last executing test programs: 19.572059357s ago: executing program 0 (id=3001): socket(0x2, 0x1, 0x0) socket$pptp(0x18, 0x1, 0x2) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0xfffffff8, "07bbfeb30c52d28881875bac175ccb0d6c446593aa7eaba9a256d98e03ab46af"}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_register$IORING_REGISTER_IOWQ_AFF(0xffffffffffffffff, 0x25, &(0x7f0000000080)="01", 0x1) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x8) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) getitimer(0x0, 0x0) fcntl$setlease(r4, 0x400, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000002a80)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f00000014c0)="cd5927a8b2a00ee8cc111509a5dcf0343c2c5b667c514bb3055b96ebda11b4c8308aef587ef82686dc7f027c402a00582f1b338d80160b21beef66b139a7061ff65ea9c6ed4de3c272fcce0b257c322f54ca3808e8b8bb318d29a96c5035fd713f02f959dc5e55bd518d2ce967008eb6db0a89b4129c5b692bff14aeaa783a3cb22eb1004d87c97e8c8c587adeff394c43b74f5ba5ce66df35b3f4e7d9d7cbc36a20ec75e5dc96701ef447ee3160e70ad13117e96c171be8f0ba442afef0d073a33d7eb218dbb9c065f38a22096306c1e1c7a8268d7373f2f6ca476174e543a37052c6e08007c7afd75fabaf66450709ff061959d02d4f6e0c120fdfaad713688d9af3e70e752f3698b8cd0d75efd5eb50f5c4ef48aa62b641104abb1ce0e8ebcea9485d77bb9b523a47f1de80c1456f62e1387435d3f41d2d6c9e04c1f51401aa6b5204972b93c5783233a1002a1c0d9680c43f078cb2fac20df2296408b52ac0338cee4c92445b44b8d802184f15b34dcd5be61c6f55f73559", 0x17a}], 0x1}}], 0x1, 0x42054) sendto$inet(r1, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 17.338596846s ago: executing program 0 (id=3006): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi4\x00', 0x200, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000040)={0xc000003, 0x0, 0x0, 0x1, 0x20000001}) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x40000000008, 0x2, 0x3}, 0x0) r4 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsetxattr(r2, &(0x7f0000000340)=@known='user.syz\x00', &(0x7f0000000280)='+.%+\x00', 0x5, 0x2) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000180)=0x6f) r6 = dup2(r5, r5) prlimit64(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r6, &(0x7f0000002780)={0x2020}, 0x2020) 15.878143167s ago: executing program 4 (id=3011): socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$media(0x0, 0x10, 0x101000) syz_open_dev$media(0x0, 0x0, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) mremap(&(0x7f0000933000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000803000/0x3000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) timerfd_create(0x0, 0x0) syz_ublk_add_dev(r0, r1, r2, r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000200)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000002b00)={0x2, 0x0, 0x0, &(0x7f00000029c0)=""/162, &(0x7f0000002a80)=""/104, 0xf000}) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) syz_emit_vhci(&(0x7f0000002dc0)=ANY=[@ANYBLOB="02c900160012000500170c0e00", @ANYBLOB="52de5f2bc674d5936a77790b0f13c8e7fcb889197cb5aa12f82ea738903c37fd3e74cec79d5b905b2f5df4bda4c12f52e57b8912e17d5eaba21f985363cfaba97bbae6fa828bf34a625d4ba09e9b4bff6b8ed558d34942f619a5fd9c7568c8b0443f55cdd73e7a1cebbe672d07598f3f94186c3c3f4d8035f6d5bb865fbbcd014d4a498e02333e44c19e8305cef4c80ad9d72b65214e3ef8a3654eb36f876df375b858d57aecb73178"], 0x3c) 14.986665217s ago: executing program 2 (id=3014): write$binfmt_aout(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[], 0xc8) 13.153971486s ago: executing program 2 (id=3015): socket$netlink(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x88, 0x2c, 0xf3f, 0x70bd2b, 0x25dfdbbd, {0x0, 0x0, 0x0, r3, {0xffe0, 0xc}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_EMATCHES={0x54, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x48, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x44, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x6}, {{0x1, 0x0, 0x1}, {0x0, 0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x7fff, 0x7, 0x7}, {{0x2, 0x1}, {0x4, 0x1}}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0xffff, 0x3, 0xb}, {0x6, 0x2, 0x7, 0x5}}}]}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20041090}, 0x4880) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000b80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@ipv6_newnexthop={0x28, 0x68, 0x1, 0x70bd28, 0xfc00, {0x2, 0x0, 0x3}, [@NHA_ID={0x8, 0x6, 0x1}, @NHA_OIF={0x8, 0x5, r6}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004011}, 0x40000) syz_fuse_handle_req(r4, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200", 0x2000, &(0x7f00000041c0)={&(0x7f0000000480)={0x50, 0x0, 0x0, {0x7, 0x29, 0x80000001, 0x5230860e, 0xfffd, 0xc, 0x1, 0x4056, 0x0, 0x0, 0x10}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) readlink(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000880)=""/164, 0xa4) socket(0x10, 0x803, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_buf(r7, 0x6, 0x1f, 0x0, &(0x7f0000000000)) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000200)=0x11) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="6c0000001e0000012bbd7000ffdbdf2507000000", @ANYRES32, @ANYBLOB="800002000202000008002300018a000008002300030000000a0002000000000000001f002200098f7620e0f46b8fd63a2cc9b1000000000000000000000000001e7ea5f857e65c220000a296cf6c54939df3c58c64980875c3d440e7b8d0b9b78886f6eb79ddc370798a18de9858ac8bc90312f500"/126], 0x6c}}, 0x8000) 10.291965578s ago: executing program 4 (id=3018): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, 0x0, 0x8000) 10.238765679s ago: executing program 2 (id=3019): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi4\x00', 0x200, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000040)={0xc000003, 0x0, 0x0, 0x1, 0x20000001}) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x40000000008, 0x2, 0x3}, 0x0) r4 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) 10.086124432s ago: executing program 4 (id=3020): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f00000000c0)=[{0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(r0, &(0x7f0000000180), 0x4000190, 0xc03e) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) socket$inet(0x2, 0x2, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) 8.77284837s ago: executing program 0 (id=3024): sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x20000044) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f00000000c0)=[{0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x4000190, 0xc03e) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) socket$inet(0x2, 0x2, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) 8.118296365s ago: executing program 1 (id=3027): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$loop(0x0, 0x7, 0x180862) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r2 = creat(&(0x7f0000000000)='./file1\x00', 0xf8) r3 = fanotify_init(0xf00, 0x1) fanotify_mark(r3, 0x105, 0x40009975, r2, 0x0) fallocate(r1, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x37ffff4, 0x4012011, r2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x400000000009, 0x800001000091}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000040)={0x0, 0xea60}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) 8.085048545s ago: executing program 4 (id=3028): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) socket$nl_netfilter(0x10, 0x3, 0xc) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r3 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x6) ftruncate(r3, 0x2000000) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000000)={r3, 0x1f, 0x0, 0x1000000}) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) 7.40686324s ago: executing program 3 (id=3029): socket(0x2, 0x1, 0x0) socket$pptp(0x18, 0x1, 0x2) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0xfffffff8, "07bbfeb30c52d28881875bac175ccb0d6c446593aa7eaba9a256d98e03ab46af"}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_register$IORING_REGISTER_IOWQ_AFF(0xffffffffffffffff, 0x25, &(0x7f0000000080)="01", 0x1) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x8) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) getitimer(0x0, 0x0) fcntl$setlease(r4, 0x400, 0x0) add_key$keyring(&(0x7f0000000280), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000002a80)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f00000014c0)="cd5927a8b2a00ee8cc111509a5dcf0343c2c5b667c514bb3055b96ebda11b4c8308aef587ef82686dc7f027c402a00582f1b338d80160b21beef66b139a7061ff65ea9c6ed4de3c272fcce0b257c322f54ca3808e8b8bb318d29a96c5035fd713f02f959dc5e55bd518d2ce967008eb6db0a89b4129c5b692bff14aeaa783a3cb22eb1004d87c97e8c8c587adeff394c43b74f5ba5ce66df35b3f4e7d9d7cbc36a20ec75e5dc96701ef447ee3160e70ad13117e96c171be8f0ba442afef0d073a33d7eb218dbb9c065f38a22096306c1e1c7a8268d7373f2f6ca476174e543a37052c6e08007c7afd75fabaf66450709ff061959d02d4f6e0c120fdfaad713688d9af3e70e752f3698b8cd0d75efd5eb50f5c4ef48aa62b641104abb1ce0e8ebcea9485d77bb9b523a47f1de80c1456f62e1387435d3f41d2d6c9e04c1f51401aa6b5204972b93c5783233a1002a1c0d9680c43f078cb2fac20df2296408b52ac0338cee4c92445b44b8d802184f15b34dcd5be61c6f55f73559", 0x17a}], 0x1}}], 0x1, 0x42054) sendto$inet(r1, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 7.309442362s ago: executing program 1 (id=3030): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, 0x0, 0x8000) 7.165131615s ago: executing program 0 (id=3031): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = socket$l2tp(0x2, 0x2, 0x73) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x7, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) setpriority(0x1, 0x0, 0x80000000) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000640)=[0x0, 0x0], 0x42af}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='stat\x00') ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r4 = fcntl$dupfd(r0, 0x406, r0) ioctl$PPPOEIOCDFWD(r4, 0xb101, 0x0) 7.163970105s ago: executing program 2 (id=3032): fsopen(&(0x7f0000000280)='ceph\x00', 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) close(r4) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000000)={0x0, 0x1, 0x8, 0x13, 0x200, &(0x7f0000000d80)="1ae19327aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a730900000000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c536689a4a62f872f9ca3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d228186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f91ffffffffd51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6ece06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a2a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0600000000000000a1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe021c773a6664b66ae04aa62c564d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000004000000000f800"}) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r5}, 0x20) 6.081953598s ago: executing program 1 (id=3033): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB="04000000040000000400000001"], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r4, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r5, 0x6, 0x8}, 0xc) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@gettaction={0x14, 0x32, 0x300, 0x70bd25, 0x25dfdbff}, 0x14}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x3}, 0x8) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000a80)="a080203e3f764f8a9aefd39cafdb26bffadae8105afd9db7fb281c375787c7506703ffe54f53e430e0d2af6e9f88a1d5d2fdad902cf70b315dce0d0c54c3d41e7907479bef309cd6705a1a41c2b5dbdbd66493db2006692ebf42f2520d453545ab0a176692d1553d", 0x68}, {&(0x7f0000000b00)="3bcab867990dafd48a38aa5c3e5078b40f6939f90b68fb7ea320958d4d64836e07", 0x21}, {&(0x7f0000000c00)="c45d5115e5374f6fef7f2f36aa65c7d43d1a282d095234e7c7387a3fa4a89cf1ee7228bb05d139383ce8a2197e705c9fb3cbbe69978007e76b108b6833b9cb03672f82956f192da9f131d69c127412277674ff4b96ddc3e62b1da4558352a61e636903a6d5c779c89f12b18a0ebec4bb4fcba25ba5f39e411b76c23f2f1ab9f7ca0c38a061b69e5a170a679b49d3d2029a1ebcf22212cd34a8d72d5a149b0955f354a9a9218d4ed1e3fdf02ed0d4f965f3d4a3fcc8a40bc604", 0xb9}, {&(0x7f0000000cc0)="3d044f36f5552e866c3e5bb625333ef189fed6d8891dcfb57a8af0678117c5669c82577417732f234f36a56f0d93d87af4c5fc3ab6cee7349ad7727eb4a3c5112fe13630c22e2455ea850820fbcbf233c0313409a9988cdff271cee9ed03d0d21e5ce72041046a8f77a63ff19fc8b050c522430571530885a968f466dca589223abdb0d2ef3d65ae3d3330e20d2b0a65514313c8a11f2aabb1a771b5704198da9cf8c4650ca654d2fa047c4b8800efa103147f9d2a94c6d1b4e21b3c9dbd8cb8d2aaaef558253cfc76e7b5541cf74c26d20a3ac061f8cb7a92b4c4e38f5db671b3b065a358d76662135ddd869b42e4dc2e9ed3b4b232a4215e30f688caef66ebac74f58ef34139266bcfb7055a838fe80dc25a1b541c8e673e56e94b1263c900122a5bd4a1670b9fabface28fef99d81bcce6727eea3403ae2ecdd69b1c6b5c84c7ce6b0ee500aafde6a7c87d3e2dad571e2a983cb9a5b02d2779033f95e2eb88cee8fd792f8354acf392a73ea69e724634f7858d351c564f2206ab6001cafc78bd91c10de8b370920b085f76fbf49a1b30c52ede89d87f59dff53a4c17fa2450904fdd726f33510e200166034a078434064cc018035d45e242feb43840240944a9f056d105350cca3ed1a58253fd70b292e4a61c0178ed37d7dce2164a7607fdf9e0ea2f0e48d3b94c05db51566f9c9e6c5d8db185723fc3fd74408a33f98682fd5bd371db5d87ae8d7f9969a7b7975a97030445a959cde1a0910d37b1cc2be02c7b924288dbdef1edcb1005679ff13d3e42df5f35e5a2db1782e76ff2b54b11dc6245b7c974d61c730bec067a2f4869c45e1d984914dd253e9318173925918dac1199fd8f920c8412d2db567374fb8b662c718f462aeafd5bfa0ac8ab0d084a6bac390cb0375159a988f784ad996a48c8813d3dec5c0d1e0922f3a9a35d17883e93d141b0df2727aa61f4e6fb3b363773e0ea670b2d22781b1ea0464047397a028840d05eac44c0463218b0b345306b68da577c019d8f9349854f7feae6211c8d901399f26c5cb06ad60dc4d6e0db1c3f266b0c11a8f3fe30575cef7ae4195c1aa2be4816d2a1e00bb22cc0992e19b7cae73e8cce4878c5d0413965426344b1f58668869969113c5cf5d2dcbc74395c93d871b1df40750a3e2bf415d0cebb2c4398885cd59c06e8a8efecab9e4088350f17ad68d21b9ab92beb888b0cd8ea0fa91d4d41bbdb7b8a10bef8b04027a66db34dd6dbc67615e1f2b794019303861e312366980ff015aaaa3e89ea627318c530ee2b2340b3d57027701413e00a2e22072380123e8749e3b5d19021d750b435b2c6c08ae7710c5e90bd918ad9e6c3f520616a19fa5fda161ab24d56d4b29d6e71880575fcb4fb66c6f1a22a7bbfcdfdfd39d8302f722f9aab98fc4b7474f151e1bc7ead7271b63ca5a51215cf0b417b6c0ca8ca3f72b723ffa66a96f70f281f98dabab1956cb4e4decffa7cf4a272b3b811b833b1db02a7a785d39d62c315d7a6aba26a0f86a0e9194f1c2d42b472333d8e077ffaa2f9c100198d5a857d5d1789c14a0ddf0560045ce96a109514c38580e29988c669ca2838b555304294338112ad52e6ab89cd2c1b2de6aa8c7c07d2d955905fa79577f3ad12bcfb919440c4610082ac7da2cb2d2d81ae8cafad94f53776a5f49816d0588c03868e432863e28024cbc9270bac8886cdf8c95768ee50475cc4502cf3f51f217c04050fc5623a21a1e0b034e55d3610158af853ed0d091aaa94b5ad4e1ea4ffce865fb3d5f8867f3a67b48c2c8028bd9f42afa88c0d3fe5c2fe3f7c99a9609eaa8c1d50f542b55c5673a3f761fad232afecaaee20792a97e9bb196dda2cfb26f770adc2250deb8e0f8db9c1416e5c2cf6f5be7383efa377ca4594d65c370bbf1713e30e2dd0b159a88a2928eea13a285d08f83eaed977ca380960e070e57bb689aa034ebedc9e6cbf6f57d13f3f9a79722a97a3875629077b33fc5fbcb62a11fdfa932ec5d89bab5b076f902c9fb62fa1289dca4cb0845cf95d6838748b741d1a3d4ccd37d2a40ce4ef881032dffc44148e93672d380d0fdd7677a4a295cd377f8e48f10dd691ae2e288ad632d5e7c6c57da71885e3935d8839e0a05a8ff7749a0fed7b7cb23de745cde57982ce362503d26659e2080fb9ff5ca63bd610460a5dc119f05cb1b006b64de5a078f84a1e302565f414fa6316b6607e03c18805948ff6c16d8b8eeab2ad5fa7ce5940f3fcd911ec6d80230b15563fbd2be0dc09e529327a2374d5c15fe667b8168c88ecb0d13cd2ee4f994cce0272c99be012a0d092f4000756be625284f9aecd9565c43bb0f69ea5b16284b024f31122e3e6e7104d0f8d5ac96f0cd4a9e53372f0a5df793e1b4d57a0f91619b2daf21299fd9fcfacfbbe0b27643a4597073c6da888d85d873ac26190bd6386967da5f1da6b18b19944d1279aae4aba62c4120171deb0eb1e1a1ac4f8d0bfe73e7dd0204e3682fa83c11f3b695a54a3e024a7937b87bd891326bf8b1061e9a49d3a660c49eb4a39bb92259ebdc4982475c873b1d85e9713f3271882eebd090ccb167ae9a59829b62235352b664f1c050766a55350f7981b1f885aae6a84a99547530cf5dcfe30b27328d5c2561692358d1acbe9bc1999a927c8daf630a4cb945e15d441cfed27874cee9dd820f4f59331b66a3b86b24540bd3dd2207081564c0d9e5788fa908cbbbc5eb8b3b39cf0944ddeb452913013de160b83013a6ce6c71a4ebb9fba0c64e69d11296b386252bea3dc03e0b3c415fcd8a53a5cd49f3e725ef7e7bd43144f51f78a79713e3f2a12f5fe4ee52164d48aec30e8688dc3b5b5fe5f23dec7abf0aee5b148d09d948c1afeae1e0cbff4563423118b5bfbedb74e01486d2c1eef94c7b66ff3e76db46ece84154aa8ec462f6ec84f0942c6cad475aafd7d2647a58606a24c182669705b273545ecadcf9d6eef33c95dcb1f09ac944ef816ffe3586c322afcf3d750a87bef633cdc9fb413134494e972b7ca65c091822346a1fa0223e77a41c937b7e0ab71d243c65d3a09fb57bca2e2a2c2941bac03bfba3bb38c56d5478eab5dbf6b33f3aba56cb0d9ee8d55dd98bc48d6beb246d3fb0aa52eab253d10802ef7e70bccdd3ec265381896bd3623600f7904752055317d67e3f36494a8e0d8ac911b46e1b36c0dc57d13174ff05886303ae3c2ef4f06071132cc1885219a699ba1d79a985f9b21d2147497152eca2308e9c9a3be3ee5e0c0b7fa5fc3f33fe12cb2c026334e453db615b4f74d1c0288c184a4c14b053c3a071513f4f7c8a3997693f111753739bd0eeef4f890a420bd0110f7296799a505762ae44297f2a04304b71563ad9cc8f68b927790d18f58da8804394a4d0919d939167b0e4cdee6ba88208c628a466a05d52ef09126271e82c4a7e4b0fd66885d2d6bf563b01d9ce1ce58f1dea91312a9031b335ba7665da23d15e259008b56b89b49bf1aa1007ea35b125f78f43f619fe4c6ceb8445cf5fb866faca2902ae303142525401dfa24b148307e0a18620baba8fea648b551e6c3092d126192ff51b396b00dafc2fc4f1149e3d7d4572d2dca69b262dfe69b2d1d7ac61ebe61a2ae46b18c20e98db24ff39e314c1c62520af9d1847c104caca86a3df151fea892463ceb0929f44934a67c09ffc3ced430f38b1f3889e87fd3f99bf1f467a6c763965d8bc69ae5a77655798daea573345647c312362f3a86cb043baef0a4ccb1aee536229a821c6897ff5cb1e5b8a818d12e6482155caa6d151de00d5eeb50d83543d73c2cc486a7c86326a92e184fd822bc750aed095442f3e6eaaced52ae72e80b39a8e663af9dc26341798dbe5e4863b823485f5cd25f35f9f16b2578201a7662a831ded8f2afbe9ebf233e504824727eb9605e2f1097ca9d17640ac489a61c11c5d76c7afd1dfcd09210c89856654ea4be6460ae9af5a0950b5a20a28a2b2b28387f985d981d072b5c0561d1eb8b9075038eda12ee2fa1224f6ca2b67c7193df72ddc4e910c93d7544fb594833b204a01baa0e1079e4a1cad6b6edb2a31dea3814bdeb411f1a1a4d854dc99f000662957872005db01471a95e53475263b22a47087b0c85e33db6ac30ee6f26e81b06ec9b5bd781cf386b10b0d156a703ad451b3589960a546310ae8483fe60609801e242c63125652ac8857447a0478fd98d3822afef3f9146e336eba1b241004b4bee86cc1087453ef6aceb55a2d80b57624cf149b35da9a145f08211e7880276748c37d7326fff19be41535707ef4dbeaccf9c2555b1ef3e24ac6b6065e97dacc8c514e11ab822537baf0da7f32198d1bbf74008138b4fab7453f02db9a996c98ccb0cff4e40a1e502f2a1bba20462067ea38928a42a30d844626a7feaaccede8d3f7861741d9e62bff08e621dcadb3303c836dbb7ade37633b314ca8ec219c03ba4a1c720bb37ba3727c85b6c87f0b2a4a956f4a2e9db625465479faf63b4c5cd14188ce71cd28fd610ea32306dcf7a6133d79475cbdb03dee71ab095258b34a0d02a6e138e8a386caca078eba537c42e6f7e095116dcdb70321312ed238be621404a58cf29b65c5b2ee5dc568f02bf208201215e3cefdd2e435ed11e5ae0dc85c6cf06965dcabebf25fdd10d485037ca4bb864abb907c77ce4fa817f57c7707b21ca892eb9f4d3251f4948c3145c55a7f26e0b54ca45e4c6cd189b56516a0c99ef3f9f54e5ea859565bf2595e9b41d2c350cebc830f06073c215e00bfa38e4852803d757c4b1fb756bd675446452eae04316d4dc613b9b43421156fa642019d7c23ca77a52a3841b3f0d356d18ed34f864243a14b8c84ed5933d2a3d48038127b838311781198c8493d1fa462bd558953ff1ed6607e610051b1c337a741fc42a7cedd5a4ffa08cdeb59e08734833657cb59e05bf22989475f1fa7a17fbbb9a6996e17e67012b4e84de956a6540d5b62d29bb56eeb25", 0xdc7}, {&(0x7f0000001cc0)="7e8868c4fa91f7287c4914d238ba5b3168d743ba56132b7ca796aa41b127c5059e5332aec14e81434e04624a61e2c081e134a10dd7506a4a5fb431e9a25e9e37da2ba01830a7a005049e2cf7ffa27863b52a8ec33ebb8c04721a7a6eb72b1c928632c24762428c6fcd35290535bf7ec8ca332f52f754d870e5f820eaee95af433941ddd2db5bb153dde9b00bbba72bb4c2cf2ee29c8e8d67536b4824d37f4f7a2117f93f3ebbf95f1b31a22159fefe9e08f7cabddca0eb226531ae41a8096b0092b7ce63ee48c8ff3f7e12821d20636a0c36815747739c1e8a719fd97ce76f9583cfb6eefbde737325dd96b060ab964323e0124efe1dad5e", 0xf8}], 0x5) 5.870321473s ago: executing program 2 (id=3034): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x80, 0x34325241, 0x3, [0x2], [0x80ffff], [0x0, 0x0, 0x400000], [0x400000000000000]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000580)={0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$SNDCTL_DSP_SYNC(r0, 0x5034, 0x0) syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1a0) mount$overlay(0x0, &(0x7f0000000340)='./file1\x00', 0x0, 0x0, 0x0) chdir(&(0x7f00000000c0)='./bus\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) creat(&(0x7f0000000040)='./file1\x00', 0x108) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000180)='|', 0x1, 0x4010, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000140)="87", 0x1, 0x20004000, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000240), 0x8) fanotify_init(0xf00, 0x1) gettid() fallocate(r2, 0x0, 0x1000000, 0x3) 5.444631993s ago: executing program 3 (id=3035): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x2, 0x200, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) mmap(&(0x7f000097a000/0x4000)=nil, 0x4000, 0x0, 0x4031, 0xffffffffffffffff, 0xee2be000) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x22282) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xe, 0xc, &(0x7f0000000040)=ANY=[], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x0, '\x00', r2, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0xc0086202, &(0x7f0000000180)=0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x2, 0x8081) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) preadv(r5, &(0x7f00000002c0)=[{0x0}], 0x1, 0xfffffffd, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) ioctl$VIDIOC_G_MODULATOR(r4, 0xc0445636, &(0x7f0000000440)={0x93ae, "0b825347975ec0abc1c3ae4eb9343b4269c162314a3e4b10f72e901102dd908a", 0x10, 0xfffffffe, 0x10, 0x1, 0x1}) chdir(&(0x7f00000001c0)='./bus\x00') rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x290, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0x0, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x10000000, 0x8000001}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xc8) 4.427235525s ago: executing program 1 (id=3036): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x2, 0x3ff, 0x3, 0x4, 0x10201, 0xffffffffffffffff, 0xfffffffe, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x7, 0x5}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x50) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96", 0x43}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de", 0x9b}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78b", 0x3f}, {&(0x7f0000000800)}], 0x4}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e138", 0xf}, {&(0x7f0000000580)}], 0x3}}], 0x2, 0x20000044) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4.057715922s ago: executing program 4 (id=3037): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x1000}, {0x0}], 0x2}}], 0x1, 0x700, 0x0) sendfile(r1, r0, 0x0, 0x578410eb) 4.049054653s ago: executing program 3 (id=3038): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x2, 0x200, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) mmap(&(0x7f000097a000/0x4000)=nil, 0x4000, 0x0, 0x4031, 0xffffffffffffffff, 0xee2be000) sendto$inet6(r0, &(0x7f0000000240)="b6", 0x1, 0x200080c1, &(0x7f00000001c0)={0xa, 0x2, 0x8000, @loopback, 0x1000008}, 0x1c) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x22282) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xe, 0xc, &(0x7f0000000040)=ANY=[], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x0, '\x00', r2, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0xc0086202, &(0x7f0000000180)=0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x2, 0x8081) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) preadv(r5, &(0x7f00000002c0)=[{0x0}], 0x1, 0xfffffffd, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) ioctl$VIDIOC_G_MODULATOR(r4, 0xc0445636, &(0x7f0000000440)={0x93ae, "0b825347975ec0abc1c3ae4eb9343b4269c162314a3e4b10f72e901102dd908a", 0x10, 0xfffffffe, 0x10, 0x1, 0x1}) chdir(&(0x7f00000001c0)='./bus\x00') rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x290, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0x0, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x10000000, 0x8000001}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xc8) 4.009972614s ago: executing program 2 (id=3039): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x6, 0x61, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4f, 0x1, 0x1, 0x2, 0x10, 0x3, "", [{{0x9, 0x4, 0x0, 0xff, 0x3, 0x2, 0x6, 0x0, 0xd, {{0x6, 0x24, 0x6, 0x0, 0x0, 'c'}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x2, 0x3, 0x8}, [@mdlm_detail={0x4, 0x24, 0x13, 0x3}, @ncm={0x6, 0x24, 0x1a, 0xff}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0xe2, 0x7, 0x9}}], {{0x9, 0x5, 0x82, 0x2, 0x8, 0x8a, 0x7f, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0xf7, 0x1, 0x3}}}}}]}}]}}, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 2.30631746s ago: executing program 0 (id=3040): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi4\x00', 0x200, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000040)={0xc000003, 0x0, 0x0, 0x1, 0x20000001}) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x40000000008, 0x2, 0x3}, 0x0) r4 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsetxattr(r2, &(0x7f0000000340)=@known='user.syz\x00', &(0x7f0000000280)='+.%+\x00', 0x5, 0x2) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000180)=0x6f) r6 = dup2(r5, r5) prlimit64(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r6, &(0x7f0000002780)={0x2020}, 0x2020) 2.183533803s ago: executing program 3 (id=3041): sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x20000044) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f00000000c0)=[{0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x4000190, 0xc03e) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) socket$inet(0x2, 0x2, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) 2.124024894s ago: executing program 1 (id=3042): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102400, 0x19000) socket$pppoe(0x18, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x800}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf980000000000000d08000000000000850000001b000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) sched_getparam(0xffffffffffffffff, &(0x7f0000000000)) 1.145362115s ago: executing program 4 (id=3043): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000000)={0x5, 0x1, 0x2, "ee4f6da8d2cf4011ac7b00", 0x43353039}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000080000000b"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000050000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r4}, 0xc) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x9640, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f0000000040)) sendmmsg$inet6(r5, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', 0xa02, 0xc1) sendfile(r6, r6, 0x0, 0x2) 1.018901548s ago: executing program 1 (id=3044): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000017c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0xe}, {&(0x7f0000000240)="cba346bb41e24d36777e56426a39357b23c1265feda67338b16a556656a35cc6607fc28f791f4a958bf5656ba473cf1b837df1", 0x33}], 0x2) 938.25104ms ago: executing program 3 (id=3045): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, 0x0, 0x8000) 772.107024ms ago: executing program 3 (id=3046): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) keyctl$clear(0x3, 0xfffffffffffffffd) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000005140)=@newtfilter={0x24, 0x2c, 0xd27, 0x11, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x8, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0xc004) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r4, 0x5522) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000140)={0x0, 0x2, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d80672e65a6a0a72e19c2b60bd6276fd8bb6366e9d1ed9a60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d10d1f600"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r3, 0x5522) ioctl$USBDEVFS_SETINTERFACE(r3, 0x80045510, &(0x7f0000000040)={0x0, 0x200000}) syz_open_dev$vcsn(&(0x7f0000000040), 0xd0f, 0x103000) keyctl$set_reqkey_keyring(0xe, 0x3) getpgid(r0) syz_clone3(&(0x7f0000000340)={0xc6107700, &(0x7f00000000c0), 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) 0s ago: executing program 0 (id=3048): socket(0x2, 0x1, 0x0) socket$pptp(0x18, 0x1, 0x2) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0xfffffff8, "07bbfeb30c52d28881875bac175ccb0d6c446593aa7eaba9a256d98e03ab46af"}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_register$IORING_REGISTER_IOWQ_AFF(0xffffffffffffffff, 0x25, &(0x7f0000000080)="01", 0x1) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x8) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) fcntl$setlease(r4, 0x400, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) add_key$keyring(&(0x7f0000000280), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000002a80)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f00000014c0)="cd5927a8b2a00ee8cc111509a5dcf0343c2c5b667c514bb3055b96ebda11b4c8308aef587ef82686dc7f027c402a00582f1b338d80160b21beef66b139a7061ff65ea9c6ed4de3c272fcce0b257c322f54ca3808e8b8bb318d29a96c5035fd713f02f959dc5e55bd518d2ce967008eb6db0a89b4129c5b692bff14aeaa783a3cb22eb1004d87c97e8c8c587adeff394c43b74f5ba5ce66df35b3f4e7d9d7cbc36a20ec75e5dc96701ef447ee3160e70ad13117e96c171be8f0ba442afef0d073a33d7eb218dbb9c065f38a22096306c1e1c7a8268d7373f2f6ca476174e543a37052c6e08007c7afd75fabaf66450709ff061959d02d4f6e0c120fdfaad713688d9af3e70e752f3698b8cd0d75efd5eb50f5c4ef48aa62b641104abb1ce0e8ebcea9485d77bb9b523a47f1de80c1456f62e1387435d3f41d2d6c9e04c1f51401aa6b5204972b93c5783233a1002a1c0d9680c43f078cb2fac20df2296408b52ac0338cee4c92445b44b8d802184f15b34dcd5be61c6f55f73559", 0x17a}], 0x1}}], 0x1, 0x42054) sendto$inet(r1, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) kernel console output (not intermixed with test programs): ptor of length 0, skipping remainder of the config [ 320.124639][ T22] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 320.134371][ T33] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 320.148523][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.174475][ T22] usb 1-1: config 0 descriptor?? [ 320.187117][ T22] pwc: Askey VC010 type 2 USB webcam detected. [ 320.261390][ T8954] tipc: Enabled bearer , priority 0 [ 320.272214][ T4317] usbhid 2-1:0.0: can't add hid device: -71 [ 320.283211][ T8954] device syzkaller0 entered promiscuous mode [ 320.291963][ T4317] usbhid: probe of 2-1:0.0 failed with error -71 [ 320.323730][ T4317] usb 2-1: USB disconnect, device number 19 [ 320.337714][ T8954] tipc: Resetting bearer [ 320.347327][ T33] usb 3-1: Using ep0 maxpacket: 16 [ 320.353829][ T8953] tipc: Resetting bearer [ 320.363371][ T33] usb 3-1: unable to get BOS descriptor or descriptor too short [ 320.396538][ T33] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 320.407152][ T33] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 320.418695][ T33] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 320.418718][ T8953] tipc: Disabling bearer [ 320.440635][ T33] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 320.450476][ T33] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.458953][ T33] usb 3-1: Product: syz [ 320.463460][ T33] usb 3-1: Manufacturer: syz [ 320.468540][ T33] usb 3-1: SerialNumber: syz [ 320.604082][ T22] pwc: recv_control_msg error -32 req 02 val 2b00 [ 320.624165][ T22] pwc: recv_control_msg error -32 req 02 val 2700 [ 320.648200][ T22] pwc: recv_control_msg error -32 req 02 val 2c00 [ 320.666727][ T22] pwc: recv_control_msg error -32 req 04 val 1000 [ 320.674195][ T22] pwc: recv_control_msg error -32 req 04 val 1300 [ 320.695092][ T33] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 320.705036][ T22] pwc: recv_control_msg error -32 req 04 val 1400 [ 320.712212][ T33] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 320.720651][ T22] pwc: recv_control_msg error -32 req 02 val 2000 [ 320.794210][ T8960] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 320.915709][ T4317] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 320.931437][ T22] pwc: recv_control_msg error -71 req 04 val 1500 [ 320.946161][ T22] pwc: recv_control_msg error -71 req 02 val 2500 [ 320.959173][ T22] pwc: recv_control_msg error -71 req 02 val 2400 [ 320.967815][ T22] pwc: recv_control_msg error -71 req 02 val 2600 [ 320.974628][ T22] pwc: recv_control_msg error -71 req 02 val 2900 [ 320.985390][ T22] pwc: recv_control_msg error -71 req 02 val 2800 [ 320.995266][ T22] pwc: recv_control_msg error -71 req 04 val 1100 [ 321.005116][ T22] pwc: recv_control_msg error -71 req 04 val 1200 [ 321.020149][ T22] pwc: Registered as video103. [ 321.089849][ T22] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input12 [ 321.100356][ T33] usb 3-1: 2:1 : can't get Cluster Descriptor [ 321.140766][ T4317] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 321.229358][ T4317] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 321.430130][ T22] usb 1-1: USB disconnect, device number 10 [ 321.438724][ T4317] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.693884][ T33] usb 3-1: USB disconnect, device number 14 [ 321.900260][ T4317] usb 2-1: config 0 descriptor?? [ 322.353375][ T8983] device syzkaller0 entered promiscuous mode [ 322.767246][ T4317] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 322.839494][ T4317] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input13 [ 323.324149][ T22] usb 2-1: USB disconnect, device number 20 [ 323.330168][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 323.402774][ T8997] device syzkaller0 entered promiscuous mode [ 323.557616][ T4317] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 323.613978][ T9005] tipc: Enabled bearer , priority 0 [ 323.636217][ T9005] device syzkaller0 entered promiscuous mode [ 323.646259][ T9005] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 323.681749][ T9005] tipc: Resetting bearer [ 323.698060][ T9004] tipc: Resetting bearer [ 323.718677][ T9004] tipc: Disabling bearer [ 323.747451][ T4317] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.774994][ T4317] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 323.790485][ T4317] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.812510][ T4317] usb 3-1: config 0 descriptor?? [ 324.040092][ T4317] usbhid 3-1:0.0: can't add hid device: -71 [ 324.050122][ T4317] usbhid: probe of 3-1:0.0 failed with error -71 [ 324.081182][ T4317] usb 3-1: USB disconnect, device number 15 [ 324.696099][ T4317] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 324.901749][ T4317] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 324.973601][ T4317] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 325.115529][ T4317] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.164893][ T4317] usb 3-1: config 0 descriptor?? [ 325.275879][ T9026] device syzkaller0 entered promiscuous mode [ 326.311455][ T9036] device syzkaller0 entered promiscuous mode [ 326.362153][ T9038] binder: BINDER_SET_CONTEXT_MGR already set [ 326.368590][ T9035] device syzkaller0 entered promiscuous mode [ 326.384548][ T9038] binder: 9037:9038 ioctl 4018620d 200000004a80 returned -16 [ 326.442607][ T9040] device syzkaller0 entered promiscuous mode [ 326.541022][ T4317] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 326.578869][ T4317] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input14 [ 326.943348][ T4317] usb 3-1: USB disconnect, device number 16 [ 326.949582][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 329.850518][ T9065] netlink: 'syz.3.1341': attribute type 2 has an invalid length. [ 329.858593][ T9065] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1341'. [ 329.873715][ T9073] netlink: 'syz.0.1342': attribute type 49 has an invalid length. [ 329.936502][ T9081] tipc: Enabling of bearer rejected, failed to enable media [ 331.064037][ T9102] device syzkaller0 entered promiscuous mode [ 331.196011][ T9105] tipc: Enabled bearer , priority 0 [ 331.205214][ T9105] device syzkaller0 entered promiscuous mode [ 331.224130][ T9105] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 331.266188][ T9105] tipc: Resetting bearer [ 331.286218][ T9108] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 331.286320][ T9104] tipc: Resetting bearer [ 331.354782][ T9104] tipc: Disabling bearer [ 331.385047][ T9118] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1350'. [ 331.446164][ T9117] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 332.786113][ T9141] tipc: Enabled bearer , priority 0 [ 332.795221][ T9143] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1360'. [ 332.813244][ T9141] device syzkaller0 entered promiscuous mode [ 332.829251][ T9141] tipc: Resetting bearer [ 332.846252][ T9140] tipc: Resetting bearer [ 332.914813][ T9140] tipc: Disabling bearer [ 332.940226][ T9147] device syzkaller0 entered promiscuous mode [ 332.952246][ T9137] netlink: 'syz.4.1359': attribute type 49 has an invalid length. [ 332.967031][ T9149] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1362'. [ 333.201372][ T9157] device syzkaller0 entered promiscuous mode [ 333.745594][ T7521] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 334.409125][ T9168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 334.947281][ T9176] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1372'. [ 334.982156][ T9178] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1373'. [ 335.097350][ T7521] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 335.116482][ T7521] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 335.213319][ T7521] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.379520][ T7521] usb 4-1: config 0 descriptor?? [ 335.523837][ T7521] pwc: Askey VC010 type 2 USB webcam detected. [ 335.970983][ T7521] pwc: recv_control_msg error -32 req 02 val 2b00 [ 335.995010][ T7521] pwc: recv_control_msg error -32 req 02 val 2700 [ 336.068696][ T7521] pwc: recv_control_msg error -32 req 02 val 2c00 [ 336.131005][ T7521] pwc: recv_control_msg error -32 req 04 val 1000 [ 336.188671][ T7521] pwc: recv_control_msg error -32 req 04 val 1300 [ 336.204047][ T9183] device syzkaller0 entered promiscuous mode [ 336.218007][ T7521] pwc: recv_control_msg error -32 req 04 val 1400 [ 336.225094][ T9191] device syzkaller0 entered promiscuous mode [ 336.233475][ T7521] pwc: recv_control_msg error -32 req 02 val 2000 [ 336.262625][ T9195] tipc: Enabled bearer , priority 0 [ 336.445760][ T7521] pwc: recv_control_msg error -71 req 04 val 1500 [ 336.456679][ T7521] pwc: recv_control_msg error -71 req 02 val 2500 [ 336.471067][ T7521] pwc: recv_control_msg error -71 req 02 val 2400 [ 336.489133][ T7521] pwc: recv_control_msg error -71 req 02 val 2600 [ 336.496814][ T7521] pwc: recv_control_msg error -71 req 02 val 2900 [ 336.503704][ T7521] pwc: recv_control_msg error -71 req 02 val 2800 [ 336.520824][ T7521] pwc: recv_control_msg error -71 req 04 val 1100 [ 336.538851][ T7521] pwc: recv_control_msg error -71 req 04 val 1200 [ 336.549203][ T7521] pwc: Registered as video103. [ 336.564478][ T7521] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input15 [ 336.601095][ T7521] usb 4-1: USB disconnect, device number 18 [ 338.080429][ T9192] device syzkaller0 entered promiscuous mode [ 338.094388][ T9195] tipc: Resetting bearer [ 338.104575][ T9189] tipc: Resetting bearer [ 338.141310][ T9189] tipc: Disabling bearer [ 338.167301][ T9203] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1379'. [ 338.335954][ T9203] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 338.414968][ T9203] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 338.502813][ T9203] bond0 (unregistering): Released all slaves [ 339.634364][ T9230] device syzkaller0 entered promiscuous mode [ 340.635143][ T9231] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 341.330399][ T9236] netlink: 'syz.4.1390': attribute type 2 has an invalid length. [ 341.369759][ T9236] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1390'. [ 341.519358][ T9250] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1392'. [ 341.679338][ T9249] tipc: Enabled bearer , priority 0 [ 341.798201][ T9249] device syzkaller0 entered promiscuous mode [ 342.459383][ T9249] tipc: Resetting bearer [ 342.664049][ T9248] tipc: Resetting bearer [ 342.993097][ T9248] tipc: Disabling bearer [ 344.750293][ T9262] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1396'. [ 346.198525][ T9286] device syzkaller0 entered promiscuous mode [ 346.596708][ T9299] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1405'. [ 346.814094][ T9304] tipc: Enabled bearer , priority 0 [ 346.855252][ T9304] device syzkaller0 entered promiscuous mode [ 348.476424][ T7522] tipc: Node number set to 243633603 [ 348.516132][ T9304] tipc: Resetting bearer [ 348.573126][ T9303] tipc: Resetting bearer [ 348.656885][ T9303] tipc: Disabling bearer [ 349.391135][ T9330] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1415'. [ 349.584003][ T9336] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1418'. [ 349.655814][ T9338] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1419'. [ 349.810932][ T9345] tipc: Enabled bearer , priority 0 [ 349.838663][ T9345] device syzkaller0 entered promiscuous mode [ 349.953557][ T9349] tmpfs: Unknown parameter 'quota' [ 350.158317][ T9345] tipc: Resetting bearer [ 350.292004][ T9344] tipc: Resetting bearer [ 350.534362][ T9344] tipc: Disabling bearer [ 351.088399][ T9362] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1427'. [ 355.005269][ T9382] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1431'. [ 355.299871][ T9387] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1433'. [ 355.531926][ T9391] device syzkaller0 entered promiscuous mode [ 355.641239][ T9398] tipc: Enabled bearer , priority 0 [ 355.655196][ T9398] tipc: Resetting bearer [ 355.681781][ T9397] tipc: Disabling bearer [ 355.746610][ T9400] device syzkaller0 entered promiscuous mode [ 356.705664][ T7521] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 356.805669][ T9410] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1443'. [ 356.985569][ T7521] usb 2-1: Using ep0 maxpacket: 16 [ 357.097584][ T7521] usb 2-1: unable to get BOS descriptor or descriptor too short [ 357.124318][ T7521] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 357.135380][ T7521] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 357.251045][ T7521] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 357.716475][ T7521] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 357.729355][ T7521] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.742105][ T7521] usb 2-1: Product: syz [ 357.778250][ T7521] usb 2-1: Manufacturer: syz [ 357.782914][ T7521] usb 2-1: SerialNumber: syz [ 358.063420][ T7521] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 358.073515][ T9427] fuse: Bad value for 'fd' [ 358.102073][ T7521] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 358.709288][ T7521] usb 2-1: 2:1 : bogus bTerminalLink 6 [ 358.966122][ T7521] usb 2-1: USB disconnect, device number 21 [ 360.681516][ T9425] tipc: Enabled bearer , priority 0 [ 360.695168][ T9428] device syzkaller0 entered promiscuous mode [ 360.901539][ T9428] tipc: Resetting bearer [ 361.031729][ T9475] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1456'. [ 361.103055][ T9428] tipc: Disabling bearer [ 361.286934][ T9478] netlink: 'syz.0.1455': attribute type 2 has an invalid length. [ 361.391424][ T9478] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1455'. [ 361.807186][ T9470] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 362.354647][ T9484] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1458'. [ 362.556167][ T9495] netlink: 'syz.2.1457': attribute type 49 has an invalid length. [ 363.582647][ T9506] device syzkaller0 entered promiscuous mode [ 363.758711][ T9523] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 368.916400][ T9526] netlink: 'syz.2.1468': attribute type 2 has an invalid length. [ 368.931382][ T9526] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1468'. [ 368.975516][ T9536] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1470'. [ 369.083294][ T9536] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 369.107367][ T9536] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 369.135065][ T9536] bond0 (unregistering): Released all slaves [ 370.567973][ T9553] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 371.125161][ T9567] device syzkaller0 entered promiscuous mode [ 371.319191][ T9573] tmpfs: Unknown parameter 'quota' [ 374.154932][ T9587] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 374.174488][ T9586] device syzkaller0 entered promiscuous mode [ 376.178420][ T9608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 377.624487][ T9603] netlink: 'syz.0.1490': attribute type 49 has an invalid length. [ 377.876781][ T9619] device syzkaller0 entered promiscuous mode [ 377.925636][ T9623] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1494'. [ 378.480937][ T9629] tmpfs: Unknown parameter 'quota' [ 378.545573][ T7521] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 378.618139][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.624552][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.813328][ T7521] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 378.824542][ T9645] tmpfs: Unknown parameter 'quota' [ 379.662468][ T7521] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 379.672001][ T7521] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.681960][ T7521] usb 2-1: config 0 descriptor?? [ 379.689803][ T7521] pwc: Askey VC010 type 2 USB webcam detected. [ 379.950911][ T9654] device syzkaller0 entered promiscuous mode [ 380.117551][ T7521] pwc: recv_control_msg error -32 req 02 val 2b00 [ 380.125919][ T7521] pwc: recv_control_msg error -32 req 02 val 2700 [ 380.141203][ T7521] pwc: recv_control_msg error -32 req 02 val 2c00 [ 380.155668][ T7521] pwc: recv_control_msg error -32 req 04 val 1000 [ 380.173435][ T7521] pwc: recv_control_msg error -32 req 04 val 1300 [ 380.183426][ T7521] pwc: recv_control_msg error -32 req 04 val 1400 [ 380.202929][ T7521] pwc: recv_control_msg error -32 req 02 val 2000 [ 380.412341][ T7521] pwc: recv_control_msg error -71 req 04 val 1500 [ 380.422942][ T7521] pwc: recv_control_msg error -71 req 02 val 2500 [ 380.436529][ T7521] pwc: recv_control_msg error -71 req 02 val 2400 [ 380.449160][ T7521] pwc: recv_control_msg error -71 req 02 val 2600 [ 380.463059][ T7521] pwc: recv_control_msg error -71 req 02 val 2900 [ 380.475897][ T7521] pwc: recv_control_msg error -71 req 02 val 2800 [ 380.488147][ T7521] pwc: recv_control_msg error -71 req 04 val 1100 [ 380.523492][ T7521] pwc: recv_control_msg error -71 req 04 val 1200 [ 380.541876][ T7521] pwc: Registered as video103. [ 380.551487][ T7521] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input16 [ 380.569021][ T7521] usb 2-1: USB disconnect, device number 22 [ 381.591441][ T9677] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 385.000571][ T9663] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1509'. [ 386.137867][ T9687] device syzkaller0 entered promiscuous mode [ 386.162598][ T9697] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 387.969795][ T9710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 390.600778][ T9736] device syzkaller0 entered promiscuous mode [ 393.153214][ T9763] device syzkaller0 entered promiscuous mode [ 396.060640][ T9791] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 400.075657][ T9837] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1546'. [ 400.321011][ T9850] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 400.435673][ T4317] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 400.625763][ T4317] usb 3-1: Using ep0 maxpacket: 8 [ 400.660884][ T4317] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 400.750708][ T4317] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 400.829926][ T4317] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.489492][ T9852] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 402.058075][ T4317] usb 3-1: Product: syz [ 402.062320][ T4317] usb 3-1: Manufacturer: syz [ 402.087416][ T4317] usb 3-1: SerialNumber: syz [ 402.113246][ T4317] usb 3-1: config 0 descriptor?? [ 402.176182][ T4317] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 402.210711][ T4317] usb 3-1: setting power ON [ 402.286274][ T4317] dvb-usb: bulk message failed: -22 (2/0) [ 402.311996][ T4317] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 402.357938][ T4317] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 402.389488][ T9857] tmpfs: Unknown parameter 'quota' [ 402.400845][ T4317] usb 3-1: media controller created [ 402.483381][ T4317] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 402.510490][ T4317] usb 3-1: selecting invalid altsetting 6 [ 402.518218][ T4317] usb 3-1: digital interface selection failed (-22) [ 402.524896][ T4317] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 402.547019][ T4317] usb 3-1: setting power OFF [ 402.552842][ T4317] dvb-usb: bulk message failed: -22 (2/0) [ 402.562988][ T4317] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 402.573902][ T4317] (NULL device *): no alternate interface [ 402.608925][ T4317] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 402.862941][ T9882] device syzkaller0 entered promiscuous mode [ 404.310678][ T7521] usb 3-1: USB disconnect, device number 17 [ 404.836213][ T9890] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1563'. [ 405.023096][ T9892] tipc: Enabled bearer , priority 0 [ 405.066964][ T9892] device syzkaller0 entered promiscuous mode [ 405.098330][ T9892] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 405.273843][ T9892] tipc: Resetting bearer [ 405.333828][ T9891] tipc: Resetting bearer [ 405.377293][ T9891] tipc: Disabling bearer [ 405.664216][ T9915] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.1572'. [ 406.962043][ T9935] tipc: Enabled bearer , priority 0 [ 407.019348][ T9935] device syzkaller0 entered promiscuous mode [ 407.053086][ T9935] tipc: Resetting bearer [ 407.744764][ T9933] tipc: Resetting bearer [ 407.831018][ T9934] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 408.459223][ T9948] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.1584'. [ 408.639118][ T9956] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 409.215679][ T22] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 409.425633][ T22] usb 4-1: Using ep0 maxpacket: 16 [ 409.433170][ T22] usb 4-1: unable to get BOS descriptor or descriptor too short [ 409.448430][ T22] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.463694][ T22] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 409.472803][ T22] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 409.490884][ T22] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 409.501962][ T22] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.514992][ T22] usb 4-1: Product: syz [ 409.519294][ T22] usb 4-1: Manufacturer: syz [ 409.523934][ T22] usb 4-1: SerialNumber: syz [ 409.754715][ T22] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 409.772465][ T9968] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.784043][ T22] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 409.803238][ T22] usb 4-1: 1:2 : does not exist [ 411.023858][ T9933] tipc: Disabling bearer [ 411.732353][ T9998] netlink: 1688 bytes leftover after parsing attributes in process `syz.0.1598'. [ 411.852955][T10002] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.1600'. [ 411.969058][ T7521] usb 4-1: USB disconnect, device number 19 [ 412.730003][T10008] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 412.907990][T10016] device syzkaller0 entered promiscuous mode [ 413.060761][T10021] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1604'. [ 413.293551][T10021] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 413.357568][T10033] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 413.384292][T10021] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.431751][T10041] netlink: 1688 bytes leftover after parsing attributes in process `syz.0.1610'. [ 413.436946][T10021] bond0 (unregistering): Released all slaves [ 413.930654][T10054] tmpfs: Unknown parameter 'quota' [ 414.704093][T10050] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.122530][T10068] device syzkaller0 entered promiscuous mode [ 415.149912][T10073] netlink: 'syz.3.1623': attribute type 72 has an invalid length. [ 416.635126][T10115] tmpfs: Unknown parameter 'quota' [ 418.304942][T10141] tipc: Enabling of bearer rejected, failed to enable media [ 418.325579][T10144] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1657'. [ 418.739064][T10159] tipc: Enabling of bearer rejected, failed to enable media [ 418.812234][T10161] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 419.266992][T10175] netlink: 'syz.4.1668': attribute type 72 has an invalid length. [ 420.940499][T10178] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 422.269847][T10208] tipc: Enabling of bearer rejected, failed to enable media [ 422.611714][T10222] tmpfs: Unknown parameter 'quota' [ 423.420271][T10218] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 423.439475][T10227] netlink: 'syz.0.1684': attribute type 72 has an invalid length. [ 423.453747][T10223] netlink: 'syz.4.1680': attribute type 49 has an invalid length. [ 423.802913][T10237] device syzkaller0 entered promiscuous mode [ 424.831808][T10243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 426.281260][T10258] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1695'. [ 428.134037][T10273] tipc: Enabled bearer , priority 0 [ 428.164347][T10277] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1703'. [ 428.204505][T10277] fuse: Bad value for 'fd' [ 428.245096][T10272] tipc: Disabling bearer [ 428.416904][T10285] device syzkaller0 entered promiscuous mode [ 428.622087][T10291] device syzkaller0 entered promiscuous mode [ 428.681723][T10293] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1708'. [ 429.012572][T10295] tmpfs: Unknown parameter 'quota' [ 430.307107][T10316] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.1714'. [ 430.520977][T10328] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 430.563502][T10328] qrtr: Invalid version 46 [ 432.282604][T10332] tipc: Enabling of bearer rejected, failed to enable media [ 432.459114][T10345] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1721'. [ 432.775145][T10357] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1724'. [ 434.016305][T10381] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1728'. [ 434.020896][T10382] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1730'. [ 434.077496][T10380] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.1729'. [ 434.287300][T10389] device syzkaller0 entered promiscuous mode [ 434.345710][ T4317] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 434.550141][ T4317] usb 3-1: Using ep0 maxpacket: 8 [ 434.566019][ T4317] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 434.598264][ T4317] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 434.615721][ T4317] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.625728][ T4317] usb 3-1: Product: syz [ 434.631865][ T4317] usb 3-1: Manufacturer: syz [ 434.636609][ T4317] usb 3-1: SerialNumber: syz [ 434.656724][ T4317] usb 3-1: config 0 descriptor?? [ 434.664847][ T4317] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 434.673847][ T4317] usb 3-1: setting power ON [ 434.678532][ T4317] dvb-usb: bulk message failed: -22 (2/0) [ 434.689042][ T4317] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 434.699635][ T4317] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 434.708262][ T4317] usb 3-1: media controller created [ 434.725842][ T4317] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 434.748704][ T4317] usb 3-1: selecting invalid altsetting 6 [ 434.754503][ T4317] usb 3-1: digital interface selection failed (-22) [ 434.761229][ T4317] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 434.770558][ T4317] usb 3-1: setting power OFF [ 434.775303][ T4317] dvb-usb: bulk message failed: -22 (2/0) [ 434.781460][ T4317] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 434.791065][ T4317] (NULL device *): no alternate interface [ 434.809789][ T4317] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 436.531396][T10394] device syzkaller0 entered promiscuous mode [ 436.586045][T10406] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 436.692525][T10412] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 436.999352][ T4360] usb 3-1: USB disconnect, device number 18 [ 437.916443][T10443] fuse: Bad value for 'fd' [ 438.191092][T10449] device syzkaller0 entered promiscuous mode [ 438.495745][T10471] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1758'. [ 440.057614][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.064071][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.228673][T10513] device syzkaller0 entered promiscuous mode [ 440.303064][T10498] tmpfs: Unknown parameter 'quota' [ 441.050725][T10515] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 441.377509][T10531] device syzkaller0 entered promiscuous mode [ 441.489980][T10536] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 441.532314][T10536] qrtr: Invalid version 46 [ 444.027058][T10537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 444.684779][T10548] netlink: 1688 bytes leftover after parsing attributes in process `syz.4.1780'. [ 445.271681][T10577] device syzkaller0 entered promiscuous mode [ 446.112151][T10565] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 446.801667][T10586] device syzkaller0 entered promiscuous mode [ 446.917310][T10585] device syzkaller0 entered promiscuous mode [ 446.989660][T10601] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.1794'. [ 447.288466][T10612] fuse: Unknown parameter 'user_i00000000000000000000' [ 449.203109][T10641] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 449.600149][T10656] device syzkaller0 entered promiscuous mode [ 449.954298][T10658] device syzkaller0 entered promiscuous mode [ 451.608991][T10679] netlink: 'syz.3.1812': attribute type 72 has an invalid length. [ 451.647949][T10683] device syzkaller0 entered promiscuous mode [ 453.963074][T10742] netlink: 'syz.0.1827': attribute type 72 has an invalid length. [ 454.222471][T10748] device syzkaller0 entered promiscuous mode [ 455.533361][T10773] tmpfs: Unknown parameter 'quota' [ 456.478457][T10786] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 457.012416][T10806] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1844'. [ 458.271543][T10824] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1851'. [ 458.683776][T10839] netlink: 'syz.1.1855': attribute type 49 has an invalid length. [ 458.699917][T10840] tmpfs: Unknown parameter 'quota' [ 461.068815][T10879] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1865'. [ 461.323394][T10892] netlink: 'syz.0.1868': attribute type 49 has an invalid length. [ 461.601026][T10900] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4210825046 (8421650092 ns) > initial count (6043900494 ns). Using initial count to start timer. [ 461.846940][T10911] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 461.896393][T10915] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.1878'. [ 463.137906][T10927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 463.844609][T10943] device syzkaller0 entered promiscuous mode [ 464.083555][T10954] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 464.312331][T10959] tmpfs: Unknown parameter 'quota' [ 467.039709][T10998] device syzkaller0 entered promiscuous mode [ 468.402590][T11017] tmpfs: Unknown parameter 'quota' [ 469.070233][T11038] device syzkaller0 entered promiscuous mode [ 470.123792][T11044] device syzkaller0 entered promiscuous mode [ 475.728720][T11162] device syzkaller0 entered promiscuous mode [ 478.864440][T11218] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 478.913649][T11218] qrtr: Invalid version 46 [ 483.611864][T11263] tipc: Enabling of bearer rejected, failed to enable media [ 484.018385][T11284] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1989'. [ 484.092449][T11280] tmpfs: Unknown parameter 'quota' [ 485.957611][T11291] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 485.971917][T11296] device syzkaller0 entered promiscuous mode [ 486.123183][T11286] tmpfs: Unknown parameter 'quota' [ 487.055757][ T22] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 487.275987][ T22] usb 3-1: Using ep0 maxpacket: 16 [ 487.290812][ T22] usb 3-1: unable to get BOS descriptor or descriptor too short [ 487.398056][ T22] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 487.509302][ T22] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 487.627035][ T22] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 487.756406][ T22] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 487.833827][ T22] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.902321][ T22] usb 3-1: Product: syz [ 487.935979][ T22] usb 3-1: Manufacturer: syz [ 487.960813][ T22] usb 3-1: SerialNumber: syz [ 488.376289][ T22] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 488.405814][ T22] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 488.782606][ T22] usb 3-1: 2:1 : can't get Cluster Descriptor [ 489.010354][T11322] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 489.117459][T11327] tipc: Enabling of bearer rejected, failed to enable media [ 489.131429][T11316] tmpfs: Unknown parameter 'quota' [ 489.273443][ T22] usb 3-1: USB disconnect, device number 19 [ 490.373574][T11347] device syzkaller0 entered promiscuous mode [ 490.716840][T11353] tmpfs: Unknown parameter 'quota' [ 492.317221][T11378] fuse: Bad value for 'rootmode' [ 492.722925][T11374] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 493.564592][T11389] tipc: Enabling of bearer rejected, failed to enable media [ 493.994636][T11406] tmpfs: Unknown parameter 'quota' [ 494.711043][T11426] device syzkaller0 entered promiscuous mode [ 495.529010][T11430] device syzkaller0 entered promiscuous mode [ 496.156710][T11440] tmpfs: Unknown parameter 'quota' [ 498.274746][T11476] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.2038'. [ 498.419149][T11470] tmpfs: Unknown parameter 'quota' [ 499.200360][T11474] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 499.800665][T11481] device syzkaller0 entered promiscuous mode [ 499.942006][T11483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 500.861096][T11487] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 501.498981][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.505410][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.480402][T11514] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 504.555401][ T22] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 504.995672][ T22] usb 5-1: Using ep0 maxpacket: 8 [ 505.011056][ T22] usb 5-1: unable to get BOS descriptor or descriptor too short [ 505.057278][ T22] usb 5-1: config 14 has too many interfaces: 66, using maximum allowed: 32 [ 505.073555][ T22] usb 5-1: config 14 has an invalid descriptor of length 121, skipping remainder of the config [ 505.094302][ T22] usb 5-1: config 14 has 0 interfaces, different from the descriptor's value: 66 [ 505.120234][T11547] fuse: Bad value for 'fd' [ 505.125186][ T22] usb 5-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 505.135885][ T22] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.143999][ T22] usb 5-1: Product: syz [ 505.148628][ T22] usb 5-1: Manufacturer: syz [ 505.153240][ T22] usb 5-1: SerialNumber: syz [ 506.675125][ T22] usb 5-1: USB disconnect, device number 10 [ 506.887209][T11554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 507.448460][T11552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 507.468676][T11561] tmpfs: Unknown parameter 'quota' [ 509.480929][T11616] tipc: Enabling of bearer rejected, failed to enable media [ 511.163067][T11605] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 512.777133][T11639] device syzkaller0 entered promiscuous mode [ 512.897883][T11644] fuse: Unknown parameter '00000000000000000004' [ 512.915039][T11646] fuse: Bad value for 'fd' [ 514.027829][T11650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 514.713675][T11654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 516.077443][T11667] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 516.613365][T11695] netlink: 'syz.3.2103': attribute type 10 has an invalid length. [ 516.621612][T11695] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2103'. [ 516.637292][T11695] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.646531][T11695] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.655316][T11695] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.664294][T11695] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.693012][T11695] team0: Port device geneve0 added [ 517.745550][T11710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 517.799262][T11720] device syzkaller0 entered promiscuous mode [ 518.163539][T11729] netlink: 'syz.2.2112': attribute type 10 has an invalid length. [ 518.171723][T11729] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2112'. [ 518.181731][T11729] team0: Device geneve0 is up. Set it down before adding it as a team port [ 518.191975][T11729] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 519.043367][T11735] netlink: 'syz.0.2113': attribute type 10 has an invalid length. [ 519.051678][T11735] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2113'. [ 519.068283][T11735] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.077534][T11735] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.086386][T11735] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.095368][T11735] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.120751][T11735] team0: Port device geneve0 added [ 520.031823][T11745] netlink: 'syz.0.2117': attribute type 10 has an invalid length. [ 520.039825][T11745] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2117'. [ 522.509219][T11773] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.998780][T11773] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.035604][ T22] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 523.048169][T11773] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.245427][ T22] usb 4-1: Using ep0 maxpacket: 16 [ 523.255753][ T22] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 523.264268][T11785] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 523.298503][ T22] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 523.346741][ T22] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 523.376989][ T22] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.404979][ T22] usb 4-1: Product: syz [ 523.417300][ T22] usb 4-1: Manufacturer: syz [ 523.424312][ T22] usb 4-1: SerialNumber: syz [ 523.550149][T11773] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.561048][T11773] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.570263][T11773] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.579391][T11773] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.653245][T11792] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 523.672659][T11791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.683548][T11791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.698865][ T4281] Bluetooth: hci2: Malformed LE Event: 0x0b [ 523.703553][T11791] [U]  [ 523.731559][T11791] [U] K{ [ 523.734856][T11791] [U] T 1ŠFFˊ`GJǘGO/MC [ 523.743282][T11791] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 523.760131][T11791] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 523.913355][T11791] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 524.876439][T11791] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 524.903259][T11791] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 524.917540][T11791] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 524.956013][T11791] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/< rejected, failed to enable media [ 537.452021][T11959] netlink: 'syz.2.2170': attribute type 10 has an invalid length. [ 537.630281][T11959] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2170'. [ 537.650015][T11959] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.659184][T11959] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.668065][T11959] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.677061][T11959] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.713449][T11959] team0: Port device geneve0 added [ 537.924111][T11962] netlink: 'syz.1.2171': attribute type 10 has an invalid length. [ 537.932068][T11962] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2171'. [ 537.943041][T11962] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.952068][T11962] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.960838][T11962] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.969587][T11962] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.984730][T11962] team0: Port device geneve0 added [ 541.997968][T11994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 543.773860][T12013] netlink: 'syz.2.2186': attribute type 10 has an invalid length. [ 543.781871][T12013] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2186'. [ 544.405301][T12014] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 546.106990][T12033] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 550.166058][T12058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 551.044771][T12081] tmpfs: Unknown parameter 'quota' [ 551.168693][T12087] fuse: Bad value for 'fd' [ 552.451363][ T4281] Bluetooth: hci4: unknown advertising packet type: 0xff [ 552.451436][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x79 [ 552.459877][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x20 [ 552.467812][ T4281] Bluetooth: hci4: unknown advertising packet type: 0xac [ 552.474976][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x24 [ 552.482644][ T4281] Bluetooth: hci4: Malformed LE Event: 0x02 [ 553.314453][T12099] fuse: Unknown parameter 'group_id00000000000000000000' [ 554.615383][T12110] netlink: 'syz.2.2211': attribute type 10 has an invalid length. [ 554.623418][T12110] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2211'. [ 554.888875][T12112] netlink: 'syz.3.2215': attribute type 10 has an invalid length. [ 554.896877][T12112] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2215'. [ 555.535924][T12119] autofs4:pid:12119:autofs_fill_super: called with bogus options [ 557.295426][ T4319] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 557.311650][T12151] netlink: 'syz.1.2224': attribute type 10 has an invalid length. [ 557.319668][T12151] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2224'. [ 557.974438][ T4319] usb 3-1: Using ep0 maxpacket: 16 [ 558.006609][ T4319] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 558.057833][ T4319] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 558.123041][ T4319] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 558.246560][ T4319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.254787][ T4319] usb 3-1: Product: syz [ 558.288449][ T4319] usb 3-1: Manufacturer: syz [ 558.311968][ T4319] usb 3-1: SerialNumber: syz [ 558.930522][T12138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.957331][T12138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.074728][ T4281] Bluetooth: hci4: unknown advertising packet type: 0xff [ 559.074763][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x79 [ 559.082346][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x20 [ 559.090592][ T4281] Bluetooth: hci4: unknown advertising packet type: 0xac [ 559.098239][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x24 [ 559.105632][ T4281] Bluetooth: hci4: Malformed LE Event: 0x02 [ 559.728822][ T4281] Bluetooth: hci1: Malformed LE Event: 0x0b [ 559.742854][T12138] [U]  [ 559.764231][T12138] [U] K{ [ 559.770841][T12138] [U] T 1ŠFFˊ`GJǘGO/MC [ 559.781112][T12138] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 559.806825][T12138] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 559.829056][T12138] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 560.746207][T12168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 561.268077][T12138] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 561.401741][T12138] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 561.416106][T12138] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 561.451759][T12138] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 570.118264][T12270] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 570.507447][ T4281] Bluetooth: hci4: unknown advertising packet type: 0xff [ 570.507562][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x79 [ 570.515647][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x20 [ 570.523137][ T4281] Bluetooth: hci4: unknown advertising packet type: 0xac [ 570.534954][ T4281] Bluetooth: hci4: unknown advertising packet type: 0x24 [ 570.626418][ T4281] Bluetooth: hci4: Malformed LE Event: 0x02 [ 570.647873][T12270] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 571.288520][T12270] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 571.317608][T12270] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 624.792908][T12955] device syzkaller0 entered promiscuous mode [ 624.831664][T12915] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 624.859856][T12915] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 624.875640][T12915] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 624.894127][T12915] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/< rejected, failed to enable media [ 634.660886][T13139] device syzkaller0 entered promiscuous mode [ 634.831079][T13134] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 634.995814][T13152] netlink: 'syz.3.2494': attribute type 10 has an invalid length. [ 635.003713][T13152] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2494'. [ 637.293872][T13195] tipc: Enabling of bearer rejected, failed to enable media [ 637.460377][T13199] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.020841][T13222] device syzkaller0 entered promiscuous mode [ 638.218456][T13227] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.397093][T13241] netlink: 'syz.4.2517': attribute type 1 has an invalid length. [ 638.427688][T13241] device bond2 entered promiscuous mode [ 638.433499][T13241] 8021q: adding VLAN 0 to HW filter on device bond2 [ 639.669645][T13267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2530'. [ 639.821661][T13272] device syzkaller0 entered promiscuous mode [ 641.034539][T13283] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 641.594499][T13286] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.651124][T13308] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 645.862678][T13355] netlink: 'syz.0.2553': attribute type 10 has an invalid length. [ 645.949749][T13355] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2553'. [ 647.061056][T13389] tipc: Enabling of bearer rejected, failed to enable media [ 648.449895][T13415] device syzkaller0 entered promiscuous mode [ 648.874053][T13425] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 649.522040][T13440] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2575'. [ 649.594808][T13444] tipc: Enabling of bearer rejected, failed to enable media [ 649.885351][T12486] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 650.085933][T12486] usb 3-1: Using ep0 maxpacket: 8 [ 650.099778][T12486] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 650.151941][T12486] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 650.161574][T12486] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.169767][T12486] usb 3-1: Product: syz [ 650.174384][T12486] usb 3-1: Manufacturer: syz [ 650.179387][T12486] usb 3-1: SerialNumber: syz [ 650.198112][T12486] usb 3-1: config 0 descriptor?? [ 650.214749][T12486] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 650.223043][T12486] usb 3-1: setting power ON [ 650.227751][T12486] dvb-usb: bulk message failed: -22 (2/0) [ 650.235879][T12486] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 650.245904][T12486] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 650.254453][T12486] usb 3-1: media controller created [ 650.344781][T12486] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 650.362600][T12486] usb 3-1: selecting invalid altsetting 6 [ 650.376269][T12486] usb 3-1: digital interface selection failed (-22) [ 650.477811][T12486] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 650.517542][T12486] usb 3-1: setting power OFF [ 650.527525][T12486] dvb-usb: bulk message failed: -22 (2/0) [ 650.533289][T12486] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 650.573403][T12486] (NULL device *): no alternate interface [ 650.627313][T12486] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 650.735728][ T4277] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 650.745399][ T4277] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 650.753394][ T4277] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 650.765035][ T4277] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 650.772889][ T4277] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 650.782766][ T4277] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 650.871858][ T4658] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.039709][ T4658] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.188439][ T4658] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.284848][ T4658] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.418626][ T4658] tipc: Left network mode [ 653.006439][ T4281] Bluetooth: hci3: command 0x0409 tx timeout [ 653.332574][T12489] usb 3-1: USB disconnect, device number 23 [ 653.402548][T13466] chnl_net:caif_netlink_parms(): no params data found [ 653.571702][T13516] tipc: Enabling of bearer rejected, failed to enable media [ 654.607828][T13523] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.015380][ T4277] Bluetooth: hci3: command 0x041b tx timeout [ 655.730148][T13466] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.800556][T13466] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.835063][T13466] device bridge_slave_0 entered promiscuous mode [ 655.946562][T13466] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.981709][T13466] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.216391][T13466] device bridge_slave_1 entered promiscuous mode [ 656.815478][T13550] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 657.095368][ T4277] Bluetooth: hci3: command 0x040f tx timeout [ 658.648317][T13466] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 658.713571][T13466] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 659.028428][T13466] team0: Port device team_slave_0 added [ 659.055808][T13596] tipc: Enabling of bearer rejected, failed to enable media [ 659.088755][T13466] team0: Port device team_slave_1 added [ 659.185601][ T4277] Bluetooth: hci3: command 0x0419 tx timeout [ 659.281627][ T4658] device hsr_slave_0 left promiscuous mode [ 659.365646][ T4658] device hsr_slave_1 left promiscuous mode [ 659.412572][ T4658] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 659.448571][ T4658] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 659.457130][ T4658] device bridge_slave_1 left promiscuous mode [ 659.465312][ T4658] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.475659][ T4658] device bridge_slave_0 left promiscuous mode [ 659.481908][ T4658] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.549583][ T4658] bond0 (unregistering): Released all slaves [ 660.315190][T13611] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2606'. [ 660.325726][ T4658] team0 (unregistering): Port device geneve0 removed [ 660.953017][ T4658] team0 (unregistering): Port device team_slave_1 removed [ 660.992653][ T4658] team0 (unregistering): Port device team_slave_0 removed [ 661.370436][T13466] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 661.386988][T13466] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 661.414101][T13466] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 661.472062][T13466] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 661.485968][T13466] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 661.512591][T13466] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 661.533736][T13620] device syzkaller0 entered promiscuous mode [ 661.570926][T13466] device hsr_slave_0 entered promiscuous mode [ 661.587497][T13466] device hsr_slave_1 entered promiscuous mode [ 661.594058][T13466] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 661.605598][T13466] Cannot create hsr debugfs directory [ 663.571673][T13466] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 663.608339][T13466] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 663.626721][T13466] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 663.673242][T13466] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 663.852490][T13653] tipc: Enabling of bearer rejected, failed to enable media [ 663.919409][T13466] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.995917][T13466] 8021q: adding VLAN 0 to HW filter on device team0 [ 664.228267][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 664.356265][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 664.610411][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 664.629742][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 664.652833][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 664.660033][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 664.703767][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 664.727928][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 664.745927][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 664.753094][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 664.793608][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 664.828312][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 664.934641][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 665.040192][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 665.123745][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 665.266024][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 665.495468][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 665.710701][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 665.760586][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 665.841543][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 665.894780][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 665.931040][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 665.954512][T13466] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 666.054927][T13684] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2620'. [ 666.176679][T13675] device syzkaller0 entered promiscuous mode [ 671.756271][T13755] tipc: Enabling of bearer rejected, failed to enable media [ 672.727160][T13770] device syzkaller0 entered promiscuous mode [ 672.767887][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 672.781627][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 672.843690][T13775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 672.854010][T13466] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 672.936148][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 672.951146][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 673.010165][T13466] device veth0_vlan entered promiscuous mode [ 673.031534][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 673.040620][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 673.090547][T13466] device veth1_vlan entered promiscuous mode [ 673.109962][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 673.126035][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 673.161077][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 673.232548][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 673.246441][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 673.266441][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 673.288147][T13466] device veth0_macvtap entered promiscuous mode [ 673.324059][T13466] device veth1_macvtap entered promiscuous mode [ 673.499289][T13466] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 673.645047][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 673.672325][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 674.364341][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 674.403802][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 674.435871][T13466] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 674.470675][T13805] netlink: 'syz.1.2640': attribute type 1 has an invalid length. [ 674.559966][T13805] device bond0 entered promiscuous mode [ 674.571640][T13805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 674.594954][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 674.622757][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 674.683477][T13466] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.722941][T13466] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.747501][T13466] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.777890][T13466] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.120554][T13829] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 675.128796][T13829] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 675.137309][T13829] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 675.480752][ T4338] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.713980][T13845] device bond0 left promiscuous mode [ 675.810134][ T4338] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.923920][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 676.385994][ T4373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 676.394583][ T4373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 676.404925][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 676.698708][T13859] device syzkaller0 entered promiscuous mode [ 678.710908][T13897] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2659'. [ 679.330311][T13865] netlink: 'syz.0.2577': attribute type 1 has an invalid length. [ 679.813565][T13908] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2660'. [ 679.847124][T13908] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.856132][T13908] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.864833][T13908] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.873597][T13908] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.628782][T13906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 681.658852][ T26] audit: type=1326 audit(1783267068.859:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13902 comm="syz.2.2661" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f101b39de59 code=0x0 [ 681.754436][T13925] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 681.775367][ T4360] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 681.955332][ T4360] usb 1-1: Using ep0 maxpacket: 8 [ 681.962592][ T4360] usb 1-1: unable to get BOS descriptor or descriptor too short [ 681.982877][ T4360] usb 1-1: config 14 has too many interfaces: 66, using maximum allowed: 32 [ 681.996300][ T4360] usb 1-1: config 14 has an invalid descriptor of length 121, skipping remainder of the config [ 682.007305][ T4360] usb 1-1: config 14 has 0 interfaces, different from the descriptor's value: 66 [ 682.024297][ T4360] usb 1-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 682.035356][ T4360] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.043393][ T4360] usb 1-1: Product: syz [ 682.056648][ T4360] usb 1-1: Manufacturer: syz [ 682.069124][ T4360] usb 1-1: SerialNumber: syz [ 682.670586][T13935] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 683.136994][T13950] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 683.145562][T13950] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 683.154150][T13950] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 683.844165][ T4360] usb 1-1: USB disconnect, device number 11 [ 684.555944][ T4360] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 685.101042][T13967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.177311][T13975] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2678'. [ 685.190427][T13975] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 685.199253][T13975] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 685.208023][T13975] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 685.217034][T13975] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 685.767595][ T4360] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 685.779228][ T4360] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 685.788674][ T4360] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 685.806589][ T4360] usb 1-1: config 0 descriptor?? [ 685.819784][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.826538][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.087173][ T4360] usbhid 1-1:0.0: can't add hid device: -71 [ 686.093191][ T4360] usbhid: probe of 1-1:0.0 failed with error -71 [ 686.796975][T13981] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.315501][ T4360] usb 1-1: USB disconnect, device number 12 [ 687.548152][T13993] device syzkaller0 entered promiscuous mode [ 687.554913][T13987] netlink: 'syz.2.2683': attribute type 1 has an invalid length. [ 687.595775][T13987] device bond1 entered promiscuous mode [ 687.601596][T13987] 8021q: adding VLAN 0 to HW filter on device bond1 [ 691.612548][T14024] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 693.543438][T14048] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 694.166845][T14057] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 694.175069][T14057] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 694.183586][T14057] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 695.486237][T14060] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.466796][T14089] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 697.519229][T14089] qrtr: Invalid version 46 [ 697.740053][T14091] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2708'. [ 697.767438][T14091] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 697.776222][T14091] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 697.784913][T14091] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 697.793672][T14091] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.819216][T14105] device syzkaller0 entered promiscuous mode [ 701.061294][T14111] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 701.728413][T14108] device syzkaller0 entered promiscuous mode [ 703.065118][T14125] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 704.081672][T14134] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 704.089953][T14134] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 704.098434][T14134] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 705.488927][T14153] device syzkaller0 entered promiscuous mode [ 708.646010][ T4277] Bluetooth: Frame is too long (len 55, expected len 22) [ 712.047886][ T26] audit: type=1326 audit(1783267099.249:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14189 comm="syz.2.2736" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f101b39de59 code=0x0 [ 712.130593][T14221] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 717.747240][T14262] device bond0 left promiscuous mode [ 717.809801][T14260] device syzkaller0 entered promiscuous mode [ 718.267293][T14271] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 718.320237][T14271] qrtr: Invalid version 46 [ 722.755352][T12489] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 723.725323][T12489] usb 4-1: Using ep0 maxpacket: 8 [ 724.924021][T12489] usb 4-1: unable to get BOS descriptor or descriptor too short [ 724.950358][T12489] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 724.959259][T12489] usb 4-1: can't read configurations, error -71 [ 725.483323][T14314] fuse: Bad value for 'fd' [ 726.600534][T14327] device syzkaller0 entered promiscuous mode [ 727.552329][T14332] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2773'. [ 727.563285][T14333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2773'. [ 727.573663][T14333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2773'. [ 728.321785][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.328225][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.334307][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.340408][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.346484][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.352551][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.358624][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.364670][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.370744][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.376833][T14336] tc action pedit 'at' offset 5 out of bounds [ 728.382882][T14336] 0: reclassify loop, rule prio 0, protocol 800 [ 729.103520][T14337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 729.366082][T14344] device syzkaller0 entered promiscuous mode [ 730.582370][ T4277] Bluetooth: Frame is too long (len 55, expected len 22) [ 730.658465][T14366] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 730.708538][T14366] qrtr: Invalid version 46 [ 731.776565][T14372] device syzkaller0 entered promiscuous mode [ 731.809147][ T4277] Bluetooth: hci0: Malformed LE Event: 0x0b [ 733.085358][T12490] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 733.365344][T12490] usb 1-1: Using ep0 maxpacket: 16 [ 733.609911][T12490] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 733.651492][T12490] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 733.799547][T12490] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 733.845118][T12490] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.015549][T12490] usb 1-1: Product: syz [ 734.020556][T12490] usb 1-1: Manufacturer: syz [ 734.034662][T12490] usb 1-1: SerialNumber: syz [ 734.534969][ T4277] Bluetooth: hci3: Malformed LE Event: 0x0b [ 734.537123][T12490] usb 1-1: 0:2 : does not exist [ 734.579797][T12490] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 735.920480][T12490] usb 1-1: USB disconnect, device number 13 [ 735.995670][T12779] udevd[12779]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 736.233814][T14409] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 736.242147][T14409] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 736.250642][T14409] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 736.260470][T12489] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 736.445316][T12489] usb 3-1: Using ep0 maxpacket: 8 [ 736.453155][T12489] usb 3-1: unable to get BOS descriptor or descriptor too short [ 736.480306][T12489] usb 3-1: config 14 has too many interfaces: 66, using maximum allowed: 32 [ 736.501663][T12489] usb 3-1: config 14 has an invalid descriptor of length 121, skipping remainder of the config [ 736.529842][T12489] usb 3-1: config 14 has 0 interfaces, different from the descriptor's value: 66 [ 736.547386][T12489] usb 3-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 736.565417][T12489] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.573776][T12489] usb 3-1: Product: syz [ 736.583528][T12489] usb 3-1: Manufacturer: syz [ 736.589865][T12489] usb 3-1: SerialNumber: syz [ 736.922856][ T4277] Bluetooth: hci4: Malformed LE Event: 0x0b [ 737.723473][ T4277] Bluetooth: hci4: Malformed LE Event: 0x0b [ 737.895566][T12489] usb 3-1: USB disconnect, device number 24 [ 738.039349][T12486] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 738.193573][T14438] NILFS (nullb0): couldn't find nilfs on the device [ 738.947786][T12486] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 741.262987][T12486] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 741.273068][T12486] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.291216][T12486] usb 1-1: config 0 descriptor?? [ 741.296869][T12486] usb 1-1: can't set config #0, error -71 [ 741.303556][T12486] usb 1-1: USB disconnect, device number 14 [ 743.447508][T14474] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 743.455834][T14474] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 743.464267][T14474] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 745.175298][ T4323] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 745.248643][T14476] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 745.375421][ T4323] usb 4-1: Using ep0 maxpacket: 8 [ 745.389511][ T4323] usb 4-1: unable to get BOS descriptor or descriptor too short [ 745.409836][ T4323] usb 4-1: config 14 has too many interfaces: 66, using maximum allowed: 32 [ 745.429096][ T4323] usb 4-1: config 14 has an invalid descriptor of length 121, skipping remainder of the config [ 745.445141][ T4323] usb 4-1: config 14 has 0 interfaces, different from the descriptor's value: 66 [ 745.459999][ T4323] usb 4-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 745.475096][ T4323] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.483393][ T4323] usb 4-1: Product: syz [ 745.492902][ T4323] usb 4-1: Manufacturer: syz [ 745.498662][ T4323] usb 4-1: SerialNumber: syz [ 746.143797][T14507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2821'. [ 746.169269][T14507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2821'. [ 746.180624][T14507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2821'. [ 747.202206][ T4323] usb 4-1: USB disconnect, device number 24 [ 747.257629][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.263954][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.737170][ T4277] Bluetooth: hci3: link tx timeout [ 748.742716][ T4277] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 748.756155][ T4277] Bluetooth: hci3: link tx timeout [ 748.762849][ T4277] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 748.771698][ T4277] Bluetooth: hci3: link tx timeout [ 748.777078][ T4277] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 748.885467][ T4277] Bluetooth: hci3: link tx timeout [ 748.890635][ T4277] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 748.915580][ T4277] Bluetooth: hci3: link tx timeout [ 748.920762][ T4277] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 749.873438][T14546] netlink: 'syz.3.2830': attribute type 1 has an invalid length. [ 749.996964][T14546] device bond0 entered promiscuous mode [ 750.057012][T14546] 8021q: adding VLAN 0 to HW filter on device bond0 [ 750.090382][T14559] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2834'. [ 750.775768][ T4277] Bluetooth: hci3: command 0x0406 tx timeout [ 750.864129][ T4281] Bluetooth: Frame is too long (len 55, expected len 22) [ 753.161381][T14580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 758.500770][T14623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 758.807659][ T4277] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 758.817441][ T4277] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 758.826091][ T4277] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 758.833681][ T4277] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 758.847714][ T4277] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 758.859802][ T4277] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 758.953149][ T4338] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.169456][ T4338] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.209091][T14633] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 759.758151][ T4338] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 760.224263][ T4338] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 760.415548][T14644] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2856'. [ 760.450756][T14644] IPVS: Unknown mcast interface: vcan0 [ 760.858651][T14622] chnl_net:caif_netlink_parms(): no params data found [ 760.936423][ T4281] Bluetooth: hci0: command 0x0409 tx timeout [ 761.712943][T14653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 762.232327][ T4338] tipc: Left network mode [ 763.168203][ T4281] Bluetooth: hci0: command 0x041b tx timeout [ 763.707983][T14682] tipc: Enabled bearer , priority 0 [ 763.938564][T14682] tipc: Resetting bearer [ 763.981453][T14622] bridge0: port 1(bridge_slave_0) entered blocking state [ 764.032641][T14622] bridge0: port 1(bridge_slave_0) entered disabled state [ 764.084489][T14622] device bridge_slave_0 entered promiscuous mode [ 764.334513][T14710] NILFS (nullb0): couldn't find nilfs on the device [ 765.175651][ T4277] Bluetooth: hci0: command 0x040f tx timeout [ 765.386727][T14671] tipc: Disabling bearer [ 765.449859][T14622] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.475630][T14622] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.507511][T14622] device bridge_slave_1 entered promiscuous mode [ 767.255339][ T4277] Bluetooth: hci0: command 0x0419 tx timeout [ 767.831507][T14622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 767.925310][ T7] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 767.938298][T14622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 767.946942][ T4277] Bluetooth: Frame is too long (len 55, expected len 22) [ 768.110715][T14622] team0: Port device team_slave_0 added [ 768.126319][ T7] usb 3-1: Using ep0 maxpacket: 8 [ 768.137329][ T7] usb 3-1: unable to get BOS descriptor or descriptor too short [ 768.150808][T14622] team0: Port device team_slave_1 added [ 768.275441][ T7] usb 3-1: config 14 has too many interfaces: 66, using maximum allowed: 32 [ 768.438188][ T7] usb 3-1: config 14 has an invalid descriptor of length 121, skipping remainder of the config [ 768.534344][ T7] usb 3-1: config 14 has 0 interfaces, different from the descriptor's value: 66 [ 768.692552][ T7] usb 3-1: string descriptor 0 read error: -71 [ 768.715167][ T7] usb 3-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 768.777626][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.855138][ T7] usb 3-1: can't set config #14, error -71 [ 768.862760][ T7] usb 3-1: USB disconnect, device number 25 [ 768.896584][T14622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 768.908197][T14622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 769.372510][T14622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 769.459562][T14622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 769.480586][T14622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 769.594238][T14622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 769.638013][T14756] tipc: Enabling of bearer rejected, failed to enable media [ 769.824709][T14622] device hsr_slave_0 entered promiscuous mode [ 769.845602][T14622] device hsr_slave_1 entered promiscuous mode [ 769.883795][T14622] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 769.917071][T14622] Cannot create hsr debugfs directory [ 769.925496][T12483] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 769.982297][ T4338] device hsr_slave_0 left promiscuous mode [ 769.998008][ T4338] device hsr_slave_1 left promiscuous mode [ 770.024532][ T4338] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 770.049979][ T4338] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 770.081317][ T4338] device bridge_slave_1 left promiscuous mode [ 770.099868][ T4338] bridge0: port 2(bridge_slave_1) entered disabled state [ 770.115620][T12483] usb 3-1: Using ep0 maxpacket: 16 [ 770.125148][T12483] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.266851][T12483] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 770.310245][T12483] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 770.330530][T12483] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.341147][T12483] usb 3-1: Product: syz [ 770.351345][T12483] usb 3-1: Manufacturer: syz [ 770.361526][T12483] usb 3-1: SerialNumber: syz [ 770.502320][ T4338] device bridge_slave_0 left promiscuous mode [ 770.656851][T14758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 770.667678][T14758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 770.676093][ T4338] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.685137][ T4277] Bluetooth: hci1: Malformed LE Event: 0x0b [ 770.689911][T14758] [U]  [ 770.696514][T14758] [U] K{ [ 770.709019][T14758] [U] T 1ŠFFˊ`GJǘGO/MC [ 770.720334][T14758] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 770.737473][T14758] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 770.758032][ T4338] bond1 (unregistering): Released all slaves [ 770.770635][T14758] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 770.847973][ T26] audit: type=1326 audit(1783267158.049:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.4.2880" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f343db9de59 code=0x0 [ 770.928375][T14758] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 770.995685][T14758] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 771.051798][T14758] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 771.134655][T14758] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/< rejected, failed to enable media [ 799.165478][ T7522] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 800.085493][ T7522] usb 4-1: Using ep0 maxpacket: 8 [ 800.103394][ T7522] usb 4-1: unable to get BOS descriptor or descriptor too short [ 800.144328][ T7522] usb 4-1: config 14 has too many interfaces: 66, using maximum allowed: 32 [ 800.153840][ T7522] usb 4-1: config 14 has an invalid descriptor of length 121, skipping remainder of the config [ 800.164938][ T7522] usb 4-1: config 14 has 0 interfaces, different from the descriptor's value: 66 [ 800.186332][ T7522] usb 4-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 800.218546][ T7522] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.319759][ T7522] usb 4-1: Product: syz [ 800.334315][ T7522] usb 4-1: Manufacturer: syz [ 800.344466][ T7522] usb 4-1: SerialNumber: syz [ 801.179415][ T7522] usb 4-1: can't set config #14, error -71 [ 801.295768][ T7522] usb 4-1: USB disconnect, device number 27 [ 802.585190][T15109] netlink: 'syz.4.2946': attribute type 1 has an invalid length. [ 802.639800][T15109] device bond4 entered promiscuous mode [ 802.781275][T15109] 8021q: adding VLAN 0 to HW filter on device bond4 [ 803.445510][ T7522] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 803.588444][ T26] audit: type=1326 audit(1783267190.789:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15106 comm="syz.2.2949" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f101b39de59 code=0x0 [ 803.657042][ T7522] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 803.705812][ T7522] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 803.724461][ T7522] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 803.749329][ T7522] usb 1-1: config 0 descriptor?? [ 803.962537][ T7522] usbhid 1-1:0.0: can't add hid device: -71 [ 803.975969][ T7522] usbhid: probe of 1-1:0.0 failed with error -71 [ 804.013281][ T7522] usb 1-1: USB disconnect, device number 15 [ 805.015521][ T7522] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 805.257544][ T7522] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 805.757155][ T7522] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 805.878652][ T7522] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 805.947698][ T7522] usb 1-1: config 0 descriptor?? [ 806.202778][ T7522] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 806.221092][ T7522] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input21 [ 806.330226][ T7522] usb 1-1: USB disconnect, device number 16 [ 806.336326][ C0] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 806.567831][T15163] NILFS (nullb0): couldn't find nilfs on the device [ 808.970476][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.993017][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.495576][ T7] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 809.717865][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 809.765034][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 810.024785][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 810.303847][ T7] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 810.317555][ T7] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 810.326977][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.405104][ T7] usb 4-1: config 0 descriptor?? [ 811.928266][ T7] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 812.022893][T15217] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 812.033288][T15217] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 812.574169][ T7] microsoft 0003:045E:07DA.0002: ignoring exceeding usage max [ 812.593840][ T7] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0002/input/input23 [ 813.103905][ T7] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 814.205361][ T7] usb 4-1: USB disconnect, device number 28 [ 816.361747][T15247] fido_id[15247]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 816.533009][ T4277] Bluetooth: Frame is too long (len 55, expected len 22) [ 817.203094][T15271] netlink: 'syz.1.2977': attribute type 1 has an invalid length. [ 817.281272][T15271] device bond1 entered promiscuous mode [ 817.305009][T15271] 8021q: adding VLAN 0 to HW filter on device bond1 [ 818.949834][T10329] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.322919][T10329] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.425601][T10329] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 819.436120][T15291] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 819.468019][T15298] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2984'. [ 819.875556][ T3601] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 820.218302][ T3601] usb 2-1: Using ep0 maxpacket: 8 [ 820.424864][ T3601] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 820.475905][ T3601] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 820.486149][ T3601] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 820.631630][ T3601] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 820.805965][ T3601] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.941115][ T3601] usb 2-1: Product: syz [ 821.007109][ T3601] usb 2-1: Manufacturer: syz [ 821.064898][ T3601] usb 2-1: SerialNumber: syz [ 821.079833][ T3601] usb 2-1: config 0 descriptor?? [ 821.326685][ T3601] usb 2-1: USB disconnect, device number 23 [ 821.402709][T15325] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 821.568826][T15328] netlink: 'syz.3.2994': attribute type 1 has an invalid length. [ 821.621324][T15328] device bond2 entered promiscuous mode [ 821.632472][T15328] 8021q: adding VLAN 0 to HW filter on device bond2 [ 822.324427][T15347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 827.055907][T15416] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 827.100072][T15416] qrtr: Invalid version 46 [ 829.800949][T15425] can0: slcan on ptm0. [ 831.527866][T15418] can0 (unregistered): slcan off ptm0. [ 833.868334][T15454] device syzkaller0 entered promiscuous mode [ 836.725950][T15483] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3033'. [ 836.738919][T15483] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.747927][T15483] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.756683][T15483] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.765713][T15483] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 837.554191][T15484] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 837.998006][T15490] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 838.041637][T15490] qrtr: Invalid version 46 [ 840.286173][ T128] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 840.573259][ T128] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 840.735463][ T128] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 840.785859][ T128] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 840.802425][ T128] usb 3-1: config 0 descriptor?? [ 841.030321][ T128] usbhid 3-1:0.0: can't add hid device: -71 [ 841.042203][ T128] usbhid: probe of 3-1:0.0 failed with error -71 [ 841.062393][ T128] usb 3-1: USB disconnect, device number 29 [ 841.117215][T15510] device syzkaller0 entered promiscuous mode [ 841.607420][ T128] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 841.806652][ T128] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 841.855501][ T128] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 841.938450][ T128] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.978469][ T128] usb 3-1: config 0 descriptor?? [ 842.410601][ T4281] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 842.430222][ T4281] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 842.448570][ T4281] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 842.462119][ T4281] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 842.475736][ T4281] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 842.483170][ T4281] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 842.827823][ T128] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 842.866631][ T128] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input24 [ 842.900087][ C0] ================================================================================ [ 842.909441][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 842.918164][ C0] index 6691 is out of range for type 'const int[34]' [ 842.924947][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 842.931961][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 842.942019][ C0] Call Trace: [ 842.945360][ C0] [ 842.948249][ C0] dump_stack_lvl+0x188/0x24e [ 842.953008][ C0] ? show_regs_print_info+0x12/0x12 [ 842.958220][ C0] ? load_image+0x410/0x410 [ 842.962788][ C0] ubsan_epilogue+0xa/0x30 [ 842.967249][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 842.973096][ C0] aiptek_irq+0x1e87/0x28f0 [ 842.977694][ C0] ? kcov_remote_start+0x86/0x7e0 [ 842.982815][ C0] ? led_trigger_blink_setup+0x37/0x230 [ 842.988453][ C0] __usb_hcd_giveback_urb+0x35d/0x520 [ 842.993931][ C0] dummy_timer+0xa21/0x3420 [ 842.998587][ C0] ? dummy_free_streams+0x520/0x520 [ 843.003837][ C0] __hrtimer_run_queues+0x522/0xc90 [ 843.009139][ C0] ? dummy_free_streams+0x520/0x520 [ 843.014381][ C0] ? hrtimer_interrupt+0x980/0x980 [ 843.019532][ C0] hrtimer_run_softirq+0x173/0x290 [ 843.024684][ C0] handle_softirqs+0x291/0x910 [ 843.029546][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 843.034429][ C0] ? do_softirq+0x210/0x210 [ 843.038952][ C0] ? hrtimer_interrupt+0x775/0x980 [ 843.044094][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 843.049391][ C0] __irq_exit_rcu+0x13b/0x230 [ 843.054091][ C0] ? irq_exit_rcu+0x20/0x20 [ 843.058630][ C0] irq_exit_rcu+0x5/0x20 [ 843.062903][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 843.068632][ C0] [ 843.071659][ C0] [ 843.074658][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 843.080726][ C0] RIP: 0010:default_idle+0xb/0x10 [ 843.085778][ C0] Code: 48 89 df e8 67 01 99 f7 e9 44 ff ff ff e8 8d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d f7 60 4c 00 fb f4 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48 [ 843.105569][ C0] RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6 [ 843.111738][ C0] RAX: 6236c61fc914e600 RBX: ffffffff8a3a4b17 RCX: 6236c61fc914e600 [ 843.119739][ C0] RDX: 0000000000000001 RSI: ffffffff8a8c17a0 RDI: ffffffff8adf42e0 [ 843.127739][ C0] RBP: ffffffff8c807ec0 R08: ffff8880b8e3580b R09: 1ffff110171c6b01 [ 843.135731][ C0] R10: dffffc0000000000 R11: ffffed10171c6b02 R12: 0000000000000000 [ 843.143721][ C0] R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc [ 843.151722][ C0] ? default_idle_call+0x77/0xc0 [ 843.156701][ C0] default_idle_call+0x84/0xc0 [ 843.161490][ C0] do_idle+0x3a2/0x680 [ 843.165672][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 843.170906][ C0] ? asm_sysvec_call_function_single+0x16/0x20 [ 843.177101][ C0] ? schedule_idle+0x57/0x90 [ 843.181801][ C0] cpu_startup_entry+0x3f/0x60 [ 843.186598][ C0] rest_init+0x2dc/0x300 [ 843.190868][ C0] ? time_init+0x33/0x33 [ 843.195223][ C0] arch_call_rest_init+0xa/0xa [ 843.200009][ C0] start_kernel+0x493/0x53c [ 843.204541][ C0] secondary_startup_64_no_verify+0xcf/0xdb [ 843.210511][ C0] [ 843.213546][ C0] ================================================================================ [ 843.222874][ C0] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 843.230119][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 843.237148][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 843.247195][ C0] Call Trace: [ 843.250464][ C0] [ 843.253332][ C0] dump_stack_lvl+0x188/0x24e [ 843.258008][ C0] ? memcpy+0x3c/0x60 [ 843.262041][ C0] ? show_regs_print_info+0x12/0x12 [ 843.267230][ C0] ? load_image+0x410/0x410 [ 843.271725][ C0] panic+0x2d3/0x710 [ 843.275612][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 843.280115][ C0] check_panic_on_warn+0x80/0xa0 [ 843.285107][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 843.290822][ C0] aiptek_irq+0x1e87/0x28f0 [ 843.295313][ C0] ? kcov_remote_start+0x86/0x7e0 [ 843.300350][ C0] ? led_trigger_blink_setup+0x37/0x230 [ 843.305911][ C0] __usb_hcd_giveback_urb+0x35d/0x520 [ 843.311316][ C0] dummy_timer+0xa21/0x3420 [ 843.315850][ C0] ? dummy_free_streams+0x520/0x520 [ 843.321044][ C0] __hrtimer_run_queues+0x522/0xc90 [ 843.326233][ C0] ? dummy_free_streams+0x520/0x520 [ 843.331424][ C0] ? hrtimer_interrupt+0x980/0x980 [ 843.336527][ C0] hrtimer_run_softirq+0x173/0x290 [ 843.341629][ C0] handle_softirqs+0x291/0x910 [ 843.346380][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 843.351216][ C0] ? do_softirq+0x210/0x210 [ 843.355716][ C0] ? hrtimer_interrupt+0x775/0x980 [ 843.360839][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 843.366026][ C0] __irq_exit_rcu+0x13b/0x230 [ 843.370689][ C0] ? irq_exit_rcu+0x20/0x20 [ 843.375186][ C0] irq_exit_rcu+0x5/0x20 [ 843.379430][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 843.385055][ C0] [ 843.387970][ C0] [ 843.390886][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 843.396858][ C0] RIP: 0010:default_idle+0xb/0x10 [ 843.401872][ C0] Code: 48 89 df e8 67 01 99 f7 e9 44 ff ff ff e8 8d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d f7 60 4c 00 fb f4 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48 [ 843.421475][ C0] RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6 [ 843.427622][ C0] RAX: 6236c61fc914e600 RBX: ffffffff8a3a4b17 RCX: 6236c61fc914e600 [ 843.435582][ C0] RDX: 0000000000000001 RSI: ffffffff8a8c17a0 RDI: ffffffff8adf42e0 [ 843.443550][ C0] RBP: ffffffff8c807ec0 R08: ffff8880b8e3580b R09: 1ffff110171c6b01 [ 843.451521][ C0] R10: dffffc0000000000 R11: ffffed10171c6b02 R12: 0000000000000000 [ 843.459489][ C0] R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc [ 843.467465][ C0] ? default_idle_call+0x77/0xc0 [ 843.472412][ C0] default_idle_call+0x84/0xc0 [ 843.477164][ C0] do_idle+0x3a2/0x680 [ 843.481229][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 843.486422][ C0] ? asm_sysvec_call_function_single+0x16/0x20 [ 843.492568][ C0] ? schedule_idle+0x57/0x90 [ 843.497153][ C0] cpu_startup_entry+0x3f/0x60 [ 843.501921][ C0] rest_init+0x2dc/0x300 [ 843.506178][ C0] ? time_init+0x33/0x33 [ 843.510449][ C0] arch_call_rest_init+0xa/0xa [ 843.515220][ C0] start_kernel+0x493/0x53c [ 843.519759][ C0] secondary_startup_64_no_verify+0xcf/0xdb [ 843.525660][ C0] [ 843.528940][ C0] Kernel Offset: disabled [ 843.533281][ C0] Rebooting in 86400 seconds..