] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2853.947868][T23039] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2854.681864][T23039] pwc: recv_control_msg error -32 req 02 val 2700 [ 2854.704268][T23039] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2854.714180][T23039] pwc: recv_control_msg error -32 req 04 val 1000 [ 2854.743380][T22177] pwc: recv_control_msg error -32 req 04 val 1000 [ 2854.743453][T23039] pwc: recv_control_msg error -32 req 04 val 1300 [ 2854.792184][T23039] pwc: recv_control_msg error -32 req 04 val 1400 [ 2854.798427][T22177] pwc: recv_control_msg error -32 req 04 val 1300 [ 2855.011487][T22177] pwc: recv_control_msg error -32 req 04 val 1400 [ 2855.027526][T23039] pwc: recv_control_msg error -71 req 02 val 2100 [ 2855.084340][T23039] pwc: recv_control_msg error -71 req 04 val 1500 [ 2855.091930][T23039] pwc: recv_control_msg error -71 req 02 val 2500 [ 2855.097882][T22177] pwc: recv_control_msg error -32 req 02 val 2000 [ 2855.098711][T23039] pwc: recv_control_msg error -71 req 02 val 2400 [ 2855.111673][T23039] pwc: recv_control_msg error -71 req 02 val 2600 [ 2855.119572][T23039] pwc: recv_control_msg error -71 req 02 val 2900 [ 2855.136903][T23039] pwc: recv_control_msg error -71 req 02 val 2800 [ 2855.150436][T23039] pwc: recv_control_msg error -71 req 04 val 1100 [ 2855.150985][T22177] pwc: recv_control_msg error -32 req 02 val 2100 [ 2855.174215][T23039] pwc: recv_control_msg error -71 req 04 val 1200 [ 2855.183431][T22177] pwc: recv_control_msg error -32 req 04 val 1500 [ 2855.192877][T22177] pwc: recv_control_msg error -71 req 02 val 2500 [ 2855.492735][T23039] pwc: Registered as video103. [ 2855.503916][T23039] input: PWC snapshot button as /devices/platform/dummy_hcd.8/usb9/9-1/input/input115 [ 2855.506097][T22177] pwc: recv_control_msg error -71 req 02 val 2400 [ 2855.574872][T22177] pwc: recv_control_msg error -71 req 02 val 2600 [ 2855.595131][T22177] pwc: recv_control_msg error -71 req 02 val 2900 [ 2855.641570][T23039] usb 9-1: USB disconnect, device number 8 [ 2855.650604][T22177] pwc: recv_control_msg error -71 req 02 val 2800 [ 2855.670908][T22177] pwc: recv_control_msg error -71 req 04 val 1100 [ 2855.687467][T22177] pwc: recv_control_msg error -71 req 04 val 1200 [ 2855.727884][T22177] pwc: Registered as video103. [ 2855.753680][T22177] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input116 [ 2855.868665][T22177] usb 6-1: USB disconnect, device number 45 [ 2856.585879][T23039] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 2856.854744][T23039] usb 9-1: Using ep0 maxpacket: 16 [ 2856.866387][T23039] usb 9-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 2856.875919][T23039] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2856.890588][T23039] usb 9-1: Product: syz [ 2856.895209][T23039] usb 9-1: Manufacturer: syz [ 2856.983905][T23039] usb 9-1: SerialNumber: syz [ 2857.012358][ T2123] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 2857.029897][T23039] usb 9-1: config 0 descriptor?? [ 2857.046929][T23039] visor 9-1:0.0: Sony Clie 3.5 converter detected [ 2857.154915][ T2123] usb 7-1: device descriptor read/64, error -71 [ 2857.405126][T22212] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 2857.405203][ T2123] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 2857.452850][T23039] usb 9-1: clie_3_5_startup: get config number failed: -32 [ 2857.460230][T23039] visor 9-1:0.0: probe with driver visor failed with error -32 [ 2857.470004][T23039] usb 9-1: USB disconnect, device number 9 [ 2857.604743][ T2123] usb 7-1: device descriptor read/64, error -71 [ 2857.624697][T22212] usb 4-1: Using ep0 maxpacket: 8 [ 2857.631025][T22212] usb 4-1: config 162 has an invalid interface number: 166 but max is 0 [ 2857.639808][T22212] usb 4-1: config 162 has no interface number 0 [ 2857.646931][T22212] usb 4-1: config 162 interface 166 has no altsetting 0 [ 2857.655920][T22212] usb 4-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=d3.ea [ 2857.665315][T22212] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2857.674787][T22212] usb 4-1: Product: syz [ 2857.679003][T22212] usb 4-1: Manufacturer: syz [ 2857.690628][T22212] usb 4-1: SerialNumber: syz [ 2857.725655][ T2123] usb usb7-port1: attempt power cycle [ 2858.747322][T22212] appledisplay 4-1:162.166: Could not find int-in endpoint [ 2858.804840][ T2123] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 2858.823338][T22212] usbhid 4-1:162.166: couldn't find an input interrupt endpoint [ 2858.851544][T22212] usb 4-1: USB disconnect, device number 98 [ 2858.862379][ T2123] usb 7-1: device descriptor read/8, error -71 [ 2859.124793][ T2123] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 2859.145277][ T2123] usb 7-1: device descriptor read/8, error -71 [ 2859.256848][ T2123] usb usb7-port1: unable to enumerate USB device [ 2889.591227][T12892] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2889.624843][T12892] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2889.655076][T12892] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2889.679291][T12892] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2889.686781][T12892] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2889.950295][ T7879] lo speed is unknown, defaulting to 1000 [ 2890.132152][T12892] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2890.201950][ T7885] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2890.215804][T32211] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2890.225899][ T7886] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2890.226607][T32211] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2890.241606][T32211] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2890.248028][ T7886] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2890.249268][T32211] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2890.256115][ T7886] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2890.263187][T32211] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2890.352189][T13247] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 2890.365972][T13247] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 2890.372937][ T3288] ================================================================== [ 2890.380989][ T3288] BUG: KASAN: slab-use-after-free in __mutex_lock+0xe8a/0x1060 [ 2890.388539][ T3288] Read of size 8 at addr ffff88806c5280a0 by task khidpd_00070008/3288 [ 2890.396767][ T3288] [ 2890.399084][ T3288] CPU: 0 UID: 0 PID: 3288 Comm: khidpd_00070008 Not tainted syzkaller #0 PREEMPT(full) [ 2890.399105][ T3288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 2890.399114][ T3288] Call Trace: [ 2890.399120][ T3288] [ 2890.399126][ T3288] dump_stack_lvl+0x116/0x1f0 [ 2890.399151][ T3288] print_report+0xcd/0x630 [ 2890.399169][ T3288] ? __virt_addr_valid+0x81/0x610 [ 2890.399190][ T3288] ? __phys_addr+0xe8/0x180 [ 2890.399210][ T3288] ? __mutex_lock+0xe8a/0x1060 [ 2890.399229][ T3288] kasan_report+0xe0/0x110 [ 2890.399246][ T3288] ? __mutex_lock+0xe8a/0x1060 [ 2890.399266][ T3288] ? l2cap_unregister_user+0x71/0x240 [ 2890.399288][ T3288] __mutex_lock+0xe8a/0x1060 [ 2890.399306][ T3288] ? __lock_acquire+0xb97/0x1ce0 [ 2890.399329][ T3288] ? l2cap_unregister_user+0x71/0x240 [ 2890.399351][ T3288] ? __pfx___mutex_lock+0x10/0x10 [ 2890.399372][ T3288] ? find_held_lock+0x2b/0x80 [ 2890.399393][ T3288] ? l2cap_unregister_user+0x71/0x240 [ 2890.399415][ T3288] l2cap_unregister_user+0x71/0x240 [ 2890.399439][ T3288] hidp_session_thread+0x45e/0x660 [ 2890.399457][ T3288] ? __pfx_hidp_session_thread+0x10/0x10 [ 2890.399474][ T3288] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 2890.399510][ T3288] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 2890.399536][ T3288] ? lockdep_hardirqs_on+0x7c/0x110 [ 2890.399558][ T3288] ? __kthread_parkme+0x19e/0x250 [ 2890.399582][ T3288] ? __pfx_hidp_session_thread+0x10/0x10 [ 2890.399600][ T3288] kthread+0x3c2/0x780 [ 2890.399617][ T3288] ? __pfx_kthread+0x10/0x10 [ 2890.399636][ T3288] ? rcu_is_watching+0x12/0xc0 [ 2890.399656][ T3288] ? __pfx_kthread+0x10/0x10 [ 2890.399673][ T3288] ret_from_fork+0x56a/0x730 [ 2890.399690][ T3288] ? __pfx_kthread+0x10/0x10 [ 2890.399707][ T3288] ret_from_fork_asm+0x1a/0x30 [ 2890.399733][ T3288] [ 2890.399740][ T3288] [ 2890.401918][T13247] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 2890.409432][ T3288] Allocated by task 2643: [ 2890.409444][ T3288] kasan_save_stack+0x33/0x60 [ 2890.409464][ T3288] kasan_save_track+0x14/0x30 [ 2890.409479][ T3288] __kasan_kmalloc+0xaa/0xb0 [ 2890.409498][ T3288] __kmalloc_noprof+0x223/0x510 [ 2890.409514][ T3288] hci_alloc_dev_priv+0x1d/0x28a0 [ 2890.409533][ T3288] __vhci_create_device+0xf0/0x880 [ 2890.409553][ T3288] vhci_write+0x2c0/0x480 [ 2890.409571][ T3288] vfs_write+0x7d3/0x11d0 [ 2890.409586][ T3288] ksys_write+0x12a/0x250 [ 2890.409602][ T3288] do_syscall_64+0xcd/0x4e0 [ 2890.409622][ T3288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2890.409639][ T3288] [ 2890.409644][ T3288] Freed by task 4014: [ 2890.409654][ T3288] kasan_save_stack+0x33/0x60 [ 2890.648391][ T3288] kasan_save_track+0x14/0x30 [ 2890.653051][ T3288] kasan_save_free_info+0x3b/0x60 [ 2890.658056][ T3288] __kasan_slab_free+0x60/0x70 [ 2890.662797][ T3288] kfree+0x2b4/0x4d0 [ 2890.666675][ T3288] hci_release_dev+0x4ef/0x610 [ 2890.671411][ T3288] bt_host_release+0x6a/0xb0 [ 2890.675979][ T3288] device_release+0xa1/0x240 [ 2890.680554][ T3288] kobject_put+0x1e7/0x5a0 [ 2890.684951][ T3288] put_device+0x1f/0x30 [ 2890.689082][ T3288] vhci_release+0x185/0x230 [ 2890.693563][ T3288] __fput+0x3ff/0xb70 [ 2890.697525][ T3288] task_work_run+0x150/0x240 [ 2890.702093][ T3288] do_exit+0x86f/0x2bf0 [ 2890.706231][ T3288] do_group_exit+0xd3/0x2a0 [ 2890.710716][ T3288] get_signal+0x2673/0x26d0 [ 2890.715197][ T3288] arch_do_signal_or_restart+0x8f/0x7d0 [ 2890.720725][ T3288] exit_to_user_mode_loop+0x84/0x110 [ 2890.725987][ T3288] do_syscall_64+0x41c/0x4e0 [ 2890.730560][ T3288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2890.736430][ T3288] [ 2890.738729][ T3288] Last potentially related work creation: [ 2890.744414][ T3288] kasan_save_stack+0x33/0x60 [ 2890.749068][ T3288] kasan_record_aux_stack+0xa7/0xc0 [ 2890.754246][ T3288] insert_work+0x36/0x230 [ 2890.758552][ T3288] __queue_work+0x97e/0x1160 [ 2890.763120][ T3288] queue_work_on+0x1a4/0x1f0 [ 2890.767687][ T3288] hci_recv_frame+0x503/0x880 [ 2890.772341][ T3288] vhci_write+0x399/0x480 [ 2890.776651][ T3288] vfs_write+0x7d3/0x11d0 [ 2890.780964][ T3288] ksys_write+0x12a/0x250 [ 2890.785267][ T3288] do_syscall_64+0xcd/0x4e0 [ 2890.789753][ T3288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2890.795620][ T3288] [ 2890.797921][ T3288] Second to last potentially related work creation: [ 2890.804477][ T3288] kasan_save_stack+0x33/0x60 [ 2890.809132][ T3288] kasan_record_aux_stack+0xa7/0xc0 [ 2890.814312][ T3288] insert_work+0x36/0x230 [ 2890.818617][ T3288] __queue_work+0x97e/0x1160 [ 2890.823189][ T3288] queue_work_on+0x1a4/0x1f0 [ 2890.827791][ T3288] hci_recv_frame+0x503/0x880 [ 2890.832455][ T3288] vhci_write+0x399/0x480 [ 2890.836771][ T3288] vfs_write+0x7d3/0x11d0 [ 2890.841081][ T3288] ksys_write+0x12a/0x250 [ 2890.845391][ T3288] do_syscall_64+0xcd/0x4e0 [ 2890.849882][ T3288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2890.855756][ T3288] [ 2890.858062][ T3288] The buggy address belongs to the object at ffff88806c528000 [ 2890.858062][ T3288] which belongs to the cache kmalloc-8k of size 8192 [ 2890.872094][ T3288] The buggy address is located 160 bytes inside of [ 2890.872094][ T3288] freed 8192-byte region [ffff88806c528000, ffff88806c52a000) [ 2890.885953][ T3288] [ 2890.888253][ T3288] The buggy address belongs to the physical page: [ 2890.894634][ T3288] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6c528 [ 2890.903369][ T3288] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2890.911838][ T3288] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 2890.919704][ T3288] page_type: f5(slab) [ 2890.923667][ T3288] raw: 00fff00000000040 ffff88801b842280 ffffea0001f76a00 0000000000000003 [ 2890.932234][ T3288] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 2890.940793][ T3288] head: 00fff00000000040 ffff88801b842280 ffffea0001f76a00 0000000000000003 [ 2890.949441][ T3288] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 2890.958088][ T3288] head: 00fff00000000003 ffffea0001b14a01 00000000ffffffff 00000000ffffffff [ 2890.966732][ T3288] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 2890.975374][ T3288] page dumped because: kasan: bad access detected [ 2890.981761][ T3288] page_owner tracks the page as allocated [ 2890.987447][ T3288] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1807, tgid 1798 (syz.0.8202), ts 2381121380735, free_ts 2301508902510 [ 2891.010349][ T3288] post_alloc_hook+0x1c0/0x230 [ 2891.015099][ T3288] get_page_from_freelist+0x132b/0x38e0 [ 2891.020621][ T3288] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 2891.026488][ T3288] alloc_pages_mpol+0x1fb/0x550 [ 2891.031323][ T3288] new_slab+0x247/0x330 [ 2891.035463][ T3288] ___slab_alloc+0xcf2/0x1750 [ 2891.040125][ T3288] __slab_alloc.constprop.0+0x56/0xb0 [ 2891.045480][ T3288] __kmalloc_noprof+0x2f2/0x510 [ 2891.050310][ T3288] io_vec_realloc+0x24/0xe0 [ 2891.054794][ T3288] io_prep_reg_iovec+0x75/0x240 [ 2891.059626][ T3288] io_sendmsg_setup+0x282/0x300 [ 2891.064454][ T3288] io_send_zc_prep+0x55d/0x9e0 [ 2891.069198][ T3288] io_submit_sqes+0x853/0x25c0 [ 2891.073938][ T3288] __do_sys_io_uring_enter+0xd6a/0x1630 [ 2891.079479][ T3288] do_syscall_64+0xcd/0x4e0 [ 2891.083973][ T3288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2891.089842][ T3288] page last free pid 19476 tgid 19476 stack trace: [ 2891.096315][ T3288] __free_pages_ok+0x720/0xfc0 [ 2891.101060][ T3288] batadv_hash_destroy+0x31/0x70 [ 2891.105974][ T3288] batadv_tt_free+0x303/0xad0 [ 2891.110630][ T3288] batadv_mesh_free+0xa1/0x170 [ 2891.115370][ T3288] batadv_meshif_free+0x15/0x20 [ 2891.120199][ T3288] netdev_run_todo+0x78f/0x1320 [ 2891.125029][ T3288] default_device_exit_batch+0x858/0xaf0 [ 2891.130645][ T3288] ops_undo_list+0x363/0xab0 [ 2891.135217][ T3288] cleanup_net+0x408/0x890 [ 2891.139615][ T3288] process_one_work+0x9cc/0x1b70 [ 2891.144530][ T3288] worker_thread+0x6c8/0xf10 [ 2891.149096][ T3288] kthread+0x3c2/0x780 [ 2891.153139][ T3288] ret_from_fork+0x56a/0x730 [ 2891.157706][ T3288] ret_from_fork_asm+0x1a/0x30 [ 2891.162448][ T3288] [ 2891.164750][ T3288] Memory state around the buggy address: [ 2891.170352][ T3288] ffff88806c527f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2891.178387][ T3288] ffff88806c528000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2891.186425][ T3288] >ffff88806c528080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2891.194458][ T3288] ^ [ 2891.199539][ T3288] ffff88806c528100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2891.207573][ T3288] ffff88806c528180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2891.215604][ T3288] ================================================================== [ 2891.224320][ T3288] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2891.231515][ T3288] CPU: 0 UID: 0 PID: 3288 Comm: khidpd_00070008 Not tainted syzkaller #0 PREEMPT(full) [ 2891.241220][ T3288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 2891.251263][ T3288] Call Trace: [ 2891.254522][ T3288] [ 2891.257431][ T3288] dump_stack_lvl+0x3d/0x1f0 [ 2891.262006][ T3288] vpanic+0x6e8/0x7a0 [ 2891.265976][ T3288] ? __pfx_vpanic+0x10/0x10 [ 2891.270466][ T3288] ? __pfx_vprintk_emit+0x10/0x10 [ 2891.275476][ T3288] ? __mutex_lock+0xe8a/0x1060 [ 2891.280225][ T3288] panic+0xca/0xd0 [ 2891.283923][ T3288] ? __pfx_panic+0x10/0x10 [ 2891.288344][ T3288] ? check_panic_on_warn+0x1f/0xb0 [ 2891.293432][ T3288] check_panic_on_warn+0xab/0xb0 [ 2891.298345][ T3288] end_report+0x107/0x170 [ 2891.302655][ T3288] kasan_report+0xee/0x110 [ 2891.307051][ T3288] ? __mutex_lock+0xe8a/0x1060 [ 2891.311797][ T3288] ? l2cap_unregister_user+0x71/0x240 [ 2891.317150][ T3288] __mutex_lock+0xe8a/0x1060 [ 2891.321723][ T3288] ? __lock_acquire+0xb97/0x1ce0 [ 2891.326649][ T3288] ? l2cap_unregister_user+0x71/0x240 [ 2891.332003][ T3288] ? __pfx___mutex_lock+0x10/0x10 [ 2891.337011][ T3288] ? find_held_lock+0x2b/0x80 [ 2891.341673][ T3288] ? l2cap_unregister_user+0x71/0x240 [ 2891.347027][ T3288] l2cap_unregister_user+0x71/0x240 [ 2891.352206][ T3288] hidp_session_thread+0x45e/0x660 [ 2891.357294][ T3288] ? __pfx_hidp_session_thread+0x10/0x10 [ 2891.362902][ T3288] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 2891.369127][ T3288] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 2891.375354][ T3288] ? lockdep_hardirqs_on+0x7c/0x110 [ 2891.380535][ T3288] ? __kthread_parkme+0x19e/0x250 [ 2891.385543][ T3288] ? __pfx_hidp_session_thread+0x10/0x10 [ 2891.391153][ T3288] kthread+0x3c2/0x780 [ 2891.395200][ T3288] ? __pfx_kthread+0x10/0x10 [ 2891.399766][ T3288] ? rcu_is_watching+0x12/0xc0 [ 2891.404525][ T3288] ? __pfx_kthread+0x10/0x10 [ 2891.409091][ T3288] ret_from_fork+0x56a/0x730 [ 2891.413660][ T3288] ? __pfx_kthread+0x10/0x10 [ 2891.418226][ T3288] ret_from_fork_asm+0x1a/0x30 [ 2891.422976][ T3288] [ 2891.426158][ T3288] Kernel Offset: disabled [ 2891.430453][ T3288] Rebooting in 86400 seconds..