last executing test programs: 3.376727175s ago: executing program 0 (id=136): creat(&(0x7f0000000140)='./file0\x00', 0x71) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='cramfs\x00', 0xa08081, 0x0) 3.286474558s ago: executing program 0 (id=137): mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x1002, 0x0) 3.283838987s ago: executing program 0 (id=138): creat(&(0x7f0000000040)='./file0\x00', 0x29) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELOBJ={0x1c, 0x14, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x8080) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ntfs3\x00', 0x8000, 0x0) 3.244527619s ago: executing program 0 (id=139): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r1, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r1, 0x0, &(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x4}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r1}) r2 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}, 0x0, 0x0, 0xffffffffffffffff}) close_range(r3, r2, 0x0) 3.176255211s ago: executing program 0 (id=140): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) fadvise64(r0, 0x94, 0x6e, 0x5) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="1201"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket(0x10, 0x3, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x9b, 0x4f, 0xb6, 0x20, 0x711, 0x230, 0x3c61, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0x8, 0x80, 0x0, [{{0x9, 0x4, 0x67, 0x4, 0x0, 0x6d, 0x8f, 0x95, 0x7b}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000000)={{0xeeee8000, 0xdddd0000, 0x8, 0xf6, 0x0, 0x9, 0x2, 0x0, 0x6, 0x3, 0xf, 0x1}, {0xd000, 0x6000, 0xd, 0x61, 0x46, 0x3, 0x49, 0x9, 0xc, 0x6, 0x80, 0x9}, {0x2000, 0x1000, 0x8, 0x40, 0x5f, 0x76, 0x5, 0x5, 0x4, 0x6, 0x6, 0x4}, {0x4, 0x6000, 0x0, 0x3, 0x1, 0x7, 0x1, 0x5, 0x81, 0x5, 0x40, 0x7f}, {0x5c5dd724e66d4d29, 0xffff1000, 0x0, 0x8, 0x3, 0x8, 0x1, 0x8, 0x6, 0xf4, 0x4, 0x5}, {0x100000, 0x0, 0x4, 0x8, 0x1, 0x6, 0xf, 0x4, 0x3c, 0xfe, 0x7, 0x3}, {0x100000, 0x5000, 0x0, 0x10, 0x4, 0x7, 0x1, 0x5, 0x1, 0xe, 0x33}, {0x0, 0xffff1000, 0x8, 0x5d, 0xc, 0x37, 0x7, 0xc, 0x0, 0xf, 0x5, 0x80}, {0x10000, 0x8}, {0x0, 0x2}, 0x10002, 0x0, 0xeeee0000, 0x100008, 0x8, 0x1401, 0xeeef0000, [0x200, 0x5, 0x7, 0x3]}) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000240)="67400f07c40249af4b8bb9800000c00f3235010000000f300f20a366450f769e00000100440f20c03588001d00440f22c0460f01c9c4827d24c366bafc0cf0ff07ef87f345a57a43e16806a4", 0x4c}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000300)={[0xb0ae, 0xd91, 0x6, 0x9, 0x7, 0x9, 0x7, 0x3ff, 0x377e, 0xff, 0x3, 0x8, 0x100000001, 0x7, 0x9, 0x83], 0x5000, 0x28010}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, 0x0, 0x0) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ipvlan0\x00', 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0x20) sendmsg$inet6(r3, &(0x7f00000003c0)={&(0x7f0000000100)={0xa, 0x4e23, 0x77, @mcast1, 0x6}, 0x1c, &(0x7f0000000140), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="14000000000000002900ec00430001befaff3c24716e7f616bee133b0000050000000000000028000000000000002900000036000000290200000000000004010805020008000100c204000000e2140000000000000029000000430000000d00000000000000380000000000000029000000370000002f03000000000000c910fc010000000000000000000000000000050200050001000000000000000014000000000000002900000034c07d70f600000000000000"], 0xa8}, 0x8008000) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f00000001c0)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x10003}}, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @loopback, 0x3}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7}, 0xfffffffffffffe0c) 1.518446488s ago: executing program 0 (id=149): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) r2 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000001c0)) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r3, &(0x7f0000000240)=""/226, 0xe2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r1, 0xd83ba000) lstat(&(0x7f0000000000)='./cgroup\x00', 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000100)={'fscrypt:', @auto=[0x31, 0x34, 0x31, 0x61, 0x39, 0x66, 0x31, 0x31, 0x35, 0x31, 0x37, 0x63, 0x61, 0x33, 0x32, 0xffa95bac6bfbca89]}, &(0x7f0000000140)={0x0, "3a9b738972151f34e3051829037cd7d8f3cbb0b442deabf2f28390894c7a7727593638945de33b6d4a535bba9ddd6b6f0b9680f03ef841dc162f32bb47fc672b", 0x40}, 0x48, 0xfffffffffffffffa) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f0000000500)={0x7, 0x4, 0x7, 0x8000}, 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, 0x0, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x4, 0x30}, 0xc) sendmsg$inet_sctp(r4, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0), 0x0, 0x0, 0x0, 0x804c040}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ff000040720501cb6526010203010902120001000000000904"], 0x0) r5 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0x7) mount$tmpfs(0x0, 0x0, &(0x7f0000000280), 0x802, 0x0) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r6, 0xc018937e, &(0x7f0000000240)={{0x1, 0x1, 0x5f, 0xffffffffffffffff, {0x80000}}, './file0\x00'}) ioctl$TCSETA(r5, 0x8924, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x10, "4feda26323b172e0"}) 1.400652232s ago: executing program 2 (id=152): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x42002080}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x44, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xe}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000004}, 0x400c0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xb4, r2, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x40, 0x2f}}}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0xc, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x7f}]}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x7}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x7, 0x2b}}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x7630}, @NL80211_ATTR_SCAN_SSIDS={0x54, 0x2d, 0x0, 0x1, [{0x5, 0x0, @random="d5"}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ibss_ssid}, {0xd, 0x0, @random="5f1d9680a6e5b946fb"}, {0x1f, 0x0, @random="bda183311dfdabe51675ae3d868ce15dbfeae7a84df788bbadaba7"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0xb4}, 0x1, 0x0, 0x0, 0x44845}, 0x90) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="ff0000001000010000000000000000000000000a54000000060a0b040000000000000000020000002800048024000180090001006d6574610000000014000280080002400000001908000140000000140900010073797a3000001fcacfc8020073797a3200000000140000001100010000000000000000000000000a986aea50f3ec99fe33f3a8cdf321c4ba22e5c865362636ddeac3f043b6361f765968a621e894018046325c02ae0c754c4f94c85eec0c3abfd9ade8344bf30df8bab1b51220f5d56c631e107d921f8f29bdec796154b807bb58a052bb5e1d6776b9483438ad5a050b44"], 0x7c}}, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000004, 0x20011, r3, 0xf648d000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 1.290372903s ago: executing program 2 (id=153): syz_usb_connect$uac1(0x2, 0xa3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102000000206b1d01014000010203010902910013010140cc0904000000010100000a2401f5ffff020102132406060406040003000300030003000a000705240501030a24040508e53a273e3108240405047b653609040100000102000009040101010102000008240201080200030905010920003b0008072501020510000904020000010200000904020101010220000905820920"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) (async) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./file0\x00', &(0x7f0000000340)='configfs\x00', 0x248000, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r5 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904fb00026c5d650009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) stat(&(0x7f0000000580)='./file0\x00', 0x0) (async) syz_usb_control_io$uac1(r5, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x2, {0x2, 0x3}}, 0x0}, &(0x7f0000000740)={0x44, &(0x7f0000000340)={0x40, 0xf, 0x26, "5249f7e5ac6bbc94328ebae49b68b9252a8bc3ae83f874e071bb080c32ad457df9f3b8fcd35c"}, 0x0, 0x0, &(0x7f00000004c0)={0x20, 0x81, 0x2, "d542"}, &(0x7f0000000640)={0x20, 0x82, 0x2, "bb21"}, &(0x7f0000000680)={0x20, 0x83, 0x3, "ead5b9"}, 0x0, 0x0}) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000000400)={0x0, 0x0, r7, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r6, 0xc01864b1, &(0x7f0000000580)={r8, 0x3, 0x1002a, 0x2, &(0x7f0000000080)=[{0xd4f9, 0x1ff, 0x1ff, 0x7}, {0x7, 0xc899, 0x2}]}) (async) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000540)={0x2c, &(0x7f00000002c0)={0x0, 0x30, 0x8b, "efcb739f7d614a6455fc5d0af26e8692127ce5733672f679117101e680e220a3801f8c0c606ff80f85a5ff7b541952364f19433c1846f4277034167eeb4ac9138d4d0161a234cf335624e8ae995e26ef5055bf9242a00e90c55ccfcf58f75bc6bb2bdf01413f96d3fcaf6feb12994763cfb68634c86914466dede1d00e0c345788d263dd2af6c536dd50db"}, 0x0, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000400), 0x0}) (async) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) (async) write(r2, &(0x7f0000000240)="94", 0x1) (async) close(r3) tee(r1, r4, 0x8f5, 0x0) (async) write(0xffffffffffffffff, 0x0, 0x0) (async) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) (async) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) (async) r9 = inotify_init1(0x0) (async) r10 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r10, 0xc0205649, &(0x7f0000000080)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90f, 0x8000, '\x00', @p_u8=&(0x7f0000000240)}}) inotify_add_watch(r9, &(0x7f00000000c0)='./file0\x00', 0xa4000608) (async) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) sendmsg(r11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x208}, 0x0) 1.144836544s ago: executing program 2 (id=155): r0 = openat$random(0xffffffffffffff9c, &(0x7f0000005240), 0x400, 0x0) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000005280)) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000100)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="11072abd7000ffdbdf250500000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x28008000}, 0x40000) readv(r1, &(0x7f0000000740)=[{&(0x7f0000000240)=""/152, 0x98}], 0x1) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='msdos\x00', 0x200000, 0x0) 1.054616673s ago: executing program 2 (id=156): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0), 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}], 0x4) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x2) creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000100)='xfs\x00', 0x208083, 0x0) 958.513842ms ago: executing program 2 (id=159): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x35, 0x0, "317f83735b4bb1eadc74dde27798c831eec04c24eeec7ff3d3137a508003d2d5c89ab0220cefebd4687636457b9822766c1bfea4e01ff23c6a4caeaf049a572a9774d3b882eb3b4a66c5ec48c29f065d"}, 0xd8) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "000000008100e108", "5171bb672965593497418688ac68cb126474cd3660dab9e2086e246728d7a040", "05e2e505", "12000700"}, 0x38) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000140)={0x1, 0x0, [{0xd, 0x3482, 0x800, 0x10001, 0x1}]}) fcntl$lock(r1, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x5, 0x5}) fcntl$lock(r1, 0x26, &(0x7f0000000100)={0x1, 0x1, 0x2, 0x7fff800000000}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xa8001, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r7, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0xfffffffffffffffe, 0x3, 0x20000e691, 0x6, 0x0, 0x6, 0x4000000000000000, 0xfffffffffffffffe, 0x0, 0xd1, 0x1, 0x7, 0x836f, 0x0, 0x100000000100000], 0x0, 0x8340}) ioctl$KVM_RUN(r7, 0xae80, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000140)={0x1, 0x1, 0x80000000001, 0x6}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) fcntl$lock(r1, 0x26, &(0x7f0000000200)={0x3, 0x3, 0x7f, 0x7}) fcntl$lock(r1, 0x7, &(0x7f0000000280)={0x0, 0x1, 0x5, 0x10}) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) r8 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x2) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r8, 0x0) fallocate(r8, 0x0, 0x0, 0x1000f4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 958.214219ms ago: executing program 3 (id=160): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r2, 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000005c00), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000005c40)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, &(0x7f0000005d00)={0x0, 0x0, &(0x7f0000005cc0)={&(0x7f0000005c80)={0x1c, r3, 0x711, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0xf0ffff, 0x0, 0x4000084}, 0x10) creat(&(0x7f0000000000)='./file0\x00', 0x1ea) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='qnx4\x00', 0x84, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x2e3c00, &(0x7f00000000c0)={[{@redirect_dir_off}, {@volatile}], [{@mask={'mask', 0x3d, 'MAY_APPEND'}}]}) 909.590377ms ago: executing program 3 (id=162): r0 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000000)={0x3, 'gre0\x00', {0x4}, 0x7}) 903.059404ms ago: executing program 1 (id=163): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001340)={0x14, r2, 0xb0b}, 0x14}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x191000, 0x0) r4 = syz_clone(0x88028200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000001c0)=0xaf) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x40, 0x1) r6 = openat$cgroup_devices(r5, &(0x7f0000000480)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f0000000180)=ANY=[@ANYBLOB], 0xa) ptrace(0x10, r4) ptrace$poke(0x5, r4, &(0x7f0000000080), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa471a000) ioctl$TIOCSLCKTRMIOS(r3, 0x5457, &(0x7f0000000180)) 814.411614ms ago: executing program 3 (id=164): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xd83ba000) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000200)='.\x02\x00', 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000080)=0x14) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000200)=0x32) close(r1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 756.037836ms ago: executing program 3 (id=165): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500561308005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000100000000000000cc00000000050004"], 0xfdef) 635.671536ms ago: executing program 1 (id=166): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @none, 0x4, 0x2}, 0xe) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040), 0x10) listen(r1, 0x0) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r2, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) r3 = accept4$unix(r1, 0x0, 0x0, 0x0) recvfrom$unix(r3, &(0x7f0000000140)=""/246, 0xf6, 0x0, 0x0, 0x0) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000000440)={{}, 0x5, 0xe9c, 0x5}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x800, &(0x7f0000000000)) syz_clone(0x20000000, &(0x7f00000009c0)="60e9674f8434316f2751ded03e21476c7a4b017772f09d4b2c7b24a6cf0bbaf08581e136982524198e26005b29e4b1506fd459e0166c8b056a68108e14ce7b1c6d81e7514bf7080f9a20330d42bac6df9991bcd75495e53cbd18dd75a4f762b93627f20e1601832a8c47fb53b3675d79ccbf2897f4ce321bc9ea6e99e2fb4c1ccd56f36faa44c37f4a3b0a76968136582fc2e9abe9e6c3b496fcb4a4aec1", 0x9e, &(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)="653470ef93") r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x41) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r4, 0x40806685, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x10, 0x8, 0x2, 0x1, {{0xa, 0x4, 0x0, 0x32, 0x28, 0x68, 0x0, 0x4, 0x2f, 0x0, @empty, @multicast2, {[@lsrr={0x83, 0xb, 0x37, [@multicast1, @remote]}, @rr={0x7, 0x7, 0x23, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @end]}}}}}) sendmsg$nl_route_sched_retired(r4, &(0x7f0000000980)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000280)=@deltfilter={0x694, 0x2d, 0x200, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xe, 0x1}, {0x2, 0xfffd}}, [@f_rsvp={{0x9}, {0x5c0, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0x0, 0x7fffffff, 0x7}, {0x7f, 0x0, 0x2}, 0x88, 0x1, 0x3}}, @TCA_RSVP_SRC={0x8, 0x3, @empty}, @TCA_RSVP_ACT={0x56c, 0x6, [@m_simple={0xb8, 0x5, 0x0, 0x0, {{0xb}, {0x5c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x8, 0xff, 0x4, 0x3ff, 0x7}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7, 0x80000000, 0x9b4e6f41b5bb9c99, 0x7, 0x2}}, @TCA_DEF_DATA={0x6, 0x3, '!\x00'}, @TCA_DEF_DATA={0x7, 0x3, '\xdf.\x00'}, @TCA_DEF_DATA={0xb, 0x3, 'nilfs2\x00'}, @TCA_DEF_DATA={0x9, 0x3, '\'.&$\x00'}]}, {0x34, 0x6, "19d46c88d185efd79fd62922e5b7227b933beef3c82c012c261e2c96f4fb22daaa4daa0f3f7f03073cea56f279c3d5a7"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_mpls={0x15c, 0x14, 0x0, 0x0, {{0x9}, {0x40, 0x2, 0x0, 0x1, [@TCA_MPLS_TC={0x5, 0x6, 0x2}, @TCA_MPLS_PROTO={0x6, 0x4, 0x94c}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0xa704, 0x0, 0x2, 0x5, 0x9}, 0x4}}, @TCA_MPLS_TC={0x5, 0x6, 0x5}, @TCA_MPLS_BOS={0x5}]}, {0xf3, 0x6, "ee9ffd4cab1e98c19674086bb72dba46daaff47d05a43ca4850d9702e5e2024e65151e7427115dd642cb6cb7d131224c6bcb07b584b538e1c57288df84d1e220e2226f7d42e2b71513c34182d33e6001700636e1d7cd583d62306a9b801b827a14a77954793cf674c1ad1129256e3d9240c750732dfb339df8ab0c13c8c2df383d0b0221d131cb754921e32c7de90b9f3bb40d92e8ee7c6e94095c336b5a15189646395c67c445efafc0f4428565bc9813456f5885ae422bc37450202886b3a379b67be740bae8baf59b54f529698aa5fb25c7eb335181dfef35ec665a8ee6c2971161760f50ff759f9482cb0fcbdd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_mpls={0xb4, 0x9, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x4, 0x890d}]}, {0x7e, 0x6, "dc6d618884685e587ee0cc88148d6d55206f7bb7c6de38127bf278abc73214e5cdd10c3e0b3f15753f748ef7354452ccc9f974835754349462b29b4ec480e71fc153af036dc5dd6377ff90c0932fe8b6904b43aa3bdd578a733b7e7164a3fc9f574b6713e4b0111a2473a83cde17d8c61c44be2c41eb8ed5a853"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_connmark={0x78, 0x1d, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x1, 0x8, 0x3, 0x395d}, 0xc5b}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x62, 0x2a4, 0x4, 0x2, 0x100}, 0x5}}]}, {0xe, 0x6, "4be0e7b3bc91ca936f42"}, {0xc, 0x7, {0x0, 0x13363731cbeb3faa}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_nat={0xfc, 0xa, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x8, 0x5, 0x3, 0x897}, @dev={0xac, 0x14, 0x14, 0x25}, @local, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8, 0x4, 0x4, 0xc76, 0x4}, @dev={0xac, 0x14, 0x14, 0x3e}, @private=0xa010100, 0xffffffff, 0x1}}]}, {0x81, 0x6, "577a3a802e363183aa0b26ae2a222d2f8cc3366be0a2f67c6e1bddce0168fcee61c0104202c31d9d0580de8dd956126bd346c4eb6dc472bf224f5369d2867f7075776d6423a1f9aa69aa00a1b0c53c2366664e7e5b913f5ccbfe3330e66d2445067b5bb7bb4f36bdef3ac2f981cc4e0e4a788c2b80a46e32f8f7dcbafc"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_ct={0x12c, 0x6, 0x0, 0x0, {{0x7}, {0xc, 0x2, 0x0, 0x1, [@TCA_CT_ZONE={0x6, 0x4, 0xe22}]}, {0xfc, 0x6, "660a9ccb1bd3b19e8839f7ba9a01681f3a6ae542712ec82d28e2bf59992afc9850881823dfce6678390e9dd105aee2f1d0bb859e91599b5d4030611d8dcb5abbf23910eec9606b619c72f1d55e0a87163771ea520799780e722936144dadff7ce584ea3fa13575cb9d224c0697fef9a9ee1771a8c7fa2813bb61452a70bd18b6de53227951d1331f2916bb178f2020943bee5206cf8fc551deb90056e5dab60dc811426f653a2ee80abdd881467fba9f9f1841d9027896b2086ef7e7c33d6d8e4f694f9a4727f169796a499a081f926cdc2336efa9aedde4d459e45e6251a367dca18b99cd9545174385a9f3b9251878cd8cc68d45d6811c"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}, @TCA_RSVP_DST={0x8, 0x2, @broadcast}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x2, 0x6, 0x1}, {0x2, 0x800, 0xf55}, 0x32, 0x3, 0x2}}]}}, @f_rsvp={{0x9}, {0x4}}, @f_tcindex={{0xc}, {0x60, 0x2, [@TCA_TCINDEX_POLICE={0x5c, 0x6, [@TCA_POLICE_AVRATE={0x8, 0x4, 0xeb89}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x9}, @TCA_POLICE_RESULT={0x8, 0x5, 0x2}, @TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x1, 0x7, 0x60000000, 0x6, {0x77, 0x1, 0x8, 0x75, 0x81, 0x9}, {0xff, 0x0, 0x3, 0x3, 0xc, 0x7ff}, 0x1, 0x9, 0x2a84}}]}]}}, @f_tcindex={{0xc}, {0x1c, 0x2, [@TCA_TCINDEX_MASK={0x6, 0x2, 0xc24}, @TCA_TCINDEX_MASK={0x6, 0x2, 0x9}, @TCA_TCINDEX_FALL_THROUGH={0x8}]}}]}, 0x694}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0) 538.524022ms ago: executing program 3 (id=167): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd2(0x6, 0x80800) (async) r2 = eventfd2(0x6, 0x80800) r3 = eventfd(0xfffffc6f) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x3, r3}) (async) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x3, r3}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f00000001c0)={0x3, r2}) set_mempolicy(0x3, &(0x7f0000000080)=0x7e, 0x9) (async) set_mempolicy(0x3, &(0x7f0000000080)=0x7e, 0x9) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x16d342, 0x0) munmap(&(0x7f0000012000/0x4000)=nil, 0x4000) (async) munmap(&(0x7f0000012000/0x4000)=nil, 0x4000) write(r4, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$P9_RLCREATE(r5, &(0x7f00000000c0)={0x18, 0xf, 0x1, {{0x80, 0x3, 0x8}, 0xfa}}, 0x18) 538.27646ms ago: executing program 1 (id=168): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats={0x11}}) ioctl$VIDIOC_QBUF(r1, 0xc058ff0b, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8000"}, 0x0, 0x2, {}, 0x20800}) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) fstat(r3, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x2c39000) 475.168643ms ago: executing program 1 (id=169): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(r1, 0x3ba0, &(0x7f0000000080)={0x48}) (async) ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(r1, 0x3ba0, &(0x7f0000000080)={0x48}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000280)={'sit0\x00', &(0x7f00000001c0)={'gretap0\x00', 0x0, 0x7, 0x7840, 0x4, 0x400, {{0x6, 0x4, 0x0, 0x2, 0x18, 0x4, 0x0, 0x1, 0x29, 0x0, @private=0xa010102, @private=0xa010101, {[@generic={0x83, 0x2}]}}}}}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff04000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x48810}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) (async) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18}, './file0\x00'}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x4000, 0x0) ioctl$PPPIOCSACTIVE(r7, 0x40107446, &(0x7f0000000200)={0x2, &(0x7f0000000180)=[{0x4, 0x2f, 0x21, 0x790}, {0x7, 0x3, 0x1, 0xfff}]}) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) (async) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x18, 0x1418, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x4008885}, 0x10) (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x18, 0x1418, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x4008885}, 0x10) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r6, 0xc01c64a3, &(0x7f0000000040)={0x3, r10, 0x10000000, 0x80000005, 0xb, 0x1fd, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CURSOR(r6, 0xc01c64a3, &(0x7f0000000040)={0x3, r10, 0x10000000, 0x80000005, 0xb, 0x1fd, 0x1}) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x208002, 0x0) 463.231499ms ago: executing program 3 (id=170): syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000000000020ef0e01000000000300010902240001000080000904000001f2ff0100092100000001220500090581083f"], 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r0, 0x80045503, &(0x7f0000002a40)) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r2, &(0x7f0000000000)={0x1f, @none}, 0x8) mremap(&(0x7f0000155000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000416000/0x3000)=nil) sendfile(r1, r1, 0x0, 0x7ffff000) 214.449402ms ago: executing program 1 (id=171): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)={'#! ', './file0'}, 0xb) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x729) r2 = accept4(r1, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010014000000000000000200e70308000300", @ANYRES32=r5, @ANYRESDEC], 0x40}}, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x13) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f00000000c0)={'ip6erspan0\x00'}) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) listen(r7, 0x6227) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, 0x0, 0x0) r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r10, r11, &(0x7f0000036000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x49, &(0x7f00000000c0)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1120008c}], 0x1) ioctl$KVM_RUN(r11, 0xae80, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@mcast2, 0x9775, 0x1, 0x0, 0x1, 0x3, 0x3}, &(0x7f0000000140)=0x20) 107.936791ms ago: executing program 1 (id=172): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) preadv(r3, &(0x7f00000004c0)=[{&(0x7f0000001740)=""/12, 0xc}], 0x1, 0x4, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000002700), r4) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002840)={&(0x7f0000000240)=ANY=[@ANYBLOB="ed450a3239b51e3a74cd68e40000", @ANYRES16=r5, @ANYBLOB="010325bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x24008040) sendmsg$GTP_CMD_GETPDP(r3, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="240000002b8deac6b755f9cd83abef082848830a840bf842ea7a52a9b45151430ce22403000000000000006a843840c04efbab3d2c65f44ccea01b556bf82b2c6a05a7c2e16799a95d4ebd748e8870ed40e97ef77bea3795cf9438d11e7d4d5069e19ed6d95de7b68962cf", @ANYRES16=r5, @ANYBLOB="000227bd7000ff0c00000200000008000500ffffffff080005007f000001"], 0x24}, 0x1, 0x0, 0x0, 0x1804}, 0x0) (async) sendmsg$GTP_CMD_GETPDP(r3, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="240000002b8deac6b755f9cd83abef082848830a840bf842ea7a52a9b45151430ce22403000000000000006a843840c04efbab3d2c65f44ccea01b556bf82b2c6a05a7c2e16799a95d4ebd748e8870ed40e97ef77bea3795cf9438d11e7d4d5069e19ed6d95de7b68962cf", @ANYRES16=r5, @ANYBLOB="000227bd7000ff0c00000200000008000500ffffffff080005007f000001"], 0x24}, 0x1, 0x0, 0x0, 0x1804}, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000200)='cdg\x00', 0x4) (async) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000200)='cdg\x00', 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$inet6_udp(0xa, 0x2, 0x0) (async) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001180)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r7}]}, 0x1c}}, 0x0) sendmmsg$inet6(r1, &(0x7f0000000440)=[{{&(0x7f0000000280)={0xa, 0x4e22, 0x7ff, @private0, 0x9f83}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000002c0)="8e175e4f385b1d1ebc6e93eafa2159efa2626698d201eb98d1a91d61d624e1b015d93562e7ab5b2fb21cf2907cc5a4c63dec", 0x32}, {&(0x7f0000000300)="3f2107f8a5809001524b6a23f1516f50ada3746e0bf147188e74d3e8e8c5ee229fb4f7060703d9afe6046a10aba951db2f5faa1d06edae70bc29b37bbbb0ba78aa54a350e63eff7d0fe7bc71d2fb2b1316caab81e5ad45e0a7769c235315bdd6e7a4853527c3ef767c96d21d19c58e80098012c7e450baaab72b22030bd436ed90ead1a94f35aa67f287685c5d02e4a597b836cd74298865edd0819faf651766fe2dd9d772126fff1a041035ccacef7b601d21723afd0baff9578ec7371ea20f209c13695d7c1125574938b19138d81f34bc37f2db497bf146f3bd34", 0xdc}], 0x2, &(0x7f0000000500)=[@hopopts={{0x30, 0x29, 0x36, {0x62, 0x2, '\x00', [@ra={0x5, 0x2, 0x3}, @generic={0xd, 0x11, "a04031be9f6d226e462cf9b72cbbdd44c7"}]}}}, @hopopts_2292={{0x70, 0x29, 0x36, {0x33, 0xa, '\x00', [@pad1, @calipso={0x7, 0x18, {0x1, 0x4, 0x8, 0x4, [0x1, 0x90]}}, @calipso={0x7, 0x38, {0x0, 0xc, 0x3, 0x5, [0x7, 0x5, 0x9, 0x3, 0x3, 0xbe]}}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0xfff}}, @hopopts={{0x20, 0x29, 0x36, {0x5e, 0x0, '\x00', [@enc_lim={0x4, 0x1, 0x9}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@local, r7}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x100}}], 0x118}}], 0x1, 0x14) prctl$PR_GET_THP_DISABLE(0x2a) (async) prctl$PR_GET_THP_DISABLE(0x2a) syz_usb_disconnect(0xffffffffffffffff) (async) syz_usb_disconnect(0xffffffffffffffff) shutdown(r1, 0x2) r10 = syz_open_dev$vim2m(&(0x7f0000000080), 0x6, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r10, 0xc0405602, &(0x7f0000000140)={0x11, 0x1, 0x0, "8eb89c2c11d85d06000000000000000000faff00000000eaff0000e600"}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x5708e000) 0s ago: executing program 2 (id=173): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) pipe2$watch_queue(&(0x7f0000002240)={0xffffffffffffffff}, 0x80) r2 = add_key$user(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="8e", 0x1, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r3, 0x6) r5 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a6c000000060a090400000000000000000a0000010900010073797a3100000000400004803c0001800900010068617368000000002c0002800800024000000014080001400000001708000440000000e7080006400000000108000740000000010900020073797a320000000014000000110001"], 0x94}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) landlock_restrict_self(r5, 0x0) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000b40)='./file7\x00') keyctl$KEYCTL_WATCH_KEY(0x20, r2, r1, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r4, 0xffffffffffffffff) ioctl$VIDIOC_ENCODER_CMD(r4, 0xc028564d, &(0x7f0000000000)={0x0, 0x0, [0x9, 0x7fffffff, 0x3, 0x0, 0x10000, 0x462a, 0x732, 0x20cf]}) mmap(&(0x7f0000a5a000/0x4000)=nil, 0x4000, 0x3000005, 0x8010, r0, 0x7a708000) ioctl$BLKRRPART(r0, 0x125f, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7b1"], 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fsync(r7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$invalidate(0x15, r2) r10 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) r11 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, r10) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f0000000900)="0000000000000001ff690000000000010000001806fa0100861f4104bf007d16dcdc2850b5000000000000008eb49c9179da48b7", 0x34, r11) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0xc) fstat(r9, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r11, r12, r13) r14 = request_key(&(0x7f0000000340)='cifs.spnego\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)='rxrpc\x00', r10) keyctl$reject(0x13, r14, 0x4, 0x800, r11) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts. [ 68.407457][ T5848] cgroup: Unknown subsys name 'net' [ 68.556786][ T5848] cgroup: Unknown subsys name 'cpuset' [ 68.564545][ T5848] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.878779][ T5848] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.346272][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.352554][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.910572][ T5861] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 71.928031][ T5865] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.935367][ T5871] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 71.935416][ T5865] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 71.942429][ T5871] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 71.950784][ T5865] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 71.956740][ T5871] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.971232][ T5865] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 71.971321][ T5871] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.986038][ T5871] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 71.986600][ T5865] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 71.993836][ T5871] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.007580][ T5871] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.015251][ T5871] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.015465][ T5865] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.030933][ T5872] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.036543][ T5871] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.045834][ T5874] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.053692][ T5186] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.063217][ T5873] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.322174][ T5869] chnl_net:caif_netlink_parms(): no params data found [ 72.412407][ T5857] chnl_net:caif_netlink_parms(): no params data found [ 72.441033][ T5858] chnl_net:caif_netlink_parms(): no params data found [ 72.500924][ T5869] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.508347][ T5869] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.516090][ T5869] bridge_slave_0: entered allmulticast mode [ 72.522771][ T5869] bridge_slave_0: entered promiscuous mode [ 72.529868][ T5864] chnl_net:caif_netlink_parms(): no params data found [ 72.546342][ T5869] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.553465][ T5869] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.561048][ T5869] bridge_slave_1: entered allmulticast mode [ 72.568183][ T5869] bridge_slave_1: entered promiscuous mode [ 72.605312][ T5869] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.627121][ T5869] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.666651][ T5857] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.673791][ T5857] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.681506][ T5857] bridge_slave_0: entered allmulticast mode [ 72.688459][ T5857] bridge_slave_0: entered promiscuous mode [ 72.713048][ T5857] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.720295][ T5857] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.727492][ T5857] bridge_slave_1: entered allmulticast mode [ 72.734146][ T5857] bridge_slave_1: entered promiscuous mode [ 72.742170][ T5869] team0: Port device team_slave_0 added [ 72.749834][ T5869] team0: Port device team_slave_1 added [ 72.759319][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.766509][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.773664][ T5858] bridge_slave_0: entered allmulticast mode [ 72.780378][ T5858] bridge_slave_0: entered promiscuous mode [ 72.812469][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.819697][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.827066][ T5858] bridge_slave_1: entered allmulticast mode [ 72.833789][ T5858] bridge_slave_1: entered promiscuous mode [ 72.842251][ T5857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.880932][ T5857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.897970][ T5869] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.905497][ T5869] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.931825][ T5869] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.942812][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.950122][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.957375][ T5864] bridge_slave_0: entered allmulticast mode [ 72.964009][ T5864] bridge_slave_0: entered promiscuous mode [ 72.986377][ T5857] team0: Port device team_slave_0 added [ 72.992585][ T5869] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.999923][ T5869] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.026131][ T5869] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.041292][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.049009][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.056428][ T5864] bridge_slave_1: entered allmulticast mode [ 73.063135][ T5864] bridge_slave_1: entered promiscuous mode [ 73.071486][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.081930][ T5857] team0: Port device team_slave_1 added [ 73.112017][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.122246][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.129679][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.155832][ T5857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.195745][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.202708][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.229839][ T5857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.242403][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.253062][ T5858] team0: Port device team_slave_0 added [ 73.271804][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.290297][ T5858] team0: Port device team_slave_1 added [ 73.303081][ T5869] hsr_slave_0: entered promiscuous mode [ 73.309467][ T5869] hsr_slave_1: entered promiscuous mode [ 73.339393][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.346656][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.372782][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.385503][ T5864] team0: Port device team_slave_0 added [ 73.391714][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.398984][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.425275][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.448101][ T5864] team0: Port device team_slave_1 added [ 73.486541][ T5857] hsr_slave_0: entered promiscuous mode [ 73.492718][ T5857] hsr_slave_1: entered promiscuous mode [ 73.499048][ T5857] debugfs: 'hsr0' already exists in 'hsr' [ 73.505887][ T5857] Cannot create hsr debugfs directory [ 73.511932][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.518944][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.545133][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.567732][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.574846][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.600878][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.655721][ T5858] hsr_slave_0: entered promiscuous mode [ 73.661782][ T5858] hsr_slave_1: entered promiscuous mode [ 73.668231][ T5858] debugfs: 'hsr0' already exists in 'hsr' [ 73.673977][ T5858] Cannot create hsr debugfs directory [ 73.730447][ T5864] hsr_slave_0: entered promiscuous mode [ 73.736581][ T5864] hsr_slave_1: entered promiscuous mode [ 73.742489][ T5864] debugfs: 'hsr0' already exists in 'hsr' [ 73.748261][ T5864] Cannot create hsr debugfs directory [ 73.919635][ T5857] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 73.928800][ T5857] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 73.956658][ T5857] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 73.969384][ T5857] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 74.000001][ T5869] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.025124][ T5869] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.041656][ T5869] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.057351][ T5869] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.064670][ T5873] Bluetooth: hci0: command tx timeout [ 74.065270][ T5868] Bluetooth: hci3: command tx timeout [ 74.070079][ T5873] Bluetooth: hci1: command tx timeout [ 74.090107][ T5858] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 74.107688][ T5858] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 74.128282][ T5858] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 74.144762][ T5873] Bluetooth: hci2: command tx timeout [ 74.161553][ T5858] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 74.188912][ T5864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.198585][ T5864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.211386][ T5864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.220755][ T5864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.252977][ T5857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.281028][ T5857] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.305430][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.312575][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.329172][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.336285][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.423004][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.439580][ T5869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.473654][ T5869] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.483780][ T5864] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.503153][ T1030] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.510324][ T1030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.530557][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.546742][ T1030] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.553872][ T1030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.563552][ T1030] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.570688][ T1030] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.583694][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.590830][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.617680][ T5858] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.643992][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.651122][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.666672][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.673782][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.692546][ T5864] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 74.703214][ T5864] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 74.717705][ T5857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.813771][ T5857] veth0_vlan: entered promiscuous mode [ 74.851592][ T5857] veth1_vlan: entered promiscuous mode [ 74.906067][ T5857] veth0_macvtap: entered promiscuous mode [ 74.925815][ T5857] veth1_macvtap: entered promiscuous mode [ 74.954081][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.980748][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.012326][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.030296][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.055839][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.079775][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.100071][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.131236][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.148169][ T5864] veth0_vlan: entered promiscuous mode [ 75.183185][ T1030] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.190240][ T5864] veth1_vlan: entered promiscuous mode [ 75.196802][ T1030] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.204058][ T5869] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.239916][ T5858] veth0_vlan: entered promiscuous mode [ 75.273417][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.277337][ T5864] veth0_macvtap: entered promiscuous mode [ 75.288511][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.291249][ T5858] veth1_vlan: entered promiscuous mode [ 75.308196][ T5864] veth1_macvtap: entered promiscuous mode [ 75.340727][ T5869] veth0_vlan: entered promiscuous mode [ 75.351061][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.362524][ T5857] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 75.366182][ T5869] veth1_vlan: entered promiscuous mode [ 75.398124][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.428628][ T49] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.439969][ T49] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.462752][ T5858] veth0_macvtap: entered promiscuous mode [ 75.475312][ T49] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.486583][ T5858] veth1_macvtap: entered promiscuous mode [ 75.502531][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.518487][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.544112][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.569283][ T5869] veth0_macvtap: entered promiscuous mode [ 75.591935][ T1030] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.613421][ T5869] veth1_macvtap: entered promiscuous mode [ 75.623467][ T4394] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.638723][ T4394] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.674476][ T4394] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.727590][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.733157][ T5953] Zero length message leads to an empty skb [ 75.751180][ T4394] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.761393][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.775296][ T4394] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.808106][ T4394] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.822649][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.850999][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.861656][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.892112][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.902480][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.938588][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.966622][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.038420][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.082380][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.091588][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.108142][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.145814][ T5873] Bluetooth: hci1: command tx timeout [ 76.155723][ T5873] Bluetooth: hci3: command tx timeout [ 76.161166][ T5873] Bluetooth: hci0: command tx timeout [ 76.172982][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.187406][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.216901][ T5957] Mount JFS Failure: -22 [ 76.224664][ T5873] Bluetooth: hci2: command tx timeout [ 76.694377][ T5955] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.838045][ T5929] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 76.857578][ T5955] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 76.881877][ T5955] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 76.905525][ T5955] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 76.921787][ T5955] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 76.929055][ T5991] ======================================================= [ 76.929055][ T5991] WARNING: The mand mount option has been deprecated and [ 76.929055][ T5991] and is ignored by this kernel. Remove the mand [ 76.929055][ T5991] option from the mount to silence this warning. [ 76.929055][ T5991] ======================================================= [ 76.966236][ T5955] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 76.979152][ T5955] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.015096][ T5955] usb 4-1: config 0 descriptor?? [ 77.034581][ T5991] XFS (rnullb0): Invalid superblock magic number [ 77.044681][ T5929] usb 2-1: Using ep0 maxpacket: 16 [ 77.052953][ T5929] usb 2-1: unable to get BOS descriptor or descriptor too short [ 77.077262][ T5929] usb 2-1: config 129 has an invalid interface number: 147 but max is 0 [ 77.087975][ T5929] usb 2-1: config 129 has no interface number 0 [ 77.096482][ T5929] usb 2-1: config 129 interface 147 altsetting 133 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 77.112106][ T5929] usb 2-1: config 129 interface 147 has no altsetting 0 [ 77.123506][ T5929] usb 2-1: New USB device found, idVendor=0c72, idProduct=0011, bcdDevice=80.af [ 77.139883][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.148142][ T5929] usb 2-1: Product: syz [ 77.156929][ T5929] usb 2-1: Manufacturer: syz [ 77.162011][ T5929] usb 2-1: SerialNumber: syz [ 77.234746][ T5943] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 77.374312][ T5943] usb 1-1: device descriptor read/64, error -71 [ 77.432736][ T5955] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 77.460428][ T5955] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 77.625215][ T5943] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 77.709171][ T5969] process 'syz.3.10' launched '/dev/fd/9' with NULL argv: empty string added [ 77.776852][ T5943] usb 1-1: device descriptor read/64, error -71 [ 77.862377][ T5866] usb 4-1: USB disconnect, device number 2 [ 77.960500][ T5943] usb usb1-port1: attempt power cycle [ 78.224453][ T5873] Bluetooth: hci3: command tx timeout [ 78.225599][ T5868] Bluetooth: hci0: command tx timeout [ 78.230050][ T5873] Bluetooth: hci1: command tx timeout [ 78.304514][ T5873] Bluetooth: hci2: command tx timeout [ 78.324300][ T5943] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 78.367743][ T5943] usb 1-1: device descriptor read/8, error -71 [ 78.604325][ T5943] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 78.635154][ T5943] usb 1-1: device descriptor read/8, error -71 [ 78.754548][ T5943] usb usb1-port1: unable to enumerate USB device [ 78.897838][ T6025] overlayfs: failed lookup in lower (newroot/8, name='bus', err=-40): overlapping layers [ 79.015062][ T6028] /dev/rnullb0: Can't open blockdev [ 79.343666][ T6034] omfs: Invalid superblock (0) [ 79.543079][ T6036] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 79.683567][ T5929] peak_usb 2-1:129.147 can0: unable to request usb[type=0 value=1] err=-71 [ 79.725567][ T5929] peak_usb 2-1:129.147: unable to read PCAN-USB Pro FD firmware info (err -71) [ 79.827253][ T5929] peak_usb 2-1:129.147: probe with driver peak_usb failed with error -71 [ 79.853570][ T5929] usb 2-1: USB disconnect, device number 2 [ 80.214316][ T5929] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 80.265918][ T5955] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 80.308250][ T5873] Bluetooth: hci1: command tx timeout [ 80.313711][ T5873] Bluetooth: hci0: command tx timeout [ 80.319522][ T5873] Bluetooth: hci3: command tx timeout [ 80.386835][ T5873] Bluetooth: hci2: command tx timeout [ 80.396835][ T6057] /dev/rnullb0: Can't open blockdev [ 80.407814][ T5929] usb 2-1: Using ep0 maxpacket: 32 [ 80.428501][ T5929] usb 2-1: unable to get BOS descriptor or descriptor too short [ 80.447817][ T5955] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 80.460682][ T5929] usb 2-1: config 7 has an invalid interface number: 103 but max is 2 [ 80.479371][ T5955] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 80.494612][ T5929] usb 2-1: config 7 has an invalid interface number: 3 but max is 2 [ 80.521987][ T5955] usb 3-1: Product: syz [ 80.531508][ T5929] usb 2-1: config 7 has an invalid interface number: 134 but max is 2 [ 80.541335][ T5955] usb 3-1: SerialNumber: syz [ 80.555463][ T5929] usb 2-1: config 7 has no interface number 0 [ 80.561720][ T5929] usb 2-1: config 7 has no interface number 1 [ 80.569483][ T5929] usb 2-1: config 7 has no interface number 2 [ 80.578614][ T5929] usb 2-1: config 7 interface 103 altsetting 9 endpoint 0xC has an invalid bInterval 178, changing to 11 [ 80.597437][ T5955] usb 3-1: config 0 descriptor?? [ 80.609291][ T5929] usb 2-1: config 7 interface 3 altsetting 1 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 80.622141][ T5929] usb 2-1: config 7 interface 103 has no altsetting 0 [ 80.635076][ T5929] usb 2-1: config 7 interface 3 has no altsetting 0 [ 80.641852][ T5929] usb 2-1: config 7 interface 134 has no altsetting 0 [ 80.652343][ T5929] usb 2-1: New USB device found, idVendor=4971, idProduct=1012, bcdDevice=36.82 [ 80.665904][ T6060] /dev/rnullb0: Can't open blockdev [ 80.672420][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.685806][ T5929] usb 2-1: Product: syz [ 80.690089][ T5929] usb 2-1: Manufacturer: syz [ 80.698313][ T5929] usb 2-1: SerialNumber: syz [ 80.711284][ T5929] usb 2-1: Interface #103 referenced by multiple IADs [ 80.719844][ T5929] usb 2-1: Interface #134 referenced by multiple IADs [ 80.824094][ T6044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.839453][ T6044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.855305][ T5955] usb 3-1: USB disconnect, device number 2 [ 80.939232][ T6039] /dev/rnullb0: Can't open blockdev [ 80.957759][ T5929] usb-storage 2-1:7.103: USB Mass Storage device detected [ 80.973496][ T5929] usb-storage 2-1:7.103: Quirks match for vid 4971 pid 1012: 800000 [ 81.127358][ T5929] usb-storage 2-1:7.3: USB Mass Storage device detected [ 81.138670][ T5929] usb-storage 2-1:7.3: Quirks match for vid 4971 pid 1012: 800000 [ 81.198548][ T5929] usb-storage 2-1:7.134: USB Mass Storage device detected [ 81.207242][ T5929] usb-storage 2-1:7.134: Quirks match for vid 4971 pid 1012: 800000 [ 81.243848][ T5929] usb 2-1: USB disconnect, device number 3 [ 81.404332][ T5955] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 81.554369][ T5955] usb 1-1: Using ep0 maxpacket: 32 [ 81.561001][ T5955] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 81.569434][ T5955] usb 1-1: config 0 has no interface number 0 [ 81.588895][ T5955] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 81.598622][ T5955] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.607054][ T5955] usb 1-1: Product: syz [ 81.611243][ T5955] usb 1-1: Manufacturer: syz [ 81.617097][ T5955] usb 1-1: SerialNumber: syz [ 81.625494][ T5955] usb 1-1: config 0 descriptor?? [ 81.640188][ T6075] netlink: 8 bytes leftover after parsing attributes in process `syz.2.34'. [ 81.714856][ T5929] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 81.865201][ T5929] usb 4-1: Using ep0 maxpacket: 32 [ 81.871760][ T5929] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 81.883050][ T5929] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 81.892950][ T5929] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 81.902656][ T5929] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 81.916013][ T5929] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 81.925144][ T5866] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 81.932681][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.940870][ T5929] usb 4-1: Product: syz [ 81.945380][ T5929] usb 4-1: Manufacturer: syz [ 81.950002][ T5929] usb 4-1: SerialNumber: syz [ 82.043417][ T5955] radio-si470x 1-1:0.35: DeviceID=0x6b9d ChipID=0xe901 [ 82.104297][ T5866] usb 3-1: Using ep0 maxpacket: 16 [ 82.111183][ T5866] usb 3-1: unable to get BOS descriptor or descriptor too short [ 82.119908][ T5866] usb 3-1: config 5 has an invalid interface number: 151 but max is 0 [ 82.128220][ T5866] usb 3-1: config 5 has no interface number 0 [ 82.134390][ T5866] usb 3-1: config 5 interface 151 altsetting 7 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 82.145508][ T5866] usb 3-1: config 5 interface 151 altsetting 7 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 82.157457][ T5866] usb 3-1: config 5 interface 151 altsetting 7 endpoint 0x8F has invalid maxpacket 12805, setting to 1024 [ 82.169529][ T6070] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 82.177475][ T5866] usb 3-1: config 5 interface 151 altsetting 7 bulk endpoint 0x8F has invalid maxpacket 1024 [ 82.187784][ T5866] usb 3-1: config 5 interface 151 altsetting 7 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 82.201041][ T5866] usb 3-1: config 5 interface 151 has no altsetting 0 [ 82.209785][ T5866] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=5e.14 [ 82.218922][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.227042][ T5866] usb 3-1: Product: syz [ 82.231237][ T5866] usb 3-1: Manufacturer: syz [ 82.235913][ T5866] usb 3-1: SerialNumber: syz [ 82.243361][ T6078] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 82.250812][ T5955] radio-si470x 1-1:0.35: software version 107, hardware version 157 [ 82.452141][ T5955] radio-si470x 1-1:0.35: si470x_set_report: usb_control_msg returned -71 [ 82.466819][ T6078] serio: Serial port ptm0 [ 82.472412][ C0] radio-si470x 1-1:0.35: non-zero urb status (-71) [ 82.479831][ C0] radio-si470x 1-1:0.35: non-zero urb status (-71) [ 82.488757][ C0] radio-si470x 1-1:0.35: non-zero urb status (-71) [ 82.495488][ T5955] radio-si470x 1-1:0.35: si470x_set_report: usb_control_msg returned -71 [ 82.504167][ T5955] radio-si470x 1-1:0.35: probe with driver radio-si470x failed with error -22 [ 82.540119][ T5866] hdpvr 3-1:5.151: unexpected answer of status request, len -71 [ 82.548321][ T5866] hdpvr 3-1:5.151: device init failed [ 82.553841][ T5955] radio-raremono 1-1:0.35: this is not Thanko's Raremono. [ 82.561117][ T5866] hdpvr 3-1:5.151: probe with driver hdpvr failed with error -12 [ 82.574469][ T5955] usb 1-1: USB disconnect, device number 6 [ 82.583800][ T5866] usb 3-1: USB disconnect, device number 3 [ 82.790907][ T6070] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 82.999389][ T5929] cdc_ncm 4-1:1.0: bind() failure [ 83.017814][ T5929] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 83.027432][ T5929] cdc_ncm 4-1:1.1: bind() failure [ 83.049843][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 83.056439][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.087732][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.107353][ T6090] loop0: Can't mount, would change RO state [ 83.119965][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(6) [ 83.126516][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.157443][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.176740][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(9) [ 83.183392][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.205478][ T5866] usb 4-1: USB disconnect, device number 3 [ 83.226958][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.243820][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(3) sockfd(11) [ 83.250461][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.264347][ T24] vhci_hcd: vhci_device speed not set [ 83.280261][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.300490][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(13) [ 83.307133][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.324281][ T24] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 83.324378][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.367934][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(5) sockfd(15) [ 83.374579][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.398541][ T6106] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 83.402984][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.430387][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(6) sockfd(17) [ 83.437027][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.444337][ T5943] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 83.464883][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.480587][ T6110] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 83.499550][ T6086] vhci_hcd vhci_hcd.0: pdev(0) rhport(7) sockfd(19) [ 83.506183][ T6086] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 83.535630][ T6086] vhci_hcd vhci_hcd.0: Device attached [ 83.560449][ T6086] vhci_hcd vhci_hcd.0: port 0 already used [ 83.594346][ T5943] usb 1-1: device descriptor read/64, error -71 [ 83.764311][ T43] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 83.866548][ T5943] usb 1-1: new low-speed USB device number 8 using dummy_hcd [ 83.887338][ T6118] syz.3.42 uses obsolete (PF_INET,SOCK_PACKET) [ 83.944358][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 83.951332][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 83.968916][ T43] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 83.971968][ T6123] /dev/rnullb0: Can't open blockdev [ 83.978456][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.004327][ T5943] usb 1-1: device descriptor read/64, error -71 [ 84.018788][ T43] usb 3-1: Product: syz [ 84.027450][ T43] usb 3-1: Manufacturer: syz [ 84.037913][ T43] usb 3-1: SerialNumber: syz [ 84.049838][ T43] usb 3-1: config 0 descriptor?? [ 84.134525][ T5943] usb usb1-port1: attempt power cycle [ 84.276175][ T6110] use of bytesused == 0 is deprecated and will be removed in the future, [ 84.284987][ T6110] use the actual size instead. [ 84.300977][ T43] dm9601 3-1:0.0: probe with driver dm9601 failed with error -22 [ 84.312789][ T43] sr9700 3-1:0.0: probe with driver sr9700 failed with error -22 [ 84.323722][ T43] usb 3-1: USB disconnect, device number 4 [ 84.484369][ T5943] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 84.505290][ T5943] usb 1-1: device descriptor read/8, error -71 [ 84.552837][ T6130] netlink: 32 bytes leftover after parsing attributes in process `syz.1.46'. [ 84.582052][ T5929] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 84.715268][ T5929] usb 4-1: device descriptor read/64, error -71 [ 84.964380][ T5929] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 85.036945][ T6138] FAULT_INJECTION: forcing a failure. [ 85.036945][ T6138] name failslab, interval 1, probability 0, space 0, times 1 [ 85.049786][ T6138] CPU: 0 UID: 0 PID: 6138 Comm: syz.2.48 Not tainted syzkaller #0 PREEMPT(full) [ 85.049812][ T6138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 85.049824][ T6138] Call Trace: [ 85.049831][ T6138] [ 85.049841][ T6138] dump_stack_lvl+0x189/0x250 [ 85.049876][ T6138] ? __pfx____ratelimit+0x10/0x10 [ 85.049905][ T6138] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.049934][ T6138] ? __pfx__printk+0x10/0x10 [ 85.049962][ T6138] ? __pfx___might_resched+0x10/0x10 [ 85.049989][ T6138] ? lock_acquire+0x5f/0x360 [ 85.050014][ T6138] should_fail_ex+0x414/0x560 [ 85.050036][ T6138] should_failslab+0xa8/0x100 [ 85.050061][ T6138] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 85.050084][ T6138] ? dup_task_struct+0x52/0x860 [ 85.050114][ T6138] dup_task_struct+0x52/0x860 [ 85.050143][ T6138] copy_process+0x54b/0x3c00 [ 85.050183][ T6138] ? __pfx_copy_process+0x10/0x10 [ 85.050212][ T6138] ? __raw_spin_lock_init+0x45/0x100 [ 85.050233][ T6138] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 85.050256][ T6138] vhost_task_create+0x1c4/0x290 [ 85.050274][ T6138] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 85.050298][ T6138] ? __pfx_vhost_task_create+0x10/0x10 [ 85.050317][ T6138] ? __pfx_vhost_task_fn+0x10/0x10 [ 85.050338][ T6138] ? kasan_save_track+0x4f/0x80 [ 85.050357][ T6138] ? kasan_save_track+0x3e/0x80 [ 85.050376][ T6138] ? kasan_save_free_info+0x46/0x50 [ 85.050403][ T6138] ? __kasan_slab_free+0x5b/0x80 [ 85.050422][ T6138] ? kfree+0x18e/0x440 [ 85.050442][ T6138] kvm_mmu_post_init_vm+0x14c/0x300 [ 85.050468][ T6138] kvm_arch_vcpu_ioctl_run+0xdc/0x1940 [ 85.050492][ T6138] ? __mutex_trylock_common+0x153/0x260 [ 85.050522][ T6138] ? __pfx___mutex_trylock_common+0x10/0x10 [ 85.050551][ T6138] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 85.050573][ T6138] ? rcu_is_watching+0x15/0xb0 [ 85.050611][ T6138] ? trace_contention_end+0x39/0x120 [ 85.050640][ T6138] ? __mutex_lock+0x335/0x1350 [ 85.050660][ T6138] ? rcu_is_watching+0x15/0xb0 [ 85.050688][ T6138] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 85.050711][ T6138] ? rcu_is_watching+0x15/0xb0 [ 85.050737][ T6138] ? lock_release+0x4b/0x3e0 [ 85.050760][ T6138] ? get_task_pid+0x22/0x310 [ 85.050785][ T6138] kvm_vcpu_ioctl+0x95c/0xe90 [ 85.050805][ T6138] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 85.050821][ T6138] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 85.050865][ T6138] ? lock_release+0x4b/0x3e0 [ 85.050892][ T6138] ? __fget_files+0x2a/0x420 [ 85.050923][ T6138] ? __fget_files+0x3a0/0x420 [ 85.050952][ T6138] ? __fget_files+0x2a/0x420 [ 85.050983][ T6138] ? bpf_lsm_file_ioctl+0x9/0x20 [ 85.051004][ T6138] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 85.051023][ T6138] __se_sys_ioctl+0xfc/0x170 [ 85.051048][ T6138] do_syscall_64+0xfa/0x3b0 [ 85.051067][ T6138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.051088][ T6138] ? clear_bhb_loop+0x60/0xb0 [ 85.051111][ T6138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.051130][ T6138] RIP: 0033:0x7fab8578ebe9 [ 85.051159][ T6138] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.051177][ T6138] RSP: 002b:00007fab86538038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.051199][ T6138] RAX: ffffffffffffffda RBX: 00007fab859b5fa0 RCX: 00007fab8578ebe9 [ 85.051214][ T6138] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 85.051226][ T6138] RBP: 00007fab86538090 R08: 0000000000000000 R09: 0000000000000000 [ 85.051238][ T6138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 85.051250][ T6138] R13: 00007fab859b6038 R14: 00007fab859b5fa0 R15: 00007fff0a035c98 [ 85.051273][ T6138] [ 85.504763][ T5929] usb 4-1: device descriptor read/64, error -71 [ 85.524128][ T6140] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 85.544098][ T6140] /dev/rnullb0: Can't open blockdev [ 85.599708][ T6142] /dev/rnullb0: Can't open blockdev [ 85.614833][ T5929] usb usb4-port1: attempt power cycle [ 85.618211][ T6144] syzkaller1: entered promiscuous mode [ 85.626091][ T6144] syzkaller1: entered allmulticast mode [ 85.656544][ T5943] usb 1-1: new low-speed USB device number 10 using dummy_hcd [ 85.667417][ T6146] syzkaller1: entered promiscuous mode [ 85.672921][ T6146] syzkaller1: entered allmulticast mode [ 85.686239][ T5943] usb 1-1: device descriptor read/8, error -71 [ 85.771354][ T6148] netlink: 60 bytes leftover after parsing attributes in process `syz.2.53'. [ 85.783964][ T6148] netlink: 60 bytes leftover after parsing attributes in process `syz.2.53'. [ 85.800904][ T5943] usb usb1-port1: unable to enumerate USB device [ 85.814118][ T6148] netlink: 60 bytes leftover after parsing attributes in process `syz.2.53'. [ 85.954999][ T5929] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 85.980699][ T5929] usb 4-1: device descriptor read/8, error -71 [ 86.119039][ T6111] vhci_hcd: connection closed [ 86.119349][ T49] vhci_hcd: stop threads [ 86.119866][ T6107] vhci_hcd: connection closed [ 86.131970][ T6099] vhci_hcd: connection closed [ 86.134440][ T6092] vhci_hcd: connection closed [ 86.138813][ T6087] vhci_hcd: connection reset by peer [ 86.144417][ T6101] vhci_hcd: connection closed [ 86.146615][ T6103] vhci_hcd: connection closed [ 86.151406][ T6094] vhci_hcd: connection closed [ 86.153113][ T49] vhci_hcd: release socket [ 86.184954][ T49] vhci_hcd: disconnect device [ 86.204819][ T49] vhci_hcd: stop threads [ 86.209103][ T49] vhci_hcd: release socket [ 86.222303][ T49] vhci_hcd: disconnect device [ 86.234528][ T5929] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 86.242189][ T49] vhci_hcd: stop threads [ 86.248924][ T49] vhci_hcd: release socket [ 86.267229][ T5929] usb 4-1: device descriptor read/8, error -71 [ 86.374730][ T5929] usb usb4-port1: unable to enumerate USB device [ 86.463439][ T49] vhci_hcd: disconnect device [ 86.525327][ T49] vhci_hcd: stop threads [ 86.549097][ T49] vhci_hcd: release socket [ 86.569903][ T49] vhci_hcd: disconnect device [ 86.593464][ T49] vhci_hcd: stop threads [ 86.605016][ T6148] orangefs_mount: mount request failed with -4 [ 86.621427][ T49] vhci_hcd: release socket [ 86.629793][ T6171] /dev/rnullb0: Can't open blockdev [ 86.631636][ T49] vhci_hcd: disconnect device [ 86.662050][ T49] vhci_hcd: stop threads [ 86.678003][ T49] vhci_hcd: release socket [ 86.694329][ T49] vhci_hcd: disconnect device [ 86.702057][ T49] vhci_hcd: stop threads [ 86.750931][ T49] vhci_hcd: release socket [ 86.774339][ T49] vhci_hcd: disconnect device [ 86.794287][ T49] vhci_hcd: stop threads [ 86.798579][ T49] vhci_hcd: release socket [ 86.833458][ T49] vhci_hcd: disconnect device [ 86.857243][ T6182] FAULT_INJECTION: forcing a failure. [ 86.857243][ T6182] name failslab, interval 1, probability 0, space 0, times 0 [ 86.895596][ T6182] CPU: 0 UID: 0 PID: 6182 Comm: syz.0.58 Not tainted syzkaller #0 PREEMPT(full) [ 86.895623][ T6182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 86.895635][ T6182] Call Trace: [ 86.895642][ T6182] [ 86.895650][ T6182] dump_stack_lvl+0x189/0x250 [ 86.895691][ T6182] ? __pfx____ratelimit+0x10/0x10 [ 86.895720][ T6182] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.895749][ T6182] ? __pfx__printk+0x10/0x10 [ 86.895775][ T6182] ? rcu_is_watching+0x15/0xb0 [ 86.895804][ T6182] ? __pfx___might_resched+0x10/0x10 [ 86.895830][ T6182] ? lock_acquire+0x5f/0x360 [ 86.895855][ T6182] should_fail_ex+0x414/0x560 [ 86.895878][ T6182] should_failslab+0xa8/0x100 [ 86.895902][ T6182] __kmalloc_noprof+0xcb/0x4f0 [ 86.895924][ T6182] ? security_task_alloc+0x4d/0x360 [ 86.895951][ T6182] ? perf_event_init_task+0x12d/0x4b0 [ 86.895972][ T6182] security_task_alloc+0x4d/0x360 [ 86.896000][ T6182] copy_process+0x1530/0x3c00 [ 86.896036][ T6182] ? copy_process+0x97f/0x3c00 [ 86.896067][ T6182] ? __pfx_copy_process+0x10/0x10 [ 86.896097][ T6182] ? __raw_spin_lock_init+0x45/0x100 [ 86.896118][ T6182] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 86.896141][ T6182] vhost_task_create+0x1c4/0x290 [ 86.896160][ T6182] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 86.896183][ T6182] ? __pfx_vhost_task_create+0x10/0x10 [ 86.896205][ T6182] ? __pfx_vhost_task_fn+0x10/0x10 [ 86.896227][ T6182] ? kasan_save_track+0x4f/0x80 [ 86.896246][ T6182] ? kasan_save_track+0x3e/0x80 [ 86.896264][ T6182] ? kasan_save_free_info+0x46/0x50 [ 86.896292][ T6182] ? __kasan_slab_free+0x5b/0x80 [ 86.896312][ T6182] ? kfree+0x18e/0x440 [ 86.896332][ T6182] kvm_mmu_post_init_vm+0x14c/0x300 [ 86.896358][ T6182] kvm_arch_vcpu_ioctl_run+0xdc/0x1940 [ 86.896382][ T6182] ? __mutex_trylock_common+0x153/0x260 [ 86.896412][ T6182] ? __pfx___mutex_trylock_common+0x10/0x10 [ 86.896441][ T6182] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 86.896462][ T6182] ? rcu_is_watching+0x15/0xb0 [ 86.896488][ T6182] ? trace_contention_end+0x39/0x120 [ 86.896517][ T6182] ? __mutex_lock+0x335/0x1350 [ 86.896537][ T6182] ? rcu_is_watching+0x15/0xb0 [ 86.896565][ T6182] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 86.896588][ T6182] ? rcu_is_watching+0x15/0xb0 [ 86.896615][ T6182] ? lock_release+0x4b/0x3e0 [ 86.896637][ T6182] ? get_task_pid+0x22/0x310 [ 86.896659][ T6182] kvm_vcpu_ioctl+0x95c/0xe90 [ 86.896706][ T6182] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 86.896724][ T6182] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 86.896752][ T6182] ? lock_release+0x4b/0x3e0 [ 86.896779][ T6182] ? __fget_files+0x2a/0x420 [ 86.896809][ T6182] ? __fget_files+0x3a0/0x420 [ 86.896838][ T6182] ? __fget_files+0x2a/0x420 [ 86.896869][ T6182] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.896890][ T6182] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 86.896909][ T6182] __se_sys_ioctl+0xfc/0x170 [ 86.896934][ T6182] do_syscall_64+0xfa/0x3b0 [ 86.896954][ T6182] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.896974][ T6182] ? clear_bhb_loop+0x60/0xb0 [ 86.896997][ T6182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.897017][ T6182] RIP: 0033:0x7f4daaf8ebe9 [ 86.897034][ T6182] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.897052][ T6182] RSP: 002b:00007f4dabe65038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.897073][ T6182] RAX: ffffffffffffffda RBX: 00007f4dab1b6090 RCX: 00007f4daaf8ebe9 [ 86.897088][ T6182] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 86.897101][ T6182] RBP: 00007f4dabe65090 R08: 0000000000000000 R09: 0000000000000000 [ 86.897113][ T6182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 86.897125][ T6182] R13: 00007f4dab1b6128 R14: 00007f4dab1b6090 R15: 00007ffdb6871d28 [ 86.897147][ T6182] [ 87.542724][ T6199] syzkaller1: entered promiscuous mode [ 87.551509][ T6199] syzkaller1: entered allmulticast mode [ 87.690412][ T6205] syzkaller1: entered promiscuous mode [ 87.715159][ T6205] syzkaller1: entered allmulticast mode [ 87.768214][ T6214] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 87.784500][ T5866] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 87.910895][ T6221] netlink: 40 bytes leftover after parsing attributes in process `syz.1.67'. [ 87.959843][ T5866] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 87.971660][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 87.974415][ T43] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 87.992630][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 88.026249][ T5866] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 88.067238][ T5866] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 88.095685][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.105937][ T5866] usb 4-1: config 0 descriptor?? [ 88.194297][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 88.202704][ T43] usb 3-1: config 0 has an invalid interface number: 150 but max is 0 [ 88.214345][ T43] usb 3-1: config 0 has an invalid interface number: 112 but max is 0 [ 88.232771][ T43] usb 3-1: config 0 has an invalid interface number: 3 but max is 0 [ 88.249868][ T43] usb 3-1: config 0 has 3 interfaces, different from the descriptor's value: 1 [ 88.268078][ T43] usb 3-1: config 0 has no interface number 0 [ 88.283549][ T43] usb 3-1: config 0 has no interface number 1 [ 88.303818][ T43] usb 3-1: config 0 has no interface number 2 [ 88.312848][ T6194] random: crng reseeded on system resumption [ 88.332989][ T43] usb 3-1: config 0 interface 150 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 88.353193][ T43] usb 3-1: too many endpoints for config 0 interface 112 altsetting 233: 104, using maximum allowed: 30 [ 88.366186][ T43] usb 3-1: config 0 interface 112 altsetting 233 has 1 endpoint descriptor, different from the interface descriptor's value: 104 [ 88.380052][ T43] usb 3-1: config 0 interface 150 has no altsetting 0 [ 88.389487][ T43] usb 3-1: config 0 interface 112 has no altsetting 0 [ 88.401983][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.411348][ T43] usb 3-1: New USB device found, idVendor=1395, idProduct=0300, bcdDevice=81.75 [ 88.418872][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.428924][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.434363][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.444309][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.444343][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.444370][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.444397][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.444424][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.444452][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.444479][ T5866] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 88.454581][ T24] vhci_hcd: vhci_device speed not set [ 88.501509][ C1] vkms_vblank_simulate: vblank timer overrun [ 88.518829][ T5866] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 88.538646][ T43] usb 3-1: config 0 descriptor?? [ 88.658755][ T6249] netlink: 56 bytes leftover after parsing attributes in process `syz.3.61'. [ 88.673981][ T6249] netlink: 16 bytes leftover after parsing attributes in process `syz.3.61'. [ 88.737742][ T6263] XFS (rnullb0): Invalid superblock magic number [ 89.048848][ T6284] Malformed UNC in devname [ 89.048848][ T6284] [ 89.055866][ T6284] CIFS: VFS: Malformed UNC in devname [ 89.061463][ T43] usb 3-1: string descriptor 0 read error: -71 [ 89.087148][ T6194] Unrecognized hibernate image header format! [ 89.093256][ T6194] PM: hibernation: Image mismatch: architecture specific data [ 89.093647][ T43] usb 3-1: USB disconnect, device number 5 [ 89.176663][ T6292] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 89.191451][ T5943] usb 4-1: USB disconnect, device number 8 [ 89.507165][ T6316] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 89.547670][ T43] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 89.754607][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 89.773787][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 89.829541][ T43] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 89.855153][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.870619][ T43] usb 3-1: Product: syz [ 89.875405][ T43] usb 3-1: Manufacturer: syz [ 89.880065][ T43] usb 3-1: SerialNumber: syz [ 89.884769][ T5943] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 89.913745][ T43] usb 3-1: config 0 descriptor?? [ 90.044369][ T5943] usb 4-1: Using ep0 maxpacket: 32 [ 90.062333][ T5943] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 90.102158][ T5943] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 90.138300][ T5943] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 90.160919][ T5943] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 90.174607][ T43] dm9601 3-1:0.0: probe with driver dm9601 failed with error -22 [ 90.218288][ T5943] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 90.228471][ T43] sr9700 3-1:0.0: probe with driver sr9700 failed with error -22 [ 90.244307][ T5943] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.259262][ T43] usb 3-1: USB disconnect, device number 6 [ 90.269423][ T5943] usb 4-1: Product: syz [ 90.273639][ T5943] usb 4-1: Manufacturer: syz [ 90.286288][ T5943] usb 4-1: SerialNumber: syz [ 90.470637][ T6352] /dev/rnullb0: Can't open blockdev [ 90.488533][ T6352] netlink: 8 bytes leftover after parsing attributes in process `syz.1.88'. [ 90.500990][ T6323] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 90.557290][ T6340] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 90.563350][ T6340] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 90.585884][ T6340] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 90.602734][ T6340] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 90.612931][ T6340] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 90.621194][ T6340] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 90.628696][ T6340] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 90.637891][ T6340] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 90.651146][ T6340] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 90.658803][ T6340] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 90.667317][ T6340] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 90.914318][ T5866] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 90.946855][ T6370] comedi comedi3: comedi_test: 20263 microvolt, 5 microsecond waveform attached [ 91.074374][ T5866] usb 2-1: Using ep0 maxpacket: 32 [ 91.106620][ T5866] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 91.117062][ T6323] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 91.117823][ T5866] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 91.135288][ T5866] usb 2-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 91.145246][ T5866] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.190525][ T5866] usb 2-1: config 0 descriptor?? [ 91.326270][ T5943] cdc_ncm 4-1:1.0: bind() failure [ 91.348739][ T5943] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 91.396884][ T5943] cdc_ncm 4-1:1.1: bind() failure [ 91.428357][ T6357] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 91.455685][ T6380] netlink: 420 bytes leftover after parsing attributes in process `syz.2.97'. [ 91.471147][ T5943] usb 2-1: USB disconnect, device number 4 [ 91.531714][ T24] usb 4-1: USB disconnect, device number 9 [ 91.589439][ T6384] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 91.856986][ T6389] /dev/rnullb0: Can't open blockdev [ 92.088167][ T2151] cfg80211: failed to load regulatory.db [ 92.209919][ T6402] capability: warning: `syz.1.104' uses 32-bit capabilities (legacy support in use) [ 92.221118][ T6403] netlink: 32 bytes leftover after parsing attributes in process `syz.0.103'. [ 92.287525][ T6409] /dev/rnullb0: Can't open blockdev [ 92.394439][ T24] usb 4-1: new low-speed USB device number 10 using dummy_hcd [ 92.413719][ T30] audit: type=1326 audit(1755750367.220:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6415 comm="syz.2.109" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fab8578ebe9 code=0x0 [ 92.466214][ T5868] Bluetooth: hci1: command 0x0c1a tx timeout [ 92.493054][ T6419] 9p: Bad value for 'wfdno' [ 92.568535][ T24] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 92.577874][ T24] usb 4-1: config 179 has no interface number 0 [ 92.587011][ T24] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 92.604686][ T24] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 92.625541][ T5873] Bluetooth: hci0: command 0x0c1a tx timeout [ 92.626680][ T24] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 92.631624][ T5868] Bluetooth: hci2: command 0x0c1a tx timeout [ 92.668761][ T24] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 58368, setting to 8 [ 92.704369][ T5868] Bluetooth: hci3: command 0x0c1a tx timeout [ 93.079104][ T24] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 93.092516][ T24] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 93.112042][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.112331][ T5929] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 93.131930][ T6399] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 93.158551][ T24] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.196953][ T24] xpad 4-1:179.65: probe with driver xpad failed with error -90 [ 93.305719][ T5929] usb 1-1: Using ep0 maxpacket: 32 [ 93.314166][ T5929] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.330234][ T5929] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 93.340470][ T5929] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 93.351765][ T5929] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 93.400063][ T5929] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 93.489747][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.503557][ T2151] usb 4-1: USB disconnect, device number 10 [ 93.508603][ T6429] syzkaller1: entered promiscuous mode [ 93.516877][ T5929] usb 1-1: Product: syz [ 93.519693][ T6429] syzkaller1: entered allmulticast mode [ 93.524081][ T5929] usb 1-1: Manufacturer: syz [ 93.531405][ T5929] usb 1-1: SerialNumber: syz [ 93.680839][ T6435] ISOFS: unsupported/invalid hardware sector size 4096 [ 93.720739][ T6437] netlink: 'syz.1.117': attribute type 32 has an invalid length. [ 93.745115][ T6424] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 93.984367][ T2151] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 94.074389][ T24] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 94.147232][ T2151] usb 2-1: unable to get BOS descriptor or descriptor too short [ 94.157671][ T2151] usb 2-1: not running at top speed; connect to a high speed hub [ 94.166353][ T2151] usb 2-1: config 1 has an invalid interface number: 130 but max is 0 [ 94.177161][ T2151] usb 2-1: config 1 has no interface number 0 [ 94.183296][ T2151] usb 2-1: config 1 interface 130 altsetting 3 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 94.194602][ T2151] usb 2-1: config 1 interface 130 has no altsetting 0 [ 94.203823][ T2151] usb 2-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice=84.ac [ 94.213320][ T2151] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.222130][ T2151] usb 2-1: Product: syz [ 94.226772][ T2151] usb 2-1: Manufacturer: syz [ 94.231440][ T2151] usb 2-1: SerialNumber: syz [ 94.245119][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 94.245445][ T6437] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 94.255204][ T24] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 94.270414][ T24] usb 3-1: config 0 has no interface number 0 [ 94.279364][ T24] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 94.290488][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.298910][ T24] usb 3-1: Product: syz [ 94.303138][ T24] usb 3-1: Manufacturer: syz [ 94.309285][ T24] usb 3-1: SerialNumber: syz [ 94.320088][ T24] usb 3-1: config 0 descriptor?? [ 94.332002][ T24] smsc95xx v2.0.0 [ 94.356237][ T6424] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 94.590110][ T5929] cdc_ncm 1-1:1.0: bind() failure [ 94.617386][ T5868] Bluetooth: hci1: command 0x0c1a tx timeout [ 94.704423][ T5868] Bluetooth: hci2: command 0x0c1a tx timeout [ 94.710549][ T5868] Bluetooth: hci0: command 0x0c1a tx timeout [ 94.784503][ T5873] Bluetooth: hci3: command 0x0c1a tx timeout [ 94.852842][ T24] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 94.881235][ T24] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 94.914677][ T24] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 94.957236][ T24] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 94.996589][ T24] usb 3-1: USB disconnect, device number 7 [ 95.322633][ T6454] mmap: syz.3.122 (6454): VmData 37597184 exceed data ulimit 9. Update limits or use boot option ignore_rlimit_data. [ 95.422739][ T5929] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 95.439417][ T6458] syzkaller1: entered promiscuous mode [ 95.444587][ T5929] cdc_ncm 1-1:1.1: bind() failure [ 95.457919][ T5929] usb 1-1: USB disconnect, device number 11 [ 95.470784][ T6458] syzkaller1: entered allmulticast mode [ 96.561826][ T6461] /dev/rnullb0: Can't open blockdev [ 96.600429][ T6461] /dev/rnullb0: Can't open blockdev [ 96.624420][ T5873] Bluetooth: hci1: command 0x0c1a tx timeout [ 96.732234][ T6466] syzkaller1: entered promiscuous mode [ 96.742381][ T6466] syzkaller1: entered allmulticast mode [ 96.771758][ T2151] dvb-usb: found a 'Gigabyte U7000' in cold state, will try to load a firmware [ 96.784863][ T5873] Bluetooth: hci2: command 0x0c1a tx timeout [ 96.810349][ T2151] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 96.829328][ T2151] dib0700: firmware download failed at 7 with -71 [ 96.855376][ T2151] usb 2-1: USB disconnect, device number 5 [ 96.875016][ T5873] Bluetooth: hci3: command 0x0c1a tx timeout [ 97.085233][ T5929] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 97.154323][ T2151] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 97.204325][ T5955] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 97.235940][ T5929] usb 1-1: unable to get BOS descriptor or descriptor too short [ 97.244118][ T5929] usb 1-1: not running at top speed; connect to a high speed hub [ 97.253253][ T5929] usb 1-1: config 10 has an invalid interface number: 50 but max is 0 [ 97.261589][ T5929] usb 1-1: config 10 has no interface number 0 [ 97.267976][ T5929] usb 1-1: config 10 interface 50 has no altsetting 0 [ 97.276786][ T5929] usb 1-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=43.2d [ 97.286029][ T2151] usb 2-1: device descriptor read/64, error -71 [ 97.292314][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.300442][ T5929] usb 1-1: Product: syz [ 97.304659][ T5929] usb 1-1: Manufacturer: syz [ 97.309247][ T5929] usb 1-1: SerialNumber: syz [ 97.357976][ T5955] usb 3-1: config 7 has an invalid interface number: 3 but max is 2 [ 97.366156][ T5955] usb 3-1: config 7 has an invalid descriptor of length 1, skipping remainder of the config [ 97.376460][ T5955] usb 3-1: config 7 has 1 interface, different from the descriptor's value: 3 [ 97.385398][ T5955] usb 3-1: config 7 has no interface number 0 [ 97.391501][ T5955] usb 3-1: config 7 interface 3 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 11 [ 97.405219][ T5955] usb 3-1: config 7 interface 3 has no altsetting 0 [ 97.413831][ T5955] usb 3-1: New USB device found, idVendor=19d2, idProduct=1432, bcdDevice=58.a8 [ 97.422965][ T5955] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.431053][ T5955] usb 3-1: Product: ၞ퀕쐐︽홹哰屏䀩쾲ᶈ䄍ﰮ͝⋟鲧ᣢ劼䃔ᛖ᠌宒鑌⍳凜昭䬫厰潈֊莙踂⺬愥佷于䂷빦餪璈탥擅氎⬟Ჯ鷈♙睬捨䯂뺛薻祋쿅曬錽읟⽄֛꩛ᓷˁ塚Ⲽ죬树祜ਗ਼뷢䚉⇅泥੠ꢸؑ舙떻谿栶涎➦뿵뫴砋͑ꠏ㜩㌽桥봖躖혐ൣ⯤卿菴ฆ鱪泌ം㓝ऄᐞ뉁햠ﵗ눷ῢ빌 [ 97.465375][ T5955] usb 3-1: Manufacturer: ૴楲᠟즪ﻌ熖僻뀧礥黱鼥㝗訸ꊦ˫ㅦ摀뻝哸嚭籆낥ɝ﷙፪௴㊏꟒熘ấ샡湝嵭⢔䍏둁住쏨區ꗕ紥ㆋ㌃瞭⌯⋱傭꥗⨙챵廍됚渪傚ꉬ⍿톇ׄ橭釮퇟뷄렅⇔邥/㭍丹鷣釋턯 [ 97.490258][ T5955] usb 3-1: SerialNumber: 、 [ 97.522250][ T5929] usbserial_generic 1-1:10.50: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 97.541159][ T5929] usbserial_generic 1-1:10.50: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 97.545777][ T6480] /dev/rnullb0: Can't open blockdev [ 97.552208][ T2151] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 97.568482][ T5929] usbserial_generic 1-1:10.50: device has no bulk endpoints [ 97.578669][ T5929] usb 1-1: USB disconnect, device number 12 [ 97.714423][ T2151] usb 2-1: device descriptor read/64, error -71 [ 97.826486][ T2151] usb usb2-port1: attempt power cycle [ 97.894895][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 98.054421][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 98.062371][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.073770][ T10] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 98.088168][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 98.098628][ T10] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 98.112123][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 98.121944][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.138044][ T10] usb 4-1: Product: syz [ 98.142286][ T10] usb 4-1: Manufacturer: syz [ 98.147421][ T10] usb 4-1: SerialNumber: syz [ 98.151634][ T6486] syzkaller1: entered promiscuous mode [ 98.157715][ T6486] syzkaller1: entered allmulticast mode [ 98.164432][ T2151] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 98.195190][ T2151] usb 2-1: device descriptor read/8, error -71 [ 98.365737][ T6482] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 98.366515][ T6490] /dev/rnullb0: Can't open blockdev [ 98.380667][ T6491] /dev/rnullb0: Can't open blockdev [ 98.423585][ T6494] /dev/rnullb0: Can't open blockdev [ 98.454462][ T2151] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 98.485531][ T2151] usb 2-1: device descriptor read/8, error -71 [ 98.512645][ T6499] /dev/rnullb0: Can't open blockdev [ 98.559211][ T6501] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 98.594957][ T2151] usb usb2-port1: unable to enumerate USB device [ 98.864317][ T43] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 98.975944][ T6482] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 99.014400][ T43] usb 1-1: Using ep0 maxpacket: 8 [ 99.021325][ T43] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 99.032643][ T43] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 99.042727][ T43] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 99.052756][ T43] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 99.065793][ T43] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 99.076103][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.184363][ T10] cdc_ncm 4-1:1.0: bind() failure [ 99.194820][ T10] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 99.201680][ T10] cdc_ncm 4-1:1.1: bind() failure [ 99.290109][ T6503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.298941][ T6503] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.309903][ T43] usb 1-1: GET_CAPABILITIES returned 0 [ 99.315766][ T43] usbtmc 1-1:16.0: can't read capabilities [ 99.389371][ T43] usb 4-1: USB disconnect, device number 11 [ 99.512140][ T6503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.520996][ T6503] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.682059][ T10] usb 1-1: USB disconnect, device number 13 [ 99.942411][ T5955] usb 3-1: USB disconnect, device number 8 [ 99.982168][ T6509] syzkaller1: entered promiscuous mode [ 99.998304][ T6509] syzkaller1: entered allmulticast mode [ 100.240175][ T6527] XFS (rnullb0): Invalid superblock magic number [ 100.517576][ T6549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.526177][ T5925] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 100.553478][ T6549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.578169][ T6552] syzkaller1: entered promiscuous mode [ 100.594596][ T6552] syzkaller1: entered allmulticast mode [ 100.660336][ T6557] /dev/rnullb0: Can't open blockdev [ 100.685182][ T5925] usb 1-1: device descriptor read/64, error -71 [ 100.692548][ T6536] XFS (rnullb0): Invalid superblock magic number [ 100.697917][ T6563] random: crng reseeded on system resumption [ 100.841430][ T6577] qnx4: no qnx4 filesystem (no root dir). [ 100.944286][ T5925] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 101.072442][ T6591] syzkaller1: entered promiscuous mode [ 101.078811][ T6591] syzkaller1: entered allmulticast mode [ 101.089081][ T5925] usb 1-1: device descriptor read/64, error -71 [ 101.159352][ T6593] nfs: Unknown parameter '' [ 101.187944][ T6593] NILFS (rnullb0): couldn't find nilfs on the device [ 101.208338][ T5925] usb usb1-port1: attempt power cycle [ 101.474059][ T30] audit: type=1326 audit(1755750376.280:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6600 comm="syz.1.169" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbee58ebe9 code=0x7fc00000 [ 101.496946][ T30] audit: type=1326 audit(1755750376.290:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6600 comm="syz.1.169" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbee58ebe9 code=0x7fc00000 [ 101.540620][ T6608] netlink: 36 bytes leftover after parsing attributes in process `syz.1.171'. [ 101.555355][ T5925] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 101.574308][ T2151] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 101.585986][ T5925] usb 1-1: device descriptor read/8, error -71 [ 101.724432][ T2151] usb 4-1: Using ep0 maxpacket: 32 [ 101.731718][ T2151] usb 4-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.00 [ 101.741385][ T2151] usb 4-1: New USB device strings: Mfr=0, Product=3, SerialNumber=0 [ 101.749476][ T2151] usb 4-1: Product: syz [ 101.757738][ T2151] usb 4-1: config 0 descriptor?? [ 101.834480][ T5925] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 101.855104][ T5925] usb 1-1: device descriptor read/8, error -71 [ 101.964508][ T5925] usb usb1-port1: unable to enumerate USB device [ 102.005641][ T5868] non-paged memory [ 102.009541][ T5868] list_del corruption, ffff88802d247e80->next is LIST_POISON1 (dead000000000100) [ 102.019614][ T5868] ------------[ cut here ]------------ [ 102.025174][ T5868] kernel BUG at lib/list_debug.c:58! [ 102.030723][ T5868] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 102.036994][ T5868] CPU: 1 UID: 0 PID: 5868 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 102.046470][ T5868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 102.056564][ T5868] Workqueue: hci3 hci_conn_timeout [ 102.061716][ T5868] RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 [ 102.068766][ T5868] Code: 80 ed 04 8c 48 89 de e8 b0 bd 4c fc 90 0f 0b 4c 89 e7 e8 b5 c0 27 fd 48 c7 c7 e0 ed 04 8c 48 89 de 4c 89 e2 e8 93 bd 4c fc 90 <0f> 0b 4c 89 e7 e8 98 c0 27 fd 48 c7 c7 40 ee 04 8c 48 89 de 4c 89 [ 102.088399][ T5868] RSP: 0018:ffffc90003fe7980 EFLAGS: 00010246 [ 102.094485][ T5868] RAX: 000000000000004e RBX: ffff88802d247e80 RCX: 360abbd55ccdca00 [ 102.102461][ T5868] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 102.110441][ T5868] RBP: ffffffff8a92b720 R08: 0000000000000003 R09: 0000000000000004 [ 102.118420][ T5868] R10: dffffc0000000000 R11: fffffbfff1c7a1ec R12: dead000000000100 [ 102.126399][ T5868] R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 [ 102.134378][ T5868] FS: 0000000000000000(0000) GS:ffff8881258cc000(0000) knlGS:0000000000000000 [ 102.143316][ T5868] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.149906][ T5868] CR2: 000000110c35f143 CR3: 000000007ea96000 CR4: 00000000003526f0 [ 102.158161][ T5868] Call Trace: [ 102.161439][ T5868] [ 102.164375][ T5868] hci_cmd_sync_dequeue_once+0x24a/0x370 [ 102.170021][ T5868] hci_cancel_connect_sync+0xc8/0x120 [ 102.175403][ T5868] hci_abort_conn+0x191/0x330 [ 102.180097][ T5868] ? process_scheduled_works+0x9ef/0x17b0 [ 102.185868][ T5868] process_scheduled_works+0xade/0x17b0 [ 102.191439][ T5868] ? __pfx_process_scheduled_works+0x10/0x10 [ 102.197439][ T5868] worker_thread+0x8a0/0xda0 [ 102.202052][ T5868] kthread+0x70e/0x8a0 [ 102.206129][ T5868] ? __pfx_worker_thread+0x10/0x10 [ 102.212125][ T5868] ? __pfx_kthread+0x10/0x10 [ 102.216718][ T5868] ? rcu_is_watching+0x15/0xb0 [ 102.221496][ T5868] ? __pfx_kthread+0x10/0x10 [ 102.226089][ T5868] ret_from_fork+0x3f9/0x770 [ 102.230698][ T5868] ? __pfx_ret_from_fork+0x10/0x10 [ 102.235829][ T5868] ? __switch_to_asm+0x39/0x70 [ 102.240598][ T5868] ? __switch_to_asm+0x33/0x70 [ 102.245448][ T5868] ? __pfx_kthread+0x10/0x10 [ 102.250065][ T5868] ret_from_fork_asm+0x1a/0x30 [ 102.254882][ T5868] [ 102.257924][ T5868] Modules linked in: [ 102.261886][ C1] vkms_vblank_simulate: vblank timer overrun [ 102.268822][ T5868] ---[ end trace 0000000000000000 ]--- [ 102.276393][ T5868] RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 [ 102.283463][ T5868] Code: 80 ed 04 8c 48 89 de e8 b0 bd 4c fc 90 0f 0b 4c 89 e7 e8 b5 c0 27 fd 48 c7 c7 e0 ed 04 8c 48 89 de 4c 89 e2 e8 93 bd 4c fc 90 <0f> 0b 4c 89 e7 e8 98 c0 27 fd 48 c7 c7 40 ee 04 8c 48 89 de 4c 89 [ 102.303143][ C1] vkms_vblank_simulate: vblank timer overrun [ 102.309326][ T5868] RSP: 0018:ffffc90003fe7980 EFLAGS: 00010246 [ 102.315495][ T5868] RAX: 000000000000004e RBX: ffff88802d247e80 RCX: 360abbd55ccdca00 [ 102.323522][ T5868] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 102.331641][ T5868] RBP: ffffffff8a92b720 R08: 0000000000000003 R09: 0000000000000004 [ 102.339709][ T5868] R10: dffffc0000000000 R11: fffffbfff1c7a1ec R12: dead000000000100 [ 102.347843][ T5868] R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 [ 102.355931][ T5868] FS: 0000000000000000(0000) GS:ffff8881258cc000(0000) knlGS:0000000000000000 [ 102.364934][ T5868] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.371577][ T5868] CR2: 000000110c35f143 CR3: 0000000078988000 CR4: 00000000003526f0 [ 102.379689][ T5868] Kernel panic - not syncing: Fatal exception [ 102.386086][ T5868] Kernel Offset: disabled [ 102.390427][ T5868] Rebooting in 86400 seconds..