last executing test programs: 6m23.459276992s ago: executing program 1 (id=296): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x0, &(0x7f0000000100)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x80049370, 0x1000000000000) 6m23.300260045s ago: executing program 1 (id=298): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)=""/81, 0x51}], 0x1}, 0x0) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0300000004000000040000000a00000000", @ANYRES32=0x0, @ANYBLOB="0400"/18, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000857d92b7d54277093c2b692213bc53f9d14192f757add8c6b9a8a1b74fbbdc4c198f156693672535624cc075eb0046244131a15d31"], 0x50) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000851000000300000018000000000000000000000000000000950000000000000095000000"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r8, 0x58, &(0x7f0000000600)}, 0x10) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, 0x0) 6m21.159799149s ago: executing program 1 (id=300): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080), 0x8) ioctl$PTP_PEROUT_REQUEST2(0xffffffffffffffff, 0x40383d0c, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) io_setup(0x20, &(0x7f0000001140)) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000000)='4', 0x1}], 0x1) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r2 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000480)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) 5m57.337821187s ago: executing program 32 (id=315): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000480)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) 18.724181338s ago: executing program 4 (id=919): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="1000000003142302"], 0x10}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ptrace$ARCH_GET_GS(0x1e, 0x0, 0x0, 0x1004) ioprio_get$pid(0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) readlinkat(0xffffffffffffff9c, 0x0, 0xfffffffffffffffe, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000380)=@urb_type_control={0x2, {}, 0x0, 0x61, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$USBDEVFS_REAPURB(r5, 0x4004550d, &(0x7f0000001080)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x4040000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) getrlimit(0x0, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000061195400000000009500000000000000675c783586cc9867f244"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) 11.191697509s ago: executing program 4 (id=932): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000f8000000bca300000e0000002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff02000015010000033800001d13fcff000000007a0bf0ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe8a, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27}, 0x48) 10.294112183s ago: executing program 4 (id=934): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1e, 0x0, 0x6, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x28, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) write(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 10.290904604s ago: executing program 3 (id=935): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@getnexthop={0x34, 0x6a, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@NHA_GROUPS={0x4}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x24}}, 0x0) syz_usb_connect$uac1(0x6, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x9, 0x9936c5154318bee0, 0x8}}]}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 10.129687181s ago: executing program 5 (id=937): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'syz_tun\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000) 10.058104656s ago: executing program 4 (id=938): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000003c0)='./file0\x00', &(0x7f00000001c0)='./file0/../file0\x00') 9.194104577s ago: executing program 4 (id=941): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080), 0x8) ioctl$PTP_PEROUT_REQUEST2(0xffffffffffffffff, 0x40383d0c, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r2 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) readlinkat(0xffffffffffffff9c, 0x0, 0xfffffffffffffffe, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000380)=@urb_type_control={0x2, {}, 0x0, 0x61, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$USBDEVFS_REAPURB(r5, 0x4004550d, &(0x7f0000001080)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x4040000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) getrlimit(0x0, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000061195400000000009500000000000000675c783586cc9867f244"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) 9.131947672s ago: executing program 3 (id=943): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad60", @ANYRES32=0x0], 0x50}}, 0x4000084) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000009000000440003800800010002000000140002007663616e3000000000000000000000000800030000000000140006"], 0x58}}, 0x200040d4) 8.992619898s ago: executing program 3 (id=944): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1022002, 0x0) r2 = dup(r1) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 8.328022401s ago: executing program 3 (id=945): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x10, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00004c2000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000150000/0x1000)=nil, &(0x7f0000b21000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00004c2000/0x1000)=nil, &(0x7f000069c000/0x2000)=nil, &(0x7f0000184000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x10) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\''], 0x50) io_uring_enter(r0, 0x2219, 0x1adf, 0x16, 0x0, 0x0) 8.326389669s ago: executing program 5 (id=946): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000180)) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) 8.116507331s ago: executing program 0 (id=948): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1e, 0x0, 0x6, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x28, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) write(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 7.56311628s ago: executing program 0 (id=949): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240"], 0x7c}, 0x1, 0x0, 0x0, 0x6004041}, 0x4000000) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) syz_open_procfs$namespace(0x0, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7, 0x0, 0x7}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000069112800000000008510000002000000850000000500000095000000000000009500a50500fb00"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f0000000c40)={{0x80}, 'port1\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x1000003, 0x4, 0xfffffffd, 0x0, 0x7cce8c743ee810df}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ac1e0101000000000000000000000000fe8000"/45, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb000004d333000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/167], 0x184}, 0x1, 0x0, 0x0, 0x4044850}, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r1, &(0x7f0000000840)=""/40, 0x28) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x101000, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000000)={0xd, @tick=0x9, 0x40, {0xc0, 0xff}, 0x42, 0x1, 0x1}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724f, 0x0, 0x55a}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000000000)={0x2, 0x0, 0x2, 0x791b}) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b0400000000000000000200fffe240004802000018007000100637400"], 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x77, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r5 = fcntl$dupfd(r4, 0x406, r4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xe4}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008090) 7.136551797s ago: executing program 5 (id=951): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1279000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) getrlimit(0xa, &(0x7f0000000280)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b00000000010000081100000900000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000a134f5233b701e88159e0bb959df0c63255f9eaf6f2fa366417a4377b0cb3095291ca4c3e36ba27139cf6a2dcd5bd776f665a8a9bd3e73cef1c3d93de8aba5d1cc408c561ef55707cd77710bcd210de41606cf524c7e10636534b2929fa7215ae39309d38a8b947946"], 0x50) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r3}, 0x38) 7.101106292s ago: executing program 0 (id=952): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4, r1, 0x0}]) modify_ldt$write2(0x11, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) socket(0x2, 0x80805, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x50}, 0xc0) 6.726980847s ago: executing program 2 (id=953): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@getnexthop={0x34, 0x6a, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@NHA_GROUPS={0x4}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x24}}, 0x0) syz_usb_connect$uac1(0x6, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x9, 0x9936c5154318bee0, 0x8}}]}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 6.511847245s ago: executing program 4 (id=954): r0 = socket(0x10, 0x80002, 0x0) r1 = syz_open_procfs(0x0, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1000"], 0x10}}, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000000)='asymmetric\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) getpid() r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1, 0x0, 0x0, 0x8000000}, 0x48043) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f00000002c0)=ANY=[@ANYBLOB="726177020000000000000066490000000000000000000000000000000000000002"], 0x48) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r6, 0x0, 0x97, 0x8000000}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff07bbbf7f00931c07b2fd"], 0x1c}}, 0x0) recvmmsg$unix(r0, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1004}], 0x1}}], 0x8, 0x34000, 0x0) 6.049286122s ago: executing program 33 (id=954): r0 = socket(0x10, 0x80002, 0x0) r1 = syz_open_procfs(0x0, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1000"], 0x10}}, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000000)='asymmetric\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) getpid() r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1, 0x0, 0x0, 0x8000000}, 0x48043) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f00000002c0)=ANY=[@ANYBLOB="726177020000000000000066490000000000000000000000000000000000000002"], 0x48) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r6, 0x0, 0x97, 0x8000000}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff07bbbf7f00931c07b2fd"], 0x1c}}, 0x0) recvmmsg$unix(r0, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1004}], 0x1}}], 0x8, 0x34000, 0x0) 6.038321685s ago: executing program 5 (id=956): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x820) 5.823532809s ago: executing program 2 (id=957): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0xfe, 0x0, 0x7fffffff}]}) close_range(r0, 0xffffffffffffffff, 0x0) 5.822966872s ago: executing program 0 (id=958): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="1000000003142302"], 0x10}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ptrace$ARCH_GET_GS(0x1e, 0x0, 0x0, 0x1004) ioprio_get$pid(0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) readlinkat(0xffffffffffffff9c, 0x0, 0xfffffffffffffffe, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000380)=@urb_type_control={0x2, {}, 0x0, 0x61, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$USBDEVFS_REAPURB(r5, 0x4004550d, &(0x7f0000001080)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x4040000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) getrlimit(0x0, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000061195400000000009500000000000000675c783586cc9867f244"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) 5.810498179s ago: executing program 5 (id=959): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1e, 0x0, 0x6, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x28, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) write(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.66923831s ago: executing program 2 (id=960): read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000240)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000100)={0x1d, r2, 0x2, {0x2, 0x0, 0x1}, 0xfd}, 0x18) 5.431825721s ago: executing program 5 (id=961): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$TCSETSF2(r3, 0x402c542d, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r3, 0xc0207511, &(0x7f0000000140)={0x0, 0xffff, 0x0, 0x0, r0}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r4, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000001780)={0x24, 0x4, 0x8, 0x301, 0x0, 0x0, {}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8917}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000010}, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f00000000c0)=@usbdevfs_connect) kexec_load(0x0, 0x1, &(0x7f00000002c0)=[{0x0, 0x0, 0x40000000, 0x1980000}], 0x0) 4.84180154s ago: executing program 3 (id=962): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000b80)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fadvise64(0xffffffffffffffff, 0x1, 0x0, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00'}) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x1, 0x20008000) r4 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3, 0x2f, 0x10, {0x2, 0x4e22, @empty}}, 0x80, 0x0, 0x0, 0x0, 0x10b8}, 0x8000) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "be45f415d19a877b", "53a8e8ba641839da93589ef68e3aace9", "d6c25a50", "12b78d5d9ab7ce57"}, 0x28) 4.665446629s ago: executing program 2 (id=963): prlimit64(0x0, 0xe, 0x0, 0x0) getpid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e04023920"], 0x7) socket$inet(0x2, 0x3, 0xd) add_key(0x0, &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) 4.549478797s ago: executing program 0 (id=964): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080), 0x8) ioctl$PTP_PEROUT_REQUEST2(0xffffffffffffffff, 0x40383d0c, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r2 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) getrlimit(0xa, &(0x7f0000000280)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b00000000010000081100000900000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000a134f5233b701e88159e0bb959df0c63255f9eaf6f2fa366417a4377b0cb3095291ca4c3e36ba27139cf6a2dcd5bd776f665a8a9bd3e73cef1c3d93de8aba5d1cc408c561ef55707cd77710bcd210de41606cf524c7e10636534b2929fa7215ae39309d38a8b947946"], 0x50) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r3}, 0x38) 3.140311892s ago: executing program 2 (id=966): socket$igmp(0x2, 0x3, 0x2) socket$inet_icmp(0x2, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000001000)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@mask_fadd={0x58, 0x118, 0x8, {{0xfffffffc, 0x1}, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x200010000000}}], 0x58}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='dummy_hcd.0', 0xb) 0s ago: executing program 3 (id=967): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4, r1, 0x0}]) modify_ldt$write2(0x11, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) socket(0x2, 0x80805, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x50}, 0xc0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.34' (ED25519) to the list of known hosts. [ 89.429095][ T5584] cgroup: Unknown subsys name 'net' [ 89.691314][ T5584] cgroup: Unknown subsys name 'cpuset' [ 89.764142][ T5584] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.751985][ T5584] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.010479][ T10] cfg80211: failed to load regulatory.db [ 94.577531][ T5605] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 94.590238][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 94.624465][ T5609] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 94.629051][ T5613] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 94.647751][ T5609] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 94.648882][ T5609] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.650031][ T5609] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.662677][ T5613] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 94.675260][ T59] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 94.705165][ T5614] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 94.709671][ T5614] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 94.721604][ T5614] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 94.724088][ T5614] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 94.729521][ T5614] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 94.748932][ T5614] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 94.751012][ T5614] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 94.760272][ T5614] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 94.768971][ T5615] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 94.769103][ T5614] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 94.792071][ T5615] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 94.799726][ T5614] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 94.800130][ T5614] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 94.817847][ T5615] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 94.839507][ T4913] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 94.929403][ T5615] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.764624][ T5602] Bluetooth: hci0: command tx timeout [ 96.924644][ T4913] Bluetooth: hci1: command tx timeout [ 96.924842][ T5602] Bluetooth: hci4: command tx timeout [ 97.004027][ T5602] Bluetooth: hci3: command tx timeout [ 97.013394][ T5602] Bluetooth: hci2: command tx timeout [ 97.642761][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.646009][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.646572][ T5599] bridge_slave_0: entered allmulticast mode [ 97.661705][ T5599] bridge_slave_0: entered promiscuous mode [ 97.707639][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.707758][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.707930][ T5596] bridge_slave_0: entered allmulticast mode [ 97.709860][ T5596] bridge_slave_0: entered promiscuous mode [ 97.760902][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.760990][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.761159][ T5599] bridge_slave_1: entered allmulticast mode [ 97.769670][ T5599] bridge_slave_1: entered promiscuous mode [ 97.820268][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.820394][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.820563][ T5596] bridge_slave_1: entered allmulticast mode [ 97.822755][ T5596] bridge_slave_1: entered promiscuous mode [ 97.832929][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.833235][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.839426][ T5597] bridge_slave_0: entered allmulticast mode [ 97.847950][ T5597] bridge_slave_0: entered promiscuous mode [ 97.896345][ T5598] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.896474][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.896863][ T5598] bridge_slave_0: entered allmulticast mode [ 97.898789][ T5598] bridge_slave_0: entered promiscuous mode [ 97.900365][ T5600] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.900549][ T5600] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.900708][ T5600] bridge_slave_0: entered allmulticast mode [ 97.902900][ T5600] bridge_slave_0: entered promiscuous mode [ 97.989936][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.990052][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.990408][ T5597] bridge_slave_1: entered allmulticast mode [ 97.992239][ T5597] bridge_slave_1: entered promiscuous mode [ 98.032153][ T5598] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.032320][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.032491][ T5598] bridge_slave_1: entered allmulticast mode [ 98.056698][ T5598] bridge_slave_1: entered promiscuous mode [ 98.059706][ T5600] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.059825][ T5600] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.060604][ T5600] bridge_slave_1: entered allmulticast mode [ 98.079170][ T5600] bridge_slave_1: entered promiscuous mode [ 98.138660][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.189683][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.217730][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.263779][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.268677][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.301769][ T5598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.316542][ T5600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.347068][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.377153][ T5598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.380064][ T5600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.434644][ T5599] team0: Port device team_slave_0 added [ 98.480697][ T5596] team0: Port device team_slave_0 added [ 98.504370][ T5599] team0: Port device team_slave_1 added [ 98.544400][ T5596] team0: Port device team_slave_1 added [ 98.546876][ T5597] team0: Port device team_slave_0 added [ 98.578270][ T5598] team0: Port device team_slave_0 added [ 98.580781][ T5600] team0: Port device team_slave_0 added [ 98.606507][ T5597] team0: Port device team_slave_1 added [ 98.628897][ T5598] team0: Port device team_slave_1 added [ 98.630884][ T5600] team0: Port device team_slave_1 added [ 98.668862][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.668875][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.668895][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.731969][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.731983][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.732003][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.787834][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.787853][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.787882][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.843608][ T5602] Bluetooth: hci0: command tx timeout [ 98.878821][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.878840][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.878870][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.880427][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.880438][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.880457][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.978066][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.978079][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.978098][ T5598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.003483][ T4913] Bluetooth: hci1: command tx timeout [ 99.003524][ T5602] Bluetooth: hci4: command tx timeout [ 99.042695][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.042708][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.042727][ T5600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.065115][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.065134][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.065239][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.083573][ T4913] Bluetooth: hci2: command tx timeout [ 99.083605][ T4913] Bluetooth: hci3: command tx timeout [ 99.092842][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.092887][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.092962][ T5598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.596105][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.596119][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.596139][ T5600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.767911][ T5599] hsr_slave_0: entered promiscuous mode [ 99.769075][ T5599] hsr_slave_1: entered promiscuous mode [ 99.803130][ T5596] hsr_slave_0: entered promiscuous mode [ 99.810556][ T5596] hsr_slave_1: entered promiscuous mode [ 99.811530][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 99.811621][ T5596] Cannot create hsr debugfs directory [ 99.877368][ T5597] hsr_slave_0: entered promiscuous mode [ 99.878404][ T5597] hsr_slave_1: entered promiscuous mode [ 99.879125][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 99.879142][ T5597] Cannot create hsr debugfs directory [ 99.909065][ T5598] hsr_slave_0: entered promiscuous mode [ 99.910124][ T5598] hsr_slave_1: entered promiscuous mode [ 99.910792][ T5598] debugfs: 'hsr0' already exists in 'hsr' [ 99.910810][ T5598] Cannot create hsr debugfs directory [ 99.934251][ T5600] hsr_slave_0: entered promiscuous mode [ 99.938061][ T5600] hsr_slave_1: entered promiscuous mode [ 99.941056][ T5600] debugfs: 'hsr0' already exists in 'hsr' [ 99.941122][ T5600] Cannot create hsr debugfs directory [ 100.923831][ T5602] Bluetooth: hci0: command tx timeout [ 101.002759][ T5599] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 101.066709][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.071880][ T5599] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 101.083987][ T4913] Bluetooth: hci1: command tx timeout [ 101.086325][ T5602] Bluetooth: hci4: command tx timeout [ 101.110644][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.113880][ T5599] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 101.158706][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.166022][ T5602] Bluetooth: hci2: command tx timeout [ 101.177397][ T5602] Bluetooth: hci3: command tx timeout [ 101.206810][ T5599] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 101.227907][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.349370][ T5597] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 101.389050][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.398647][ T5597] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 101.437007][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.460971][ T5597] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 101.497291][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.522142][ T5597] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 101.558892][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.719542][ T5598] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 101.759346][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.772999][ T5598] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 101.807363][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.812847][ T5598] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 101.840501][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.871946][ T5598] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 101.896600][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.080099][ T5596] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 102.118372][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.136255][ T5596] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 102.172444][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.204590][ T5596] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 102.241237][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.255644][ T5596] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 102.292340][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.470391][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.470789][ T5600] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.506888][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.526831][ T5600] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.567308][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.584538][ T5600] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.617194][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.632093][ T5600] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.658516][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.741477][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.761011][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.811114][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.811294][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.885487][ T2393] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.885640][ T2393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.941800][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.983972][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.993069][ T2393] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.004003][ T5602] Bluetooth: hci0: command tx timeout [ 103.015290][ T2393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.066667][ T2393] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.066823][ T2393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.155210][ T5598] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.163729][ T5602] Bluetooth: hci4: command tx timeout [ 103.163762][ T5602] Bluetooth: hci1: command tx timeout [ 103.229878][ T1173] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.230030][ T1173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.243526][ T4913] Bluetooth: hci3: command tx timeout [ 103.243558][ T4913] Bluetooth: hci2: command tx timeout [ 103.298800][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.312594][ T1173] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.312731][ T1173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.499985][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.561118][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.601585][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.601797][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.681883][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.682015][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.758812][ T5600] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.852313][ T2393] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.852450][ T2393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.006337][ T1173] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.006472][ T1173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.400603][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.880163][ T5599] veth0_vlan: entered promiscuous mode [ 104.993494][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.051023][ T5599] veth1_vlan: entered promiscuous mode [ 105.363238][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.443704][ T5597] veth0_vlan: entered promiscuous mode [ 105.446709][ T5599] veth0_macvtap: entered promiscuous mode [ 105.485492][ T5599] veth1_macvtap: entered promiscuous mode [ 105.565210][ T5597] veth1_vlan: entered promiscuous mode [ 105.681800][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.748848][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.752348][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.861467][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.888631][ T5597] veth0_macvtap: entered promiscuous mode [ 105.902837][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.919275][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.920645][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.957362][ T5597] veth1_macvtap: entered promiscuous mode [ 105.972921][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.284678][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.456847][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.536622][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.562519][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.562766][ T5596] veth0_vlan: entered promiscuous mode [ 106.587830][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.619931][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.638054][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.638091][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.779759][ T5596] veth1_vlan: entered promiscuous mode [ 106.800439][ T5600] veth0_vlan: entered promiscuous mode [ 106.802790][ T5598] veth0_vlan: entered promiscuous mode [ 106.900271][ T3334] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.900294][ T3334] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.084475][ T5598] veth1_vlan: entered promiscuous mode [ 107.119958][ T5600] veth1_vlan: entered promiscuous mode [ 107.228867][ T2393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.228890][ T2393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.355556][ T5596] veth0_macvtap: entered promiscuous mode [ 107.418323][ T5596] veth1_macvtap: entered promiscuous mode [ 107.498726][ T5600] veth0_macvtap: entered promiscuous mode [ 107.566542][ T5598] veth0_macvtap: entered promiscuous mode [ 107.599014][ T5600] veth1_macvtap: entered promiscuous mode [ 107.619499][ T2393] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.619519][ T2393] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.622726][ T5598] veth1_macvtap: entered promiscuous mode [ 107.721586][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.763316][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.783358][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.793337][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.803322][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.813316][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.823314][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.833312][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.843310][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.853321][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.863320][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 109.502381][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.677043][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.755208][ T1451] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.815942][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.816061][ T1451] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820492][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.878649][ T1451] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.899806][ T1451] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.945033][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.004955][ T2393] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.032654][ T66] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.054832][ T66] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.112980][ T66] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.155743][ T66] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.158609][ T66] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.272710][ T66] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.334217][ T66] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.466328][ T9] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 111.637459][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.664434][ T9] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 111.664468][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.664490][ T9] usb 4-1: Product: syz [ 111.664506][ T9] usb 4-1: Manufacturer: syz [ 111.664522][ T9] usb 4-1: SerialNumber: syz [ 111.949990][ T5798] netlink: 'syz.2.3': attribute type 4 has an invalid length. [ 112.903071][ T9] usb 4-1: config 0 descriptor?? [ 113.253957][ T9] usb 4-1: USB disconnect, device number 2 [ 113.673142][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.673180][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.804021][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.804042][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.913471][ T5608] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 114.188578][ T5608] usb 3-1: unable to get BOS descriptor or descriptor too short [ 114.189588][ T5608] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 114.189624][ T5608] usb 3-1: can't read configurations, error -71 [ 114.257092][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.257113][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.416550][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.416574][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.520772][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.520794][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.701592][ T3334] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.701616][ T3334] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.839109][ T5819] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10'. [ 123.679796][ T5848] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 125.477430][ T5855] faux_driver vkms: [drm] Unknown color mode 7; guessing buffer size. [ 127.607254][ T5866] afs: Bad value for 'source' [ 128.161435][ T5866] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18'. [ 128.198293][ T5863] lo speed is unknown, defaulting to 1000 [ 128.233763][ T5863] lo speed is unknown, defaulting to 1000 [ 128.882918][ T5863] lo speed is unknown, defaulting to 1000 [ 129.016398][ T5863] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 129.016429][ T5863] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 129.016463][ T5863] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 129.167087][ T5863] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 129.311463][ T5863] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 131.241763][ T5863] lo speed is unknown, defaulting to 1000 [ 131.268448][ T5863] lo speed is unknown, defaulting to 1000 [ 131.303449][ T5863] lo speed is unknown, defaulting to 1000 [ 131.343480][ T5863] lo speed is unknown, defaulting to 1000 [ 131.449796][ T5863] lo speed is unknown, defaulting to 1000 [ 133.510786][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.510889][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.683458][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 133.869980][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 133.892112][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 133.892141][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 133.892216][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 133.949869][ T10] usb 4-1: New USB device found, idVendor=1235, idProduct=8213, bcdDevice= 0.40 [ 133.949901][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.949921][ T10] usb 4-1: Product: syz [ 133.949936][ T10] usb 4-1: Manufacturer: syz [ 133.949950][ T10] usb 4-1: SerialNumber: syz [ 134.703594][ T10] usb 4-1: 1:1 : no or invalid class specific endpoint descriptor [ 134.703639][ T10] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 134.762337][ T10] usb 4-1: 0:2 : does not exist [ 135.056477][ T10] usb 4-1: USB disconnect, device number 3 [ 135.257894][ T197] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 135.423483][ T197] usb 3-1: Using ep0 maxpacket: 8 [ 137.579162][ T5943] afs: Bad value for 'source' [ 137.787155][ T5934] siw: device registration error -23 [ 137.788142][ T197] usb 3-1: unable to get BOS descriptor or descriptor too short [ 137.788226][ T197] usb 3-1: no configurations [ 137.788239][ T197] usb 3-1: can't read configurations, error -22 [ 137.871912][ T5934] netlink: 16 bytes leftover after parsing attributes in process `syz.0.40'. [ 140.517615][ T5998] 9pnet_virtio: no channels available for device syz [ 144.226575][ T197] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 144.403389][ T197] usb 1-1: Using ep0 maxpacket: 32 [ 144.406976][ T197] usb 1-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 144.407007][ T197] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.483975][ T197] usb 1-1: config 0 descriptor?? [ 144.525637][ T197] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 145.560647][ T197] gspca_nw80x: reg_w err -71 [ 145.560748][ T197] nw80x 1-1:0.0: probe with driver nw80x failed with error -71 [ 147.928458][ T197] usb 1-1: USB disconnect, device number 2 [ 152.885745][ T6093] Zero length message leads to an empty skb [ 153.138256][ T6096] afs: Bad value for 'source' [ 153.234313][ T6106] siw: device registration error -23 [ 153.294570][ T6106] netlink: 16 bytes leftover after parsing attributes in process `syz.3.70'. [ 154.620299][ T6117] afs: Bad value for 'source' [ 154.674475][ T6117] siw: device registration error -23 [ 154.707382][ T6117] netlink: 16 bytes leftover after parsing attributes in process `syz.3.77'. [ 158.615243][ T6163] afs: Bad value for 'source' [ 159.270714][ T6163] netlink: 16 bytes leftover after parsing attributes in process `syz.1.85'. [ 160.203898][ T5755] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 161.149051][ T5755] usb 4-1: device descriptor read/all, error -71 [ 163.712499][ T6179] afs: Bad value for 'source' [ 163.766087][ T6179] siw: device registration error -23 [ 163.844179][ T6179] netlink: 16 bytes leftover after parsing attributes in process `syz.2.91'. [ 166.352233][ T37] audit: type=1804 audit(1785123257.825:2): pid=6193 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.90" name="/newroot/17/file0" dev="tmpfs" ino=113 res=1 errno=0 [ 168.809353][ T6205] mmap: syz.2.94 (6205) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 170.645940][ T6213] ieee802154 phy0 wpan0: encryption failed: -22 [ 171.576594][ T6229] afs: Bad value for 'source' [ 171.657270][ T6229] siw: device registration error -23 [ 171.695436][ T6229] netlink: 16 bytes leftover after parsing attributes in process `syz.4.104'. [ 176.879702][ T6247] syz.1.108 (6247) used greatest stack depth: 19320 bytes left [ 177.593394][ T5710] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 178.012015][ T5710] usb 4-1: Using ep0 maxpacket: 32 [ 178.045391][ T5710] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 178.045422][ T5710] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.068584][ T5710] usb 4-1: config 0 descriptor?? [ 179.202317][ T5710] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 179.884913][ T5710] gspca_nw80x: reg_r err -32 [ 179.884992][ T5710] nw80x 4-1:0.0: probe with driver nw80x failed with error -32 [ 180.000547][ T5710] usb 4-1: USB disconnect, device number 6 [ 186.613368][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 186.773443][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 186.775307][ T10] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 186.775330][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.947204][ T10] usb 3-1: config 0 descriptor?? [ 186.980547][ T10] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 187.315907][ T6343] Config c/1 of g1 needs at least one function. [ 187.322434][ T6343] udc dummy_udc.0: failed to start g1: -22 [ 187.322542][ T6343] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 187.370785][ T6343] UDC core: g1: couldn't find an available UDC or it's busy [ 188.399534][ T10] gspca_nw80x: reg_w err -110 [ 188.484992][ T10] nw80x 3-1:0.0: probe with driver nw80x failed with error -110 [ 190.237146][ T6365] netlink: 'syz.4.146': attribute type 4 has an invalid length. [ 191.986458][ T5729] usb 3-1: USB disconnect, device number 6 [ 193.156282][ T6391] Config c/1 of g1 needs at least one function. [ 193.157310][ T6391] udc dummy_udc.0: failed to start g1: -22 [ 193.157340][ T6391] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 193.173877][ T6391] UDC core: g1: couldn't find an available UDC or it's busy [ 194.872624][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.872699][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.281681][ T6408] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.907428][ T5729] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 196.063382][ T5729] usb 1-1: Using ep0 maxpacket: 32 [ 196.066665][ T5729] usb 1-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 196.066690][ T5729] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.155784][ T5729] usb 1-1: config 0 descriptor?? [ 196.200188][ T5729] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 196.354608][ T6428] UDC core: g1: couldn't find an available UDC or it's busy [ 197.232915][ T5729] gspca_nw80x: reg_w err -110 [ 197.233015][ T5729] nw80x 1-1:0.0: probe with driver nw80x failed with error -110 [ 198.793851][ T37] audit: type=1804 audit(1785123290.425:3): pid=6447 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.171" name="/newroot/37/file0" dev="tmpfs" ino=216 res=1 errno=0 [ 199.776564][ T5610] usb 1-1: USB disconnect, device number 3 [ 201.279409][ T6445] uprobe: syz.1.171:6445 failed to unregister, leaking uprobe [ 201.558074][ T6460] trusted_key: encrypted_key: insufficient parameters specified [ 201.559044][ T6460] trusted_key: encrypted_key: insufficient parameters specified [ 201.996950][ T6472] Config c/1 of g1 needs at least one function. [ 201.997097][ T6472] udc dummy_udc.0: failed to start g1: -22 [ 201.997121][ T6472] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 201.998274][ T6472] UDC core: g1: couldn't find an available UDC or it's busy [ 202.421335][ T37] audit: type=1800 audit(1785123294.045:4): pid=6467 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.176" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 202.463396][ T5755] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 202.663602][ T5755] usb 4-1: unable to get BOS descriptor or descriptor too short [ 202.665894][ T5755] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 202.665955][ T5755] usb 4-1: can't read configurations, error -71 [ 204.430006][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 204.430048][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 204.430074][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 204.430085][ T5602] Workqueue: hci2 hci_rx_work [ 204.430126][ T5602] Call Trace: [ 204.430133][ T5602] [ 204.430140][ T5602] dump_stack_lvl+0xe8/0x150 [ 204.430168][ T5602] sysfs_create_dir_ns+0x271/0x2a0 [ 204.430188][ T5602] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 204.430209][ T5602] ? rt_spin_unlock+0x163/0x200 [ 204.430238][ T5602] kobject_add_internal+0x62c/0xce0 [ 204.430269][ T5602] kobject_add+0x163/0x240 [ 204.430290][ T5602] ? rt_spin_unlock+0x157/0x200 [ 204.430320][ T5602] ? __pfx_kobject_add+0x10/0x10 [ 204.430348][ T5602] ? get_device_parent+0x370/0x3a0 [ 204.430372][ T5602] device_add+0x3fa/0xb80 [ 204.430395][ T5602] hci_conn_add_sysfs+0xd5/0x210 [ 204.430417][ T5602] le_conn_complete_evt+0xfef/0x1580 [ 204.430447][ T5602] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 204.430470][ T5602] ? lockdep_hardirqs_on+0x7a/0x110 [ 204.430488][ T5602] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 204.430508][ T5602] ? rt_mutex_slowunlock+0x219/0x460 [ 204.430532][ T5602] ? skb_pull_data+0xf0/0x200 [ 204.430559][ T5602] hci_le_conn_complete_evt+0x187/0x470 [ 204.430586][ T5602] hci_event_packet+0x67a/0xf10 [ 204.430639][ T5602] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 204.430667][ T5602] ? __pfx_hci_event_packet+0x10/0x10 [ 204.430694][ T5602] ? rt_spin_unlock+0x157/0x200 [ 204.430756][ T5602] ? hci_send_to_monitor+0xe2/0x590 [ 204.430796][ T5602] hci_rx_work+0x3ee/0x1020 [ 204.430826][ T5602] ? process_scheduled_works+0xa20/0x14e0 [ 204.430847][ T5602] process_scheduled_works+0xa8e/0x14e0 [ 204.430889][ T5602] ? __pfx_process_scheduled_works+0x10/0x10 [ 204.430920][ T5602] ? assign_work+0x3cf/0x5d0 [ 204.430944][ T5602] worker_thread+0xa47/0xfb0 [ 204.430986][ T5602] kthread+0x388/0x470 [ 204.431011][ T5602] ? __pfx_worker_thread+0x10/0x10 [ 204.431031][ T5602] ? __pfx_kthread+0x10/0x10 [ 204.431057][ T5602] ret_from_fork+0x514/0xb70 [ 204.431086][ T5602] ? __pfx_ret_from_fork+0x10/0x10 [ 204.431112][ T5602] ? __switch_to+0xc89/0x1420 [ 204.431136][ T5602] ? __pfx_kthread+0x10/0x10 [ 204.431162][ T5602] ret_from_fork_asm+0x1a/0x30 [ 204.431191][ T5602] [ 204.431276][ T5602] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 204.431307][ T5602] Bluetooth: hci2: failed to register connection device [ 204.901708][ T6493] input: syz1 as /devices/virtual/input/input5 [ 206.183400][ T37] audit: type=1804 audit(1785123297.775:5): pid=6507 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.189" name="/newroot/33/file0" dev="tmpfs" ino=190 res=1 errno=0 [ 206.264833][ T197] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 208.203511][ T197] usb 2-1: Using ep0 maxpacket: 32 [ 209.256393][ T5986] udevd[5986]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 209.473397][ T197] usb 2-1: device descriptor read/all, error -71 [ 210.512998][ T6530] Config c/1 of g1 needs at least one function. [ 210.516036][ T6530] udc dummy_udc.0: failed to start g1: -22 [ 210.516066][ T6530] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 210.517242][ T6530] UDC core: g1: couldn't find an available UDC or it's busy [ 211.865572][ T6532] netlink: 'syz.0.192': attribute type 4 has an invalid length. [ 212.733402][ T5602] Bluetooth: hci2: command 0x0406 tx timeout [ 213.565163][ T5602] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 214.805816][ T6540] geneve2: entered promiscuous mode [ 214.805851][ T6540] geneve2: entered allmulticast mode [ 216.727214][ T6567] Config c/1 of g1 needs at least one function. [ 216.727371][ T6567] udc dummy_udc.0: failed to start g1: -22 [ 216.727395][ T6567] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 216.728528][ T6567] UDC core: g1: couldn't find an available UDC or it's busy [ 217.129223][ T5606] Bluetooth: hci0: command 0x0406 tx timeout [ 217.721682][ T6545] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.885251][ T5984] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 218.887279][ T5984] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 218.887327][ T5984] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 221.191976][ T6591] netlink: 'syz.1.209': attribute type 1 has an invalid length. [ 221.353433][ T31] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 222.074298][ T6594] gretap1: entered allmulticast mode [ 222.112241][ T6594] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 222.954887][ T59] Bluetooth: hci4: command 0x0406 tx timeout [ 223.333491][ T59] Bluetooth: hci3: command 0x0406 tx timeout [ 223.333774][ T59] Bluetooth: hci2: command 0x0406 tx timeout [ 223.542243][ T59] Bluetooth: hci1: command 0x0406 tx timeout [ 223.686298][ T6624] Config c/1 of g1 needs at least one function. [ 223.686451][ T6624] udc dummy_udc.0: failed to start g1: -22 [ 223.686476][ T6624] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 224.018294][ T6624] UDC core: g1: couldn't find an available UDC or it's busy [ 226.667777][ T6654] netlink: 'syz.2.226': attribute type 1 has an invalid length. [ 227.455755][ T6660] gretap1: entered allmulticast mode [ 227.471262][ T6659] ALSA: mixer_oss: invalid OSS volume 'P' [ 227.510665][ T6660] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 227.533962][ T5259] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 227.697618][ T6667] netlink: 532 bytes leftover after parsing attributes in process `syz.0.230'. [ 228.583427][ T10] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 229.437748][ T10] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 229.437778][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 229.437799][ T10] usb 3-1: config 0 has no interface number 0 [ 229.437846][ T10] usb 3-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 229.440088][ T10] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 229.440119][ T10] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 229.440141][ T10] usb 3-1: Product: syz [ 229.440157][ T10] usb 3-1: SerialNumber: syz [ 229.702480][ T10] usb 3-1: config 0 descriptor?? [ 229.931806][ T10] usbhid 3-1:0.8: couldn't find an input interrupt endpoint [ 229.977052][ T10] usb 3-1: USB disconnect, device number 8 [ 233.427805][ T6701] netlink: 'syz.1.241': attribute type 1 has an invalid length. [ 233.487140][ T6705] netlink: 112 bytes leftover after parsing attributes in process `syz.0.243'. [ 233.640294][ T6708] netlink: 8 bytes leftover after parsing attributes in process `syz.0.243'. [ 233.640388][ T6708] netlink: 20 bytes leftover after parsing attributes in process `syz.0.243'. [ 236.714326][ T31] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 236.757358][ T6726] Config c/1 of g1 needs at least one function. [ 236.757514][ T6726] udc dummy_udc.0: failed to start g1: -22 [ 236.757539][ T6726] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 237.005294][ T6732] overlayfs: missing 'lowerdir' [ 237.253167][ T31] usb 2-1: unable to get BOS descriptor or descriptor too short [ 237.285336][ T6726] UDC core: g1: couldn't find an available UDC or it's busy [ 237.465427][ T31] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 237.465561][ T31] usb 2-1: can't read configurations, error -71 [ 238.067409][ T6739] afs: Bad value for 'source' [ 238.130646][ T6739] siw: device registration error -23 [ 238.511992][ T6739] netlink: 16 bytes leftover after parsing attributes in process `syz.4.251'. [ 240.889579][ T6754] netlink: 'syz.4.256': attribute type 1 has an invalid length. [ 241.559776][ T6756] gretap1: entered allmulticast mode [ 241.564167][ T6756] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 245.059433][ T6790] afs: Bad value for 'source' [ 245.062364][ T6790] siw: device registration error -23 [ 245.073583][ T6790] netlink: 16 bytes leftover after parsing attributes in process `syz.0.264'. [ 246.590701][ T6799] process 'syz.4.266' launched './file0' with NULL argv: empty string added [ 247.077102][ T5615] Bluetooth: hci2: unexpected event for opcode 0x2039 [ 248.705088][ T5710] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 249.364737][ T6816] netlink: 'syz.1.272': attribute type 1 has an invalid length. [ 249.424642][ T5710] usb 5-1: unable to get BOS descriptor or descriptor too short [ 249.425687][ T5710] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 249.425723][ T5710] usb 5-1: can't read configurations, error -71 [ 250.366977][ T37] audit: type=1804 audit(1785123341.945:6): pid=6824 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.273" name="/newroot/57/file0" dev="tmpfs" ino=326 res=1 errno=0 [ 252.733047][ T6823] uprobe: syz.1.273:6823 failed to unregister, leaking uprobe [ 253.127876][ T6830] Config c/1 of g1 needs at least one function. [ 253.128023][ T6830] udc dummy_udc.0: failed to start g1: -22 [ 253.128045][ T6830] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 253.132587][ T6830] UDC core: g1: couldn't find an available UDC or it's busy [ 253.163278][ T6834] overlayfs: missing 'lowerdir' [ 254.035580][ T6850] netlink: 64 bytes leftover after parsing attributes in process `syz.3.277'. [ 255.215827][ T6854] netlink: 4 bytes leftover after parsing attributes in process `syz.1.279'. [ 255.785929][ T6856] afs: Bad value for 'source' [ 255.905519][ T6856] siw: device registration error -23 [ 255.944707][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.972584][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.075296][ T6856] netlink: 16 bytes leftover after parsing attributes in process `syz.0.281'. [ 258.496270][ T6876] netlink: 'syz.0.287': attribute type 3 has an invalid length. [ 258.983596][ T6881] overlayfs: unescaped trailing colons in lowerdir mount option. [ 261.783361][ T31] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 261.845529][ T6904] Config c/1 of g1 needs at least one function. [ 261.845679][ T6904] udc dummy_udc.0: failed to start g1: -22 [ 261.845703][ T6904] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 261.962681][ T31] usb 5-1: unable to get BOS descriptor or descriptor too short [ 261.970050][ T31] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 261.970164][ T31] usb 5-1: can't read configurations, error -71 [ 262.037542][ T6904] UDC core: g1: couldn't find an available UDC or it's busy [ 262.355825][ T6909] netlink: 4 bytes leftover after parsing attributes in process `syz.1.293'. [ 263.605395][ T6918] afs: Bad value for 'source' [ 263.636615][ T6918] siw: device registration error -23 [ 263.661338][ T6918] netlink: 16 bytes leftover after parsing attributes in process `syz.2.297'. [ 266.563417][ T5729] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 266.723304][ T5729] usb 3-1: Using ep0 maxpacket: 8 [ 266.729464][ T5608] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 266.836609][ T5729] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 266.836632][ T5729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.836647][ T5729] usb 3-1: Product: syz [ 266.836657][ T5729] usb 3-1: Manufacturer: syz [ 266.836668][ T5729] usb 3-1: SerialNumber: syz [ 266.933889][ T5729] usb 3-1: config 0 descriptor?? [ 267.049676][ T5729] radio-usb-si4713 3-1:0.0: Si4713 development board discovered: (10C4:8244) [ 267.327617][ T5608] usb 2-1: unable to get BOS descriptor or descriptor too short [ 267.331035][ T5608] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 267.331068][ T5608] usb 2-1: can't read configurations, error -71 [ 268.254275][ T5729] radio-usb-si4713 3-1:0.0: probe with driver radio-usb-si4713 failed with error -32 [ 268.254831][ T5729] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 268.834601][ T6942] overlayfs: missing 'lowerdir' [ 269.930159][ T6955] netlink: 4 bytes leftover after parsing attributes in process `syz.3.306'. [ 271.038022][ T6963] afs: Bad value for 'source' [ 271.076008][ T6963] siw: device registration error -23 [ 271.090966][ T6963] netlink: 16 bytes leftover after parsing attributes in process `syz.4.309'. [ 273.881913][ T5729] usb 3-1: USB disconnect, device number 9 [ 275.463361][ T5729] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 276.416031][ T5729] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 276.416086][ T5729] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 276.416112][ T5729] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 276.416139][ T5729] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 276.416154][ T5729] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 276.421383][ T5729] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 276.421413][ T5729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 276.421434][ T5729] usb 3-1: Product: syz [ 276.421452][ T5729] usb 3-1: Manufacturer: syz [ 276.421463][ T5729] usb 3-1: SerialNumber: syz [ 276.604615][ T6990] overlayfs: missing 'lowerdir' [ 276.825963][ T5729] usb 3-1: config 0 descriptor?? [ 277.032306][ T5729] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 277.032332][ T5729] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 277.242639][ T5729] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 277.242678][ T5729] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 277.242700][ T5729] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 277.593659][ T6999] afs: Bad value for 'source' [ 277.613854][ T6999] siw: device registration error -23 [ 277.630102][ T6999] netlink: 16 bytes leftover after parsing attributes in process `syz.3.322'. [ 277.630270][ T5729] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 277.948941][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 277.972070][ T37] audit: type=1804 audit(1785123369.605:7): pid=6998 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.319" name="/newroot/61/file0" dev="tmpfs" ino=342 res=1 errno=0 [ 278.280439][ T5729] radio-si470x 3-1:0.0: si470x_set_report: usb_control_msg returned -32 [ 278.829165][ T5729] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -22 [ 278.909128][ T5729] usb 3-1: USB disconnect, device number 10 [ 281.659940][ T7032] overlayfs: missing 'lowerdir' [ 282.316920][ T7041] afs: Bad value for 'source' [ 282.357250][ T7041] siw: device registration error -23 [ 282.376117][ T7041] netlink: 16 bytes leftover after parsing attributes in process `syz.4.333'. [ 283.811645][ T37] audit: type=1804 audit(1785123375.445:8): pid=7050 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.335" name="/newroot/53/file0" dev="tmpfs" ino=297 res=1 errno=0 [ 286.135018][ T7054] uprobe: syz.2.335:7054 failed to unregister, leaking uprobe [ 287.729126][ T5615] Bluetooth: hci2: unexpected event for opcode 0x2039 [ 290.757684][ T5606] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 290.773933][ T5606] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 290.795887][ T5606] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 290.837016][ T5606] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 290.839314][ T5606] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 293.037515][ T5606] Bluetooth: hci5: command tx timeout [ 295.083696][ T5606] Bluetooth: hci5: command tx timeout [ 296.265334][ T7147] rdma_rxe: rxe_newlink: failed to add team_slave_1 [ 298.529584][ T5606] Bluetooth: hci5: command tx timeout [ 300.613553][ T5615] Bluetooth: hci5: command tx timeout [ 300.997363][ T7109] lo speed is unknown, defaulting to 1000 [ 301.577253][ T7172] netlink: 24 bytes leftover after parsing attributes in process `syz.3.373'. [ 301.938802][ T5839] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.043337][ T5729] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 302.203325][ T5729] usb 4-1: Using ep0 maxpacket: 32 [ 302.206628][ T5729] usb 4-1: config 0 has an invalid interface number: 49 but max is 0 [ 302.206655][ T5729] usb 4-1: config 0 has no interface number 0 [ 302.206687][ T5729] usb 4-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 302.206733][ T5729] usb 4-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 302.206752][ T5729] usb 4-1: config 0 interface 49 has no altsetting 0 [ 302.206776][ T5729] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 302.206792][ T5729] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.299143][ T5729] usb 4-1: config 0 descriptor?? [ 302.848151][ T5729] usb 4-1: string descriptor 0 read error: -71 [ 303.001612][ T5729] usb 4-1: USB disconnect, device number 9 [ 303.422709][ T5839] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.678976][ T5839] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.787346][ T7211] netlink: 24 bytes leftover after parsing attributes in process `syz.2.385'. [ 308.253476][ T5710] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 308.413322][ T5710] usb 3-1: Using ep0 maxpacket: 32 [ 308.467339][ T5710] usb 3-1: config 0 has an invalid interface number: 49 but max is 0 [ 308.467371][ T5710] usb 3-1: config 0 has no interface number 0 [ 308.467403][ T5710] usb 3-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 308.467444][ T5710] usb 3-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 308.467473][ T5710] usb 3-1: config 0 interface 49 has no altsetting 0 [ 308.467510][ T5710] usb 3-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 308.467534][ T5710] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.151796][ T5839] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.590912][ T5710] usb 3-1: config 0 descriptor?? [ 311.040698][ T5710] usb 3-1: string descriptor 0 read error: -71 [ 311.232992][ T5710] usb 3-1: USB disconnect, device number 11 [ 313.728104][ T7245] afs: Bad value for 'source' [ 313.729158][ T7245] siw: device registration error -23 [ 313.731362][ T7245] netlink: 16 bytes leftover after parsing attributes in process `syz.2.392'. [ 317.073295][ T5729] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 317.223863][ T5729] usb 1-1: Using ep0 maxpacket: 32 [ 317.226201][ T5729] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 317.226225][ T5729] usb 1-1: config 0 has no interface number 0 [ 317.226253][ T5729] usb 1-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 317.226294][ T5729] usb 1-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 317.226320][ T5729] usb 1-1: config 0 interface 49 has no altsetting 0 [ 317.226349][ T5729] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 317.226372][ T5729] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.245548][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.245616][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.333738][ T5729] usb 1-1: config 0 descriptor?? [ 317.579132][ T5729] usb 1-1: string descriptor 0 read error: -71 [ 317.638673][ T5729] usb 1-1: USB disconnect, device number 4 [ 318.090288][ T7271] overlayfs: missing 'lowerdir' [ 319.901113][ T7109] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.901950][ T7109] bridge0: port 1(bridge_slave_0) entered disabled state [ 319.902197][ T7109] bridge_slave_0: entered allmulticast mode [ 319.918057][ T7109] bridge_slave_0: entered promiscuous mode [ 320.202527][ T7109] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.225006][ T7109] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.225575][ T7109] bridge_slave_1: entered allmulticast mode [ 320.740573][ T7109] bridge_slave_1: entered promiscuous mode [ 322.679393][ T5839] bridge_slave_1: left allmulticast mode [ 322.679606][ T5839] bridge_slave_1: left promiscuous mode [ 322.680608][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.948791][ T5839] bridge_slave_0: left allmulticast mode [ 322.948853][ T5839] bridge_slave_0: left promiscuous mode [ 322.949120][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 327.023874][ T5839] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 327.428106][ T7311] trusted_key: encrypted_key: insufficient parameters specified [ 327.436755][ T7311] trusted_key: encrypted_key: insufficient parameters specified [ 328.253929][ T5839] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 328.305619][ T5839] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 328.327923][ T5839] bond0 (unregistering): Released all slaves [ 328.335780][ T5839] bond1 (unregistering): Released all slaves [ 328.351344][ T5839] bond2 (unregistering): Released all slaves [ 328.365052][ T5839] bond3 (unregistering): Released all slaves [ 328.870606][ T7109] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 328.943965][ T7109] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 329.093330][ T5729] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 329.248796][ T5729] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 329.248849][ T5729] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 329.248875][ T5729] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 329.248899][ T5729] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 329.248928][ T5729] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 329.253407][ T5729] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 329.253430][ T5729] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 329.253452][ T5729] usb 4-1: Product: syz [ 329.253463][ T5729] usb 4-1: Manufacturer: syz [ 329.253474][ T5729] usb 4-1: SerialNumber: syz [ 329.412872][ T7320] overlayfs: missing 'lowerdir' [ 329.475802][ T5729] usb 4-1: config 0 descriptor?? [ 329.682722][ T5729] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 329.682753][ T5729] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 329.883878][ T5729] radio-si470x 4-1:0.0: software version 0, hardware version 0 [ 329.883906][ T5729] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 329.883928][ T5729] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 330.117107][ T5729] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 330.117165][ T5729] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 330.117721][ T7109] team0: Port device team_slave_0 added [ 330.129444][ T5729] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 330.129789][ T5729] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22 [ 330.188523][ T7109] team0: Port device team_slave_1 added [ 330.255849][ T5729] usb 4-1: USB disconnect, device number 10 [ 331.725427][ T7341] netlink: 4 bytes leftover after parsing attributes in process `syz.2.417'. [ 334.678782][ T7109] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 334.678797][ T7109] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.678817][ T7109] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 334.693359][ T5755] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 334.769897][ T7109] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 334.769915][ T7109] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.769944][ T7109] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 334.856593][ T5755] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 334.856654][ T5755] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 334.856683][ T5755] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 334.856707][ T5755] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 334.856751][ T5755] usb 3-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 334.856776][ T5755] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.026266][ T5755] usb 3-1: config 0 descriptor?? [ 336.964564][ T5755] usbhid 3-1:0.0: can't add hid device: -71 [ 336.964703][ T5755] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 337.233411][ T5755] usb 3-1: USB disconnect, device number 12 [ 337.624549][ T7369] trusted_key: encrypted_key: insufficient parameters specified [ 337.635432][ T7369] trusted_key: encrypted_key: insufficient parameters specified [ 338.586680][ T7109] hsr_slave_0: entered promiscuous mode [ 338.607807][ T7109] hsr_slave_1: entered promiscuous mode [ 338.619561][ T7109] debugfs: 'hsr0' already exists in 'hsr' [ 338.619609][ T7109] Cannot create hsr debugfs directory [ 338.740024][ T5259] 8021q: adding VLAN 0 to HW filter on device eth1 [ 339.635619][ T7390] netlink: 64 bytes leftover after parsing attributes in process `syz.4.427'. [ 340.639314][ T7374] overlayfs: missing 'lowerdir' [ 341.301308][ T7396] netlink: 4 bytes leftover after parsing attributes in process `syz.3.428'. [ 342.706286][ T7404] netlink: 12 bytes leftover after parsing attributes in process `syz.3.431'. [ 345.235099][ T5703] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 345.369122][ T5703] usb 3-1: device descriptor read/64, error -71 [ 345.698377][ T5703] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 345.833321][ T5703] usb 3-1: device descriptor read/64, error -71 [ 345.883324][ T10] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 346.219772][ T5703] usb usb3-port1: attempt power cycle [ 346.309581][ T10] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 346.309640][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 346.309668][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 346.309691][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 346.309735][ T10] usb 5-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 346.309759][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.342051][ T10] usb 5-1: config 0 descriptor?? [ 346.600236][ T5703] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 346.616574][ T5703] usb 3-1: device descriptor read/8, error -71 [ 346.733324][ T5839] hsr_slave_0: left promiscuous mode [ 346.903852][ T10] usbhid 5-1:0.0: can't add hid device: -71 [ 346.924648][ T5839] hsr_slave_1: left promiscuous mode [ 346.942314][ T10] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 346.964751][ T5839] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 346.964845][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 347.003383][ T5703] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 347.011212][ T10] usb 5-1: USB disconnect, device number 6 [ 347.053546][ T5839] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 347.053576][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 347.121719][ T5703] usb 3-1: device descriptor read/8, error -71 [ 348.181948][ T5703] usb usb3-port1: unable to enumerate USB device [ 348.498610][ T5839] veth1_macvtap: left promiscuous mode [ 348.498952][ T5839] veth0_macvtap: left promiscuous mode [ 348.580976][ T7451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.440'. [ 349.448574][ T5839] veth1_vlan: left promiscuous mode [ 349.459403][ T5839] veth0_vlan: left promiscuous mode [ 349.840420][ T7448] overlayfs: missing 'lowerdir' [ 351.376412][ T5606] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 351.457445][ T5606] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 351.480063][ T5606] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 351.558573][ T5606] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 351.583368][ T5606] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 353.733478][ T5615] Bluetooth: hci1: command tx timeout [ 354.838151][ T7484] Bluetooth: MGMT ver 1.23 [ 354.863978][ T5839] team0 (unregistering): Port device team_slave_1 removed [ 354.983932][ T5839] team0 (unregistering): Port device team_slave_0 removed [ 355.683380][ T5755] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 355.803328][ T5615] Bluetooth: hci1: command tx timeout [ 355.869549][ T5755] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 355.869578][ T5755] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 355.869617][ T5755] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 355.869641][ T5755] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.960554][ T5755] usb 4-1: config 0 descriptor?? [ 356.109335][ T5259] 8021q: adding VLAN 0 to HW filter on device eth2 [ 356.156041][ T5703] lo speed is unknown, defaulting to 1000 [ 356.212269][ T5703] syz2: Port: 1 Link DOWN [ 358.477491][ T5615] Bluetooth: hci1: command tx timeout [ 358.601015][ T5981] smbdirect: ib_dev[syz2] removed [ 358.822910][ T5755] usb 4-1: USB disconnect, device number 11 [ 360.180994][ T7515] overlayfs: missing 'lowerdir' [ 360.523755][ T5606] Bluetooth: hci1: command tx timeout [ 366.756554][ T7563] overlayfs: missing 'lowerdir' [ 368.721761][ T7589] netlink: 'syz.3.471': attribute type 4 has an invalid length. [ 369.546808][ T7599] netlink: 8 bytes leftover after parsing attributes in process `syz.4.477'. [ 369.700433][ T5259] 8021q: adding VLAN 0 to HW filter on device eth3 [ 369.873342][ T36] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 370.035769][ T36] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 370.035828][ T36] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 370.035856][ T36] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 370.035884][ T36] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 370.035908][ T36] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 370.038940][ T36] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 370.038977][ T36] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 370.038998][ T36] usb 3-1: Product: syz [ 370.039014][ T36] usb 3-1: Manufacturer: syz [ 370.039034][ T36] usb 3-1: SerialNumber: syz [ 370.051943][ T36] usb 3-1: config 0 descriptor?? [ 370.359660][ T7609] overlayfs: missing 'lowerdir' [ 371.285572][ T36] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 371.285601][ T36] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 371.318709][ T36] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 371.318734][ T36] radio-si470x 3-1:0.0: si470x_get_scratch: si470x_get_report returned -32 [ 371.319137][ T36] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -5 [ 371.451181][ T36] usb 3-1: USB disconnect, device number 17 [ 374.645187][ T7641] netlink: 8 bytes leftover after parsing attributes in process `syz.2.488'. [ 374.733509][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 375.004723][ T5755] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 375.225525][ T5755] usb 5-1: unable to get BOS descriptor or descriptor too short [ 375.227998][ T5755] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 375.228036][ T5755] usb 5-1: can't read configurations, error -71 [ 376.203058][ T7667] netlink: 4 bytes leftover after parsing attributes in process `syz.2.492'. [ 376.574782][ T7473] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.577947][ T7473] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.578186][ T7473] bridge_slave_0: entered allmulticast mode [ 376.609175][ T7473] bridge_slave_0: entered promiscuous mode [ 376.661008][ T7473] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.661153][ T7473] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.682631][ T7473] bridge_slave_1: entered allmulticast mode [ 376.702678][ T7473] bridge_slave_1: entered promiscuous mode [ 376.876827][ T7473] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.902824][ T7473] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 379.220028][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.220102][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.918351][ T5615] Bluetooth: hci2: Invalid handle: 0x20c9 > 0x0eff [ 380.058772][ T7473] team0: Port device team_slave_0 added [ 380.082221][ T7473] team0: Port device team_slave_1 added [ 380.323322][ T10] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 380.927590][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 380.933731][ T10] usb 4-1: config 0 has an invalid interface number: 49 but max is 0 [ 380.933761][ T10] usb 4-1: config 0 has no interface number 0 [ 380.933792][ T10] usb 4-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 380.933831][ T10] usb 4-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 380.933858][ T10] usb 4-1: config 0 interface 49 has no altsetting 0 [ 380.933892][ T10] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 380.933917][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.943119][ T10] usb 4-1: config 0 descriptor?? [ 381.155054][ T10] usb 4-1: string descriptor 0 read error: -71 [ 381.192120][ T10] usb 4-1: USB disconnect, device number 12 [ 381.413724][ T5755] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 381.758970][ T7473] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 381.758989][ T7473] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 381.759019][ T7473] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 381.850482][ T7710] netlink: 4 bytes leftover after parsing attributes in process `syz.0.503'. [ 382.608791][ T5259] 8021q: adding VLAN 0 to HW filter on device eth4 [ 382.624045][ T7473] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 382.624063][ T7473] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 382.624107][ T7473] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 382.717647][ T5755] usb 3-1: unable to get BOS descriptor or descriptor too short [ 382.732687][ T5755] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 382.732727][ T5755] usb 3-1: can't read configurations, error -71 [ 383.549232][ T7473] hsr_slave_0: entered promiscuous mode [ 383.550443][ T7473] hsr_slave_1: entered promiscuous mode [ 383.551357][ T7473] debugfs: 'hsr0' already exists in 'hsr' [ 383.552817][ T7473] Cannot create hsr debugfs directory [ 383.714134][ T36] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 384.945318][ T36] usb 4-1: unable to get BOS descriptor or descriptor too short [ 384.951592][ T36] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 384.951630][ T36] usb 4-1: can't read configurations, error -71 [ 385.658867][ T5606] Bluetooth: hci4: Invalid handle: 0x20c9 > 0x0eff [ 386.764913][ T7751] overlayfs: unescaped trailing colons in lowerdir mount option. [ 387.284345][ T5839] bridge_slave_1: left allmulticast mode [ 387.284383][ T5839] bridge_slave_1: left promiscuous mode [ 387.333066][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.911443][ T37] audit: type=1804 audit(1785123479.545:9): pid=7758 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.515" name="/newroot/120/file0" dev="tmpfs" ino=653 res=1 errno=0 [ 389.146177][ T7764] uprobe: syz.0.515:7764 failed to unregister, leaking uprobe [ 389.222027][ T5839] bridge_slave_0: left allmulticast mode [ 389.222055][ T5839] bridge_slave_0: left promiscuous mode [ 389.269499][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 389.443267][ T36] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 391.216702][ T36] usb 4-1: unable to get BOS descriptor or descriptor too short [ 391.222548][ T36] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 391.222593][ T36] usb 4-1: can't read configurations, error -71 [ 392.634261][ T5839] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 392.903785][ T5839] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 393.758779][ T5839] bond0 (unregistering): Released all slaves [ 394.868282][ T5259] 8021q: adding VLAN 0 to HW filter on device eth5 [ 396.150880][ T37] audit: type=1804 audit(1785123487.785:10): pid=7817 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.527" name="/newroot/115/file0" dev="tmpfs" ino=616 res=1 errno=0 [ 396.350916][ T7821] netlink: 24 bytes leftover after parsing attributes in process `syz.0.530'. [ 397.168119][ T7814] uprobe: syz.3.527:7814 failed to unregister, leaking uprobe [ 397.477862][ T5703] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 397.623308][ T5703] usb 1-1: Using ep0 maxpacket: 32 [ 397.627756][ T5703] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 397.627776][ T5703] usb 1-1: config 0 has no interface number 0 [ 397.627822][ T5703] usb 1-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 397.627861][ T5703] usb 1-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 397.627892][ T5703] usb 1-1: config 0 interface 49 has no altsetting 0 [ 397.627916][ T5703] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 397.627933][ T5703] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.650931][ T7841] afs: Bad value for 'source' [ 397.894363][ T7842] netlink: 16 bytes leftover after parsing attributes in process `syz.2.533'. [ 398.414586][ T5703] usb 1-1: config 0 descriptor?? [ 398.642573][ T5703] usb 1-1: string descriptor 0 read error: -71 [ 398.698969][ T5839] hsr_slave_0: left promiscuous mode [ 398.710419][ T5703] usb 1-1: USB disconnect, device number 6 [ 398.734005][ T5839] hsr_slave_1: left promiscuous mode [ 398.779993][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 398.837585][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 399.871537][ T7855] netlink: 156 bytes leftover after parsing attributes in process `syz.0.538'. [ 401.504115][ T5839] team0 (unregistering): Port device team_slave_1 removed [ 402.174034][ T5839] team0 (unregistering): Port device team_slave_0 removed [ 402.569325][ T7841] lo speed is unknown, defaulting to 1000 [ 402.581389][ T7841] lo speed is unknown, defaulting to 1000 [ 402.844550][ T7841] lo speed is unknown, defaulting to 1000 [ 402.946697][ T7841] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 402.946728][ T7841] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 402.946759][ T7841] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 403.129486][ T7841] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 403.305265][ T7841] lo speed is unknown, defaulting to 1000 [ 403.435340][ T7841] lo speed is unknown, defaulting to 1000 [ 406.488631][ T7841] lo speed is unknown, defaulting to 1000 [ 406.599942][ T7841] lo speed is unknown, defaulting to 1000 [ 406.667171][ T7841] lo speed is unknown, defaulting to 1000 [ 408.344886][ T7893] netlink: 24 bytes leftover after parsing attributes in process `syz.2.546'. [ 408.733852][ T5755] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 408.793404][ T820] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 408.913323][ T5755] usb 3-1: Using ep0 maxpacket: 32 [ 408.915833][ T5755] usb 3-1: config 0 has an invalid interface number: 49 but max is 0 [ 408.915861][ T5755] usb 3-1: config 0 has no interface number 0 [ 408.915894][ T5755] usb 3-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 408.915935][ T5755] usb 3-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 408.915964][ T5755] usb 3-1: config 0 interface 49 has no altsetting 0 [ 408.915998][ T5755] usb 3-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 408.916022][ T5755] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.983613][ T820] usb 1-1: Using ep0 maxpacket: 32 [ 409.005686][ T820] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 409.053211][ T820] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 409.053242][ T820] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 409.053265][ T820] usb 1-1: Product: syz [ 409.053280][ T820] usb 1-1: Manufacturer: syz [ 409.053296][ T820] usb 1-1: SerialNumber: syz [ 409.119390][ T5755] usb 3-1: config 0 descriptor?? [ 409.148758][ T820] usb 1-1: config 0 descriptor?? [ 409.238823][ T820] hub 1-1:0.0: bad descriptor, ignoring hub [ 409.239097][ T820] hub 1-1:0.0: probe with driver hub failed with error -5 [ 409.554658][ T5755] usb 3-1: string descriptor 0 read error: -71 [ 409.614195][ T7918] netlink: 64 bytes leftover after parsing attributes in process `syz.4.548'. [ 410.254771][ T5755] usb 3-1: USB disconnect, device number 20 [ 410.299817][ T7915] netlink: 32 bytes leftover after parsing attributes in process `syz.0.542'. [ 410.989562][ T5615] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 411.010701][ T5615] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 411.030112][ T5615] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 411.038890][ T5615] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 411.041005][ T5615] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 411.960847][ T7947] afs: Bad value for 'source' [ 412.025837][ T7947] siw: device registration error -23 [ 412.046772][ T7947] netlink: 16 bytes leftover after parsing attributes in process `syz.4.555'. [ 413.275248][ T7959] netlink: 64 bytes leftover after parsing attributes in process `syz.4.558'. [ 413.278936][ T7953] overlayfs: missing 'lowerdir' [ 413.403350][ T5615] Bluetooth: hci5: command tx timeout [ 414.241920][ T7930] lo speed is unknown, defaulting to 1000 [ 414.273359][ T5730] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 414.443854][ T5730] usb 5-1: Using ep0 maxpacket: 32 [ 414.446702][ T5730] usb 5-1: config 0 has an invalid interface number: 49 but max is 0 [ 414.446729][ T5730] usb 5-1: config 0 has no interface number 0 [ 414.446763][ T5730] usb 5-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 414.446804][ T5730] usb 5-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 414.446834][ T5730] usb 5-1: config 0 interface 49 has no altsetting 0 [ 414.446870][ T5730] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 414.446895][ T5730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.422962][ T5730] usb 5-1: config 0 descriptor?? [ 415.484726][ T5615] Bluetooth: hci5: command tx timeout [ 415.646567][ T5730] usb 5-1: string descriptor 0 read error: -71 [ 415.877094][ T5730] usb 5-1: USB disconnect, device number 9 [ 416.443913][ T5730] usb 1-1: USB disconnect, device number 7 [ 417.573377][ T5615] Bluetooth: hci5: command tx timeout [ 417.675540][ T56] bridge_slave_1: left allmulticast mode [ 417.675580][ T56] bridge_slave_1: left promiscuous mode [ 417.675845][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.957291][ T8014] overlayfs: missing 'lowerdir' [ 418.049039][ T56] bridge_slave_0: left allmulticast mode [ 418.049075][ T56] bridge_slave_0: left promiscuous mode [ 418.079540][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.650928][ T5615] Bluetooth: hci5: command tx timeout [ 420.263946][ T56] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 420.364249][ T56] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 420.428429][ T56] bond0 (unregistering): Released all slaves [ 422.503248][ T5703] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 422.541805][ T8057] overlayfs: missing 'lowerdir' [ 422.823398][ T5703] usb 4-1: device descriptor read/64, error -71 [ 422.885022][ T56] hsr_slave_0: left promiscuous mode [ 422.937751][ T56] hsr_slave_1: left promiscuous mode [ 422.938818][ T56] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 422.987868][ T56] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 423.063320][ T5703] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 424.339036][ T5703] usb 4-1: device descriptor read/64, error -71 [ 424.448568][ T5703] usb usb4-port1: attempt power cycle [ 425.898481][ T5703] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 425.940892][ T5703] usb 4-1: Using ep0 maxpacket: 32 [ 425.955018][ T5703] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 425.958912][ T5703] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 425.958942][ T5703] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 425.958965][ T5703] usb 4-1: Product: syz [ 425.958980][ T5703] usb 4-1: Manufacturer: syz [ 425.958996][ T5703] usb 4-1: SerialNumber: syz [ 425.964442][ T5703] usb 4-1: config 0 descriptor?? [ 425.980884][ T5703] hub 4-1:0.0: bad descriptor, ignoring hub [ 425.980924][ T5703] hub 4-1:0.0: probe with driver hub failed with error -5 [ 428.804334][ T56] team0 (unregistering): Port device team_slave_1 removed [ 428.873752][ T5730] usb 4-1: USB disconnect, device number 19 [ 429.159851][ T56] team0 (unregistering): Port device team_slave_0 removed [ 431.202556][ T7930] bridge0: port 1(bridge_slave_0) entered blocking state [ 431.210142][ T7930] bridge0: port 1(bridge_slave_0) entered disabled state [ 431.210820][ T7930] bridge_slave_0: entered allmulticast mode [ 431.263612][ T7930] bridge_slave_0: entered promiscuous mode [ 431.277345][ T7930] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.277714][ T7930] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.474764][ T7930] bridge_slave_1: entered allmulticast mode [ 431.496408][ T7930] bridge_slave_1: entered promiscuous mode [ 432.001771][ T7930] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 432.073822][ T7930] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 433.255135][ T7930] team0: Port device team_slave_0 added [ 433.257643][ T7930] team0: Port device team_slave_1 added [ 433.283838][ T7930] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 433.283850][ T7930] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 433.283878][ T7930] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 433.285502][ T7930] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 433.285512][ T7930] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 433.285531][ T7930] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 433.859118][ T7930] hsr_slave_0: entered promiscuous mode [ 433.860571][ T7930] hsr_slave_1: entered promiscuous mode [ 433.865815][ T7930] debugfs: 'hsr0' already exists in 'hsr' [ 433.865842][ T7930] Cannot create hsr debugfs directory [ 433.903333][ T5730] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 434.034011][ T5730] usb 1-1: device descriptor read/64, error -71 [ 434.850565][ T5730] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 435.005575][ T5730] usb 1-1: device descriptor read/64, error -71 [ 435.117081][ T5730] usb usb1-port1: attempt power cycle [ 435.463435][ T5730] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 435.493288][ T5730] usb 1-1: device descriptor read/8, error -71 [ 435.734847][ T5730] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 435.754055][ T5730] usb 1-1: device descriptor read/8, error -71 [ 435.863836][ T5730] usb usb1-port1: unable to enumerate USB device [ 436.684056][ T8154] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.153014][ T8154] bridge_slave_0 (unregistering): left allmulticast mode [ 437.153052][ T8154] bridge_slave_0 (unregistering): left promiscuous mode [ 437.154681][ T8154] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.351838][ T8181] warning: `syz.0.600' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 440.526652][ T8180] lo speed is unknown, defaulting to 1000 [ 440.595442][ T8178] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 440.868108][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.868178][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.132066][ T7930] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 441.281341][ T7930] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 441.351104][ T7930] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 441.534392][ T7930] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 441.599856][ T7930] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 441.774284][ T7930] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 441.782223][ T7930] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 441.925032][ T7930] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 444.694188][ T5608] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 444.856779][ T5608] usb 5-1: device descriptor read/64, error -71 [ 445.218218][ T5608] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 445.515508][ T5608] usb 5-1: device descriptor read/64, error -71 [ 445.624963][ T5608] usb usb5-port1: attempt power cycle [ 446.212716][ T7930] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.483374][ T5608] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 449.676155][ T5608] usb 5-1: device descriptor read/8, error -71 [ 451.400936][ T7930] 8021q: adding VLAN 0 to HW filter on device team0 [ 451.624833][ T2393] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.624985][ T2393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 451.724427][ T3415] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.724688][ T3415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.979759][ T5755] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 453.280095][ T5755] usb 1-1: unable to get BOS descriptor or descriptor too short [ 453.300289][ T5755] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 453.300329][ T5755] usb 1-1: can't read configurations, error -71 [ 453.559982][ T8273] netlink: 4 bytes leftover after parsing attributes in process `syz.4.619'. [ 453.615243][ T197] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 453.780293][ T197] usb 4-1: config 5 has an invalid interface number: 206 but max is 0 [ 453.780324][ T197] usb 4-1: config 5 has no interface number 0 [ 453.780376][ T197] usb 4-1: config 5 interface 206 has no altsetting 0 [ 453.784778][ T197] usb 4-1: New USB device found, idVendor=0499, idProduct=103b, bcdDevice=b8.6a [ 453.784858][ T197] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.784920][ T197] usb 4-1: Product: syz [ 453.784956][ T197] usb 4-1: Manufacturer: syz [ 453.784998][ T197] usb 4-1: SerialNumber: syz [ 454.141891][ T197] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 456.420356][ T197] snd-usb-audio 4-1:5.206: probe with driver snd-usb-audio failed with error -2 [ 456.531683][ T197] usb 4-1: USB disconnect, device number 20 [ 456.701653][ T8280] udevd[8280]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:5.206/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 456.723223][ T5755] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 456.853373][ T5755] usb 5-1: device descriptor read/64, error -71 [ 457.703756][ T5755] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 458.033231][ T5755] usb 5-1: device descriptor read/64, error -71 [ 458.143895][ T5755] usb usb5-port1: attempt power cycle [ 458.190960][ T8306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.621'. [ 458.365566][ T7930] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 458.483395][ T5755] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 458.514105][ T5755] usb 5-1: device descriptor read/8, error -71 [ 459.854786][ T5755] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 459.874231][ T5755] usb 5-1: device descriptor read/8, error -71 [ 459.989287][ T5755] usb usb5-port1: unable to enumerate USB device [ 460.121558][ T7930] veth0_vlan: entered promiscuous mode [ 460.138853][ T7930] veth1_vlan: entered promiscuous mode [ 460.214353][ T7930] veth0_macvtap: entered promiscuous mode [ 460.313854][ T7930] veth1_macvtap: entered promiscuous mode [ 461.356124][ T7930] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 461.687520][ T7930] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 461.730582][ T8331] overlayfs: unescaped trailing colons in lowerdir mount option. [ 461.891930][ T56] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.950545][ T1474] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.950599][ T1474] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.950643][ T1474] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 462.498814][ T8339] netlink: 4 bytes leftover after parsing attributes in process `syz.4.630'. [ 466.985962][ T5983] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.985986][ T5983] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.470012][ T5985] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 468.470034][ T5985] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.014242][ T8383] netlink: 8 bytes leftover after parsing attributes in process `syz.0.639'. [ 472.068902][ T8391] netlink: 8 bytes leftover after parsing attributes in process `syz.4.641'. [ 472.617610][ T37] audit: type=1804 audit(1785123564.255:11): pid=8400 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.5.644" name="/newroot/2/file0" dev="tmpfs" ino=29 res=1 errno=0 [ 473.460449][ T8398] uprobe: syz.5.644:8398 failed to unregister, leaking uprobe [ 478.988553][ T8428] overlayfs: unescaped trailing colons in lowerdir mount option. [ 479.554614][ T820] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 481.128347][ T8440] netlink: 4 bytes leftover after parsing attributes in process `syz.3.652'. [ 481.736195][ T8448] netlink: 8 bytes leftover after parsing attributes in process `syz.0.653'. [ 482.539476][ T820] usb 3-1: unable to get BOS descriptor or descriptor too short [ 482.540525][ T820] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 482.540562][ T820] usb 3-1: can't read configurations, error -71 [ 488.467080][ T8483] overlayfs: unescaped trailing colons in lowerdir mount option. [ 490.285950][ T8493] netlink: 8 bytes leftover after parsing attributes in process `syz.2.665'. [ 492.302521][ T8502] netlink: 8 bytes leftover after parsing attributes in process `syz.2.668'. [ 493.123245][ T31] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 496.488965][ T8524] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.905191][ T8524] bridge_slave_0 (unregistering): left allmulticast mode [ 496.905224][ T8524] bridge_slave_0 (unregistering): left promiscuous mode [ 496.907311][ T8524] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.973572][ T8528] afs: Bad value for 'source' [ 497.117557][ T8529] netlink: 24 bytes leftover after parsing attributes in process `syz.4.674'. [ 497.133834][ T8528] siw: device registration error -23 [ 497.142350][ T8528] netlink: 16 bytes leftover after parsing attributes in process `syz.3.673'. [ 498.403230][ T9] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 498.601866][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 498.644128][ T9] usb 5-1: config 0 has an invalid interface number: 49 but max is 0 [ 498.644159][ T9] usb 5-1: config 0 has no interface number 0 [ 498.644194][ T9] usb 5-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 498.644244][ T9] usb 5-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 498.644273][ T9] usb 5-1: config 0 interface 49 has no altsetting 0 [ 498.644308][ T9] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 498.644332][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.768420][ T9] usb 5-1: config 0 descriptor?? [ 501.581252][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.581325][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.657417][ T9] usb 5-1: string descriptor 0 read error: -71 [ 501.772329][ T9] usb 5-1: USB disconnect, device number 18 [ 502.774006][ T36] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 503.172601][ T36] usb 4-1: unable to get BOS descriptor or descriptor too short [ 503.185733][ T36] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 503.185773][ T36] usb 4-1: can't read configurations, error -71 [ 507.700862][ T8592] netlink: 24 bytes leftover after parsing attributes in process `syz.5.693'. [ 509.809423][ T5755] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 510.883697][ T5755] usb 6-1: Using ep0 maxpacket: 32 [ 511.051399][ T5755] usb 6-1: device descriptor read/all, error -71 [ 513.203349][ T9] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 514.214358][ T8619] lo speed is unknown, defaulting to 1000 [ 514.737113][ T8618] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 515.855986][ T9] usb 3-1: device descriptor read/all, error -71 [ 519.567615][ T8649] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.605908][ T8649] bridge_slave_0 (unregistering): left allmulticast mode [ 519.605947][ T8649] bridge_slave_0 (unregistering): left promiscuous mode [ 519.606059][ T8649] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.686927][ T8664] netlink: 24 bytes leftover after parsing attributes in process `syz.3.711'. [ 521.516201][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 522.233421][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 522.486234][ T9] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 522.520096][ T10] usb 4-1: config 0 has an invalid interface number: 49 but max is 0 [ 522.520118][ T10] usb 4-1: config 0 has no interface number 0 [ 522.520140][ T10] usb 4-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 522.520167][ T10] usb 4-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 522.520186][ T10] usb 4-1: config 0 interface 49 has no altsetting 0 [ 522.520211][ T10] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 522.520227][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.524096][ T10] usb 4-1: config 0 descriptor?? [ 522.989882][ T10] usb 4-1: string descriptor 0 read error: -71 [ 523.067562][ T10] usb 4-1: USB disconnect, device number 23 [ 526.063943][ T8701] netlink: 148 bytes leftover after parsing attributes in process `syz.3.721'. [ 527.943250][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 527.968124][ T9] usb 5-1: unable to read config index 0 descriptor/start: -32 [ 527.968144][ T9] usb 5-1: chopping to 0 config(s) [ 527.968162][ T9] usb 5-1: can't read configurations, error -32 [ 528.588118][ T8727] overlayfs: unescaped trailing colons in lowerdir mount option. [ 533.168304][ T8751] netlink: 32 bytes leftover after parsing attributes in process `syz.3.732'. [ 534.443241][ T5606] Bluetooth: hci5: command 0x0406 tx timeout [ 537.733203][ T820] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 538.942702][ T8790] netlink: 32 bytes leftover after parsing attributes in process `syz.0.745'. [ 545.073877][ T36] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 545.737406][ T36] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 545.737441][ T36] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 545.737460][ T36] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 545.737476][ T36] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 545.737512][ T36] usb 1-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 545.737529][ T36] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.856902][ T36] usb 1-1: config 0 descriptor?? [ 546.103423][ T5755] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 546.307122][ T5755] usb 5-1: unable to get BOS descriptor or descriptor too short [ 546.309665][ T5755] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 546.309735][ T5755] usb 5-1: can't read configurations, error -71 [ 546.511951][ T36] usbhid 1-1:0.0: can't add hid device: -71 [ 546.512080][ T36] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 546.564331][ T36] usb 1-1: USB disconnect, device number 16 [ 549.967059][ T8861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.766'. [ 555.373296][ T5755] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 555.433214][ T8902] netlink: 4 bytes leftover after parsing attributes in process `syz.3.777'. [ 556.330464][ T5755] usb 6-1: unable to get BOS descriptor or descriptor too short [ 556.349370][ T5755] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 556.349418][ T5755] usb 6-1: can't read configurations, error -71 [ 556.391601][ T8905] netlink: 148 bytes leftover after parsing attributes in process `syz.4.778'. [ 556.652610][ T8905] netlink: 20 bytes leftover after parsing attributes in process `syz.4.778'. [ 556.652633][ T8905] netlink: 24 bytes leftover after parsing attributes in process `syz.4.778'. [ 563.028074][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.032459][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.764898][ T8957] netlink: 20 bytes leftover after parsing attributes in process `syz.0.793'. [ 563.764921][ T8957] netlink: 24 bytes leftover after parsing attributes in process `syz.0.793'. [ 566.266426][ T8985] bridge0: port 1(bridge_slave_0) entered disabled state [ 566.853234][ T5755] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 567.253464][ T5755] usb 5-1: device descriptor read/all, error -71 [ 567.345871][ T8991] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 567.346199][ T8991] overlayfs: overlapping lowerdir path [ 567.354954][ T8985] bridge_slave_0 (unregistering): left allmulticast mode [ 567.354980][ T8985] bridge_slave_0 (unregistering): left promiscuous mode [ 567.355070][ T8985] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.343226][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 569.423201][ T820] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 569.496561][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 569.496601][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 569.496644][ T9] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 569.496672][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.627927][ T820] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 570.627948][ T820] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 570.631941][ T820] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 570.631964][ T820] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.631978][ T820] usb 1-1: Product: syz [ 570.631988][ T820] usb 1-1: Manufacturer: syz [ 570.631999][ T820] usb 1-1: SerialNumber: syz [ 570.699956][ T9] usb 4-1: config 0 descriptor?? [ 572.018202][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 572.018331][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 572.073693][ T9] usb 4-1: USB disconnect, device number 24 [ 572.999801][ T820] usb 1-1: USB disconnect, device number 17 [ 573.066189][ T9033] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 573.066516][ T9033] overlayfs: overlapping lowerdir path [ 574.374062][ T36] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 574.902142][ T36] usb 5-1: unable to get BOS descriptor or descriptor too short [ 574.905304][ T36] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 574.905343][ T36] usb 5-1: can't read configurations, error -71 [ 577.848270][ T9061] ISOFS: Unable to identify CD-ROM format. [ 578.633317][ T820] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 578.973998][ T9071] afs: Bad value for 'source' [ 579.012734][ T9071] siw: device registration error -23 [ 579.044218][ T9071] netlink: 16 bytes leftover after parsing attributes in process `syz.0.823'. [ 579.733803][ T5755] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 580.500381][ T5755] usb 4-1: unable to get BOS descriptor or descriptor too short [ 580.501429][ T5755] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 580.501465][ T5755] usb 4-1: can't read configurations, error -71 [ 580.580980][ T9073] overlayfs: missing 'lowerdir' [ 580.865013][ T9083] netlink: 168 bytes leftover after parsing attributes in process `syz.4.827'. [ 580.865033][ T9083] tc_dump_action: action bad kind [ 581.997529][ T9081] netlink: 8 bytes leftover after parsing attributes in process `syz.0.826'. [ 583.699898][ T9] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 583.855173][ T9] usb 3-1: config 0 has no interfaces? [ 583.858208][ T9] usb 3-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 583.858273][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.858288][ T9] usb 3-1: Product: syz [ 583.858298][ T9] usb 3-1: Manufacturer: syz [ 583.858309][ T9] usb 3-1: SerialNumber: syz [ 584.824130][ T9] usb 3-1: config 0 descriptor?? [ 585.482143][ T820] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 586.923473][ T9118] afs: Bad value for 'source' [ 586.927837][ T9118] siw: device registration error -23 [ 586.929335][ T9118] netlink: 16 bytes leftover after parsing attributes in process `syz.5.837'. [ 586.946215][ T820] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 586.946275][ T820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 586.946304][ T820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 586.946327][ T820] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 586.946371][ T820] usb 4-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 586.946396][ T820] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.576015][ T820] usb 4-1: config 0 descriptor?? [ 587.694679][ T5755] usb 3-1: USB disconnect, device number 25 [ 587.774731][ T9121] overlayfs: missing 'lowerdir' [ 588.213123][ T820] usbhid 4-1:0.0: can't add hid device: -71 [ 588.213250][ T820] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 589.289607][ T820] usb 4-1: USB disconnect, device number 27 [ 589.414500][ T5615] Bluetooth: hci5: Malformed LE Event: 0x0d [ 592.144436][ T9161] afs: Bad value for 'source' [ 592.174986][ T9161] siw: device registration error -23 [ 592.192413][ T9161] netlink: 16 bytes leftover after parsing attributes in process `syz.4.850'. [ 593.093275][ T197] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 593.175760][ T9171] overlayfs: missing 'lowerdir' [ 593.386254][ T197] usb 6-1: Using ep0 maxpacket: 16 [ 593.400532][ T197] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 593.400640][ T197] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 593.424500][ T197] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 593.424544][ T197] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.424625][ T197] usb 6-1: Product: syz [ 593.424642][ T197] usb 6-1: Manufacturer: syz [ 593.424701][ T197] usb 6-1: SerialNumber: syz [ 594.266692][ T197] usb 6-1: config 0 descriptor?? [ 594.300265][ T197] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 594.300327][ T197] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 594.657462][ T5615] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 596.321154][ T197] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 596.332699][ T197] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 596.603716][ T820] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 597.654896][ T197] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 597.654917][ T197] em28xx 6-1:0.0: No AC97 audio processor [ 597.917566][ T820] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 597.917617][ T820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 597.917646][ T820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 597.917669][ T820] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 597.917712][ T820] usb 4-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 597.917738][ T820] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.003511][ T820] usb 4-1: config 0 descriptor?? [ 598.198547][ T820] usbhid 4-1:0.0: can't add hid device: -71 [ 598.198677][ T820] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 598.347204][ T820] usb 4-1: USB disconnect, device number 28 [ 599.151135][ T5615] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 599.154761][ T5615] Bluetooth: hci2: Injecting HCI hardware error event [ 599.161244][ T5615] Bluetooth: hci2: hardware error 0x00 [ 599.287635][ T197] usb 6-1: USB disconnect, device number 6 [ 599.371679][ T197] em28xx 6-1:0.0: Disconnecting em28xx [ 600.046601][ T5606] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 601.650543][ T9218] afs: Bad value for 'source' [ 601.783290][ T10] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 602.171007][ T9218] siw: device registration error -23 [ 602.257195][ T197] em28xx 6-1:0.0: Freeing device [ 602.286884][ T5615] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 602.665004][ T9218] netlink: 16 bytes leftover after parsing attributes in process `syz.5.866'. [ 603.246878][ T10] usb 5-1: device descriptor read/all, error -71 [ 604.485322][ T5615] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 604.504427][ T5615] Bluetooth: hci0: Injecting HCI hardware error event [ 604.507549][ T5615] Bluetooth: hci0: hardware error 0x00 [ 605.509731][ T9256] trusted_key: encrypted_key: insufficient parameters specified [ 605.964823][ T9259] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 605.965274][ T9259] overlayfs: overlapping lowerdir path [ 606.181828][ T5606] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 606.243229][ T10] usb 5-1: new full-speed USB device number 29 using dummy_hcd [ 607.078352][ T9266] netlink: 24 bytes leftover after parsing attributes in process `syz.3.881'. [ 607.127857][ T10] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 607.127914][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 607.127940][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 607.127965][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 607.128007][ T10] usb 5-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 607.128030][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.215398][ T10] usb 5-1: config 0 descriptor?? [ 607.653515][ T5755] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 607.854259][ T10] usbhid 5-1:0.0: can't add hid device: -71 [ 607.854651][ T10] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 607.918671][ T10] usb 5-1: USB disconnect, device number 29 [ 607.926503][ T5755] usb 4-1: device descriptor read/64, error -71 [ 607.969704][ T5615] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 609.671603][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 609.770923][ T5755] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 610.051330][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 610.052404][ T9] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 610.052441][ T9] usb 6-1: can't read configurations, error -71 [ 610.493940][ T5615] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 610.494344][ T5615] Bluetooth: hci3: Injecting HCI hardware error event [ 610.532177][ T5606] Bluetooth: hci3: hardware error 0x00 [ 612.773801][ T5606] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 613.013467][ T5755] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 615.247097][ T5755] usb 4-1: device not accepting address 31, error -71 [ 615.332432][ T9308] afs: Bad value for 'source' [ 615.356639][ T9308] netlink: 16 bytes leftover after parsing attributes in process `syz.2.885'. [ 616.343925][ T5755] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 616.560563][ T5755] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 616.560614][ T5755] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 616.560642][ T5755] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.560665][ T5755] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 616.560709][ T5755] usb 4-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 616.560733][ T5755] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.767210][ T5755] usb 4-1: config 0 descriptor?? [ 617.427420][ T5755] usbhid 4-1:0.0: can't add hid device: -71 [ 617.427551][ T5755] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 617.503474][ T5755] usb 4-1: USB disconnect, device number 32 [ 619.633732][ T9] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 620.950201][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 620.954617][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 620.954703][ T9] usb 4-1: can't read configurations, error -71 [ 622.412646][ T9338] file system registered [ 623.069797][ T9358] /dev/nullb0: Can't open blockdev [ 624.699498][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.699572][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.644679][ T5729] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 625.829346][ T5729] usb 4-1: unable to get BOS descriptor or descriptor too short [ 625.830354][ T5729] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 625.830380][ T5729] usb 4-1: can't read configurations, error -71 [ 632.653282][ T5729] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 634.247628][ T9418] fuse: Bad value for 'fd' [ 634.701194][ T5729] usb 6-1: unable to get BOS descriptor or descriptor too short [ 634.702263][ T5729] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 634.702299][ T5729] usb 6-1: can't read configurations, error -71 [ 636.657671][ T9446] netlink: 'syz.5.937': attribute type 1 has an invalid length. [ 637.438504][ T9446] 8021q: adding VLAN 0 to HW filter on device bond1 [ 637.661856][ T9459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.943'. [ 638.209115][ T9448] bond1: (slave syz_tun): Enslaving as a backup interface with an up link [ 640.792873][ T9492] netlink: 20 bytes leftover after parsing attributes in process `syz.5.956'. [ 641.552917][ T5615] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 641.589391][ T5615] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 641.607833][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 641.621636][ T5615] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 641.640822][ T5615] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 643.183183][ T5729] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 643.883251][ T5606] Bluetooth: hci1: command tx timeout [ 644.328841][ T9535] dummy_hcd dummy_hcd.0: remove, state 1 [ 644.333298][ T9535] usb usb1: USB disconnect, device number 1 [ 645.666911][ T9505] lo speed is unknown, defaulting to 1000 [ 645.963306][ T5606] Bluetooth: hci1: command tx timeout [ 646.581968][ T5729] usb 1-1: unable to get BOS descriptor or descriptor too short [ 646.631915][ T9535] dummy_hcd dummy_hcd.0: stopped [ 646.631940][ T9535] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 646.817897][ T9520] ================================================================== [ 646.817981][ T9520] BUG: KASAN: slab-use-after-free in set_link_state+0xc25/0x1000 [ 646.818161][ T9520] Read of size 4 at addr ffff888029bb14d8 by task syz.0.964/9520 [ 646.818205][ T9520] [ 646.818246][ T9520] CPU: 1 UID: 0 PID: 9520 Comm: syz.0.964 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 646.818297][ T9520] Tainted: [L]=SOFTLOCKUP [ 646.818303][ T9520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 646.818318][ T9520] Call Trace: [ 646.818343][ T9520] [ 646.818389][ T9520] dump_stack_lvl+0xe8/0x150 [ 646.818494][ T9520] print_address_description+0x55/0x1e0 [ 646.818545][ T9520] ? set_link_state+0xc25/0x1000 [ 646.818594][ T9520] print_report+0x58/0x70 [ 646.818616][ T9520] kasan_report+0x117/0x150 [ 646.818681][ T9520] ? set_link_state+0xc25/0x1000 [ 646.818703][ T9520] ? __pfx_gadget_suspend+0x10/0x10 [ 646.818744][ T9520] set_link_state+0xc25/0x1000 [ 646.818773][ T9520] dummy_pullup+0xbf/0x120 [ 646.818791][ T9520] ? __pfx_dummy_pullup+0x10/0x10 [ 646.818810][ T9520] usb_gadget_disconnect_locked+0x126/0x480 [ 646.818861][ T9520] gadget_unbind_driver+0xc2/0x410 [ 646.818887][ T9520] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 646.818911][ T9520] device_release_driver_internal+0x48b/0x880 [ 646.819003][ T9520] driver_detach+0x1f3/0x2d0 [ 646.819026][ T9520] bus_remove_driver+0x229/0x320 [ 646.819044][ T9520] usb_gadget_unregister_driver+0x4e/0x70 [ 646.819070][ T9520] raw_release+0xd2/0x260 [ 646.819087][ T9520] ? __pfx_raw_release+0x10/0x10 [ 646.819104][ T9520] __fput+0x42a/0xa80 [ 646.819153][ T9520] task_work_run+0x1d9/0x270 [ 646.819220][ T9520] ? __pfx_task_work_run+0x10/0x10 [ 646.819236][ T9520] ? rt_spin_unlock+0x163/0x200 [ 646.819330][ T9520] do_exit+0x73a/0x2360 [ 646.819365][ T9520] ? lockdep_hardirqs_on+0x7a/0x110 [ 646.819406][ T9520] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 646.819427][ T9520] ? __pfx_do_exit+0x10/0x10 [ 646.819440][ T9520] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 646.819464][ T9520] ? rt_spin_lock+0x1e0/0x400 [ 646.819490][ T9520] ? rt_spin_unlock+0x157/0x200 [ 646.819515][ T9520] do_group_exit+0x22d/0x2f0 [ 646.819529][ T9520] ? rt_spin_unlock+0x163/0x200 [ 646.819554][ T9520] get_signal+0x121b/0x12c0 [ 646.819598][ T9520] arch_do_signal_or_restart+0xbb/0x860 [ 646.819661][ T9520] ? __fget_files+0x2a/0x420 [ 646.819710][ T9520] ? __fget_files+0x3a8/0x420 [ 646.819726][ T9520] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 646.819757][ T9520] ? ksys_read+0x248/0x270 [ 646.819798][ T9520] exit_to_user_mode_loop+0x104/0x730 [ 646.819839][ T9520] ? rcu_is_watching+0x15/0xb0 [ 646.819892][ T9520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.819922][ T9520] do_syscall_64+0x353/0x580 [ 646.819959][ T9520] ? trace_irq_disable+0x3b/0x140 [ 646.820007][ T9520] ? clear_bhb_loop+0x40/0x90 [ 646.820024][ T9520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.820043][ T9520] RIP: 0033:0x7fe0b96fde99 [ 646.820061][ T9520] Code: Unable to access opcode bytes at 0x7fe0b96fde6f. [ 646.820089][ T9520] RSP: 002b:00007fe0b7956028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 646.820111][ T9520] RAX: 0000000000018ff8 RBX: 00007fe0b9985fa0 RCX: 00007fe0b96fde99 [ 646.820123][ T9520] RDX: 0000000000018ff8 RSI: 0000200000019680 RDI: 0000000000000003 [ 646.820133][ T9520] RBP: 00007fe0b9793eaf R08: 0000000000000000 R09: 0000000000000000 [ 646.820142][ T9520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 646.820151][ T9520] R13: 00007fe0b9986038 R14: 00007fe0b9985fa0 R15: 00007ffe3ee4c648 [ 646.820170][ T9520] [ 646.820175][ T9520] [ 646.820179][ T9520] Allocated by task 1: [ 646.820205][ T9520] kasan_save_track+0x3e/0x80 [ 646.820220][ T9520] __kasan_kmalloc+0x93/0xb0 [ 646.820234][ T9520] __kmalloc_noprof+0x41a/0x780 [ 646.820273][ T9520] __usb_create_hcd+0x67/0x900 [ 646.820353][ T9520] dummy_hcd_probe+0xf6/0x270 [ 646.820371][ T9520] platform_probe+0xf9/0x190 [ 646.820406][ T9520] really_probe+0x254/0xae0 [ 646.820427][ T9520] __driver_probe_device+0x1e8/0x360 [ 646.820446][ T9520] driver_probe_device+0x4f/0x240 [ 646.820467][ T9520] __device_attach_driver+0x270/0x410 [ 646.820488][ T9520] bus_for_each_drv+0x25b/0x2f0 [ 646.820502][ T9520] __device_attach+0x2c7/0x450 [ 646.820520][ T9520] device_initial_probe+0xa1/0xd0 [ 646.820540][ T9520] bus_probe_device+0x12d/0x220 [ 646.820553][ T9520] device_add+0x7d7/0xb80 [ 646.820588][ T9520] platform_device_add+0x4bd/0x860 [ 646.820604][ T9520] dummy_hcd_init+0x667/0xd00 [ 646.820680][ T9520] do_one_initcall+0x250/0x870 [ 646.820708][ T9520] do_initcall_level+0x10a/0x1a0 [ 646.820767][ T9520] do_initcalls+0x59/0xa0 [ 646.820784][ T9520] kernel_init_freeable+0x29d/0x3e0 [ 646.820803][ T9520] kernel_init+0x1d/0x1d0 [ 646.820823][ T9520] ret_from_fork+0x514/0xb70 [ 646.820879][ T9520] ret_from_fork_asm+0x1a/0x30 [ 646.820893][ T9520] [ 646.820896][ T9520] Freed by task 9535: [ 646.820903][ T9520] kasan_save_track+0x3e/0x80 [ 646.820916][ T9520] kasan_save_free_info+0x40/0x50 [ 646.820936][ T9520] __kasan_slab_free+0x5c/0x80 [ 646.820951][ T9520] kfree+0x1c5/0x6c0 [ 646.820962][ T9520] dummy_hcd_remove+0x107/0x130 [ 646.820981][ T9520] device_release_driver_internal+0x48b/0x880 [ 646.821002][ T9520] unbind_store+0x1a4/0x1d0 [ 646.821018][ T9520] kernfs_fop_write_iter+0x3a5/0x540 [ 646.821079][ T9520] vfs_write+0x61e/0xbb0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 646.821095][ T9520] ksys_write+0x156/0x270 [ 646.821113][ T9520] do_syscall_64+0x174/0x580 [ 646.821129][ T9520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.821143][ T9520] [ 646.821147][ T9520] Last potentially related work creation: [ 646.821152][ T9520] kasan_save_stack+0x3e/0x60 [ 646.821165][ T9520] kasan_record_aux_stack+0xbd/0xd0 [ 646.821186][ T9520] insert_work+0x3d/0x330 [ 646.821201][ T9520] __queue_work+0xd1d/0x10f0 [ 646.821242][ T9520] queue_work_on+0x106/0x1d0 [ 646.821262][ T9520] unlink1+0x33d/0x3e0 [ 646.821278][ T9520] usb_hcd_flush_endpoint+0x167/0x440 [ 646.821297][ T9520] usb_disable_interface+0x279/0x350 [ 646.821312][ T9520] usb_unbind_interface+0x265/0x9f0 [ 646.821328][ T9520] device_release_driver_internal+0x4f5/0x880 [ 646.821349][ T9520] bus_remove_device+0x449/0x560 [ 646.821363][ T9520] device_del+0x528/0x8f0 [ 646.821380][ T9520] usb_disable_device+0x3d4/0x8d0 [ 646.821394][ T9520] usb_disconnect+0x32d/0x990 [ 646.821434][ T9520] usb_remove_hcd+0x275/0x670 [ 646.821454][ T9520] dummy_hcd_remove+0xed/0x130 [ 646.821454][ T9520] dummy_hcd_remove+0xed/0x130 [ 646.821473][ T9520] device_release_driver_internal+0x48b/0x880 [ 646.821494][ T9520] unbind_store+0x1a4/0x1d0 [ 646.821510][ T9520] kernfs_fop_write_iter+0x3a5/0x540 [ 646.821530][ T9520] vfs_write+0x61e/0xbb0 [ 646.821546][ T9520] ksys_write+0x156/0x270 [ 646.821563][ T9520] do_syscall_64+0x174/0x580 [ 646.821580][ T9520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.821594][ T9520] [ 646.821597][ T9520] Second to last potentially related work creation: [ 646.821624][ T9520] kasan_save_stack+0x3e/0x60 [ 646.821638][ T9520] kasan_record_aux_stack+0xbd/0xd0 [ 646.821658][ T9520] insert_work+0x3d/0x330 [ 646.821672][ T9520] __queue_work+0xd1d/0x10f0 [ 646.821690][ T9520] queue_work_on+0x106/0x1d0 [ 646.821708][ T9520] usb_hcd_submit_urb+0xa2d/0x1b40 [ 646.821725][ T9520] usb_start_wait_urb+0x13f/0x5b0 [ 646.821738][ T9520] usb_control_msg+0x234/0x3e0 [ 646.821750][ T9520] hub_port_reset+0x450/0x1800 [ 646.821770][ T9520] hub_port_init+0xf48/0x28b0 [ 646.821784][ T9520] hub_event+0x24e2/0x4cf0 [ 646.821798][ T9520] process_scheduled_works+0xa8e/0x14e0 [ 646.821815][ T9520] worker_thread+0xa47/0xfb0 [ 646.821833][ T9520] kthread+0x388/0x470 [ 646.821871][ T9520] ret_from_fork+0x514/0xb70 [ 646.821893][ T9520] ret_from_fork_asm+0x1a/0x30 [ 646.821906][ T9520] [ 646.821910][ T9520] The buggy address belongs to the object at ffff888029bb1000 [ 646.821910][ T9520] which belongs to the cache kmalloc-2k of size 2048 [ 646.821922][ T9520] The buggy address is located 1240 bytes inside of [ 646.821922][ T9520] freed 2048-byte region [ffff888029bb1000, ffff888029bb1800) [ 646.821938][ T9520] [ 646.821942][ T9520] The buggy address belongs to the physical page: [ 646.821957][ T9520] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029bb7000 pfn:0x29bb0 [ 646.821972][ T9520] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 646.821984][ T9520] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 646.822000][ T9520] page_type: f5(slab) [ 646.822015][ T9520] raw: 0080000000000240 ffff88813ffb2000 ffffea000097c610 ffffea0000a54610 [ 646.822029][ T9520] raw: ffff888029bb7000 0000000800080007 00000000f5000000 0000000000000000 [ 646.822044][ T9520] head: 0080000000000240 ffff88813ffb2000 ffffea000097c610 ffffea0000a54610 [ 646.822057][ T9520] head: ffff888029bb7000 0000000800080007 00000000f5000000 0000000000000000 [ 646.822071][ T9520] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 646.822085][ T9520] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 646.822094][ T9520] page dumped because: kasan: bad access detected [ 646.822104][ T9520] page_owner tracks the page as allocated [ 646.822109][ T9520] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 13045605640, free_ts 0 [ 646.822150][ T9520] post_alloc_hook+0x1f9/0x250 [ 646.822182][ T9520] get_page_from_freelist+0x262a/0x26a0 [ 646.822216][ T9520] __alloc_frozen_pages_noprof+0x18d/0x380 [ 646.822233][ T9520] allocate_slab+0x79/0x5e0 [ 646.822271][ T9520] refill_objects+0x2d8/0x350 [ 646.822292][ T9520] __pcs_replace_empty_main+0x330/0x690 [ 646.822312][ T9520] __kmalloc_noprof+0x544/0x780 [ 646.822326][ T9520] platform_device_alloc+0x39/0x260 [ 646.822342][ T9520] dummy_hcd_init+0x2c9/0xd00 [ 646.822357][ T9520] do_one_initcall+0x250/0x870 [ 646.822369][ T9520] do_initcall_level+0x10a/0x1a0 [ 646.822387][ T9520] do_initcalls+0x59/0xa0 [ 646.822406][ T9520] kernel_init_freeable+0x29d/0x3e0 [ 646.822424][ T9520] kernel_init+0x1d/0x1d0 [ 646.822444][ T9520] ret_from_fork+0x514/0xb70 [ 646.822467][ T9520] ret_from_fork_asm+0x1a/0x30 [ 646.822480][ T9520] page_owner free stack trace missing [ 646.822485][ T9520] [ 646.822489][ T9520] Memory state around the buggy address: [ 646.822518][ T9520] ffff888029bb1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 646.822528][ T9520] ffff888029bb1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 646.822539][ T9520] >ffff888029bb1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 646.822547][ T9520] ^ [ 646.822555][ T9520] ffff888029bb1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 646.822565][ T9520] ffff888029bb1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 646.822573][ T9520] ================================================================== [ 647.576615][ T9520] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 647.576644][ T9520] CPU: 1 UID: 0 PID: 9520 Comm: syz.0.964 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 647.576680][ T9520] Tainted: [L]=SOFTLOCKUP [ 647.576689][ T9520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 647.576705][ T9520] Call Trace: [ 647.576715][ T9520] [ 647.576725][ T9520] vpanic+0x56c/0xa60 [ 647.576765][ T9520] ? __pfx_vpanic+0x10/0x10 [ 647.576790][ T9520] ? __pfx___schedule+0x10/0x10 [ 647.576823][ T9520] panic+0xc5/0xd0 [ 647.576845][ T9520] ? __pfx_panic+0x10/0x10 [ 647.576868][ T9520] ? preempt_schedule_thunk+0x16/0x40 [ 647.576906][ T9520] ? set_link_state+0xc25/0x1000 [ 647.576935][ T9520] check_panic_on_warn+0x89/0xb0 [ 647.577040][ T9520] ? set_link_state+0xc25/0x1000 [ 647.577069][ T9520] end_report+0x73/0x170 [ 647.577098][ T9520] ? set_link_state+0xc25/0x1000 [ 647.577125][ T9520] kasan_report+0x128/0x150 [ 647.577156][ T9520] ? set_link_state+0xc25/0x1000 [ 647.577190][ T9520] ? __pfx_gadget_suspend+0x10/0x10 [ 647.577218][ T9520] set_link_state+0xc25/0x1000 [ 647.577254][ T9520] dummy_pullup+0xbf/0x120 [ 647.577284][ T9520] ? __pfx_dummy_pullup+0x10/0x10 [ 647.577311][ T9520] usb_gadget_disconnect_locked+0x126/0x480 [ 647.577348][ T9520] gadget_unbind_driver+0xc2/0x410 [ 647.577386][ T9520] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 647.577421][ T9520] device_release_driver_internal+0x48b/0x880 [ 647.577460][ T9520] driver_detach+0x1f3/0x2d0 [ 647.577497][ T9520] bus_remove_driver+0x229/0x320 [ 647.577525][ T9520] usb_gadget_unregister_driver+0x4e/0x70 [ 647.577560][ T9520] raw_release+0xd2/0x260 [ 647.577586][ T9520] ? __pfx_raw_release+0x10/0x10 [ 647.577614][ T9520] __fput+0x42a/0xa80 [ 647.577644][ T9520] task_work_run+0x1d9/0x270 [ 647.577671][ T9520] ? __pfx_task_work_run+0x10/0x10 [ 647.577694][ T9520] ? rt_spin_unlock+0x163/0x200 [ 647.577737][ T9520] do_exit+0x73a/0x2360 [ 647.577766][ T9520] ? lockdep_hardirqs_on+0x7a/0x110 [ 647.577795][ T9520] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 647.577828][ T9520] ? __pfx_do_exit+0x10/0x10 [ 647.577850][ T9520] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 647.577886][ T9520] ? rt_spin_lock+0x1e0/0x400 [ 647.577926][ T9520] ? rt_spin_unlock+0x157/0x200 [ 647.577966][ T9520] do_group_exit+0x22d/0x2f0 [ 647.577989][ T9520] ? rt_spin_unlock+0x163/0x200 [ 647.578033][ T9520] get_signal+0x121b/0x12c0 [ 647.578076][ T9520] arch_do_signal_or_restart+0xbb/0x860 [ 647.578111][ T9520] ? __fget_files+0x2a/0x420 [ 647.578136][ T9520] ? __fget_files+0x3a8/0x420 [ 647.578162][ T9520] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 647.578203][ T9520] ? ksys_read+0x248/0x270 [ 647.578239][ T9520] exit_to_user_mode_loop+0x104/0x730 [ 647.578265][ T9520] ? rcu_is_watching+0x15/0xb0 [ 647.578297][ T9520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.578324][ T9520] do_syscall_64+0x353/0x580 [ 647.578353][ T9520] ? trace_irq_disable+0x3b/0x140 [ 647.578377][ T9520] ? clear_bhb_loop+0x40/0x90 [ 647.578405][ T9520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.578430][ T9520] RIP: 0033:0x7fe0b96fde99 [ 647.578453][ T9520] Code: Unable to access opcode bytes at 0x7fe0b96fde6f. [ 647.578466][ T9520] RSP: 002b:00007fe0b7956028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 647.578493][ T9520] RAX: 0000000000018ff8 RBX: 00007fe0b9985fa0 RCX: 00007fe0b96fde99 [ 647.578511][ T9520] RDX: 0000000000018ff8 RSI: 0000200000019680 RDI: 0000000000000003 [ 647.578526][ T9520] RBP: 00007fe0b9793eaf R08: 0000000000000000 R09: 0000000000000000 [ 647.578542][ T9520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 647.578557][ T9520] R13: 00007fe0b9986038 R14: 00007fe0b9985fa0 R15: 00007ffe3ee4c648 [ 647.578586][ T9520] [ 647.578775][ T9520] Kernel Offset: disabled