last executing test programs: 1m11.060015643s ago: executing program 1 (id=596): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) 1m10.801079891s ago: executing program 1 (id=598): r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x38fe, &(0x7f0000000300)={0x0, 0x2355, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x280}}) io_uring_enter(r2, 0x3023, 0x4000, 0x40, 0x0, 0x28) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x3, 0x801, 0x0, &(0x7f0000000040), 0xfffffffc) 1m9.657036151s ago: executing program 1 (id=603): openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@decl_tag={0x4, 0x0, 0x0, 0x11, 0x4, 0xffffffffffffffff}]}}, 0x0, 0x2a, 0x0, 0x0, 0x5, 0x10000, @value}, 0x28) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)=0x6680000) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x10) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1m9.14670608s ago: executing program 1 (id=606): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r2 = accept4(r1, 0x0, 0x0, 0x0) write(r2, &(0x7f0000000040)="cb", 0xfffffdef) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) 1m7.391119311s ago: executing program 1 (id=618): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mount$afs(0x0, &(0x7f0000002840)='./file0\x00', &(0x7f0000002880), 0x700, &(0x7f00000000c0)={[{@dyn}]}) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 1m5.34314132s ago: executing program 1 (id=622): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000440)=[{&(0x7f0000000200)='Z', 0x1}], 0x1, 0x0) r2 = syz_io_uring_setup(0x514b, &(0x7f00000003c0)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r2, 0x48e9, 0x0, 0x2, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write(r5, &(0x7f0000000100)='\x00', 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) splice(r5, &(0x7f0000000180)=0xffffffffffffffff, r1, 0x0, 0x4, 0x0) 52.935997258s ago: executing program 4 (id=706): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000340), 0x8) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000040)={0x51, 0x5, 0xfff8, {0x3, 0x7fff}, {0x8d, 0xa}, @const={0x0, {0x5d, 0x7ff, 0x3, 0x4}}}) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x4a8, 0x0, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x508) syz_emit_ethernet(0x66, &(0x7f00000006c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd6000008000303afffe040000000000000000000000000001ff020000000000000000000000000001030190780800000065e48efe0003ef97dc9bf826339a9366b29806c0c6cb0c0400000000000000000000ffffffffffff"], 0x0) 52.745330083s ago: executing program 4 (id=707): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x5, 0xff, 0x1f}, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}]}) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0, 0x5) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 52.535964711s ago: executing program 4 (id=708): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401001186eee20009058217", @ANYBLOB="3ff4"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xffffffff) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 52.011320847s ago: executing program 3 (id=709): sched_setaffinity(0x0, 0x0, 0x0) dup(0xffffffffffffffff) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) syz_emit_ethernet(0x0, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x200000000114, 0x271f, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b25, &(0x7f0000000040)) 50.893747461s ago: executing program 4 (id=711): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x18d811, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r1, &(0x7f0000003480)={0x2020}, 0x2020) 50.720950794s ago: executing program 4 (id=712): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/13, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x42, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = mq_open(&(0x7f0000000180)='\r\x00elinu\xef\xe3elinux\x00\x96\xf6\x92\n#*\xac\x05\xce\xf8D\\\x9a\xe6[]L+\xf6\v\xe8\xf2\xd3\b\x15\n\xb8F!Q9o\x1f#\xbdt\r\xfb\"\x18%\xfdM\xaf_t\xd2\xdcJ\x10\a\xbab\x1a\xdf\xb1\xbdU\xd7Lo\xe7\xac\x81\x10k\xce-\xf5@\xbb\x9d;\xe8\xf6\xffQ\x04\xaai\x92k\x1b;\xddM\xa2\xe1-\x0e\xd8\xde\x00\xff\x18\xdd\bL\xfb\xa2.\xb6{\xb5\x85#\x88\xdc\xf0\x0f\x05\xf1\xc4 \xdeV\x80q\xf7\x04\xf5\x85T\x1f\xc2S]*\xc9lw\xd3J\xc5\xe8\x02\xcb\xbbAHxr\xac\xb77F\xdf\x1c\xcb\xd4\xce\x88L\xf1\xf9[\x98\xd4+pTx\x95\xb5\x1b]x\x1a\x95\xe1c6\xe7`83\xb7n#\xe0\xc1_\xec\xba\xde\a\x8b\xc5\x86woo\xbc\x1c\xa3r\x82\xf3enq-\x90/\xed\xff\xad+\x03\x10\t\xda\xfd\xa2\xd0\xef4\n%\xf1\xd8', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x4}) mq_getsetattr(r2, &(0x7f0000000700)={0x800, 0x10, 0x9}, 0x0) mq_timedreceive(r2, &(0x7f0000000340)=""/195, 0xc3, 0x0, 0x0) mq_timedreceive(r2, &(0x7f0000000080)=""/92, 0x5c, 0x0, 0x0) 50.278724011s ago: executing program 32 (id=622): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000440)=[{&(0x7f0000000200)='Z', 0x1}], 0x1, 0x0) r2 = syz_io_uring_setup(0x514b, &(0x7f00000003c0)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r2, 0x48e9, 0x0, 0x2, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write(r5, &(0x7f0000000100)='\x00', 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) splice(r5, &(0x7f0000000180)=0xffffffffffffffff, r1, 0x0, 0x4, 0x0) 49.285713101s ago: executing program 3 (id=717): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000e40)=ANY=[@ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="0200000002"], 0x10) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000001180)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="0200000002"], 0x10) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@cgroup=r4, 0x2, 0x0, 0x0, &(0x7f0000000200)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) 48.662889887s ago: executing program 4 (id=718): openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x101001, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='rxrpc_conn\x00', r0, 0x0, 0x2}, 0x18) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x3, 0x33) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={r2}) getsockopt$inet_mreqsrc(r1, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) 48.031804165s ago: executing program 33 (id=718): openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x101001, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='rxrpc_conn\x00', r0, 0x0, 0x2}, 0x18) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x3, 0x33) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={r2}) getsockopt$inet_mreqsrc(r1, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) 47.99305413s ago: executing program 3 (id=724): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mkdir(&(0x7f0000000000)='./file0\x00', 0x26) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r2, 0x2, 0x0) getdents64(r2, 0x0, 0x22) getdents64(r2, &(0x7f0000000100)=""/48, 0x30) 47.945920682s ago: executing program 3 (id=725): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0xe) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) 41.353155549s ago: executing program 0 (id=749): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @loopback, 0x800}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) write$binfmt_script(r0, &(0x7f0000000100), 0x61) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc67d0794e26f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r0, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) readv(r0, &(0x7f0000000bc0)=[{&(0x7f0000000c80)=""/167, 0xa7}], 0x1) 40.451629641s ago: executing program 0 (id=751): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r0, r1, 0x2, 0x2, 0x0, @void, @value}, 0x10) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r2, r3, 0x2, 0x2, 0x0, @void, @value}, 0x10) socket$kcm(0xa, 0x3, 0x3a) 40.371418958s ago: executing program 0 (id=752): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bind$can_raw(r0, &(0x7f00000005c0), 0x10) read(r0, &(0x7f00000027c0)=""/4073, 0xfe9) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000580)=0x1, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) sendmsg$can_raw(r0, &(0x7f0000000240)={&(0x7f0000000780)={0x1d, r1}, 0x10, &(0x7f0000000200)={&(0x7f00000007c0)=@can={{0x2, 0x0, 0x1, 0x1}, 0x1, 0x2, 0x0, 0x0, "f97003b8750e5566"}, 0x10}}, 0x0) 40.102124924s ago: executing program 0 (id=755): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) 31.49264599s ago: executing program 3 (id=725): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0xe) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) 25.396172814s ago: executing program 0 (id=755): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) 14.695488025s ago: executing program 3 (id=725): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0xe) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) 11.793315041s ago: executing program 0 (id=755): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) 2.273838458s ago: executing program 2 (id=937): shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000040)=""/210) socket$packet(0x11, 0x3, 0x300) syz_emit_vhci(&(0x7f0000000880)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_disconn_req={{0x6, 0x3, 0x4}, {0xb6}}}}, 0x11) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) r1 = dup(r0) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x4}}, 0x50) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000231961240950b2a7728280102030109021200014200800609044606009b34e8086a325cddfbe67246b77dd619d915b8d900e1923462c020875072a36349d331bc46e6bc5badb390ad01a1065c2a9397b0ae7e7ed99cd4f2af947582baf668e85cb8b3d138cda570f4b5d96d4941b04147573455ba0b7003d2ed1df192afd98024cc7ff7e77c3d7c4db201fa440c6cf695e3a42fbc388bf83e45d1eb8df5a9e4d92ff574a5ab7d089e163e484e9744fe3b6bdd07d469465ecdd585c82d13040a10aba52e9c6a6b61eec87238f9956d"], 0x0) 1.62392853s ago: executing program 2 (id=940): r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029b0003010000000904000000010100000a2401000000020102092408000000004c58062404000052072405000053f10b24050000133b9bda531c092405fc0596efc359090401000001020000090401010101020000090501090000000000072501000600000904020000010200000904020101010200000b2402017f0200018b7e8e07240100000000090582091000000000072501f5"], 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, &(0x7f0000000000)={0x40, 0x0, 0x6e, {0x6e, 0x7, "9d1afe8b7933c42c77943186c5dc879f64aa83a005cef25326cdc8815b46d437185981ba20558252e3f9ef5e13cdde4c8a28a3368ea8ba21237a23a2f7848a3802eb2634c5242d646211e7313e918ee8117c5a8c66c3b77443b3814f8c646d3090a0849ee2373424e029868a"}}, &(0x7f0000000140)={0x0, 0x3, 0x7d, @string={0x7d, 0x3, "0ae1f4177a413dd249d6ff13a6ca2565f0ece278461737f91d0e758740cafb8bcc8ae8f66e30d62b360f8aac62eec398416e72db7dfe7cab616f9114ab329a5173852c8700c158f2edda9442cf5e8df9ba8bbb74e6a0d7ae147b452c5f4d8d87069ecc0249a4f4b3979289d7ed9087fa2375e99b40940a754262cd"}}, &(0x7f0000000080)={0x0, 0xf, 0x8, {0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}}, 0x0, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xcc, 0x1, 0x7f, 0xf9, 0x4, 0x8, 0x9}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 1.609735932s ago: executing program 5 (id=941): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x27) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000001c0)='sched_process_wait\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x10, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000008000000000000005805000018100000", @ANYRES32=r4, @ANYBLOB="000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) close(r3) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000500)={r3, r5, 0x4, r0}, 0x10) 1.552191733s ago: executing program 6 (id=942): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0xfffffffd) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000001000), 0x581, 0x4000001f, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, 0x0, 0x0) 1.465566142s ago: executing program 5 (id=943): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400010005"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000007000000010001000800000001"], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r1}, 0x10) 1.341493863s ago: executing program 5 (id=944): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="01000000030000000200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000008900000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000007500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000100), 0x1001) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000ac0)='mm_page_free_batched\x00', r2}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) 1.233673115s ago: executing program 5 (id=945): mknod$loop(&(0x7f0000000180)='./file0\x00', 0x0, 0x1) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='cifs\x00', 0x48, &(0x7f00000002c0)='cache=none') setresuid(0xee01, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f00000001c0)) r0 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0x400e802, 0x1, 0x7, 0xfff}}) 1.124528997s ago: executing program 5 (id=946): r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r0, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc)=0x1, 0x4) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write(r0, &(0x7f0000000000)='\"', 0xfdef) 1.033236565s ago: executing program 2 (id=947): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x34, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}}, 0x20) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x2}}, 0x26) ioctl$PPPIOCGL2TPSTATS(r4, 0x40047459, 0x0) 943.766626ms ago: executing program 2 (id=948): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x20, 0x1) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) truncate(&(0x7f0000000240)='./file0\x00', 0x206b12) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0xff0f, 0x8c) 774.180879ms ago: executing program 2 (id=949): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0xf5, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r3, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) 659.404324ms ago: executing program 2 (id=950): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@loopback, 0x4e24, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {}, 0x0, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x633, 0x0, 0x80000008, {{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {@in=@local, 0x4d2, 0x32}, @in6=@mcast2, {0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x100}, {0x5, 0x2000000000, 0x0, 0x5}, {}, 0x2, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_usb_connect(0x0, 0x56, 0x0, 0x0) 619.18217ms ago: executing program 6 (id=951): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000040000000000000000000085000000d000000085000000d000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2401, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0xe) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15) r3 = dup(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xb, 0x7, 0x2, 0x4, 0x5, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000280)=ANY=[], 0xa8) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x10, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) 421.247862ms ago: executing program 6 (id=952): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000680)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x3, 0x0, 0x6, 0x6, 0x4], 0x2000, 0x8240}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) capset(&(0x7f0000000300)={0x20071026}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 283.179018ms ago: executing program 6 (id=953): r0 = fsopen(&(0x7f00000003c0)='virtiofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000540)='\xd0\x9e^\xa0\xee\xc8\x17T\xb1GI\x90\xe2Q1\xb0\x8f\xe1\xa8\x95\xa0\xcd\fL\xf10xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_fscache}], [], 0x6b}}) truncate(&(0x7f0000000240)='./file0\x00', 0x206b12) open(&(0x7f0000000340)='./file0\x00', 0x0, 0x69) 159.039092ms ago: executing program 5 (id=955): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000300)={0xc9, 0x0, 0xc}) ioctl$KVM_RUN(r2, 0xae80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000073015f00000000009500000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 6 (id=956): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01d90000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00f7ffffffffffff130012800b00010062617461647600000400028008000a00", @ANYRES32=r2], 0x3c}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) kernel console output (not intermixed with test programs): blocking state [ 76.814904][ T4468] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.838470][ T5810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.877398][ T4468] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.884631][ T4468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.057698][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.143725][ T5818] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.225726][ T5810] veth0_vlan: entered promiscuous mode [ 77.260301][ T5810] veth1_vlan: entered promiscuous mode [ 77.323269][ T5812] veth0_vlan: entered promiscuous mode [ 77.360396][ T5812] veth1_vlan: entered promiscuous mode [ 77.432850][ T5810] veth0_macvtap: entered promiscuous mode [ 77.461085][ T5810] veth1_macvtap: entered promiscuous mode [ 77.558756][ T5812] veth0_macvtap: entered promiscuous mode [ 77.581804][ T5812] veth1_macvtap: entered promiscuous mode [ 77.593520][ T5810] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.635192][ T5810] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.655744][ T5812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.667678][ T5812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.679528][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.694948][ T5810] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.703709][ T5810] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.712623][ T5810] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.721393][ T5810] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.735702][ T5812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.746715][ T5812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.760422][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.771543][ T5812] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.780650][ T5812] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.789549][ T5812] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.798382][ T5812] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.811585][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.823028][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.968307][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.977793][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.007622][ T5818] veth0_vlan: entered promiscuous mode [ 78.059022][ T5880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.059494][ T1084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.078459][ T1084] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.086698][ T5880] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.137990][ T5818] veth1_vlan: entered promiscuous mode [ 78.161828][ T5822] veth0_vlan: entered promiscuous mode [ 78.185181][ T1084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.193043][ T1084] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.207699][ T5821] veth0_vlan: entered promiscuous mode [ 78.208041][ T5810] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 78.233615][ T5822] veth1_vlan: entered promiscuous mode [ 78.252512][ T5818] veth0_macvtap: entered promiscuous mode [ 78.268532][ T5821] veth1_vlan: entered promiscuous mode [ 78.288616][ T5818] veth1_macvtap: entered promiscuous mode [ 78.398512][ T5827] Bluetooth: hci0: command tx timeout [ 78.403963][ T5827] Bluetooth: hci1: command tx timeout [ 78.452676][ T5818] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.466494][ T5818] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.474544][ T5817] Bluetooth: hci2: command tx timeout [ 78.476818][ T5820] Bluetooth: hci3: command tx timeout [ 78.481847][ T5827] Bluetooth: hci4: command tx timeout [ 78.488301][ T5818] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.503777][ T5818] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.520891][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.546630][ T5821] veth0_macvtap: entered promiscuous mode [ 78.557247][ T5822] veth0_macvtap: entered promiscuous mode [ 78.584663][ T5818] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.610539][ T5818] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.672412][ T5818] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.698874][ T5818] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.736056][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.775181][ T5821] veth1_macvtap: entered promiscuous mode [ 78.811803][ T5818] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.850194][ T5818] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.940006][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 79.042151][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 79.084814][ T5818] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.131615][ T5818] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.185777][ T5822] veth1_macvtap: entered promiscuous mode [ 79.303183][ T5821] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.376609][ T5821] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.414193][ T5821] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.424945][ T5821] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.435262][ T5821] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.452095][ T5821] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.474199][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.496727][ T5821] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.521069][ T5821] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.554195][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 79.625625][ T5821] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.646133][ T5821] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.660488][ T5821] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.676139][ T5821] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.691331][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.766989][ T5821] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.786083][ T5821] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.804289][ T5821] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.816655][ T5821] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.842738][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.870669][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.896829][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.924222][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.947866][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.964463][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.977875][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.992065][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.015986][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.090384][ T1084] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.111130][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.121743][ T1084] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.143262][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.153362][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.164474][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.179734][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.193558][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.203824][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.216962][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.265574][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.302671][ T5822] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.312414][ T5822] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.325238][ T5822] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.344547][ T5822] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.406062][ T4468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.428226][ T4468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.478274][ T5827] Bluetooth: hci1: command tx timeout [ 80.481579][ T5820] Bluetooth: hci0: command tx timeout [ 80.555083][ T5820] Bluetooth: hci3: command tx timeout [ 80.555722][ T5827] Bluetooth: hci4: command tx timeout [ 80.560510][ T5820] Bluetooth: hci2: command tx timeout [ 80.629188][ T4468] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.684649][ T4468] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.821440][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.858820][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.909244][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.938720][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.951287][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.984742][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.388242][ T5919] process 'syz.3.4' launched './file2' with NULL argv: empty string added [ 81.618473][ T95] cfg80211: failed to load regulatory.db [ 82.139890][ T5936] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 82.269411][ T5936] netlink: 16 bytes leftover after parsing attributes in process `syz.3.14'. [ 82.966077][ T5892] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 83.120719][ T30] audit: type=1326 audit(1746270282.615:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5932 comm="syz.2.15" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x0 [ 83.144291][ T5892] usb 4-1: Using ep0 maxpacket: 32 [ 83.159123][ T5892] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 83.180982][ T5892] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 83.195857][ T5892] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 83.211568][ T5892] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.256486][ T5892] usb 4-1: config 0 descriptor?? [ 83.292109][ T5892] hub 4-1:0.0: USB hub found [ 83.503911][ T5892] hub 4-1:0.0: 1 port detected [ 83.820780][ T5967] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 84.054617][ T5973] bridge: RTM_NEWNEIGH with invalid ether address [ 84.122681][ T5892] hub 4-1:0.0: activate --> -90 [ 84.253038][ T5977] netlink: 'syz.2.29': attribute type 4 has an invalid length. [ 84.277119][ T5977] netlink: 'syz.2.29': attribute type 4 has an invalid length. [ 84.339063][ T5892] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 84.349009][ T976] usb 4-1: USB disconnect, device number 2 [ 84.436115][ T5984] netlink: 96 bytes leftover after parsing attributes in process `syz.1.31'. [ 84.482114][ T5986] syz.2.32: attempt to access beyond end of device [ 84.482114][ T5986] loop5: rw=0, sector=0, nr_sectors = 1 limit=0 [ 84.524613][ T5986] FAT-fs (loop5): unable to read boot sector [ 84.964204][ T24] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 84.982024][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 85.140718][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 85.154637][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.168821][ T24] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 85.183059][ T24] usb 3-1: New USB device strings: Mfr=145, Product=0, SerialNumber=0 [ 85.200294][ T24] usb 3-1: Manufacturer: syz [ 85.210189][ T24] usb 3-1: config 0 descriptor?? [ 85.224879][ T24] hub 3-1:0.0: USB hub found [ 85.344091][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 85.437688][ T24] hub 3-1:0.0: 1 port detected [ 85.493931][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 85.963084][ T6009] kvm: pic: non byte write [ 86.051670][ T24] hub 3-1:0.0: activate --> -90 [ 86.782194][ T6035] xt_hashlimit: size too large, truncated to 1048576 [ 86.808711][ T6035] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 86.862567][ T5861] usb 3-1: USB disconnect, device number 2 [ 86.868694][ T24] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 86.876391][ T24] usb 3-1-port1: connect-debounce failed [ 86.887726][ T5892] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 87.055764][ T5892] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.066929][ T5892] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.076972][ T5892] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 87.093251][ T5892] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 87.114977][ T5892] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.136982][ T5892] usb 4-1: config 0 descriptor?? [ 87.606615][ T5892] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 87.663745][ T6050] bridge_slave_0: left allmulticast mode [ 87.667950][ T5892] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 87.716322][ T6050] bridge_slave_0: left promiscuous mode [ 87.722421][ T6050] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.775248][ T6054] netlink: 'syz.2.58': attribute type 10 has an invalid length. [ 87.803040][ T6050] bridge_slave_1: left allmulticast mode [ 87.866521][ T6050] bridge_slave_1: left promiscuous mode [ 87.875073][ T6050] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.892858][ T6050] bond0: (slave bond_slave_0): Releasing backup interface [ 87.902763][ T6050] bond0: (slave bond_slave_1): Releasing backup interface [ 87.920680][ T5861] usb 4-1: USB disconnect, device number 3 [ 87.928321][ T6050] team0: Port device team_slave_0 removed [ 87.962950][ T6050] team0: Port device team_slave_1 removed [ 87.985742][ T6050] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.014366][ T6050] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 88.033392][ T6050] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.062686][ T6050] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.100900][ T6054] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.112372][ T6054] team0: Port device bond0 added [ 88.322482][ T6065] capability: warning: `syz.4.63' uses deprecated v2 capabilities in a way that may be insecure [ 88.429183][ T6067] @: renamed from vlan0 (while UP) [ 88.789055][ T30] audit: type=1326 audit(1746270288.295:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6056 comm="syz.0.60" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff1a398e969 code=0x0 [ 89.704176][ T30] audit: type=1800 audit(1746270289.205:4): pid=6104 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.77" name="file1" dev="overlay" ino=106 res=0 errno=0 [ 89.711228][ T6103] Zero length message leads to an empty skb [ 89.916862][ T5827] Bluetooth: hci5: command 0x1003 tx timeout [ 89.922148][ T5820] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 90.459649][ T6121] netlink: 28 bytes leftover after parsing attributes in process `syz.0.84'. [ 90.477851][ T30] audit: type=1800 audit(1746270289.985:5): pid=6119 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.83" name="file1" dev="overlay" ino=125 res=0 errno=0 [ 90.509386][ T6121] netlink: 'syz.0.84': attribute type 7 has an invalid length. [ 90.552092][ T6121] netlink: 'syz.0.84': attribute type 8 has an invalid length. [ 90.594880][ T6121] netlink: 4 bytes leftover after parsing attributes in process `syz.0.84'. [ 90.897867][ T6133] netlink: 24 bytes leftover after parsing attributes in process `syz.1.88'. [ 91.137822][ T6140] tipc: Started in network mode [ 91.165531][ T6140] tipc: Node identity 4000004, cluster identity 4711 [ 91.172258][ T6140] tipc: Node number set to 67108868 [ 91.225916][ T6143] netlink: 36 bytes leftover after parsing attributes in process `syz.0.93'. [ 91.644171][ T24] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 91.816912][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.852930][ T24] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 91.862294][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.880771][ T24] usb 5-1: config 0 descriptor?? [ 93.591578][ T6204] netlink: 4 bytes leftover after parsing attributes in process `syz.3.113'. [ 93.610959][ T6204] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.627882][ T6204] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 93.642984][ T6204] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.668372][ T6204] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.377209][ T6225] mmap: syz.2.120 (6225) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 94.455202][ T24] usbhid 5-1:0.0: can't add hid device: -71 [ 94.479515][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 94.547417][ T24] usb 5-1: USB disconnect, device number 2 [ 95.824713][ T6262] loop9: detected capacity change from 0 to 7 [ 95.861783][ T6262] loop9: [POWERTEC] [ 95.867462][ T95] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 96.034167][ T95] usb 1-1: Using ep0 maxpacket: 8 [ 96.044330][ T95] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 96.063934][ T95] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.097030][ T95] usb 1-1: config 0 descriptor?? [ 96.321456][ T95] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 96.962850][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 97.770952][ T6297] trusted_key: syz.3.146 sent an empty control message without MSG_MORE. [ 97.813480][ T6299] netlink: 24 bytes leftover after parsing attributes in process `syz.1.147'. [ 97.840585][ T95] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 97.851795][ T95] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write Medium Mode mode to 0x0306: ffffffb9 [ 97.872518][ T95] asix 1-1:0.0: probe with driver asix failed with error -71 [ 97.906624][ T95] usb 1-1: USB disconnect, device number 2 [ 98.492377][ T6319] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 98.847862][ T6336] ref_ctr_offset mismatch. inode: 0xf8 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x6 [ 99.645630][ T6355] netlink: 4 bytes leftover after parsing attributes in process `syz.0.167'. [ 99.817421][ T6362] kvm: emulating exchange as write [ 99.901995][ T6365] evm: overlay not supported [ 100.225080][ T6357] infiniband syz0: set active [ 100.247529][ T6357] infiniband syz0: added bridge_slave_0 [ 100.388464][ T6357] RDS/IB: syz0: added [ 100.405493][ T6357] smc: adding ib device syz0 with port count 1 [ 100.438732][ T6357] smc: ib device syz0 port 1 has pnetid [ 100.739146][ T6391] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 100.741131][ T30] audit: type=1326 audit(1746270300.245:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 100.834187][ T30] audit: type=1326 audit(1746270300.275:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 100.877020][ T30] audit: type=1326 audit(1746270300.275:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 100.950907][ T30] audit: type=1326 audit(1746270300.275:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 101.016895][ T30] audit: type=1326 audit(1746270300.275:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 101.092109][ T30] audit: type=1326 audit(1746270300.275:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 101.153890][ T30] audit: type=1326 audit(1746270300.275:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 101.226365][ T30] audit: type=1326 audit(1746270300.275:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 101.270500][ T30] audit: type=1326 audit(1746270300.275:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=267 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 101.336499][ T30] audit: type=1326 audit(1746270300.275:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6392 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x7ffc0000 [ 102.155952][ T6420] netlink: 12 bytes leftover after parsing attributes in process `syz.1.194'. [ 102.656496][ T6431] Bluetooth: MGMT ver 1.23 [ 102.845534][ T6437] bridge_slave_0: left allmulticast mode [ 102.868992][ T6437] bridge_slave_0: left promiscuous mode [ 102.883723][ T6437] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.916673][ T6437] bridge_slave_1: left allmulticast mode [ 102.922364][ T6437] bridge_slave_1: left promiscuous mode [ 102.937315][ T6437] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.982613][ T6437] bond0: (slave bond_slave_0): Releasing backup interface [ 103.003081][ T6437] bond0: (slave bond_slave_1): Releasing backup interface [ 103.108783][ T6437] team0: Port device team_slave_0 removed [ 103.183882][ T6437] team0: Port device team_slave_1 removed [ 103.368826][ T6449] netlink: 12 bytes leftover after parsing attributes in process `syz.0.206'. [ 104.259732][ T6477] netlink: 24 bytes leftover after parsing attributes in process `syz.2.216'. [ 104.358569][ T6483] netlink: 4 bytes leftover after parsing attributes in process `syz.3.217'. [ 105.364933][ T6512] kvm: Disabled LAPIC found during irq injection [ 106.164320][ T976] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 106.334124][ T976] usb 3-1: Using ep0 maxpacket: 32 [ 106.351199][ T976] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.392665][ T976] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.415743][ T976] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 106.438915][ T976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.458659][ T976] usb 3-1: config 0 descriptor?? [ 106.488335][ T976] hub 3-1:0.0: USB hub found [ 106.704220][ T976] hub 3-1:0.0: 1 port detected [ 106.983635][ T5892] hid-generic 0005:16C0:5505.0002: item fetching failed at offset 0/3 [ 106.997813][ T5892] hid-generic 0005:16C0:5505.0002: probe with driver hid-generic failed with error -22 [ 107.118879][ T6571] netlink: 'syz.4.251': attribute type 4 has an invalid length. [ 107.346968][ T6576] netlink: 12 bytes leftover after parsing attributes in process `syz.4.252'. [ 107.550697][ T5892] hub 3-1:0.0: activate --> -90 [ 107.580261][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 107.592449][ T976] usb 3-1: USB disconnect, device number 3 [ 108.475084][ T5863] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 108.684641][ T5863] usb 3-1: Using ep0 maxpacket: 8 [ 108.714536][ T5863] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 108.748393][ T6606] netlink: 24 bytes leftover after parsing attributes in process `syz.1.265'. [ 108.752812][ T5863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.786317][ T5863] usb 3-1: Product: syz [ 108.802195][ T5863] usb 3-1: Manufacturer: syz [ 108.811054][ T5863] usb 3-1: SerialNumber: syz [ 108.873666][ T5863] usb 3-1: config 0 descriptor?? [ 109.015150][ T6613] ceph: No mds server is up or the cluster is laggy [ 109.123046][ T5863] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 109.313648][ T6627] netlink: 4 bytes leftover after parsing attributes in process `syz.3.272'. [ 110.044189][ T95] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 110.127572][ T6652] tipc: New replicast peer: 255.255.255.255 [ 110.139347][ T6652] tipc: Enabled bearer , priority 10 [ 110.153930][ T5863] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 110.224670][ T5863] usb 3-1: USB disconnect, device number 4 [ 110.269701][ T95] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.318997][ T95] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.354348][ T95] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 110.412881][ T95] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 110.469327][ T95] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.507473][ T95] usb 5-1: config 0 descriptor?? [ 110.549923][ T6667] netlink: 24 bytes leftover after parsing attributes in process `syz.3.288'. [ 110.947171][ T95] plantronics 0003:047F:FFFF.0003: reserved main item tag 0xd [ 110.959444][ T95] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 110.989126][ T95] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 111.052804][ T6679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.292'. [ 111.134218][ T6681] netlink: 'syz.2.293': attribute type 4 has an invalid length. [ 111.229379][ T95] usb 5-1: USB disconnect, device number 3 [ 111.322059][ T6686] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 111.376163][ T6686] netlink: 4 bytes leftover after parsing attributes in process `syz.0.296'. [ 111.403509][ T6686] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.436256][ T6686] bridge_slave_1 (unregistering): left allmulticast mode [ 111.451004][ T6686] bridge_slave_1 (unregistering): left promiscuous mode [ 111.479218][ T6686] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.931376][ T6714] netlink: 24 bytes leftover after parsing attributes in process `syz.4.309'. [ 112.045985][ T95] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 112.205866][ T95] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 112.228242][ T95] usb 2-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 112.254019][ T95] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.279441][ T95] usb 2-1: config 0 descriptor?? [ 112.807902][ T95] usbhid 2-1:0.0: can't add hid device: -71 [ 112.824414][ T95] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 112.852246][ T95] usb 2-1: USB disconnect, device number 2 [ 113.138153][ T6735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.316'. [ 113.281614][ T6740] ref_ctr_offset mismatch. inode: 0x162 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x7110110900006800 [ 113.960956][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 114.214375][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 114.360637][ T5912] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 114.460361][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 114.534122][ T5912] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.561683][ T5912] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 114.626284][ T5912] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 114.638486][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.656891][ T5912] usb 2-1: Product: syz [ 114.661092][ T5912] usb 2-1: Manufacturer: syz [ 114.676831][ T5912] usb 2-1: SerialNumber: syz [ 114.908180][ T5912] usb 2-1: 0:2 : does not exist [ 114.922570][ T5912] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 114.981060][ T5912] usb 2-1: USB disconnect, device number 3 [ 115.097272][ T5910] udevd[5910]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 116.353348][ T6778] syzkaller0: entered promiscuous mode [ 116.394468][ T6778] syzkaller0: entered allmulticast mode [ 117.450605][ T6808] netlink: 4 bytes leftover after parsing attributes in process `syz.4.343'. [ 117.588763][ T6815] netlink: 8 bytes leftover after parsing attributes in process `syz.0.347'. [ 117.702111][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803432a800: rx timeout, send abort [ 118.200298][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034329400: rx timeout, send abort [ 118.214731][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803432a800: abort rx timeout. Force session deactivation [ 118.708632][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034329400: abort rx timeout. Force session deactivation [ 118.970706][ T6835] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 119.007586][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 119.007601][ T30] audit: type=1326 audit(1746270318.515:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6837 comm="syz.4.356" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f08e418e969 code=0x0 [ 120.415132][ T6885] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 120.844182][ T976] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 120.936321][ T5912] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 121.016958][ T976] usb 1-1: Using ep0 maxpacket: 16 [ 121.034188][ T976] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 121.074289][ T976] usb 1-1: New USB device found, idVendor=07aa, idProduct=0017, bcdDevice=6c.f5 [ 121.100737][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.122601][ T5912] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 121.144128][ T5912] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 121.153208][ T976] usb 1-1: Product: syz [ 121.159338][ T976] usb 1-1: Manufacturer: syz [ 121.179252][ T5912] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 121.191115][ T976] usb 1-1: SerialNumber: syz [ 121.206345][ T5912] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 121.238441][ T5912] usb 5-1: SerialNumber: syz [ 121.249198][ T976] usb 1-1: config 0 descriptor?? [ 121.566516][ T6908] tipc: Enabled bearer , priority 0 [ 121.616087][ T5912] usb 5-1: 0:2 : does not exist [ 121.621094][ T5912] usb 5-1: unit 255 not found! [ 121.636545][ T6908] syzkaller0: MTU too low for tipc bearer [ 121.643176][ T6908] tipc: Disabling bearer [ 121.659806][ T5912] usb 5-1: 5:0: cannot get min/max values for control 2 (id 5) [ 121.695636][ T5912] usb 5-1: USB disconnect, device number 4 [ 121.762957][ T5819] udevd[5819]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 121.856011][ T976] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 121.875128][ T976] asix 1-1:0.0: probe with driver asix failed with error -71 [ 121.891956][ T976] usb 1-1: USB disconnect, device number 3 [ 122.264136][ T5912] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 122.468508][ T5912] usb 3-1: Using ep0 maxpacket: 8 [ 122.498699][ T6935] netlink: 4 bytes leftover after parsing attributes in process `syz.4.394'. [ 122.512136][ T5912] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 122.522622][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.550217][ T5912] usb 3-1: config 0 descriptor?? [ 122.604764][ T6935] bond0: (slave bond_slave_1): Releasing backup interface [ 122.685842][ T6937] syz_tun: entered allmulticast mode [ 122.704191][ T6936] syz_tun: left allmulticast mode [ 122.797261][ T5912] asix 3-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 123.055440][ T6947] syzkaller0: entered promiscuous mode [ 123.060959][ T6947] syzkaller0: entered allmulticast mode [ 123.732277][ T6972] netlink: 4 bytes leftover after parsing attributes in process `syz.0.408'. [ 123.914365][ T6976] netlink: 4 bytes leftover after parsing attributes in process `syz.1.410'. [ 124.432171][ T5912] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 124.455182][ T5912] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 124.466210][ T5912] asix 3-1:0.0: probe with driver asix failed with error -71 [ 124.490192][ T5912] usb 3-1: USB disconnect, device number 5 [ 124.639761][ T6972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 124.667671][ T6972] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 124.731453][ T6976] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.768009][ T6976] bridge_slave_1 (unregistering): left allmulticast mode [ 124.775302][ T6976] bridge_slave_1 (unregistering): left promiscuous mode [ 124.782337][ T6976] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.791668][ T6978] syz.4.411 uses obsolete (PF_INET,SOCK_PACKET) [ 124.849532][ T6978] bridge_slave_0: left allmulticast mode [ 124.858971][ T6978] bridge_slave_0: left promiscuous mode [ 124.869675][ T6978] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.937301][ T6978] bridge_slave_1: left allmulticast mode [ 124.942988][ T6978] bridge_slave_1: left promiscuous mode [ 124.957383][ T6978] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.980184][ T6978] bond0: (slave bond_slave_0): Releasing backup interface [ 125.052347][ T6978] team0: Port device team_slave_0 removed [ 125.099908][ T6978] team0: Port device team_slave_1 removed [ 125.128773][ T6978] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 125.146786][ T6978] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 125.170619][ T6978] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 125.178645][ T6978] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 125.300188][ T30] audit: type=1804 audit(1746270324.805:28): pid=6996 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.418" name="/newroot/94/file0" dev="tmpfs" ino=530 res=1 errno=0 [ 127.196712][ T5861] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 127.365061][ T5861] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 127.444396][ T5861] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.505210][ T5861] usb 2-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 127.593302][ T5861] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.684786][ T5861] usb 2-1: config 0 descriptor?? [ 128.169685][ T5861] ryos 0003:1E7D:3138.0004: item fetching failed at offset 1/5 [ 128.200425][ T5861] ryos 0003:1E7D:3138.0004: parse failed [ 128.212406][ T5861] ryos 0003:1E7D:3138.0004: probe with driver ryos failed with error -22 [ 128.714414][ T5912] usb 2-1: USB disconnect, device number 4 [ 129.230650][ T5863] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 129.430126][ T5863] usb 3-1: Using ep0 maxpacket: 8 [ 129.446130][ T5863] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 129.467903][ T5863] usb 3-1: config 0 has no interface number 0 [ 129.489389][ T5863] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 129.524111][ T5863] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 129.611240][ T5863] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 129.664089][ T5863] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 129.710680][ T5863] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 129.754078][ T5863] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.820613][ T5863] usb 3-1: config 0 descriptor?? [ 129.845417][ T5863] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 130.138490][ T5863] usb 3-1: USB disconnect, device number 6 [ 130.158514][ T5863] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 130.696099][ T30] audit: type=1326 audit(1746270330.205:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7102 comm="syz.3.459" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc17958e969 code=0x0 [ 131.069572][ T7109] kvm: pic: non byte write [ 132.150998][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 132.337289][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 132.347993][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.373717][ T9] usb 4-1: config 0 has no interfaces? [ 132.415523][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 132.424916][ T9] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 132.440116][ T9] usb 4-1: Product: syz [ 132.444553][ T9] usb 4-1: Manufacturer: syz [ 132.457694][ T9] usb 4-1: config 0 descriptor?? [ 132.800152][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.812478][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.889425][ T5861] usb 4-1: USB disconnect, device number 4 [ 134.157046][ T7166] netlink: 'syz.1.479': attribute type 4 has an invalid length. [ 134.936887][ T7180] cgroup: fork rejected by pids controller in /syz3 [ 135.602289][ T7235] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 135.666088][ T7235] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 136.001712][ T7259] netlink: 2048 bytes leftover after parsing attributes in process `syz.1.498'. [ 136.010956][ T7260] netlink: 12 bytes leftover after parsing attributes in process `syz.2.502'. [ 136.021537][ T7259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.498'. [ 136.196736][ T7260] 8021q: adding VLAN 0 to HW filter on device bond1 [ 136.242232][ T7266] kvm: pic: single mode not supported [ 136.242471][ T7266] kvm: pic: level sensitive irq not supported [ 136.297849][ T7267] macsec1: entered promiscuous mode [ 136.321717][ T7267] bond1: entered promiscuous mode [ 136.344920][ T7267] bond1: left promiscuous mode [ 136.403279][ T7276] netlink: 'syz.3.507': attribute type 11 has an invalid length. [ 136.411785][ T7276] netlink: 36 bytes leftover after parsing attributes in process `syz.3.507'. [ 136.892023][ T7293] syzkaller0: entered promiscuous mode [ 136.900603][ T7293] syzkaller0: entered allmulticast mode [ 139.887545][ T7357] kvm: pic: non byte write [ 139.901925][ T7359] netlink: 12 bytes leftover after parsing attributes in process `syz.0.539'. [ 140.394425][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 140.545102][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 140.581293][ T9] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 140.603342][ T9] usb 1-1: config 0 has no interface number 0 [ 140.618946][ T9] usb 1-1: config 0 interface 184 has no altsetting 0 [ 140.637371][ T9] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 140.654084][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.662209][ T9] usb 1-1: Product: syz [ 140.673975][ T9] usb 1-1: Manufacturer: syz [ 140.682751][ T9] usb 1-1: SerialNumber: syz [ 140.693788][ T9] usb 1-1: config 0 descriptor?? [ 140.709525][ T9] smsc75xx v1.0.0 [ 141.335434][ T9] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 141.358816][ T9] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 141.782388][ T9] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 141.807373][ T9] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 141.824289][ T9] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 141.851711][ T9] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 141.874157][ T9] usb 1-1: USB disconnect, device number 4 [ 142.649980][ T30] audit: type=1326 audit(1746270342.155:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7403 comm="syz.0.555" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff1a398e969 code=0x0 [ 142.870121][ T30] audit: type=1326 audit(1746270342.375:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7412 comm="syz.2.557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x7ffc0000 [ 142.910941][ T30] audit: type=1326 audit(1746270342.375:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7412 comm="syz.2.557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x7ffc0000 [ 142.934590][ T30] audit: type=1326 audit(1746270342.415:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7412 comm="syz.2.557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=264 compat=0 ip=0x7f014ad8e969 code=0x7ffc0000 [ 142.979990][ T30] audit: type=1326 audit(1746270342.415:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7412 comm="syz.2.557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x7ffc0000 [ 143.030454][ T30] audit: type=1326 audit(1746270342.415:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7412 comm="syz.2.557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x7ffc0000 [ 143.080513][ T30] audit: type=1804 audit(1746270342.585:36): pid=7417 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.559" name="/newroot/112/bus/file1" dev="overlay" ino=665 res=1 errno=0 [ 143.210880][ T30] audit: type=1804 audit(1746270342.715:37): pid=7421 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.561" name="/newroot/113/file0" dev="tmpfs" ino=627 res=1 errno=0 [ 143.420269][ T30] audit: type=1326 audit(1746270342.925:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7428 comm="syz.0.563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff1a398e969 code=0x7ffc0000 [ 143.420614][ T7427] netlink: 12 bytes leftover after parsing attributes in process `syz.1.562'. [ 143.491188][ T30] audit: type=1326 audit(1746270342.925:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7428 comm="syz.0.563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff1a398e969 code=0x7ffc0000 [ 144.490856][ T5863] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 144.652187][ T5863] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 144.688757][ T5863] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.707143][ T5863] usb 4-1: Product: syz [ 144.717279][ T5863] usb 4-1: Manufacturer: syz [ 144.736096][ T5863] usb 4-1: SerialNumber: syz [ 144.796719][ T5863] usb 4-1: config 0 descriptor?? [ 145.040219][ T95] usb 4-1: USB disconnect, device number 5 [ 145.395030][ T7462] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 145.515322][ T7469] netlink: 8 bytes leftover after parsing attributes in process `syz.2.580'. [ 145.904276][ T976] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 146.084105][ T976] usb 3-1: Using ep0 maxpacket: 32 [ 146.103840][ T976] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 146.118659][ T976] usb 3-1: config 0 has no interface number 0 [ 146.148381][ T976] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 146.172427][ T976] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.180788][ T976] usb 3-1: Product: syz [ 146.185695][ T976] usb 3-1: Manufacturer: syz [ 146.190338][ T976] usb 3-1: SerialNumber: syz [ 146.199177][ T976] usb 3-1: config 0 descriptor?? [ 146.218703][ T976] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 146.430601][ T976] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 146.487898][ T976] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 146.922116][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 91 [ 147.019609][ T7499] netlink: 4 bytes leftover after parsing attributes in process `syz.1.590'. [ 147.144988][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 147.145560][ T95] usb 3-1: USB disconnect, device number 7 [ 147.187410][ T95] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 147.224953][ T95] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 147.286197][ T95] quatech2 3-1:0.51: device disconnected [ 147.472770][ T7514] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 150.355072][ T7571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.613'. [ 150.424196][ T5892] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 150.608534][ T9] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 150.616853][ T5892] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 150.651903][ T5892] usb 4-1: config 0 has no interfaces? [ 150.668993][ T5892] usb 4-1: config 0 has no interfaces? [ 150.680435][ T5892] usb 4-1: config 0 has no interfaces? [ 150.700067][ T5892] usb 4-1: config 0 has no interfaces? [ 150.740866][ T5892] usb 4-1: config 0 has no interfaces? [ 150.774292][ T5892] usb 4-1: config 0 has no interfaces? [ 150.785312][ T7575] kvm: pic: non byte write [ 150.785621][ T5892] usb 4-1: config 0 has no interfaces? [ 150.803334][ T5892] usb 4-1: config 0 has no interfaces? [ 150.808891][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 150.815698][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 150.823776][ T9] usb 3-1: config 0 has no interface number 0 [ 150.834987][ T5892] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 150.844717][ T5892] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 150.855625][ T9] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 150.894382][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.902425][ T9] usb 3-1: Product: syz [ 150.906820][ T5892] usb 4-1: Product: syz [ 150.910976][ T5892] usb 4-1: Manufacturer: syz [ 150.916260][ T5892] usb 4-1: SerialNumber: syz [ 150.920993][ T9] usb 3-1: Manufacturer: syz [ 150.931891][ T9] usb 3-1: SerialNumber: syz [ 150.948633][ T5892] usb 4-1: config 0 descriptor?? [ 150.959156][ T9] usb 3-1: config 0 descriptor?? [ 150.978062][ T9] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 152.607484][ T9] gspca_spca1528: reg_r err -71 [ 152.614766][ T9] spca1528 3-1:0.1: probe with driver spca1528 failed with error -71 [ 152.628674][ T9] usb 3-1: USB disconnect, device number 8 [ 153.204677][ T5892] usb 4-1: USB disconnect, device number 6 [ 154.287579][ T7609] netlink: 12 bytes leftover after parsing attributes in process `syz.0.627'. [ 154.786738][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 154.786755][ T30] audit: type=1804 audit(1746270354.295:63): pid=7622 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.633" name="/newroot/138/file0" dev="tmpfs" ino=808 res=1 errno=0 [ 154.822945][ T7622] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: 0, delta: -1 [ 154.832317][ T7622] ref_ctr decrement failed for inode: 0x328 offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff88807acde400 [ 154.844954][ T7622] uprobe: syz.3.633:7622 failed to unregister, leaking uprobe [ 156.985227][ T7665] Bluetooth: hci0: Opcode 0x0c03 failed: -112 [ 157.231623][ T7676] netlink: 4 bytes leftover after parsing attributes in process `syz.0.650'. [ 157.243855][ T7676] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 157.251515][ T7676] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 157.441319][ T95] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 157.628067][ T95] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 157.664087][ T95] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.672116][ T95] usb 5-1: Product: syz [ 157.704150][ T95] usb 5-1: Manufacturer: syz [ 157.708804][ T95] usb 5-1: SerialNumber: syz [ 157.719035][ T95] usb 5-1: config 0 descriptor?? [ 157.741226][ T95] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 157.935555][ T5912] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 157.989954][ T7685] kvm: pic: non byte write [ 158.112672][ T5912] usb 1-1: Using ep0 maxpacket: 8 [ 158.136901][ T5912] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 158.149698][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.160719][ T5912] usb 1-1: Product: syz [ 158.165753][ T5912] usb 1-1: Manufacturer: syz [ 158.170502][ T5912] usb 1-1: SerialNumber: syz [ 158.181017][ T5912] usb 1-1: config 0 descriptor?? [ 158.395821][ T5912] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 159.028922][ T5912] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 159.039160][ T5820] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 159.055210][ T5912] usb 1-1: USB disconnect, device number 5 [ 159.107173][ T7699] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.266885][ T7699] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.375656][ T95] gspca_sunplus: reg_r err -71 [ 159.380567][ T95] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 159.423509][ T7699] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.441889][ T95] usb 5-1: USB disconnect, device number 5 [ 159.549523][ T7699] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.721653][ T7699] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.782751][ T7699] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.821071][ T7699] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.860603][ T7699] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.054350][ T5861] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 160.238042][ T5861] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 160.262609][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.296612][ T5861] usb 4-1: Product: syz [ 160.321523][ T5861] usb 4-1: Manufacturer: syz [ 160.350400][ T5861] usb 4-1: SerialNumber: syz [ 160.353703][ T7716] cgroup: fork rejected by pids controller in [ 160.371116][ T5861] usb 4-1: config 0 descriptor?? [ 160.408394][ T5861] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 160.429935][ T7716] /syz2 [ 161.564152][ T5892] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 161.775955][ T5892] usb 1-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=7a.ac [ 161.806169][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.825549][ T5892] usb 1-1: Product: syz [ 161.829786][ T5892] usb 1-1: Manufacturer: syz [ 161.860490][ T5892] usb 1-1: SerialNumber: syz [ 161.869517][ T5892] usb 1-1: config 0 descriptor?? [ 161.889613][ T5892] usb 1-1: interface 1 not found [ 162.088089][ T976] usb 1-1: USB disconnect, device number 6 [ 162.283691][ T5892] usb 4-1: USB disconnect, device number 7 [ 162.692607][ T7784] ======================================================= [ 162.692607][ T7784] WARNING: The mand mount option has been deprecated and [ 162.692607][ T7784] and is ignored by this kernel. Remove the mand [ 162.692607][ T7784] option from the mount to silence this warning. [ 162.692607][ T7784] ======================================================= [ 163.151973][ T7798] netlink: 'syz.2.687': attribute type 5 has an invalid length. [ 163.442266][ T5861] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 163.495323][ T5861] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 163.897431][ T7825] netlink: 'syz.4.695': attribute type 4 has an invalid length. [ 164.588982][ T7833] binder: 7832:7833 ioctl c0306201 200000000540 returned -14 [ 166.246794][ T5861] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 166.404739][ T5861] usb 5-1: Using ep0 maxpacket: 32 [ 166.422003][ T5861] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 166.436021][ T5861] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 166.444798][ T5861] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 166.454519][ T5861] usb 5-1: config 1 has no interface number 0 [ 166.468341][ T5861] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 166.480014][ T5861] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 58431, setting to 1024 [ 166.493375][ T5861] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 166.518783][ T5861] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 166.535728][ T5861] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.555199][ T7862] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 166.568076][ T5861] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 166.751866][ T7845] tipc: Started in network mode [ 166.758728][ T7845] tipc: Node identity c240208e81ac, cluster identity 4711 [ 166.768828][ T7845] tipc: Enabled bearer , priority 0 [ 166.768977][ T7862] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 166.796482][ T5861] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 166.872928][ T7846] syzkaller0: entered promiscuous mode [ 166.881527][ T7846] syzkaller0: entered allmulticast mode [ 166.890270][ T7846] tipc: Resetting bearer [ 166.898121][ T7841] tipc: Resetting bearer [ 167.030583][ T5912] usb 5-1: USB disconnect, device number 6 [ 167.045358][ T5912] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 167.128904][ T5892] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 167.316221][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 167.323458][ T5892] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 167.334657][ T5892] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 167.346173][ T5892] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 167.357730][ T5892] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.366278][ T5892] usb 3-1: Product: syz [ 167.370470][ T5892] usb 3-1: Manufacturer: syz [ 167.375239][ T5892] usb 3-1: SerialNumber: syz [ 167.637381][ T5892] usb 3-1: 0:2 : does not exist [ 167.656098][ T5892] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 167.703811][ T5892] usb 3-1: USB disconnect, device number 9 [ 167.791217][ T5910] udevd[5910]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 167.888427][ T5861] tipc: Node number set to 1139548302 [ 168.921885][ T5827] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 168.931677][ T5827] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 168.940574][ T5827] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 168.956823][ T5827] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 168.984959][ T5827] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 169.071307][ T7841] tipc: Disabling bearer [ 169.086142][ T7864] warning: `syz.3.709' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 170.330570][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.508211][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.558540][ T7901] IPv6: NLM_F_REPLACE set, but no existing node found! [ 170.632508][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.753821][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.034597][ T5827] Bluetooth: hci1: command tx timeout [ 171.146846][ T5820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 171.165237][ T5820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 171.173463][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 171.181641][ T5820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 171.189791][ T5820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 171.352660][ T5820] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 171.365541][ T5820] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 171.379890][ T5820] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 171.400973][ T5820] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 171.410052][ T5820] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 171.679668][ T13] bond0 (unregistering): Released all slaves [ 172.024816][ T7884] chnl_net:caif_netlink_parms(): no params data found [ 172.216901][ T7884] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.228942][ T7884] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.236419][ T7884] bridge_slave_0: entered allmulticast mode [ 172.244462][ T7884] bridge_slave_0: entered promiscuous mode [ 172.266395][ T7884] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.276433][ T7884] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.295188][ T7884] bridge_slave_1: entered allmulticast mode [ 172.306183][ T7884] bridge_slave_1: entered promiscuous mode [ 172.500679][ T7884] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 172.516079][ T13] hsr_slave_0: left promiscuous mode [ 172.525426][ T13] hsr_slave_1: left promiscuous mode [ 172.551121][ T13] veth1_macvtap: left promiscuous mode [ 172.559772][ T13] veth0_macvtap: left promiscuous mode [ 172.569989][ T13] veth1_vlan: left promiscuous mode [ 172.575546][ T13] veth0_vlan: left promiscuous mode [ 173.117267][ T5827] Bluetooth: hci1: command tx timeout [ 173.284640][ T5827] Bluetooth: hci2: command tx timeout [ 173.435427][ T5827] Bluetooth: hci3: command tx timeout [ 173.512255][ T4468] smc: removing ib device syz0 [ 173.760068][ T7942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.733'. [ 173.875694][ T7884] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 173.889650][ T5912] syz0: Port: 1 Link DOWN [ 173.918889][ T7936] tipc: Started in network mode [ 173.923940][ T7936] tipc: Node identity 4e22be4fd48f, cluster identity 4711 [ 173.936028][ T7936] tipc: Enabled bearer , priority 0 [ 173.942926][ T7938] €Â: renamed from syzkaller0 [ 173.951818][ T7938] tipc: Disabling bearer [ 174.072248][ T7884] team0: Port device team_slave_0 added [ 174.118579][ T7884] team0: Port device team_slave_1 added [ 174.293679][ T7913] chnl_net:caif_netlink_parms(): no params data found [ 174.359195][ T7884] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.380568][ T7884] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.464395][ T7884] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.693058][ T7884] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.702871][ T7884] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.800009][ T7884] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.194301][ T5827] Bluetooth: hci1: command tx timeout [ 175.364298][ T5827] Bluetooth: hci2: command tx timeout [ 175.421171][ T7909] chnl_net:caif_netlink_parms(): no params data found [ 175.457258][ T7884] hsr_slave_0: entered promiscuous mode [ 175.485246][ T7884] hsr_slave_1: entered promiscuous mode [ 175.510245][ T7884] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 175.524130][ T5827] Bluetooth: hci3: command tx timeout [ 175.548136][ T7884] Cannot create hsr debugfs directory [ 176.022219][ T7913] bridge0: port 1(bridge_slave_0) entered blocking state [ 176.032639][ T7913] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.040469][ T7913] bridge_slave_0: entered allmulticast mode [ 176.063538][ T7913] bridge_slave_0: entered promiscuous mode [ 176.218742][ T7913] bridge0: port 2(bridge_slave_1) entered blocking state [ 176.231525][ T7913] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.242347][ T7913] bridge_slave_1: entered allmulticast mode [ 176.265411][ T7913] bridge_slave_1: entered promiscuous mode [ 176.365331][ T7982] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2248643489 (17989147912 ns) > initial count (11631199424 ns). Using initial count to start timer. [ 176.671343][ T7913] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 176.692057][ T7988] xt_hashlimit: size too large, truncated to 1048576 [ 176.716554][ T7913] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 176.882627][ T7992] : renamed from bond0 (while UP) [ 176.926357][ T7909] bridge0: port 1(bridge_slave_0) entered blocking state [ 176.933542][ T7909] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.941988][ T7909] bridge_slave_0: entered allmulticast mode [ 176.957188][ T7909] bridge_slave_0: entered promiscuous mode [ 176.972114][ T7986] netlink: 60 bytes leftover after parsing attributes in process `syz.0.744'. [ 177.009933][ T7913] team0: Port device team_slave_0 added [ 177.016465][ T7909] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.024499][ T7909] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.031744][ T7909] bridge_slave_1: entered allmulticast mode [ 177.041762][ T7909] bridge_slave_1: entered promiscuous mode [ 177.076944][ T7913] team0: Port device team_slave_1 added [ 177.179990][ T8002] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 177.224312][ T8002] CIFS mount error: No usable UNC path provided in device string! [ 177.224312][ T8002] [ 177.229610][ T7909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 177.234624][ T8002] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 177.252937][ T7909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 177.284193][ T5827] Bluetooth: hci1: command tx timeout [ 177.360056][ T7913] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 177.370389][ T7913] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.397280][ T7913] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 177.416418][ T7909] team0: Port device team_slave_0 added [ 177.428604][ T7909] team0: Port device team_slave_1 added [ 177.435438][ T7913] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 177.442489][ T7913] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.471019][ T5827] Bluetooth: hci2: command tx timeout [ 177.476527][ T7913] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 177.532752][ T7909] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 177.539793][ T7909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.567307][ T7909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 177.594137][ T5827] Bluetooth: hci3: command tx timeout [ 177.605642][ T7909] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 177.612689][ T7909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.638917][ T7909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 177.696560][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.733739][ T7913] hsr_slave_0: entered promiscuous mode [ 177.742241][ T7913] hsr_slave_1: entered promiscuous mode [ 177.751702][ T7913] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 177.761508][ T7913] Cannot create hsr debugfs directory [ 177.779470][ T7884] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 177.790873][ T7884] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 177.819260][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.845953][ T7884] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 177.893249][ T7884] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 177.922066][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.950474][ T7909] hsr_slave_0: entered promiscuous mode [ 177.962274][ T7909] hsr_slave_1: entered promiscuous mode [ 177.971458][ T7909] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 177.979277][ T7909] Cannot create hsr debugfs directory [ 178.006294][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.308548][ T7913] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.457153][ T7913] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.551725][ T7913] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.722658][ T7913] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.746235][ T13] bridge_slave_0: left allmulticast mode [ 178.751935][ T13] bridge_slave_0: left promiscuous mode [ 178.776824][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.982271][ T5820] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 179.008508][ T5820] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 179.028325][ T5820] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 179.048609][ T5820] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 179.056740][ T5820] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 179.296141][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 179.306937][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 179.317328][ T13] bond0 (unregistering): Released all slaves [ 179.380687][ T13] tipc: Disabling bearer [ 179.395899][ T13] tipc: Left network mode [ 179.503903][ T7884] 8021q: adding VLAN 0 to HW filter on device bond0 [ 179.514239][ T5820] Bluetooth: hci2: command tx timeout [ 179.643252][ T7913] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 179.674761][ T5820] Bluetooth: hci3: command tx timeout [ 179.692706][ T7913] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 179.797569][ T7913] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 179.837719][ T7884] 8021q: adding VLAN 0 to HW filter on device team0 [ 179.849883][ T7913] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 179.928363][ T13] hsr_slave_0: left promiscuous mode [ 179.952057][ T13] hsr_slave_1: left promiscuous mode [ 179.960839][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.970184][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 179.980614][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 179.988281][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 180.039222][ T13] veth1_macvtap: left promiscuous mode [ 180.054171][ T13] veth0_macvtap: left promiscuous mode [ 180.069953][ T13] veth1_vlan: left promiscuous mode [ 180.075496][ T13] veth0_vlan: left promiscuous mode [ 180.606895][ T13] team0 (unregistering): Port device team_slave_1 removed [ 180.651979][ T13] team0 (unregistering): Port device team_slave_0 removed [ 181.115858][ T5820] Bluetooth: hci0: command tx timeout [ 182.451873][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.459066][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 182.484945][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.492065][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 182.538760][ T7909] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 182.558278][ T8021] chnl_net:caif_netlink_parms(): no params data found [ 182.585463][ T7909] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 182.610055][ T7909] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 182.678625][ T7909] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 182.842516][ T8021] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.850435][ T8021] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.858072][ T8021] bridge_slave_0: entered allmulticast mode [ 182.866354][ T8021] bridge_slave_0: entered promiscuous mode [ 182.911557][ T8021] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.920341][ T8021] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.931250][ T8021] bridge_slave_1: entered allmulticast mode [ 182.939645][ T8021] bridge_slave_1: entered promiscuous mode [ 183.004997][ T5861] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 183.053836][ T8021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 183.071780][ T8021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 183.143005][ T8021] team0: Port device team_slave_0 added [ 183.153306][ T8021] team0: Port device team_slave_1 added [ 183.171292][ T5861] usb 3-1: New USB device found, idVendor=28bd, idProduct=0055, bcdDevice= 0.00 [ 183.180880][ T5861] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.194953][ T5820] Bluetooth: hci0: command tx timeout [ 183.201832][ T5861] usb 3-1: config 0 descriptor?? [ 183.223000][ T8021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 183.230229][ T8021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 183.257255][ T8021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 183.272799][ T7913] 8021q: adding VLAN 0 to HW filter on device bond0 [ 183.287073][ T8021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 183.294872][ T8021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 183.321751][ T8021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 183.389616][ T7884] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.402635][ T8021] hsr_slave_0: entered promiscuous mode [ 183.412302][ T8021] hsr_slave_1: entered promiscuous mode [ 183.420108][ T8021] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 183.432050][ T8021] Cannot create hsr debugfs directory [ 183.525255][ T7913] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.581550][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.588766][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.620674][ T5861] uclogic 0003:28BD:0055.0006: interface is invalid, ignoring [ 183.668574][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.675798][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.690154][ T7909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 183.796876][ T7909] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.829345][ T5861] usb 3-1: USB disconnect, device number 10 [ 183.854744][ T8021] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.878477][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.885680][ T5880] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.910647][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.917834][ T5880] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.956481][ T8021] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.031651][ T8021] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.070411][ T7884] veth0_vlan: entered promiscuous mode [ 184.142855][ T8021] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.160679][ T7884] veth1_vlan: entered promiscuous mode [ 184.207765][ T7884] veth0_macvtap: entered promiscuous mode [ 184.222882][ T7884] veth1_macvtap: entered promiscuous mode [ 184.261292][ T7913] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 184.356356][ T7884] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 184.407824][ T7884] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 184.432620][ T7884] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.450597][ T7884] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.460501][ T7884] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.469602][ T7884] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.527693][ T8021] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 184.542686][ T8021] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 184.553362][ T7913] veth0_vlan: entered promiscuous mode [ 184.563750][ T8021] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 184.577021][ T8021] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 184.661229][ T7913] veth1_vlan: entered promiscuous mode [ 184.829449][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.040602][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.055427][ T7909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 185.079212][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.093414][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.274585][ T5820] Bluetooth: hci0: command tx timeout [ 185.279191][ T7913] veth0_macvtap: entered promiscuous mode [ 185.309184][ T7913] veth1_macvtap: entered promiscuous mode [ 185.453304][ T7913] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 185.470046][ T7913] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.493791][ T7913] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 185.548328][ T7913] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 185.619327][ T7913] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.679431][ T7913] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 185.874912][ T7913] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.907859][ T7913] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.944191][ T7913] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.963288][ T7913] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.063039][ T8021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 186.133407][ T7909] veth0_vlan: entered promiscuous mode [ 186.147460][ T8021] 8021q: adding VLAN 0 to HW filter on device team0 [ 186.175119][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 186.189303][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.211359][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.218553][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 186.238684][ T7909] veth1_vlan: entered promiscuous mode [ 186.279159][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.286327][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.308441][ T1104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 186.332691][ T1104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.402422][ T7909] veth0_macvtap: entered promiscuous mode [ 186.448230][ T7909] veth1_macvtap: entered promiscuous mode [ 186.492343][ T8021] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 186.569991][ T8082] binder: BINDER_SET_CONTEXT_MGR already set [ 186.580279][ T8082] binder: 8081:8082 ioctl 4018620d 200000000180 returned -16 [ 186.607372][ T7909] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 186.620204][ T7909] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.631788][ T7909] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 186.680209][ T7909] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.693338][ T7909] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 186.711220][ T7909] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 186.742369][ T7909] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.758792][ T7909] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 186.775622][ T7909] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.795422][ T7909] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 186.822116][ T7909] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.836511][ T7909] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.847779][ T7909] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.857118][ T7909] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.959512][ T8021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 187.033856][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.057791][ T8090] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 187.072456][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.151025][ T5880] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.260671][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.277969][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.302900][ T5880] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.355574][ T5820] Bluetooth: hci0: command tx timeout [ 187.421128][ T5880] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.589239][ T5880] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.667111][ T8021] veth0_vlan: entered promiscuous mode [ 187.694425][ T95] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 187.755526][ T8021] veth1_vlan: entered promiscuous mode [ 187.858506][ T95] usb 6-1: Using ep0 maxpacket: 8 [ 187.905741][ T95] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 64 [ 187.950843][ T95] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 187.966886][ T5827] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 187.978054][ T5827] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 187.989286][ T5827] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 187.998386][ T95] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.009203][ T5827] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 188.016902][ T5827] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 188.028004][ T95] usb 6-1: Product: syz [ 188.038841][ T8021] veth0_macvtap: entered promiscuous mode [ 188.045999][ T95] usb 6-1: Manufacturer: syz [ 188.050631][ T95] usb 6-1: SerialNumber: syz [ 188.108952][ T8021] veth1_macvtap: entered promiscuous mode [ 188.191490][ T8021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.210844][ T8021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.222566][ T8021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.238345][ T8021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.248995][ T8021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.264304][ T8021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.280958][ T8021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 188.309605][ T95] cdc_ncm 6-1:1.0: CDC Union missing and no IAD found [ 188.334414][ T95] cdc_ncm 6-1:1.0: bind() failure [ 188.355831][ T8021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 188.367929][ T95] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 188.374895][ T95] cdc_ncm 6-1:1.1: bind() failure [ 188.380067][ T8021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.400689][ T95] usb 6-1: USB disconnect, device number 2 [ 188.417098][ T8021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 188.431033][ T8021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.443280][ T8021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 188.454772][ T8021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.469555][ T8021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 188.492936][ T5880] bridge_slave_1: left allmulticast mode [ 188.522729][ T5880] bridge_slave_1: left promiscuous mode [ 188.530821][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.577771][ T5880] bridge_slave_0: left allmulticast mode [ 188.586947][ T5880] bridge_slave_0: left promiscuous mode [ 188.592785][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.627959][ T8114] netlink: 'syz.2.774': attribute type 10 has an invalid length. [ 188.639891][ T8114] netlink: 40 bytes leftover after parsing attributes in process `syz.2.774'. [ 188.970546][ T5880] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 188.998588][ T5880] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 189.010187][ T5880] bond0 (unregistering): Released all slaves [ 189.052065][ T8021] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.065319][ T8021] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.082183][ T8021] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.101006][ T8021] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.127421][ T8111] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.227782][ T8114] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 189.259867][ T8114] team0: Failed to send options change via netlink (err -105) [ 189.281799][ T8114] team0: Port device geneve0 added [ 189.291762][ T8121] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 189.336100][ T8111] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.451675][ T8111] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.571905][ T8111] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.837565][ T5880] hsr_slave_0: left promiscuous mode [ 189.853094][ T5880] hsr_slave_1: left promiscuous mode [ 189.890876][ T5880] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 189.912572][ T5880] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 189.936450][ T5880] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 189.967748][ T5880] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 190.052718][ T5880] veth1_macvtap: left promiscuous mode [ 190.104376][ T5820] Bluetooth: hci3: command tx timeout [ 190.404189][ T5880] veth0_macvtap: left promiscuous mode [ 190.447075][ T5880] veth1_vlan: left promiscuous mode [ 190.458172][ T5880] veth0_vlan: left promiscuous mode [ 190.737601][ T8140] netlink: 4 bytes leftover after parsing attributes in process `syz.6.785'. [ 191.404158][ T5880] team0 (unregistering): Port device team_slave_1 removed [ 191.469358][ T5880] team0 (unregistering): Port device team_slave_0 removed [ 191.977129][ T8111] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.040456][ T8111] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.161993][ T5820] Bluetooth: hci3: command tx timeout [ 192.221701][ T8111] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.226441][ T8162] netlink: 8 bytes leftover after parsing attributes in process `syz.6.792'. [ 192.280430][ T8111] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.303594][ T81] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 192.328144][ T81] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 192.457413][ T8103] chnl_net:caif_netlink_parms(): no params data found [ 192.479035][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 192.506803][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 192.713468][ T8180] kvm: pic: non byte write [ 192.927682][ T8103] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.943545][ T8103] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.964274][ T8103] bridge_slave_0: entered allmulticast mode [ 192.971395][ T8103] bridge_slave_0: entered promiscuous mode [ 192.986507][ T8103] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.994622][ T8103] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.001797][ T8103] bridge_slave_1: entered allmulticast mode [ 193.025763][ T8103] bridge_slave_1: entered promiscuous mode [ 193.112683][ T8103] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 193.149248][ T8103] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 193.249314][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.340427][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.375007][ T8103] team0: Port device team_slave_0 added [ 193.396986][ T8103] team0: Port device team_slave_1 added [ 193.557440][ T8103] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 193.585897][ T8103] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 193.675170][ T8103] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 193.786310][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.864818][ T8103] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 193.871814][ T8103] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 193.943397][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 193.953096][ T5827] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 193.964290][ T5827] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 193.983562][ T30] audit: type=1326 audit(1746270393.465:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8186 comm="syz.2.798" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x7fc00000 [ 193.983569][ T5827] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 194.015367][ T8103] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 194.026445][ T5827] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 194.108900][ T976] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 194.129746][ T8201] netlink: 24 bytes leftover after parsing attributes in process `syz.2.802'. [ 194.147803][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.216855][ T8201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.802'. [ 194.241323][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.246024][ T5827] Bluetooth: hci3: command tx timeout [ 194.254932][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.286452][ T976] usb 6-1: config 0 has no interfaces? [ 194.298663][ T976] usb 6-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 194.308528][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.316606][ T976] usb 6-1: Product: syz [ 194.320796][ T976] usb 6-1: Manufacturer: syz [ 194.325451][ T976] usb 6-1: SerialNumber: syz [ 194.334488][ T976] usb 6-1: config 0 descriptor?? [ 194.351495][ T8103] hsr_slave_0: entered promiscuous mode [ 194.358378][ T8103] hsr_slave_1: entered promiscuous mode [ 194.365093][ T8103] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 194.372671][ T8103] Cannot create hsr debugfs directory [ 194.548821][ T976] usb 6-1: USB disconnect, device number 3 [ 194.640065][ T36] bridge_slave_1: left allmulticast mode [ 194.646242][ T36] bridge_slave_1: left promiscuous mode [ 194.658275][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.672082][ T36] bridge_slave_0: left allmulticast mode [ 194.683208][ T36] bridge_slave_0: left promiscuous mode [ 194.692257][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.906660][ T30] audit: type=1326 audit(1746270394.405:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8209 comm="syz.6.806" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x0 [ 194.977936][ T8217] fuse: Bad value for 'fd' [ 195.033940][ T30] audit: type=1326 audit(1746270394.535:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8218 comm="syz.2.809" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f014ad8e969 code=0x0 [ 195.218653][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 195.229157][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 195.239356][ T36] bond0 (unregistering): Released all slaves [ 195.762827][ T36] hsr_slave_0: left promiscuous mode [ 195.776495][ T36] hsr_slave_1: left promiscuous mode [ 195.804552][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 195.812074][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 195.829461][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 195.837234][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 196.094062][ T5827] Bluetooth: hci0: command tx timeout [ 196.243491][ T36] veth1_macvtap: left promiscuous mode [ 196.334068][ T5827] Bluetooth: hci3: command tx timeout [ 196.339552][ T5827] Bluetooth: hci4: command 0x0406 tx timeout [ 196.340053][ T36] veth0_macvtap: left promiscuous mode [ 196.616812][ T36] veth1_vlan: left promiscuous mode [ 196.650783][ T36] veth0_vlan: left promiscuous mode [ 196.794897][ T976] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 197.096460][ T976] usb 7-1: config 0 interface 0 altsetting 14 endpoint 0x81 has invalid wMaxPacketSize 0 [ 197.159186][ T976] usb 7-1: config 0 interface 0 has no altsetting 0 [ 197.184803][ T976] usb 7-1: New USB device found, idVendor=09da, idProduct=001a, bcdDevice= 0.00 [ 197.403260][ T976] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.493316][ T976] usb 7-1: config 0 descriptor?? [ 197.504806][ T24] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 197.704205][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 197.713742][ T24] usb 6-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 197.734314][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.779392][ T24] usb 6-1: config 0 descriptor?? [ 197.991266][ T36] team0 (unregistering): Port device team_slave_1 removed [ 198.010033][ T24] asix 6-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 198.058141][ T36] team0 (unregistering): Port device team_slave_0 removed [ 198.164162][ T5820] Bluetooth: hci0: command tx timeout [ 198.555680][ T8198] chnl_net:caif_netlink_parms(): no params data found [ 198.835784][ T8198] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.854513][ T8198] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.862490][ T8198] bridge_slave_0: entered allmulticast mode [ 198.870603][ T8198] bridge_slave_0: entered promiscuous mode [ 198.879783][ T8198] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.887427][ T8198] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.895257][ T8198] bridge_slave_1: entered allmulticast mode [ 198.903898][ T8198] bridge_slave_1: entered promiscuous mode [ 199.083653][ T8198] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.198853][ T976] usbhid 7-1:0.0: can't add hid device: -71 [ 199.214361][ T976] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 199.270376][ T8198] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 199.271915][ T976] usb 7-1: USB disconnect, device number 2 [ 199.397392][ T8103] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 199.480993][ T8103] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 199.508395][ T8198] team0: Port device team_slave_0 added [ 199.531320][ T8198] team0: Port device team_slave_1 added [ 199.625349][ T8103] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 199.641272][ T24] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 199.671331][ T24] asix 6-1:0.0: probe with driver asix failed with error -71 [ 199.694917][ T24] usb 6-1: USB disconnect, device number 4 [ 199.803248][ T8198] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 199.820571][ T8198] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 199.879390][ T8198] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 199.901502][ T8103] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 200.008435][ T8198] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 200.034060][ T8198] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 200.093509][ T8198] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 200.237275][ T5820] Bluetooth: hci0: command tx timeout [ 200.317670][ T8198] hsr_slave_0: entered promiscuous mode [ 200.336929][ T8198] hsr_slave_1: entered promiscuous mode [ 200.351639][ T8198] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 200.422224][ T8198] Cannot create hsr debugfs directory [ 200.536112][ T8269] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 200.554712][ T8269] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 200.596925][ T8269] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 200.629133][ T8269] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 200.667896][ T8269] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 200.690475][ T8269] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 200.700153][ T8269] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 200.719930][ T8269] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 200.771815][ T8269] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 200.790544][ T8269] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 200.797779][ T8103] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.840276][ T8269] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 200.912965][ T8103] 8021q: adding VLAN 0 to HW filter on device team0 [ 200.939504][ T8269] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 200.945655][ T81] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.945775][ T81] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.976650][ T8269] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 200.990173][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.997339][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.009306][ T8269] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 201.192280][ T8103] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 201.656968][ T8198] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 201.704735][ T8198] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 201.785763][ T8198] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 201.853725][ T8198] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 201.951482][ T8103] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 202.179314][ T8103] veth0_vlan: entered promiscuous mode [ 202.212264][ T8103] veth1_vlan: entered promiscuous mode [ 202.280102][ T8198] 8021q: adding VLAN 0 to HW filter on device bond0 [ 202.305171][ T8103] veth0_macvtap: entered promiscuous mode [ 202.350200][ T8103] veth1_macvtap: entered promiscuous mode [ 202.356340][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 202.374951][ T8198] 8021q: adding VLAN 0 to HW filter on device team0 [ 202.398194][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.405404][ T5880] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.433525][ T8103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 202.447067][ T8103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 202.458375][ T8103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 202.469369][ T8103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 202.488068][ T8103] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 202.506654][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.513842][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.522059][ T8103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 202.532818][ T8103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 202.544894][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 202.551314][ T8103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 202.562000][ T5820] Bluetooth: hci4: command 0x0406 tx timeout [ 202.569796][ T24] usb 6-1: config 0 has an invalid interface number: 110 but max is 0 [ 202.578020][ T8103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 202.588351][ T24] usb 6-1: config 0 has no interface number 0 [ 202.596959][ T8103] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 202.605272][ T24] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=3a.e4 [ 202.616993][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.626182][ T24] usb 6-1: Product: syz [ 202.630370][ T24] usb 6-1: Manufacturer: syz [ 202.635874][ T5820] Bluetooth: hci1: command 0x0c1a tx timeout [ 202.657550][ T24] usb 6-1: SerialNumber: syz [ 202.662802][ T8103] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.680649][ T8103] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.691000][ T24] usb 6-1: config 0 descriptor?? [ 202.696338][ T8103] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.705589][ T8103] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.717176][ T5820] Bluetooth: hci2: command 0x0c1a tx timeout [ 202.728141][ T24] igorplugusb 6-1:0.110: incorrect number of endpoints [ 202.794381][ T5820] Bluetooth: hci3: command 0x0c1a tx timeout [ 202.957042][ T5820] Bluetooth: hci0: command 0x0405 tx timeout [ 202.981640][ T81] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 203.002080][ T81] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 203.011742][ T8332] vivid-000: disconnect [ 203.028939][ T52] usb 6-1: USB disconnect, device number 5 [ 203.107877][ T1104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 203.121307][ T1104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 203.136040][ T8314] vivid-000: reconnect [ 203.179067][ T8198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 203.278287][ T8198] veth0_vlan: entered promiscuous mode [ 203.400960][ T8198] veth1_vlan: entered promiscuous mode [ 203.472303][ T8198] veth0_macvtap: entered promiscuous mode [ 203.483177][ T8198] veth1_macvtap: entered promiscuous mode [ 203.531459][ T8198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.554434][ T8198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.567762][ T8198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.608802][ T8198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.630497][ T8198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.669424][ T8198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.696182][ T8198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 203.748927][ T8198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.780707][ T8198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.790949][ T8198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.816065][ T8198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.864069][ T8198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.890754][ T8198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.923658][ T8198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 204.040652][ T81] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.073623][ T8198] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.094067][ T8198] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.117300][ T8198] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.134075][ T8198] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.241623][ T81] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.359161][ T81] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.570775][ T81] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.621737][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 204.634311][ T5820] Bluetooth: hci4: command 0x0406 tx timeout [ 204.646583][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 204.714116][ T5820] Bluetooth: hci1: command 0x0c1a tx timeout [ 204.765792][ T5817] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 204.775666][ T5817] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 204.784091][ T5817] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 204.793123][ T5817] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 204.800194][ T5827] Bluetooth: hci2: command 0x0c1a tx timeout [ 204.808055][ T5817] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 204.939121][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 204.955057][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.034868][ T5817] Bluetooth: hci0: command 0x0405 tx timeout [ 205.054178][ T30] audit: type=1804 audit(1746270404.545:67): pid=8380 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.5.865" name="/newroot/27/file0" dev="tmpfs" ino=190 res=1 errno=0 [ 205.379069][ T81] bridge_slave_1: left allmulticast mode [ 205.390699][ T81] bridge_slave_1: left promiscuous mode [ 205.419345][ T81] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.438620][ T81] bridge_slave_0: left allmulticast mode [ 205.449027][ T81] bridge_slave_0: left promiscuous mode [ 205.460150][ T81] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.471736][ T81] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 206.488919][ T81] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 206.502338][ T81] bond0 (unregistering): Released all slaves [ 206.560203][ T8383] netlink: 96 bytes leftover after parsing attributes in process `syz.5.867'. [ 206.691661][ T8198] syz-executor (8198) used greatest stack depth: 20040 bytes left [ 206.794112][ T5817] Bluetooth: hci1: command 0x0c1a tx timeout [ 206.874347][ T5817] Bluetooth: hci3: command tx timeout [ 206.884853][ T5817] Bluetooth: hci2: command 0x0c1a tx timeout [ 207.299810][ T8370] chnl_net:caif_netlink_parms(): no params data found [ 207.502763][ T81] hsr_slave_0: left promiscuous mode [ 207.555379][ T81] hsr_slave_1: left promiscuous mode [ 207.574923][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 207.618386][ T81] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 207.673297][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 207.725158][ T81] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 207.820633][ T81] veth1_macvtap: left promiscuous mode [ 207.846748][ T81] veth0_macvtap: left promiscuous mode [ 207.852435][ T81] veth1_vlan: left promiscuous mode [ 207.868302][ T81] veth0_vlan: left promiscuous mode [ 207.956006][ T8413] netlink: 8 bytes leftover after parsing attributes in process `syz.5.876'. [ 208.145443][ T5820] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 208.167908][ T5820] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 208.181127][ T5820] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 208.197848][ T5820] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 208.206820][ T5820] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 208.463226][ T8419] fuse: Bad value for 'fd' [ 208.660483][ T81] team0 (unregistering): Port device team_slave_1 removed [ 208.736705][ T81] team0 (unregistering): Port device team_slave_0 removed [ 208.959537][ T5817] Bluetooth: hci3: command tx timeout [ 209.948740][ T8370] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.958777][ T8370] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.967393][ T8370] bridge_slave_0: entered allmulticast mode [ 209.978836][ T8370] bridge_slave_0: entered promiscuous mode [ 209.993827][ T8370] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.011263][ T8370] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.021139][ T8370] bridge_slave_1: entered allmulticast mode [ 210.031758][ T8370] bridge_slave_1: entered promiscuous mode [ 210.089530][ T8370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.103817][ T8370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 210.199521][ T8370] team0: Port device team_slave_0 added [ 210.209932][ T8370] team0: Port device team_slave_1 added [ 210.236172][ T5817] Bluetooth: hci0: command tx timeout [ 210.331921][ T8370] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 210.345740][ T8370] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 210.398696][ T8370] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 210.411613][ T8370] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 210.425647][ T8370] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 210.480095][ T8370] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 210.509733][ T8416] chnl_net:caif_netlink_parms(): no params data found [ 210.658238][ T8446] netlink: 168 bytes leftover after parsing attributes in process `syz.6.885'. [ 210.712057][ T8370] hsr_slave_0: entered promiscuous mode [ 210.743280][ T8370] hsr_slave_1: entered promiscuous mode [ 210.750065][ T8370] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 210.758108][ T8370] Cannot create hsr debugfs directory [ 210.862283][ T30] audit: type=1326 audit(1746270410.365:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 210.890061][ T30] audit: type=1326 audit(1746270410.395:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 210.913126][ T30] audit: type=1326 audit(1746270410.395:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 210.965355][ T81] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.995513][ T30] audit: type=1326 audit(1746270410.395:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.018344][ T30] audit: type=1326 audit(1746270410.395:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.044175][ T5817] Bluetooth: hci3: command tx timeout [ 211.053809][ T30] audit: type=1326 audit(1746270410.395:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.075231][ T30] audit: type=1326 audit(1746270410.395:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.096609][ T30] audit: type=1326 audit(1746270410.395:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.118279][ T30] audit: type=1326 audit(1746270410.395:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.143146][ T30] audit: type=1326 audit(1746270410.395:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8453 comm="syz.6.889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7f702838e969 code=0x7ffc0000 [ 211.246671][ T81] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.414658][ T81] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.483802][ T8416] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.491085][ T8416] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.499148][ T8416] bridge_slave_0: entered allmulticast mode [ 211.507195][ T8416] bridge_slave_0: entered promiscuous mode [ 211.516626][ T8459] IPv6: NLM_F_REPLACE set, but no existing node found! [ 211.568386][ T81] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.624150][ T8416] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.631429][ T8416] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.641160][ T8416] bridge_slave_1: entered allmulticast mode [ 211.662596][ T8416] bridge_slave_1: entered promiscuous mode [ 211.731895][ T8416] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 211.761421][ T8416] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 211.971379][ T8416] team0: Port device team_slave_0 added [ 212.052988][ T8416] team0: Port device team_slave_1 added [ 212.179106][ T8416] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.191993][ T8416] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 212.228283][ T8416] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 212.265656][ T8416] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.274246][ T8416] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 212.334252][ T8416] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 212.334537][ T5817] Bluetooth: hci0: command tx timeout [ 212.590744][ T81] bridge_slave_1: left allmulticast mode [ 212.604808][ T81] bridge_slave_1: left promiscuous mode [ 212.610611][ T81] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.642240][ T81] bridge_slave_0: left allmulticast mode [ 212.648103][ T81] bridge_slave_0: left promiscuous mode [ 212.653894][ T81] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.847414][ T8510] netlink: 156 bytes leftover after parsing attributes in process `syz.2.912'. [ 212.919103][ T8511] netlink: 20 bytes leftover after parsing attributes in process `syz.2.912'. [ 213.124155][ T5817] Bluetooth: hci3: command tx timeout [ 213.167241][ T81] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 213.178416][ T81] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 213.191441][ T81] bond0 (unregistering): Released all slaves [ 213.211240][ T8416] hsr_slave_0: entered promiscuous mode [ 213.218417][ T8416] hsr_slave_1: entered promiscuous mode [ 213.243334][ T8416] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 213.251465][ T8416] Cannot create hsr debugfs directory [ 213.673821][ T81] hsr_slave_0: left promiscuous mode [ 213.682586][ T81] hsr_slave_1: left promiscuous mode [ 213.690954][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 213.701773][ T81] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 213.710907][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 213.718773][ T81] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 213.749250][ T81] veth1_macvtap: left promiscuous mode [ 213.754928][ T81] veth0_macvtap: left promiscuous mode [ 213.760591][ T81] veth1_vlan: left promiscuous mode [ 213.766280][ T81] veth0_vlan: left promiscuous mode [ 214.397012][ T5817] Bluetooth: hci0: command tx timeout [ 215.202154][ T8551] overlayfs: failed to clone upperpath [ 215.323801][ T81] team0 (unregistering): Port device team_slave_1 removed [ 215.428075][ T81] team0 (unregistering): Port device team_slave_0 removed [ 216.291236][ T5817] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 216.441988][ T8370] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 216.460696][ T8370] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 216.472365][ T8370] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 216.481312][ T5817] Bluetooth: hci0: command tx timeout [ 216.499108][ T8370] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 216.625475][ T8370] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.700265][ T8370] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.745842][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.753075][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.823493][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.830654][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.012130][ T8416] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 217.054789][ T8416] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 217.083333][ T8416] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 217.110052][ T8416] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 217.300203][ T8598] CIFS mount error: No usable UNC path provided in device string! [ 217.300203][ T8598] [ 217.310806][ T8598] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 217.322782][ T8416] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.349284][ T8370] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 217.378271][ T8416] 8021q: adding VLAN 0 to HW filter on device team0 [ 217.415639][ T1084] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.422786][ T1084] bridge0: port 1(bridge_slave_0) entered forwarding state [ 217.443674][ T1084] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.450904][ T1084] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.580197][ T8370] veth0_vlan: entered promiscuous mode [ 217.611414][ T8370] veth1_vlan: entered promiscuous mode [ 217.656027][ T8370] veth0_macvtap: entered promiscuous mode [ 217.675551][ T8370] veth1_macvtap: entered promiscuous mode [ 217.725765][ T8370] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 217.752699][ T8370] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 217.773556][ T8370] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 217.785344][ T8370] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 217.818513][ T8370] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 217.838298][ T8370] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 217.857609][ T8370] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 217.890400][ T8370] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 217.915141][ T8370] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 217.971811][ T8370] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 218.023397][ T8370] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 218.043392][ T8370] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 218.066432][ T8370] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 218.075902][ T8370] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 218.143495][ T8416] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 218.252895][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 218.286087][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 218.367345][ T8416] veth0_vlan: entered promiscuous mode [ 218.395629][ T4468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 218.420313][ T8416] veth1_vlan: entered promiscuous mode [ 218.426185][ T4468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 218.480435][ T8370] ================================================================== [ 218.488550][ T8370] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 [ 218.496296][ T8370] Write of size 8 at addr ffff88806069bc08 by task syz-executor/8370 [ 218.504365][ T8370] [ 218.506695][ T8370] CPU: 0 UID: 0 PID: 8370 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00256-g95d3481af6dc #0 PREEMPT(full) [ 218.506712][ T8370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 218.506723][ T8370] Call Trace: [ 218.506730][ T8370] [ 218.506740][ T8370] dump_stack_lvl+0x189/0x250 [ 218.506761][ T8370] ? __kasan_check_byte+0x12/0x40 [ 218.506780][ T8370] ? __pfx_dump_stack_lvl+0x10/0x10 [ 218.506796][ T8370] ? lock_release+0x4b/0x3e0 [ 218.506812][ T8370] ? lock_release+0x4b/0x3e0 [ 218.506829][ T8370] ? __virt_addr_valid+0x469/0x540 [ 218.506846][ T8370] print_report+0xb4/0x290 [ 218.506861][ T8370] ? binder_add_device+0x5f/0xa0 [ 218.506876][ T8370] kasan_report+0x118/0x150 [ 218.506895][ T8370] ? binder_add_device+0x5f/0xa0 [ 218.506912][ T8370] binder_add_device+0x5f/0xa0 [ 218.506928][ T8370] binderfs_binder_device_create+0x8b7/0xaf0 [ 218.506947][ T8370] binderfs_fill_super+0xa0e/0xe90 [ 218.506966][ T8370] ? __pfx_binderfs_fill_super+0x10/0x10 [ 218.506990][ T8370] ? shrinker_register+0x16b/0x230 [ 218.507007][ T8370] ? sget_fc+0x962/0xa40 [ 218.507022][ T8370] ? __pfx_set_anon_super_fc+0x10/0x10 [ 218.507038][ T8370] ? __pfx_binderfs_fill_super+0x10/0x10 [ 218.507053][ T8370] get_tree_nodev+0xb8/0x150 [ 218.507069][ T8370] vfs_get_tree+0x8f/0x2b0 [ 218.507086][ T8370] do_new_mount+0x24a/0xa40 [ 218.507107][ T8370] __se_sys_mount+0x317/0x410 [ 218.507127][ T8370] ? __pfx___se_sys_mount+0x10/0x10 [ 218.507146][ T8370] ? do_syscall_64+0xba/0x210 [ 218.507161][ T8370] ? __x64_sys_mount+0x20/0xc0 [ 218.507179][ T8370] do_syscall_64+0xf6/0x210 [ 218.507193][ T8370] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 218.507206][ T8370] ? clear_bhb_loop+0x45/0xa0 [ 218.507221][ T8370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.507234][ T8370] RIP: 0033:0x7f75e479010a [ 218.507251][ T8370] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 218.507264][ T8370] RSP: 002b:00007ffc13742618 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 218.507278][ T8370] RAX: ffffffffffffffda RBX: 00007f75e4810e74 RCX: 00007f75e479010a [ 218.507289][ T8370] RDX: 00007f75e48208cb RSI: 00007f75e4810e74 RDI: 00007f75e48208cb [ 218.507299][ T8370] RBP: 00007f75e48110bd R08: 0000000000000000 R09: 00007f75e49b6738 [ 218.507309][ T8370] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f75e47ec1a8 [ 218.507318][ T8370] R13: 00007f75e47ec180 R14: 0000000000000009 R15: 0000000000000000 [ 218.507333][ T8370] [ 218.507338][ T8370] [ 218.756114][ T8370] Allocated by task 7909: [ 218.760455][ T8370] kasan_save_track+0x3e/0x80 [ 218.765125][ T8370] __kasan_kmalloc+0x93/0xb0 [ 218.769704][ T8370] __kmalloc_cache_noprof+0x230/0x3d0 [ 218.775065][ T8370] binderfs_binder_device_create+0x17f/0xaf0 [ 218.781030][ T8370] binderfs_fill_super+0xa0e/0xe90 [ 218.786126][ T8370] get_tree_nodev+0xb8/0x150 [ 218.790704][ T8370] vfs_get_tree+0x8f/0x2b0 [ 218.795104][ T8370] do_new_mount+0x24a/0xa40 [ 218.799596][ T8370] __se_sys_mount+0x317/0x410 [ 218.804259][ T8370] do_syscall_64+0xf6/0x210 [ 218.808747][ T8370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.814624][ T8370] [ 218.816933][ T8370] Freed by task 5863: [ 218.820894][ T8370] kasan_save_track+0x3e/0x80 [ 218.825562][ T8370] kasan_save_free_info+0x46/0x50 [ 218.830572][ T8370] __kasan_slab_free+0x62/0x70 [ 218.835325][ T8370] kfree+0x193/0x440 [ 218.839206][ T8370] binder_proc_dec_tmpref+0x228/0x4f0 [ 218.844563][ T8370] binder_deferred_func+0x13a5/0x1520 [ 218.849918][ T8370] process_scheduled_works+0xadb/0x17a0 [ 218.855453][ T8370] worker_thread+0x8a0/0xda0 [ 218.860031][ T8370] kthread+0x70e/0x8a0 [ 218.864084][ T8370] ret_from_fork+0x4b/0x80 [ 218.868482][ T8370] ret_from_fork_asm+0x1a/0x30 [ 218.873236][ T8370] [ 218.875544][ T8370] The buggy address belongs to the object at ffff88806069bc00 [ 218.875544][ T8370] which belongs to the cache kmalloc-512 of size 512 [ 218.889582][ T8370] The buggy address is located 8 bytes inside of [ 218.889582][ T8370] freed 512-byte region [ffff88806069bc00, ffff88806069be00) [ 218.903189][ T8370] [ 218.905501][ T8370] The buggy address belongs to the physical page: [ 218.911903][ T8370] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806069bc00 pfn:0x60698 [ 218.921952][ T8370] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 218.930441][ T8370] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 218.938966][ T8370] page_type: f5(slab) [ 218.942931][ T8370] raw: 00fff00000000240 ffff88801a041c80 ffffea00008ff610 ffffea0000a12910 [ 218.951500][ T8370] raw: ffff88806069bc00 000000000010000c 00000000f5000000 0000000000000000 [ 218.960068][ T8370] head: 00fff00000000240 ffff88801a041c80 ffffea00008ff610 ffffea0000a12910 [ 218.968724][ T8370] head: ffff88806069bc00 000000000010000c 00000000f5000000 0000000000000000 [ 218.977380][ T8370] head: 00fff00000000002 ffffea000181a601 00000000ffffffff 00000000ffffffff [ 218.986038][ T8370] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 218.994688][ T8370] page dumped because: kasan: bad access detected [ 219.001089][ T8370] page_owner tracks the page as allocated [ 219.006784][ T8370] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5818, tgid 5818 (syz-executor), ts 73175583720, free_ts 18998669007 [ 219.028141][ T8370] post_alloc_hook+0x1d8/0x230 [ 219.032911][ T8370] get_page_from_freelist+0x21c7/0x22a0 [ 219.038446][ T8370] __alloc_frozen_pages_noprof+0x181/0x370 [ 219.044241][ T8370] alloc_pages_mpol+0x232/0x4a0 [ 219.049083][ T8370] allocate_slab+0x8a/0x3b0 [ 219.053572][ T8370] ___slab_alloc+0xbfc/0x1480 [ 219.058234][ T8370] __kmalloc_cache_noprof+0x296/0x3d0 [ 219.063595][ T8370] device_add+0xbe/0xb50 [ 219.067823][ T8370] netdev_register_kobject+0x156/0x2f0 [ 219.073268][ T8370] register_netdevice+0x126c/0x1af0 [ 219.078452][ T8370] wg_newlink+0x389/0x640 [ 219.082894][ T8370] rtnl_newlink_create+0x305/0xaf0 [ 219.088004][ T8370] rtnl_newlink+0x16d6/0x1c70 [ 219.092670][ T8370] rtnetlink_rcv_msg+0x7cc/0xb70 [ 219.097608][ T8370] netlink_rcv_skb+0x219/0x490 [ 219.102365][ T8370] netlink_unicast+0x758/0x8d0 [ 219.107130][ T8370] page last free pid 1 tgid 1 stack trace: [ 219.112920][ T8370] __free_frozen_pages+0xb05/0xcd0 [ 219.118019][ T8370] free_contig_range+0x159/0x440 [ 219.122959][ T8370] destroy_args+0x86/0x460 [ 219.127370][ T8370] debug_vm_pgtable+0x3cf/0x410 [ 219.132217][ T8370] do_one_initcall+0x233/0x820 [ 219.136977][ T8370] do_initcall_level+0x137/0x1f0 [ 219.141912][ T8370] do_initcalls+0x69/0xd0 [ 219.146233][ T8370] kernel_init_freeable+0x3d9/0x570 [ 219.151425][ T8370] kernel_init+0x1d/0x1d0 [ 219.155748][ T8370] ret_from_fork+0x4b/0x80 [ 219.160151][ T8370] ret_from_fork_asm+0x1a/0x30 [ 219.164907][ T8370] [ 219.167219][ T8370] Memory state around the buggy address: [ 219.172829][ T8370] ffff88806069bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 219.180874][ T8370] ffff88806069bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 219.188917][ T8370] >ffff88806069bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.196960][ T8370] ^ [ 219.201271][ T8370] ffff88806069bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.209315][ T8370] ffff88806069bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.217376][ T8370] ================================================================== [ 219.234635][ T8416] veth0_macvtap: entered promiscuous mode [ 219.245840][ T8416] veth1_macvtap: entered promiscuous mode [ 219.285526][ T8416] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 219.296438][ T8416] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.306919][ T8416] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 219.322519][ T8416] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.333733][ T8416] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 219.341310][ T8630] netlink: 'syz.6.956': attribute type 1 has an invalid length. [ 219.345187][ T8416] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.371754][ T8416] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 219.384881][ T8370] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 219.392103][ T8370] CPU: 0 UID: 0 PID: 8370 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00256-g95d3481af6dc #0 PREEMPT(full) [ 219.404260][ T8370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 219.414318][ T8370] Call Trace: [ 219.417594][ T8370] [ 219.420508][ T8370] dump_stack_lvl+0x99/0x250 [ 219.425087][ T8370] ? __asan_memcpy+0x40/0x70 [ 219.429657][ T8370] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.434843][ T8370] ? __pfx__printk+0x10/0x10 [ 219.439421][ T8370] panic+0x2db/0x790 [ 219.443294][ T8370] ? __pfx_preempt_schedule+0x10/0x10 [ 219.448651][ T8370] ? __pfx_panic+0x10/0x10 [ 219.453071][ T8370] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 219.458955][ T8370] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 219.465268][ T8370] ? binder_add_device+0x5f/0xa0 [ 219.470188][ T8370] check_panic_on_warn+0x89/0xb0 [ 219.475110][ T8370] ? binder_add_device+0x5f/0xa0 [ 219.480053][ T8370] end_report+0x78/0x160 [ 219.484288][ T8370] kasan_report+0x129/0x150 [ 219.488774][ T8370] ? binder_add_device+0x5f/0xa0 [ 219.493696][ T8370] binder_add_device+0x5f/0xa0 [ 219.498540][ T8370] binderfs_binder_device_create+0x8b7/0xaf0 [ 219.504526][ T8370] binderfs_fill_super+0xa0e/0xe90 [ 219.509629][ T8370] ? __pfx_binderfs_fill_super+0x10/0x10 [ 219.515259][ T8370] ? shrinker_register+0x16b/0x230 [ 219.520359][ T8370] ? sget_fc+0x962/0xa40 [ 219.524588][ T8370] ? __pfx_set_anon_super_fc+0x10/0x10 [ 219.530035][ T8370] ? __pfx_binderfs_fill_super+0x10/0x10 [ 219.535656][ T8370] get_tree_nodev+0xb8/0x150 [ 219.540244][ T8370] vfs_get_tree+0x8f/0x2b0 [ 219.544663][ T8370] do_new_mount+0x24a/0xa40 [ 219.549172][ T8370] __se_sys_mount+0x317/0x410 [ 219.553846][ T8370] ? __pfx___se_sys_mount+0x10/0x10 [ 219.559037][ T8370] ? do_syscall_64+0xba/0x210 [ 219.563701][ T8370] ? __x64_sys_mount+0x20/0xc0 [ 219.568457][ T8370] do_syscall_64+0xf6/0x210 [ 219.572950][ T8370] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 219.579090][ T8370] ? clear_bhb_loop+0x45/0xa0 [ 219.583753][ T8370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.589631][ T8370] RIP: 0033:0x7f75e479010a [ 219.594035][ T8370] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.613631][ T8370] RSP: 002b:00007ffc13742618 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 219.622031][ T8370] RAX: ffffffffffffffda RBX: 00007f75e4810e74 RCX: 00007f75e479010a [ 219.629988][ T8370] RDX: 00007f75e48208cb RSI: 00007f75e4810e74 RDI: 00007f75e48208cb [ 219.637947][ T8370] RBP: 00007f75e48110bd R08: 0000000000000000 R09: 00007f75e49b6738 [ 219.645907][ T8370] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f75e47ec1a8 [ 219.653865][ T8370] R13: 00007f75e47ec180 R14: 0000000000000009 R15: 0000000000000000 [ 219.661831][ T8370] [ 219.665059][ T8370] Kernel Offset: disabled [ 219.669369][ T8370] Rebooting in 86400 seconds..