08000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:14:58 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:14:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:14:58 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 663.290474][ T1195] Bluetooth: hci1: command 0x040f tx timeout [ 663.298933][T10864] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 663.344453][T10865] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 663.621245][ T1195] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 663.776165][T10877] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 663.954071][ T26] audit: type=1800 audit(1681596899.501:1840): pid=10879 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1180 res=0 errno=0 [ 663.978480][T10864] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 664.003344][T10865] bond3 (unregistering): Released all slaves [ 664.023065][ T26] audit: type=1804 audit(1681596899.531:1841): pid=10880 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/180/file0" dev="sda1" ino=1180 res=1 errno=0 [ 664.052546][T10877] bond23 (unregistering): Released all slaves 22:14:59 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000040002800800", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:14:59 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:14:59 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 664.152220][ T26] audit: type=1804 audit(1681596899.531:1842): pid=10881 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/180/file0" dev="sda1" ino=1180 res=1 errno=0 [ 664.180741][ T1195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 664.211796][T10885] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 664.222202][ T26] audit: type=1804 audit(1681596899.611:1843): pid=10880 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/180/file0" dev="sda1" ino=1180 res=1 errno=0 [ 664.501568][ T1195] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 664.624482][ T1195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.895055][ T1195] usb 5-1: Product: syz [ 664.910049][ T1195] usb 5-1: Manufacturer: syz [ 664.914946][ T1195] usb 5-1: SerialNumber: syz 22:15:00 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000040002800800", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 664.943693][T10893] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 664.970192][ T4017] usb 6-1: new high-speed USB device number 32 using dummy_hcd 22:15:00 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 665.031526][T10895] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 665.064952][T10896] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 665.102333][T10898] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 665.380430][ T3688] Bluetooth: hci1: command 0x0419 tx timeout [ 665.793136][T10893] bond23 (unregistering): Released all slaves [ 665.832050][T10902] bond4 (unregistering): Released all slaves 22:15:01 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 665.935042][T10909] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 665.943472][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 665.966448][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 665.992345][ T4017] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 666.040048][T10910] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 666.049798][ T4017] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 666.063305][T10909] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 666.073188][T10909] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 666.116726][T10910] bond23 (unregistering): Released all slaves [ 666.220105][ T1195] cdc_ncm 5-1:1.0: failed to get mac address [ 666.240209][ T1195] cdc_ncm 5-1:1.0: bind() failure [ 666.240237][ T4017] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 666.257640][ T4017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.266417][ T4017] usb 6-1: Product: syz [ 666.270017][ T1195] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 666.270785][ T4017] usb 6-1: Manufacturer: syz [ 666.282548][ T4017] usb 6-1: SerialNumber: syz [ 666.290228][ T1195] cdc_mbim: probe of 5-1:1.1 failed with error -71 22:15:01 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:01 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:01 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:01 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 666.320104][ T1195] usbtest: probe of 5-1:1.1 failed with error -71 [ 666.329227][ T1195] usb 5-1: USB disconnect, device number 66 [ 666.330076][ T4017] usb 6-1: can't set config #1, error -71 [ 666.379086][ T4017] usb 6-1: USB disconnect, device number 32 [ 666.403682][T10920] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:02 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 667.084809][ T26] audit: type=1804 audit(1681596902.641:1844): pid=10930 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/181/file0" dev="sda1" ino=1182 res=1 errno=0 [ 667.127472][T10929] bond4 (unregistering): Released all slaves 22:15:02 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 667.152998][ T26] audit: type=1804 audit(1681596902.641:1845): pid=10926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/181/file0" dev="sda1" ino=1182 res=1 errno=0 [ 667.225217][T10920] bond23 (unregistering): Released all slaves [ 667.234978][ T26] audit: type=1804 audit(1681596902.641:1846): pid=10934 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/181/file0" dev="sda1" ino=1182 res=1 errno=0 [ 667.278474][ T26] audit: type=1804 audit(1681596902.771:1847): pid=10930 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/181/file0" dev="sda1" ino=1182 res=1 errno=0 [ 667.594421][ T3725] usb 5-1: new high-speed USB device number 67 using dummy_hcd 22:15:03 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:03 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 668.019920][ T4017] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 668.052839][T10946] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:03 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 668.144767][T10949] bond4 (unregistering): Released all slaves [ 668.170892][ T3725] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 668.438856][T10946] bond23 (unregistering): Released all slaves [ 668.580767][ T3725] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 668.698244][ T3725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 22:15:04 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 668.846331][ T3725] usb 5-1: Product: syz [ 668.851188][ T3725] usb 5-1: Manufacturer: syz [ 668.864870][ T3725] usb 5-1: SerialNumber: syz [ 668.899199][T10956] __nla_validate_parse: 8 callbacks suppressed [ 668.899215][T10956] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:15:04 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 668.970643][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 669.002105][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 669.012335][ T4017] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 669.022998][ T4017] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 669.033519][T10958] bond4 (unregistering): Released all slaves [ 669.078634][T10960] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 669.151276][T10961] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 669.177557][T10963] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 669.190144][ T4017] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 669.199738][ T4017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.220400][ T4017] usb 6-1: Product: syz [ 669.221274][T10963] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 669.224621][ T4017] usb 6-1: Manufacturer: syz [ 669.224639][ T4017] usb 6-1: SerialNumber: syz [ 669.293911][T10960] bond23 (unregistering): Released all slaves 22:15:04 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:04 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:04 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 669.420189][ T4017] cdc_ncm 6-1:1.0: bind() failure [ 669.428904][ T4017] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 669.437409][T10967] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 669.466939][ T4017] cdc_ncm 6-1:1.1: bind() failure 22:15:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:05 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 670.136030][ T4017] usb 6-1: USB disconnect, device number 33 [ 670.182348][T10975] bond4 (unregistering): Released all slaves [ 670.220974][T10978] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 670.287028][T10981] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 670.314567][ T26] audit: type=1800 audit(1681596905.871:1848): pid=10985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1156 res=0 errno=0 [ 670.337025][ T3725] cdc_ncm 5-1:1.0: failed to get mac address [ 670.367316][ T3725] cdc_ncm 5-1:1.0: bind() failure [ 670.378018][T10984] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 670.401163][ T26] audit: type=1804 audit(1681596905.901:1849): pid=10985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/182/file0" dev="sda1" ino=1156 res=1 errno=0 [ 670.428978][ T3725] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 670.440228][T10984] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 670.470057][ T3725] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 670.481412][T10978] bond23 (unregistering): Released all slaves [ 670.490079][ T3725] usbtest: probe of 5-1:1.1 failed with error -71 [ 670.498899][ T26] audit: type=1804 audit(1681596905.901:1850): pid=10985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/182/file0" dev="sda1" ino=1156 res=1 errno=0 [ 670.519923][ T4017] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 670.541276][ T3725] usb 5-1: USB disconnect, device number 67 [ 670.585131][ T26] audit: type=1804 audit(1681596906.011:1851): pid=10987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/182/file0" dev="sda1" ino=1156 res=1 errno=0 22:15:06 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, 0x0}, 0x0) 22:15:06 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:06 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:06 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 670.852686][T10993] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 670.911450][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 670.986206][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 671.042076][T10994] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 671.055314][ T4017] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 671.090433][ T4017] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 671.112016][T11000] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. [ 671.137602][T11001] bond4 (unregistering): Released all slaves [ 671.191504][T10993] bond23 (unregistering): Released all slaves 22:15:06 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 671.280124][ T4017] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 671.289466][ T3686] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 671.303482][ T4017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.323509][ T4017] usb 6-1: Product: syz [ 671.332780][ T4017] usb 6-1: Manufacturer: syz [ 671.343640][ T4017] usb 6-1: SerialNumber: syz 22:15:06 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100626174616476000004000280", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 671.387494][T11005] bond4 (unregistering): Released all slaves [ 671.458485][T11010] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 671.502830][T11010] bond23 (unregistering): Released all slaves [ 671.564615][ T26] audit: type=1800 audit(1681596907.121:1852): pid=11013 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1153 res=0 errno=0 [ 671.595308][ T26] audit: type=1804 audit(1681596907.141:1853): pid=11013 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/183/file0" dev="sda1" ino=1153 res=1 errno=0 [ 671.621463][ T26] audit: type=1804 audit(1681596907.151:1854): pid=11013 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/183/file0" dev="sda1" ino=1153 res=1 errno=0 [ 671.650218][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 671.719898][ T26] audit: type=1804 audit(1681596907.261:1855): pid=11014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/183/file0" dev="sda1" ino=1153 res=1 errno=0 [ 671.830744][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 671.848761][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.872010][ T3686] usb 5-1: Product: syz [ 671.883581][ T3686] usb 5-1: Manufacturer: syz [ 671.897345][ T3686] usb 5-1: SerialNumber: syz [ 672.510027][ T4017] cdc_ncm 6-1:1.0: bind() failure [ 672.540012][ T4017] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 672.560017][ T4017] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 672.580077][ T4017] usbtest: probe of 6-1:1.1 failed with error -71 [ 672.593513][ T4017] usb 6-1: USB disconnect, device number 34 22:15:08 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:08 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:08 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100626174616476000004000280", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:08 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 673.055592][T11023] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 673.070063][ T3686] cdc_ncm 5-1:1.0: failed to get mac address [ 673.083546][T11020] bond4 (unregistering): Released all slaves [ 673.102176][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 673.146218][T11023] bond23 (unregistering): Released all slaves [ 673.154408][ T26] audit: type=1800 audit(1681596908.721:1856): pid=11029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 673.163166][ T3686] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 673.197506][ T26] audit: type=1804 audit(1681596908.721:1857): pid=11029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/184/file0" dev="sda1" ino=1181 res=1 errno=0 [ 673.250144][ T3686] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 673.285427][ T3686] usbtest: probe of 5-1:1.1 failed with error -71 [ 673.321031][ T3686] usb 5-1: USB disconnect, device number 68 [ 673.380162][ T4017] usb 6-1: new high-speed USB device number 35 using dummy_hcd 22:15:09 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100626174616476000004000280", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:09 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, 0x0}, 0x0) [ 673.565251][T11034] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 673.700625][T11038] bond4 (unregistering): Released all slaves [ 673.750234][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 673.768386][ T4017] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 673.791443][ T4017] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 22:15:09 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 673.823894][ T4017] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 673.848657][ T4017] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 673.900219][T11034] __nla_validate_parse: 12 callbacks suppressed [ 673.900237][T11034] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 673.956011][T11037] bond23 (unregistering): Released all slaves 22:15:09 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 674.040789][ T3686] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 674.050110][ T4017] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 674.064259][ T4017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.086353][ T4017] usb 6-1: Product: syz 22:15:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000040002800800", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 674.096362][ T4017] usb 6-1: Manufacturer: syz [ 674.111439][ T4017] usb 6-1: SerialNumber: syz [ 674.119070][T11046] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 674.192794][T11049] bond4 (unregistering): Released all slaves [ 674.213987][T11050] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:09 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 674.267374][T11052] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 674.344633][T11050] bond23 (unregistering): Released all slaves [ 674.389524][T11054] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 674.420104][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 674.459148][T11056] bond4 (unregistering): Released all slaves [ 674.600615][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 674.610510][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.619789][ T3686] usb 5-1: Product: syz [ 674.624929][ T3686] usb 5-1: Manufacturer: syz [ 674.629793][ T3686] usb 5-1: SerialNumber: syz [ 675.280059][ T4017] cdc_ncm 6-1:1.0: bind() failure [ 675.310266][ T4017] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 675.340347][ T4017] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 675.360198][ T4017] usbtest: probe of 6-1:1.1 failed with error -71 [ 675.378308][ T4017] usb 6-1: USB disconnect, device number 35 22:15:11 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:11 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:11 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000040002800800", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:11 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 675.797832][T11062] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 675.800165][ T3686] cdc_ncm 5-1:1.0: failed to get mac address [ 675.846892][T11059] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 675.860031][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 675.880171][ T3686] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 675.920707][ T3686] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 675.968320][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 675.968406][ T26] audit: type=1800 audit(1681596911.501:1860): pid=11072 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 676.261293][ T3686] usbtest: probe of 5-1:1.1 failed with error -71 22:15:12 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, 0x0}, 0x0) [ 676.562254][ T3686] usb 5-1: USB disconnect, device number 69 [ 676.575719][ T26] audit: type=1804 audit(1681596911.511:1861): pid=11072 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/185/file0" dev="sda1" ino=1178 res=1 errno=0 [ 676.622376][ T26] audit: type=1804 audit(1681596911.511:1862): pid=11072 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/185/file0" dev="sda1" ino=1178 res=1 errno=0 [ 676.648494][T11062] bond4 (unregistering): Released all slaves 22:15:12 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:12 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 676.650208][ T26] audit: type=1804 audit(1681596912.091:1863): pid=11073 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/185/file0" dev="sda1" ino=1178 res=1 errno=0 [ 676.689452][ T3688] usb 6-1: new high-speed USB device number 36 using dummy_hcd 22:15:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 676.733675][T11069] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 676.759181][T11075] bond23 (unregistering): Released all slaves [ 676.908068][ T26] audit: type=1800 audit(1681596912.451:1864): pid=11084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1159 res=0 errno=0 [ 677.220746][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 677.346013][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 22:15:13 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000040002800800", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 677.431101][ T26] audit: type=1804 audit(1681596912.451:1865): pid=11084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/186/file0" dev="sda1" ino=1159 res=1 errno=0 [ 677.451350][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 677.458223][T11088] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 677.469177][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 677.486997][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 677.497529][ T26] audit: type=1804 audit(1681596912.461:1866): pid=11084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/186/file0" dev="sda1" ino=1159 res=1 errno=0 22:15:13 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:13 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 677.537627][T11091] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 677.537724][ T26] audit: type=1804 audit(1681596912.701:1867): pid=11086 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/186/file0" dev="sda1" ino=1159 res=1 errno=0 [ 677.620079][ T3686] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 677.673343][T11088] bond4 (unregistering): Released all slaves [ 677.694358][T11093] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 677.713739][T11091] bond23 (unregistering): Released all slaves [ 677.860875][ T26] audit: type=1800 audit(1681596913.361:1868): pid=11101 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1174 res=0 errno=0 [ 677.882739][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 678.000572][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 678.270865][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 678.344933][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.348196][ T26] audit: type=1804 audit(1681596913.361:1869): pid=11101 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/187/file0" dev="sda1" ino=1174 res=1 errno=0 [ 678.353226][ T3688] usb 6-1: Product: syz [ 678.383221][ T3688] usb 6-1: Manufacturer: syz [ 678.387945][ T3688] usb 6-1: SerialNumber: syz [ 678.408783][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.437973][ T3686] usb 5-1: Product: syz [ 678.463464][ T3686] usb 5-1: Manufacturer: syz [ 678.468506][ T3686] usb 5-1: SerialNumber: syz [ 679.530426][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 679.550119][ T3688] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 679.570088][ T3688] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 679.590050][ T3688] usbtest: probe of 6-1:1.1 failed with error -71 [ 679.599374][ T3688] usb 6-1: USB disconnect, device number 36 [ 679.660168][ T3686] cdc_ncm 5-1:1.0: failed to get mac address [ 679.683114][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 679.710127][ T3686] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 679.730056][ T3686] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 679.770930][ T3686] usbtest: probe of 5-1:1.1 failed with error -71 [ 679.793750][ T3686] usb 5-1: USB disconnect, device number 70 22:15:15 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:15 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c000000100001040000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:15 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:15 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:15 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 680.041928][T11111] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 680.070850][T11106] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 680.507162][T11111] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 680.544026][T11106] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:15:16 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, 0x0}, 0x0) 22:15:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c000000100001040000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 680.584553][T11122] bond4 (unregistering): Released all slaves [ 680.614610][T11106] bond23 (unregistering): Released all slaves [ 680.660285][ T3688] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 680.681284][T11127] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:15:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 680.744021][T11127] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 680.779644][T11127] bond4 (unregistering): Released all slaves [ 680.803169][T11130] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 680.837464][T11130] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:15:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c000000100001040000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:16 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:16 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 680.897874][T11130] bond23 (unregistering): Released all slaves [ 680.910096][ T3725] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 680.925798][T11133] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 681.004600][T11136] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 681.018539][T11133] bond4 (unregistering): Released all slaves 22:15:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 681.378162][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 681.378184][ T26] audit: type=1800 audit(1681596916.921:1876): pid=11143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1157 res=0 errno=0 [ 681.407598][ T26] audit: type=1804 audit(1681596916.931:1877): pid=11143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/189/file0" dev="sda1" ino=1157 res=1 errno=0 [ 681.434410][ T26] audit: type=1804 audit(1681596916.931:1878): pid=11143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/189/file0" dev="sda1" ino=1157 res=1 errno=0 [ 681.521314][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 681.546852][ T26] audit: type=1804 audit(1681596917.101:1879): pid=11144 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/189/file0" dev="sda1" ino=1157 res=1 errno=0 [ 681.557077][T11147] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 681.590674][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 681.612253][T11149] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 681.630741][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 681.655451][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 681.668248][T11147] bond23 (unregistering): Released all slaves [ 681.675867][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 681.687169][ T3725] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 681.870208][ T3725] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 681.879515][ T3725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.900423][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 681.909798][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.918478][ T3725] usb 5-1: Product: syz [ 681.922937][ T3725] usb 5-1: Manufacturer: syz [ 681.927632][ T3725] usb 5-1: SerialNumber: syz [ 681.932736][ T3688] usb 6-1: Product: syz [ 681.937081][ T3688] usb 6-1: Manufacturer: syz [ 681.952048][ T3688] usb 6-1: SerialNumber: syz [ 683.090175][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 683.120882][ T3688] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 683.140071][ T3725] cdc_ncm 5-1:1.0: failed to get mac address [ 683.146429][ T3688] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 683.170046][ T3725] cdc_ncm 5-1:1.0: bind() failure [ 683.175332][ T3688] usbtest: probe of 6-1:1.1 failed with error -71 [ 683.198090][ T3688] usb 6-1: USB disconnect, device number 37 [ 683.204278][ T3725] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 683.230703][ T3725] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 683.250108][ T3725] usbtest: probe of 5-1:1.1 failed with error -71 [ 683.266931][ T3725] usb 5-1: USB disconnect, device number 71 22:15:19 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:19 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:19 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, 0x0}, 0x0) [ 683.634257][T11156] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 683.664235][T11157] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 684.069248][ T26] audit: type=1800 audit(1681596919.441:1880): pid=11165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 [ 684.142316][ T26] audit: type=1804 audit(1681596919.541:1881): pid=11165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/190/file0" dev="sda1" ino=1175 res=1 errno=0 [ 684.169561][T11169] bond23 (unregistering): Released all slaves [ 684.189796][ T26] audit: type=1804 audit(1681596919.611:1882): pid=11165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/190/file0" dev="sda1" ino=1175 res=1 errno=0 [ 684.215319][ T26] audit: type=1804 audit(1681596919.671:1883): pid=11165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/190/file0" dev="sda1" ino=1175 res=1 errno=0 22:15:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 684.242720][T11168] bond4 (unregistering): Released all slaves 22:15:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 684.314959][T11172] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 684.355086][T11172] bond23 (unregistering): Released all slaves [ 684.370402][ T1065] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 684.396459][T11175] bond4 (unregistering): Released all slaves [ 684.409954][ T3725] usb 5-1: new high-speed USB device number 72 using dummy_hcd 22:15:20 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r1, 0x0, 0xffffffff054) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r3, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:20 executing program 1: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 684.591345][T11181] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 684.637823][T11181] bond23 (unregistering): Released all slaves [ 684.667150][T11183] bond4 (unregistering): Released all slaves [ 684.701696][ T26] audit: type=1800 audit(1681596920.261:1884): pid=11189 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1167 res=0 errno=0 [ 684.733684][ T26] audit: type=1804 audit(1681596920.261:1885): pid=11189 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/191/file0" dev="sda1" ino=1167 res=1 errno=0 [ 684.790150][ T3725] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 684.812221][ T1065] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 684.831660][ T1065] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 684.849618][ T1065] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 684.970340][ T3725] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 684.979411][ T3725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.003198][ T3725] usb 5-1: Product: syz [ 685.013545][ T3725] usb 5-1: Manufacturer: syz [ 685.026057][ T3725] usb 5-1: SerialNumber: syz [ 685.070119][ T1065] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 685.082655][ T1065] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.100960][ T1065] usb 6-1: Product: syz [ 685.109654][ T1065] usb 6-1: Manufacturer: syz [ 685.119046][ T1065] usb 6-1: SerialNumber: syz [ 685.611795][ T1376] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.618113][ T1376] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.810030][ T1065] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 685.816102][ T1065] cdc_ncm 6-1:1.0: bind() failure [ 685.824376][ T1065] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 685.831506][ T1065] cdc_ncm 6-1:1.1: bind() failure [ 685.840300][ T1065] usb 6-1: USB disconnect, device number 38 [ 686.210035][ T3725] cdc_ncm 5-1:1.0: failed to get mac address [ 686.230013][ T3725] cdc_ncm 5-1:1.0: bind() failure [ 686.258175][ T3725] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 686.280732][ T3725] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 686.300025][ T3725] usbtest: probe of 5-1:1.1 failed with error -71 22:15:21 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:21 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r1, 0x0, 0xffffffff054) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r3, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:21 executing program 1: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 686.309369][ T3725] usb 5-1: USB disconnect, device number 72 [ 686.349449][T11194] __nla_validate_parse: 11 callbacks suppressed [ 686.349468][T11194] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 686.455837][T11198] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 686.465658][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 686.465671][ T26] audit: type=1800 audit(1681596922.031:1888): pid=11206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1168 res=0 errno=0 [ 686.503959][T11200] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 686.530267][ T26] audit: type=1804 audit(1681596922.031:1889): pid=11206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/192/file0" dev="sda1" ino=1168 res=1 errno=0 [ 686.555907][T11204] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 686.572067][T11194] bond4 (unregistering): Released all slaves [ 686.591833][T11208] bond23 (unregistering): Released all slaves [ 686.600150][ T26] audit: type=1804 audit(1681596922.031:1890): pid=11206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/192/file0" dev="sda1" ino=1168 res=1 errno=0 [ 686.625924][ T26] audit: type=1804 audit(1681596922.131:1891): pid=11209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/192/file0" dev="sda1" ino=1168 res=1 errno=0 [ 686.691150][ T2922] usb 6-1: new high-speed USB device number 39 using dummy_hcd 22:15:22 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, 0x0}, 0x0) 22:15:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r1, 0x0, 0xffffffff054) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r3, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 686.803518][T11215] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 686.891153][T11213] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 686.918079][T11219] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 687.046008][T11221] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 687.563843][T11215] bond4 (unregistering): Released all slaves [ 687.612128][T11213] bond23 (unregistering): Released all slaves 22:15:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:23 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 687.700518][ T2922] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 687.711666][ T3686] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 687.729371][ T2922] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 687.760123][ T2922] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 687.793520][T11228] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 688.105215][T11228] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 688.550146][ T2922] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 688.559231][ T2922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.580132][ T2922] usb 6-1: Product: syz [ 688.584415][ T2922] usb 6-1: Manufacturer: syz [ 688.589018][ T2922] usb 6-1: SerialNumber: syz [ 688.740514][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 688.920069][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 688.929363][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.938067][ T3686] usb 5-1: Product: syz [ 688.942882][ T3686] usb 5-1: Manufacturer: syz [ 688.947644][ T3686] usb 5-1: SerialNumber: syz [ 689.310051][ T2922] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 689.316264][ T2922] cdc_ncm 6-1:1.0: bind() failure [ 689.325641][ T2922] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 689.332881][ T2922] cdc_ncm 6-1:1.1: bind() failure [ 689.342020][ T2922] usb 6-1: USB disconnect, device number 39 22:15:25 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:25 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:25 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:25 executing program 1: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 689.840792][T11239] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 689.875963][T11242] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 690.270159][ T3688] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 690.538520][ T26] audit: type=1800 audit(1681596926.091:1892): pid=11254 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1176 res=0 errno=0 [ 690.560756][ T26] audit: type=1804 audit(1681596926.091:1893): pid=11256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/193/file0" dev="sda1" ino=1176 res=1 errno=0 [ 690.562268][T11239] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 690.596954][ T3686] cdc_ncm 5-1:1.0: failed to get mac address [ 690.604858][ T26] audit: type=1804 audit(1681596926.161:1894): pid=11259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/193/file0" dev="sda1" ino=1176 res=1 errno=0 [ 690.630162][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 690.638769][T11242] bond23 (unregistering): Released all slaves [ 690.690965][ T3686] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 690.709596][ T26] audit: type=1804 audit(1681596926.261:1895): pid=11256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/193/file0" dev="sda1" ino=1176 res=1 errno=0 [ 690.720263][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 690.735769][ T3686] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 690.771453][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 690.790084][ T3686] usbtest: probe of 5-1:1.1 failed with error -71 [ 690.796777][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 690.842556][ T3686] usb 5-1: USB disconnect, device number 73 22:15:26 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:26 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) getpid() sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 690.952148][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 690.974910][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.000196][ T3688] usb 6-1: Product: syz [ 691.011184][ T3688] usb 6-1: Manufacturer: syz [ 691.072959][ T3688] usb 6-1: SerialNumber: syz [ 691.086173][T11265] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 691.184101][T11263] bond6 (unregistering): Released all slaves [ 691.246518][T11273] bond23 (unregistering): Released all slaves 22:15:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 691.373730][T11276] __nla_validate_parse: 4 callbacks suppressed [ 691.373749][T11276] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 691.410012][ T3686] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 691.474061][T11277] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 691.484314][T11280] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 691.530633][T11276] bond6 (unregistering): Released all slaves [ 691.577740][T11282] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 691.599682][T11280] bond23 (unregistering): Released all slaves 22:15:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 691.776201][T11284] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 691.820125][ T3688] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 691.826545][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 691.840243][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 691.865712][ T3688] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 691.884133][ T3688] cdc_ncm 6-1:1.1: bind() failure [ 691.895975][T11286] 8021q: adding VLAN 0 to HW filter on device batadv24 [ 691.919459][ T3688] usb 6-1: USB disconnect, device number 40 [ 691.935161][T11286] bond6: (slave batadv24): Enslaving as an active interface with an up link [ 692.040274][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 692.049790][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.073473][ T3686] usb 5-1: Product: syz [ 692.082169][ T3686] usb 5-1: Manufacturer: syz [ 692.091339][ T3686] usb 5-1: SerialNumber: syz 22:15:27 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:27 executing program 1: prlimit64(0x0, 0x0, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:27 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:27 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) getpid() sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 692.336750][T11292] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 692.373237][T11295] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 692.417479][T11292] 8021q: adding VLAN 0 to HW filter on device batadv25 [ 692.447068][ T26] audit: type=1800 audit(1681596928.001:1896): pid=11303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1180 res=0 errno=0 [ 692.493033][T11292] bond7: (slave batadv25): Enslaving as an active interface with an up link [ 692.531154][T11295] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 692.547599][ T26] audit: type=1804 audit(1681596928.031:1897): pid=11303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/194/file0" dev="sda1" ino=1180 res=1 errno=0 [ 692.595937][T11301] bond23 (unregistering): Released all slaves [ 692.630091][ T3688] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 692.684173][ T26] audit: type=1804 audit(1681596928.041:1898): pid=11303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/194/file0" dev="sda1" ino=1180 res=1 errno=0 [ 692.793775][ T26] audit: type=1804 audit(1681596928.161:1899): pid=11303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/194/file0" dev="sda1" ino=1180 res=1 errno=0 [ 692.990135][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 693.013975][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 693.047834][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 693.230188][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 693.242715][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.260058][ T3686] cdc_ncm 5-1:1.0: failed to get mac address [ 693.268875][ T3688] usb 6-1: Product: syz [ 693.277919][ T3688] usb 6-1: Manufacturer: syz [ 693.288284][ T3688] usb 6-1: SerialNumber: syz [ 693.290028][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 693.340058][ T3686] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 693.360024][ T3686] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 693.392491][ T3686] usbtest: probe of 5-1:1.1 failed with error -71 [ 693.417682][ T3686] usb 5-1: USB disconnect, device number 74 22:15:29 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) 22:15:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:29 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) getpid() sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:29 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c000000100001040000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 693.791095][T11308] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 693.839411][T11310] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) [ 693.921939][T11308] 8021q: adding VLAN 0 to HW filter on device batadv26 [ 693.930978][T11308] bond8: (slave batadv26): Enslaving as an active interface with an up link [ 693.940042][T11317] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 693.949583][T11320] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 694.011558][ T3688] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 694.017650][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 694.019416][T11323] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 694.032451][ T3688] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 694.032487][ T3688] cdc_ncm 6-1:1.1: bind() failure [ 694.036937][ T3688] usb 6-1: USB disconnect, device number 41 22:15:29 executing program 1: prlimit64(0x0, 0x0, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 694.073168][T11310] bond23 (unregistering): Released all slaves [ 694.080085][ T3686] usb 5-1: new high-speed USB device number 75 using dummy_hcd 22:15:29 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c000000100001040000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 694.190985][T11323] 8021q: adding VLAN 0 to HW filter on device batadv27 [ 694.214671][T11323] bond9: (slave batadv27): Enslaving as an active interface with an up link [ 694.277320][ T26] audit: type=1800 audit(1681596929.831:1900): pid=11329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1162 res=0 errno=0 [ 694.319950][ T26] audit: type=1804 audit(1681596929.861:1901): pid=11329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/195/file0" dev="sda1" ino=1162 res=1 errno=0 [ 694.345727][ T26] audit: type=1804 audit(1681596929.861:1902): pid=11329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/195/file0" dev="sda1" ino=1162 res=1 errno=0 [ 694.391461][T11332] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 694.409306][ T26] audit: type=1804 audit(1681596929.961:1903): pid=11330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/195/file0" dev="sda1" ino=1162 res=1 errno=0 22:15:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) 22:15:30 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 694.510022][T11335] bond23 (unregistering): Released all slaves [ 694.520184][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 694.653159][T11337] 8021q: adding VLAN 0 to HW filter on device batadv28 [ 694.691420][T11337] bond10: (slave batadv28): Enslaving as an active interface with an up link 22:15:30 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c000000100001040000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) [ 694.750023][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 694.762992][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 694.778124][ T3686] usb 5-1: Product: syz [ 694.786167][ T3686] usb 5-1: Manufacturer: syz [ 694.791119][ T3686] usb 5-1: SerialNumber: syz [ 694.854304][T11344] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 694.890107][ T3688] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 694.977268][T11348] 8021q: adding VLAN 0 to HW filter on device batadv29 [ 695.005394][T11348] bond11: (slave batadv29): Enslaving as an active interface with an up link [ 695.045230][T11351] bond23 (unregistering): Released all slaves 22:15:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 695.247324][T11353] 8021q: adding VLAN 0 to HW filter on device batadv30 [ 695.250210][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 695.273166][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 695.275935][T11353] bond12: (slave batadv30): Enslaving as an active interface with an up link [ 695.293116][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 695.470227][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 695.482433][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.490846][ T3688] usb 6-1: Product: syz [ 695.495190][ T3688] usb 6-1: Manufacturer: syz [ 695.501100][ T3688] usb 6-1: SerialNumber: syz [ 695.720091][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 695.728347][ T3686] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 695.735507][ T3686] cdc_ncm 5-1:1.1: bind() failure [ 695.744504][ T3686] usb 5-1: USB disconnect, device number 75 22:15:31 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) 22:15:31 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:31 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:31 executing program 1: prlimit64(0x0, 0x0, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:31 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 696.210115][ T3688] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 696.250278][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 696.282923][T11363] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 696.304125][ T3688] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 696.359758][ T3688] cdc_ncm 6-1:1.1: bind() failure [ 696.366833][ T26] audit: type=1800 audit(1681596931.931:1904): pid=11375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 696.392493][T11369] __nla_validate_parse: 8 callbacks suppressed [ 696.392510][T11369] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 696.444328][ T3688] usb 6-1: USB disconnect, device number 42 [ 696.481360][ T26] audit: type=1804 audit(1681596931.951:1905): pid=11375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/196/file0" dev="sda1" ino=1178 res=1 errno=0 [ 696.540902][T11359] 8021q: adding VLAN 0 to HW filter on device batadv31 [ 696.591115][T11359] bond13: (slave batadv31): Enslaving as an active interface with an up link [ 696.622232][T11374] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:15:32 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:32 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 696.677067][T11363] bond23 (unregistering): Released all slaves [ 696.780156][T11380] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 696.820031][ T25] usb 5-1: new high-speed USB device number 76 using dummy_hcd 22:15:32 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:32 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r4], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r5}}, 0x20}}, 0x0) [ 696.864350][T11380] 8021q: adding VLAN 0 to HW filter on device batadv32 [ 696.875220][T11380] bond14: (slave batadv32): Enslaving as an active interface with an up link [ 696.931648][T11385] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 697.009653][T11387] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 697.095143][T11389] 8021q: adding VLAN 0 to HW filter on device batadv33 [ 697.106538][T11389] bond15: (slave batadv33): Enslaving as an active interface with an up link [ 697.109935][ T3688] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 697.123801][T11390] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 697.135810][T11387] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:15:32 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r4], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r5}}, 0x20}}, 0x0) [ 697.176389][T11387] bond23 (unregistering): Released all slaves [ 697.182825][ T25] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 697.235903][T11394] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 697.360269][ T25] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 697.376643][T11395] 8021q: adding VLAN 0 to HW filter on device batadv34 [ 697.386051][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.418030][T11395] bond16: (slave batadv34): Enslaving as an active interface with an up link [ 697.427373][ T25] usb 5-1: Product: syz [ 697.442976][ T25] usb 5-1: Manufacturer: syz [ 697.459316][ T25] usb 5-1: SerialNumber: syz 22:15:33 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r4], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r5}}, 0x20}}, 0x0) [ 697.490129][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 697.521774][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 22:15:33 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 697.557156][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 697.576506][T11399] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 697.721419][T11401] 8021q: adding VLAN 0 to HW filter on device batadv35 [ 697.736065][T11401] bond17: (slave batadv35): Enslaving as an active interface with an up link [ 697.740137][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 697.755024][T11402] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 697.780861][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.788891][ T3688] usb 6-1: Product: syz [ 697.804729][T11405] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 697.814195][ T3688] usb 6-1: Manufacturer: syz [ 697.818842][ T3688] usb 6-1: SerialNumber: syz [ 697.824362][T11406] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 697.844391][T11402] bond23 (unregistering): Released all slaves [ 698.420122][ T25] cdc_ncm 5-1:1.0: bind() failure [ 698.430841][ T25] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 698.437817][ T25] cdc_ncm 5-1:1.1: bind() failure [ 698.452986][ T25] usb 5-1: USB disconnect, device number 76 [ 698.530059][ T3688] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 698.536345][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 698.547243][ T3688] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 698.554307][ T3688] cdc_ncm 6-1:1.1: bind() failure [ 698.571075][ T3688] usb 6-1: USB disconnect, device number 43 22:15:34 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) 22:15:34 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:34 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, 0x0, 0x0) 22:15:34 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:34 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 698.970734][T11416] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:34 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 699.023900][T11412] 8021q: adding VLAN 0 to HW filter on device batadv36 [ 699.043377][T11412] bond18: (slave batadv36): Enslaving as an active interface with an up link [ 699.065881][T11416] bond23 (unregistering): Released all slaves 22:15:34 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, 0x0, 0x0) [ 699.074221][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 699.074235][ T26] audit: type=1800 audit(1681596934.641:1908): pid=11424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1172 res=0 errno=0 [ 699.170032][ T26] audit: type=1804 audit(1681596934.691:1909): pid=11427 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/197/file0" dev="sda1" ino=1172 res=1 errno=0 [ 699.196483][ T26] audit: type=1804 audit(1681596934.691:1910): pid=11424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/197/file0" dev="sda1" ino=1172 res=1 errno=0 [ 699.241394][ T26] audit: type=1804 audit(1681596934.761:1911): pid=11427 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/197/file0" dev="sda1" ino=1172 res=1 errno=0 [ 699.250053][ T3688] usb 5-1: new high-speed USB device number 77 using dummy_hcd 22:15:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 699.412598][T11431] 8021q: adding VLAN 0 to HW filter on device batadv37 [ 699.427717][T11431] bond19: (slave batadv37): Enslaving as an active interface with an up link 22:15:35 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, 0x0, 0x0) [ 699.497627][T11434] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 699.580184][ T3685] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 699.631041][T11434] bond23 (unregistering): Released all slaves [ 699.762627][T11438] 8021q: adding VLAN 0 to HW filter on device batadv38 [ 699.780252][ T3688] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:15:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 699.821008][T11438] bond20: (slave batadv38): Enslaving as an active interface with an up link 22:15:35 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 699.915202][T11442] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 699.940597][ T3685] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 699.962026][ T3685] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 699.980299][ T3688] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 699.996623][ T3688] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.006927][T11442] bond23 (unregistering): Released all slaves 22:15:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 700.020290][ T3685] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 700.036629][T11445] 8021q: adding VLAN 0 to HW filter on device batadv39 [ 700.043296][ T3688] usb 5-1: Product: syz [ 700.048426][T11445] bond21: (slave batadv39): Enslaving as an active interface with an up link [ 700.094334][ T3688] usb 5-1: Manufacturer: syz [ 700.132281][ T3688] usb 5-1: SerialNumber: syz [ 700.181982][T11450] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 700.225652][T11450] bond23 (unregistering): Released all slaves [ 700.251904][ T3685] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 700.265778][ T3685] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.284158][ T3685] usb 6-1: Product: syz [ 700.293010][ T3685] usb 6-1: Manufacturer: syz [ 700.303652][ T3685] usb 6-1: SerialNumber: syz [ 701.030081][ T3685] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 701.037086][ T3685] cdc_ncm 6-1:1.0: bind() failure [ 701.046408][ T3685] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 701.054086][ T3685] cdc_ncm 6-1:1.1: bind() failure [ 701.076274][ T3685] usb 6-1: USB disconnect, device number 44 [ 701.092508][ T3688] cdc_ncm 5-1:1.0: bind() failure [ 701.104065][ T3688] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 701.111650][ T3688] cdc_ncm 5-1:1.1: bind() failure [ 701.129788][ T3688] usb 5-1: USB disconnect, device number 77 22:15:37 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:37 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:37 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 22:15:37 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:37 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:37 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 701.601629][T11459] __nla_validate_parse: 12 callbacks suppressed [ 701.601645][T11459] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 701.666728][T11458] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 701.706804][ T26] audit: type=1800 audit(1681596937.261:1912): pid=11470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 701.793396][T11459] 8021q: adding VLAN 0 to HW filter on device batadv40 [ 701.811839][T11459] bond22: (slave batadv40): Enslaving as an active interface with an up link [ 701.822995][ T26] audit: type=1804 audit(1681596937.291:1913): pid=11470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/198/file0" dev="sda1" ino=1178 res=1 errno=0 [ 701.869969][ T3686] usb 6-1: new high-speed USB device number 45 using dummy_hcd 22:15:37 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 701.890351][T11467] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 701.910269][ T3687] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 701.946101][T11471] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 701.968717][ T26] audit: type=1804 audit(1681596937.291:1914): pid=11470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/198/file0" dev="sda1" ino=1178 res=1 errno=0 [ 702.023765][ T26] audit: type=1804 audit(1681596937.441:1915): pid=11473 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/198/file0" dev="sda1" ino=1178 res=1 errno=0 [ 702.050837][T11458] bond23 (unregistering): Released all slaves [ 702.111566][T11476] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 702.220180][T11477] 8021q: adding VLAN 0 to HW filter on device batadv41 [ 702.230157][ T3686] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 702.248030][ T3686] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 702.252662][T11477] bond23: (slave batadv41): Enslaving as an active interface with an up link 22:15:37 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 702.269204][ T3686] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 702.280138][ T3687] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:15:37 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) [ 702.360568][T11482] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 702.395106][T11483] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 702.444064][T11482] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 702.461398][ T3686] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 702.471421][ T3687] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 702.499948][ T3687] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.508063][ T3687] usb 5-1: Product: syz [ 702.513302][ T3686] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.542768][ T3686] usb 6-1: Product: syz [ 702.547125][T11486] 8021q: adding VLAN 0 to HW filter on device batadv42 [ 702.563346][ T3687] usb 5-1: Manufacturer: syz [ 702.569262][ T3686] usb 6-1: Manufacturer: syz [ 702.588207][ T3687] usb 5-1: SerialNumber: syz [ 702.593921][ T3686] usb 6-1: SerialNumber: syz [ 702.598677][T11486] bond24: (slave batadv42): Enslaving as an active interface with an up link 22:15:38 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) [ 702.642299][T11482] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 702.686670][T11487] bond23 (unregistering): Released all slaves [ 702.760788][T11491] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 702.838327][T11492] 8021q: adding VLAN 0 to HW filter on device batadv43 [ 702.868774][T11492] bond25: (slave batadv43): Enslaving as an active interface with an up link 22:15:38 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:38 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) [ 702.983421][T11496] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 703.083354][T11498] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 703.132506][T11500] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 703.186976][T11501] 8021q: adding VLAN 0 to HW filter on device batadv44 [ 703.217367][T11501] bond26: (slave batadv44): Enslaving as an active interface with an up link [ 703.264180][T11496] 8021q: adding VLAN 0 to HW filter on device batadv177 [ 703.289046][T11496] bond23: (slave batadv177): Enslaving as a backup interface with an up link [ 703.320039][ T3687] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 703.320090][ T3687] cdc_ncm 5-1:1.0: bind() failure [ 703.331665][ T3686] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 703.338884][ T3686] cdc_ncm 6-1:1.0: bind() failure [ 703.364542][ T3687] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 703.375074][ T3686] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 703.382263][ T3686] cdc_ncm 6-1:1.1: bind() failure [ 703.388985][ T3687] cdc_ncm 5-1:1.1: bind() failure [ 703.413935][ T3686] usb 6-1: USB disconnect, device number 45 [ 703.420163][ T3687] usb 5-1: USB disconnect, device number 78 22:15:39 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:39 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:39 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:39 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x0, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:15:39 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:39 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 703.841448][T11510] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 704.588438][ T26] audit: type=1800 audit(1681596940.141:1916): pid=11524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 704.640001][ T26] audit: type=1804 audit(1681596940.181:1917): pid=11528 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/199/file0" dev="sda1" ino=1181 res=1 errno=0 22:15:40 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 704.695582][T11518] 8021q: adding VLAN 0 to HW filter on device batadv45 [ 704.731267][T11518] bond27: (slave batadv45): Enslaving as an active interface with an up link [ 704.750060][ T3685] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 704.755076][T11522] 8021q: adding VLAN 0 to HW filter on device batadv178 [ 704.771541][ T26] audit: type=1804 audit(1681596940.191:1918): pid=11524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/199/file0" dev="sda1" ino=1181 res=1 errno=0 [ 704.893714][T11522] bond24: (slave batadv178): Enslaving as a backup interface with an up link [ 704.950335][ T3688] usb 6-1: new high-speed USB device number 46 using dummy_hcd 22:15:40 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x0, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 705.190548][ T3685] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:15:41 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 705.430132][ T26] audit: type=1804 audit(1681596940.281:1919): pid=11528 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/199/file0" dev="sda1" ino=1181 res=1 errno=0 [ 705.460995][ T3688] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 705.479245][ T3688] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 705.489868][ T3685] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 705.506593][ T3685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 705.515524][ T3688] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 705.526085][ T3685] usb 5-1: Product: syz [ 705.530757][ T3685] usb 5-1: Manufacturer: syz [ 705.535700][ T3685] usb 5-1: SerialNumber: syz [ 705.541998][T11540] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:41 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:41 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x0, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 705.614974][T11538] 8021q: adding VLAN 0 to HW filter on device batadv46 [ 705.624721][T11538] bond28: (slave batadv46): Enslaving as an active interface with an up link [ 705.646738][T11540] 8021q: adding VLAN 0 to HW filter on device batadv179 [ 705.655747][T11540] bond25: (slave batadv179): Enslaving as a backup interface with an up link [ 705.790673][ T3688] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 705.914614][ T3688] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 706.083804][ T3688] usb 6-1: Product: syz [ 706.168396][ T3688] usb 6-1: Manufacturer: syz [ 706.246722][ T3688] usb 6-1: SerialNumber: syz [ 706.300177][ T3685] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 706.306766][ T3685] cdc_ncm 5-1:1.0: bind() failure [ 706.334781][ T3685] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 706.342603][ T3685] cdc_ncm 5-1:1.1: bind() failure 22:15:41 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) [ 706.352464][ T3685] usb 5-1: USB disconnect, device number 79 [ 706.414749][T11550] 8021q: adding VLAN 0 to HW filter on device batadv47 [ 706.424010][T11550] bond29: (slave batadv47): Enslaving as an active interface with an up link [ 706.433600][T11554] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 706.529214][T11555] 8021q: adding VLAN 0 to HW filter on device batadv180 [ 706.562682][T11555] bond26: (slave batadv180): Enslaving as a backup interface with an up link 22:15:42 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:42 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) 22:15:42 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:42 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) 22:15:42 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 706.826726][T11560] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 706.879250][T11563] __nla_validate_parse: 6 callbacks suppressed [ 706.879268][T11563] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 707.036677][T11568] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 707.046439][ T3688] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 707.052636][ T26] audit: type=1800 audit(1681596942.551:1920): pid=11574 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 [ 707.079785][ T3688] cdc_ncm 6-1:1.0: bind() failure [ 707.132403][ T3688] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 707.150017][ T25] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 707.174643][T11560] 8021q: adding VLAN 0 to HW filter on device batadv181 [ 707.192752][ T26] audit: type=1804 audit(1681596942.561:1921): pid=11574 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/200/file0" dev="sda1" ino=1175 res=1 errno=0 [ 707.219953][ T3688] cdc_ncm 6-1:1.1: bind() failure [ 707.274877][T11560] bond27: (slave batadv181): Enslaving as a backup interface with an up link [ 707.280592][ T26] audit: type=1804 audit(1681596942.561:1922): pid=11574 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/200/file0" dev="sda1" ino=1175 res=1 errno=0 [ 707.292273][ T3688] usb 6-1: USB disconnect, device number 46 [ 707.314522][T11571] 8021q: adding VLAN 0 to HW filter on device batadv48 [ 707.323246][ T26] audit: type=1804 audit(1681596942.651:1923): pid=11577 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/200/file0" dev="sda1" ino=1175 res=1 errno=0 [ 707.360327][T11571] bond30: (slave batadv48): Enslaving as an active interface with an up link 22:15:43 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) 22:15:43 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) 22:15:43 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 707.555852][T11582] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 707.580310][ T25] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 707.630236][T11581] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:43 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 707.681867][T11587] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 707.724294][T11586] 8021q: adding VLAN 0 to HW filter on device batadv49 [ 707.748450][T11586] bond31: (slave batadv49): Enslaving as an active interface with an up link 22:15:43 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) [ 707.788660][T11589] 8021q: adding VLAN 0 to HW filter on device batadv182 [ 707.800103][ T25] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 707.812850][T11589] bond28: (slave batadv182): Enslaving as a backup interface with an up link [ 707.820598][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.833811][ T25] usb 5-1: Product: syz [ 707.844907][ T25] usb 5-1: Manufacturer: syz [ 707.864523][ T25] usb 5-1: SerialNumber: syz [ 707.935628][T11594] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:15:43 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 708.017014][T11594] 8021q: adding VLAN 0 to HW filter on device batadv50 [ 708.034963][T11594] bond32: (slave batadv50): Enslaving as an active interface with an up link [ 708.175578][T11599] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:43 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 708.304245][T11600] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 708.319952][ T2922] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 708.361668][T11599] 8021q: adding VLAN 0 to HW filter on device batadv183 [ 708.384270][T11599] bond29: (slave batadv183): Enslaving as a backup interface with an up link [ 708.549999][ T3685] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 708.580040][ T25] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 708.586568][ T25] cdc_ncm 5-1:1.0: bind() failure [ 708.596201][ T25] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 708.603653][ T25] cdc_ncm 5-1:1.1: bind() failure [ 708.618128][ T25] usb 5-1: USB disconnect, device number 80 [ 708.680271][ T2922] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 708.691659][ T2922] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 708.701728][ T2922] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 708.870232][ T2922] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 708.879295][ T2922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.887861][ T2922] usb 6-1: Product: syz [ 708.892494][ T2922] usb 6-1: Manufacturer: syz [ 708.897258][ T2922] usb 6-1: SerialNumber: syz [ 708.930208][ T3685] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 708.941964][ T3685] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 708.952155][ T3685] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 22:15:44 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:44 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:44 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 709.093850][T11610] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 709.125469][T11610] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 709.140873][ T3685] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 709.159379][ T3685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.181952][ T3685] usb 4-1: Product: syz [ 709.203925][ T3685] usb 4-1: Manufacturer: syz [ 709.209514][ T3685] usb 4-1: SerialNumber: syz [ 709.267652][T11610] 8021q: adding VLAN 0 to HW filter on device batadv184 [ 709.302675][T11610] bond30: (slave batadv184): Enslaving as a backup interface with an up link [ 709.330086][ T26] audit: type=1800 audit(1681596944.801:1924): pid=11616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 22:15:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 709.541913][ T26] audit: type=1804 audit(1681596945.101:1925): pid=11618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/201/file0" dev="sda1" ino=1175 res=1 errno=0 [ 709.561785][T11622] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 709.612296][T11622] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 709.649970][T11622] 8021q: adding VLAN 0 to HW filter on device batadv185 [ 709.676080][T11622] bond31: (slave batadv185): Enslaving as a backup interface with an up link [ 709.679951][ T3686] usb 5-1: new high-speed USB device number 81 using dummy_hcd 22:15:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x0, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 709.761282][T11626] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 709.790017][ T2922] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 709.796081][ T2922] cdc_ncm 6-1:1.0: bind() failure [ 709.804140][ T2922] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 709.811111][ T2922] cdc_ncm 6-1:1.1: bind() failure [ 709.833889][T11626] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 709.854964][T11626] 8021q: adding VLAN 0 to HW filter on device batadv186 [ 709.866859][T11626] bond32: (slave batadv186): Enslaving as a backup interface with an up link [ 709.893339][T11626] bond32 (unregistering): (slave batadv186): Releasing backup interface [ 709.950148][ T3685] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 709.956380][ T3685] cdc_ncm 4-1:1.0: bind() failure [ 709.968045][T11626] bond32 (unregistering): Released all slaves 22:15:45 executing program 0: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 709.995502][ T3685] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 710.029036][ T3685] cdc_ncm 4-1:1.1: bind() failure [ 710.060151][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 710.074325][ T3685] usb 4-1: USB disconnect, device number 5 [ 710.230153][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 710.245937][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.271236][ T3686] usb 5-1: Product: syz [ 710.299984][ T3686] usb 5-1: Manufacturer: syz [ 710.304615][ T3686] usb 5-1: SerialNumber: syz 22:15:46 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x0, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:46 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:46 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 710.806848][ T2922] usb 6-1: USB disconnect, device number 47 [ 710.807255][T11637] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 710.897312][T11641] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 710.943425][ T26] audit: type=1800 audit(1681596946.501:1926): pid=11644 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1179 res=0 errno=0 [ 710.959730][T11637] 8021q: adding VLAN 0 to HW filter on device batadv187 [ 710.985654][ T26] audit: type=1804 audit(1681596946.501:1927): pid=11644 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/202/file0" dev="sda1" ino=1179 res=1 errno=0 [ 711.020052][ T3686] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 711.027445][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 711.040726][T11637] bond32: (slave batadv187): Enslaving as a backup interface with an up link [ 711.045422][ T3686] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 711.067575][ T3686] cdc_ncm 5-1:1.1: bind() failure [ 711.080058][ T3685] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 711.084960][ T3686] usb 5-1: USB disconnect, device number 81 [ 711.111793][T11641] bond32 (unregistering): (slave batadv187): Releasing backup interface [ 711.121232][ T26] audit: type=1804 audit(1681596946.501:1928): pid=11644 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/202/file0" dev="sda1" ino=1179 res=1 errno=0 [ 711.146938][ T26] audit: type=1804 audit(1681596946.621:1929): pid=11645 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/202/file0" dev="sda1" ino=1179 res=1 errno=0 [ 711.176254][T11641] bond32 (unregistering): Released all slaves [ 711.239993][ T2922] usb 6-1: new high-speed USB device number 48 using dummy_hcd 22:15:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x0, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 711.355366][T11648] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 711.436453][T11648] 8021q: adding VLAN 0 to HW filter on device batadv188 [ 711.475445][T11648] bond32: (slave batadv188): Enslaving as a backup interface with an up link [ 711.480126][ T3685] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 711.507831][ T3685] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 711.518392][T11650] bond32 (unregistering): (slave batadv188): Releasing backup interface 22:15:47 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:47 executing program 0: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 711.527912][ T3685] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 711.604662][T11650] bond32 (unregistering): Released all slaves [ 711.620032][ T2922] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 711.645752][ T2922] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 711.676911][ T2922] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 711.710250][ T3685] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 22:15:47 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 711.726309][ T3685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.757857][ T3685] usb 4-1: Product: syz [ 711.772487][ T3685] usb 4-1: Manufacturer: syz [ 711.788468][ T3685] usb 4-1: SerialNumber: syz [ 711.800495][T11658] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 711.860914][ T2922] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 711.883554][T11660] __nla_validate_parse: 1 callbacks suppressed [ 711.883571][T11660] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 711.907410][ T2922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.940045][ T2922] usb 6-1: Product: syz [ 711.960638][ T2922] usb 6-1: Manufacturer: syz [ 711.970320][ T3686] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 711.990487][T11658] 8021q: adding VLAN 0 to HW filter on device batadv189 [ 711.998736][T11658] bond32: (slave batadv189): Enslaving as a backup interface with an up link [ 712.000376][ T2922] usb 6-1: SerialNumber: syz [ 712.066421][T11660] bond32 (unregistering): (slave batadv189): Releasing backup interface [ 712.088044][T11660] bond32 (unregistering): Released all slaves 22:15:47 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 712.312206][T11662] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 712.340490][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 712.386597][T11664] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 712.437968][T11662] 8021q: adding VLAN 0 to HW filter on device batadv190 [ 712.483498][T11662] bond32: (slave batadv190): Enslaving as a backup interface with an up link [ 712.510060][ T3685] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 712.516111][ T3685] cdc_ncm 4-1:1.0: bind() failure [ 712.520434][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 22:15:48 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 712.530996][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.544827][ T3686] usb 5-1: Product: syz [ 712.552561][ T3686] usb 5-1: Manufacturer: syz [ 712.555939][ T3685] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 712.561092][ T3686] usb 5-1: SerialNumber: syz [ 712.591891][ T3685] cdc_ncm 4-1:1.1: bind() failure [ 712.630288][ T3685] usb 4-1: USB disconnect, device number 6 [ 712.677446][T11664] bond32 (unregistering): (slave batadv190): Releasing backup interface [ 712.688525][ T26] audit: type=1800 audit(1681596948.241:1930): pid=11668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1174 res=0 errno=0 [ 712.726055][T11664] bond32 (unregistering): Released all slaves [ 712.740565][ T26] audit: type=1804 audit(1681596948.241:1931): pid=11668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/203/file0" dev="sda1" ino=1174 res=1 errno=0 [ 712.766564][ T2922] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 712.774146][ T2922] cdc_ncm 6-1:1.0: bind() failure [ 712.794216][ T2922] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found 22:15:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 712.821835][ T2922] cdc_ncm 6-1:1.1: bind() failure [ 712.842973][ T26] audit: type=1804 audit(1681596948.241:1932): pid=11668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/203/file0" dev="sda1" ino=1174 res=1 errno=0 [ 712.893395][ T26] audit: type=1804 audit(1681596948.301:1933): pid=11669 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/203/file0" dev="sda1" ino=1174 res=1 errno=0 [ 712.924774][T11671] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 712.968770][T11671] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 713.002048][T11671] 8021q: adding VLAN 0 to HW filter on device batadv191 [ 713.014665][T11671] bond32: (slave batadv191): Enslaving as a backup interface with an up link [ 713.031702][T11671] bond32 (unregistering): (slave batadv191): Releasing backup interface 22:15:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 713.068995][T11671] bond32 (unregistering): Released all slaves [ 713.116241][T11674] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 713.236482][T11676] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 713.250040][ T3686] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 713.256185][ T3686] cdc_ncm 5-1:1.0: bind() failure [ 713.272638][ T3686] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 713.279464][ T3686] cdc_ncm 5-1:1.1: bind() failure [ 713.300803][ T3686] usb 5-1: USB disconnect, device number 82 [ 713.353727][T11674] 8021q: adding VLAN 0 to HW filter on device batadv51 [ 713.372692][T11674] bond33: (slave batadv51): Enslaving as a backup interface with an up link 22:15:49 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, 0x0, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:49 executing program 0: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:49 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:49 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:49 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 713.857004][ T3685] usb 6-1: USB disconnect, device number 48 [ 713.875234][T11681] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 713.962383][T11690] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 714.012223][ T26] audit: type=1800 audit(1681596949.571:1934): pid=11696 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1180 res=0 errno=0 [ 714.057073][ T26] audit: type=1804 audit(1681596949.601:1935): pid=11696 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/204/file0" dev="sda1" ino=1180 res=1 errno=0 [ 714.074318][T11681] 8021q: adding VLAN 0 to HW filter on device batadv192 [ 714.156202][T11681] bond32: (slave batadv192): Enslaving as a backup interface with an up link [ 714.165438][ T3686] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 714.233935][T11690] bond32 (unregistering): (slave batadv192): Releasing backup interface [ 714.292411][T11690] bond32 (unregistering): Released all slaves [ 714.340253][ T3685] usb 6-1: new high-speed USB device number 49 using dummy_hcd 22:15:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, 0x0, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 714.480650][T11703] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 714.540369][ T3686] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 714.582848][T11705] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 714.621141][T11703] 8021q: adding VLAN 0 to HW filter on device batadv193 [ 714.631856][T11703] bond32: (slave batadv193): Enslaving as a backup interface with an up link [ 714.660290][T11703] bond32 (unregistering): (slave batadv193): Releasing backup interface [ 714.710173][ T3686] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 714.721756][ T3686] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.732365][T11703] bond32 (unregistering): Released all slaves [ 714.746550][ T3686] usb 5-1: Product: syz [ 714.753556][ T3686] usb 5-1: Manufacturer: syz [ 714.760469][ T3685] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 714.760577][ T3686] usb 5-1: SerialNumber: syz [ 714.791620][ T3685] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 714.836988][ T3685] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 22:15:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, 0x0, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 714.971778][T11707] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 715.061048][ T3685] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 715.070764][ T3685] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.080620][ T3685] usb 6-1: Product: syz [ 715.084885][ T3685] usb 6-1: Manufacturer: syz [ 715.089732][ T3685] usb 6-1: SerialNumber: syz [ 715.103135][T11709] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 715.120924][T11710] 8021q: adding VLAN 0 to HW filter on device batadv194 [ 715.129478][T11710] bond32: (slave batadv194): Enslaving as a backup interface with an up link [ 715.158145][T11707] bond32 (unregistering): (slave batadv194): Releasing backup interface [ 715.188141][T11707] bond32 (unregistering): Released all slaves 22:15:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 715.338637][T11712] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 715.405640][T11714] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 715.490031][ T3686] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 715.497423][ T3686] cdc_ncm 5-1:1.0: bind() failure 22:15:51 executing program 0: prlimit64(0x0, 0x0, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 715.538431][ T3686] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 715.555860][T11712] 8021q: adding VLAN 0 to HW filter on device batadv195 [ 715.571710][T11712] bond32: (slave batadv195): Enslaving as a backup interface with an up link 22:15:51 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10}}, 0x20}}, 0x0) [ 715.586150][ T3686] cdc_ncm 5-1:1.1: bind() failure [ 715.596682][T11714] bond32 (unregistering): (slave batadv195): Releasing backup interface [ 715.628507][T11714] bond32 (unregistering): Released all slaves [ 715.637537][ T3686] usb 5-1: USB disconnect, device number 83 22:15:51 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 715.691913][T11717] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 715.753327][T11719] 8021q: adding VLAN 0 to HW filter on device batadv52 [ 715.790051][ T3685] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 715.796117][ T3685] cdc_ncm 6-1:1.0: bind() failure [ 715.808232][ T3685] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 715.812364][T11719] bond34: (slave batadv52): Enslaving as an active interface with an up link [ 715.819917][ T3685] cdc_ncm 6-1:1.1: bind() failure [ 715.960577][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 715.960592][ T26] audit: type=1804 audit(1681596951.521:1945): pid=11727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/205/file0" dev="sda1" ino=1156 res=1 errno=0 22:15:52 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:52 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:52 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:52 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:52 executing program 0: prlimit64(0x0, 0x0, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:52 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 716.937695][ T1065] usb 6-1: USB disconnect, device number 49 [ 716.969401][T11730] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 717.057767][T11740] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 717.141479][T11730] 8021q: adding VLAN 0 to HW filter on device batadv196 [ 717.170055][ T26] audit: type=1800 audit(1681596952.711:1946): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 717.257067][T11730] bond32: (slave batadv196): Enslaving as a backup interface with an up link [ 717.266311][ T3685] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 717.320368][ T26] audit: type=1804 audit(1681596952.711:1947): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/206/file0" dev="sda1" ino=1181 res=1 errno=0 [ 717.354702][T11740] bond32 (unregistering): (slave batadv196): Releasing backup interface [ 717.429150][T11740] bond32 (unregistering): Released all slaves [ 717.478341][ T26] audit: type=1804 audit(1681596952.711:1948): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/206/file0" dev="sda1" ino=1181 res=1 errno=0 [ 717.519223][ T26] audit: type=1804 audit(1681596952.761:1949): pid=11747 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/206/file0" dev="sda1" ino=1181 res=1 errno=0 [ 717.550007][ T4017] usb 5-1: new high-speed USB device number 84 using dummy_hcd 22:15:53 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 717.641939][T11749] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 717.667295][T11749] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 717.715670][T11749] 8021q: adding VLAN 0 to HW filter on device batadv197 [ 717.730141][ T3685] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 717.739566][T11749] bond32: (slave batadv197): Enslaving as a backup interface with an up link [ 717.750388][ T1065] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 717.783042][T11749] bond32 (unregistering): (slave batadv197): Releasing backup interface [ 717.818525][T11749] bond32 (unregistering): Released all slaves 22:15:53 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 717.920191][ T4017] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 717.940084][ T3685] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 717.949188][ T3685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.965287][ T3685] usb 4-1: Product: syz [ 717.979958][ T3685] usb 4-1: Manufacturer: syz 22:15:53 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 718.003354][ T3685] usb 4-1: SerialNumber: syz [ 718.038331][T11755] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 718.067736][T11755] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 718.085761][T11755] 8021q: adding VLAN 0 to HW filter on device batadv198 [ 718.107320][T11755] bond32: (slave batadv198): Enslaving as a backup interface with an up link [ 718.195406][ T26] audit: type=1800 audit(1681596953.661:1950): pid=11758 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 718.225490][T11755] bond32 (unregistering): (slave batadv198): Releasing backup interface [ 718.278086][T11755] bond32 (unregistering): Released all slaves [ 718.299344][ T26] audit: type=1804 audit(1681596953.661:1951): pid=11758 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/207/file0" dev="sda1" ino=1181 res=1 errno=0 22:15:54 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 718.400159][ T26] audit: type=1804 audit(1681596953.661:1952): pid=11758 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/207/file0" dev="sda1" ino=1181 res=1 errno=0 [ 718.425521][ T26] audit: type=1804 audit(1681596953.711:1953): pid=11759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/207/file0" dev="sda1" ino=1181 res=1 errno=0 [ 718.451176][ T4017] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 718.460704][ T1065] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 718.471720][ T4017] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.486115][ T1065] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 718.496208][ T4017] usb 5-1: Product: syz [ 718.505389][T11761] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 718.513915][ T4017] usb 5-1: Manufacturer: syz [ 718.518596][ T1065] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 718.528770][ T4017] usb 5-1: SerialNumber: syz [ 718.556251][T11761] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 718.574608][T11761] 8021q: adding VLAN 0 to HW filter on device batadv199 [ 718.583105][T11761] bond32: (slave batadv199): Enslaving as a backup interface with an up link [ 718.596658][T11761] bond32 (unregistering): (slave batadv199): Releasing backup interface [ 718.612676][T11761] bond32 (unregistering): Released all slaves 22:15:54 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 718.690369][ T3685] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 718.700072][ T1065] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 718.709320][ T1065] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.715569][ T3685] cdc_ncm 4-1:1.0: bind() failure [ 718.718453][ T1065] usb 6-1: Product: syz [ 718.739947][ T1065] usb 6-1: Manufacturer: syz [ 718.744311][T11764] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 718.744566][ T1065] usb 6-1: SerialNumber: syz [ 718.755087][ T3685] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 718.766492][ T3685] cdc_ncm 4-1:1.1: bind() failure 22:15:54 executing program 0: prlimit64(0x0, 0x0, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 718.790962][ T3685] usb 4-1: USB disconnect, device number 7 [ 718.805566][T11766] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 718.877669][T11764] 8021q: adding VLAN 0 to HW filter on device batadv200 [ 718.891788][T11764] bond32: (slave batadv200): Enslaving as a backup interface with an up link [ 718.930311][T11764] bond32 (unregistering): (slave batadv200): Releasing backup interface [ 718.962283][T11764] bond32 (unregistering): Released all slaves [ 719.230041][ T4017] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 719.242339][ T4017] cdc_ncm 5-1:1.0: bind() failure [ 719.269531][ T4017] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 719.290693][ T4017] cdc_ncm 5-1:1.1: bind() failure [ 719.322865][ T4017] usb 5-1: USB disconnect, device number 84 [ 719.530872][ T1065] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 719.536941][ T1065] cdc_ncm 6-1:1.0: bind() failure [ 719.553528][ T1065] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 719.580061][ T1065] cdc_ncm 6-1:1.1: bind() failure 22:15:56 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:56 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:56 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:56 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:15:56 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:15:56 executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 720.526840][ T1065] usb 6-1: USB disconnect, device number 50 [ 720.552364][T11774] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:15:57 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 721.660299][ T26] audit: type=1800 audit(1681596956.561:1954): pid=11786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 [ 721.683879][T11782] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 721.725674][T11774] 8021q: adding VLAN 0 to HW filter on device batadv201 [ 721.742684][ T26] audit: type=1804 audit(1681596956.821:1955): pid=11786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/208/file0" dev="sda1" ino=1175 res=1 errno=0 22:15:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 721.779919][ T3685] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 721.796679][T11774] bond32: (slave batadv201): Enslaving as a backup interface with an up link [ 721.810485][T11791] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 721.865105][ T26] audit: type=1804 audit(1681596957.071:1956): pid=11786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/208/file0" dev="sda1" ino=1175 res=1 errno=0 [ 721.908182][ T26] audit: type=1804 audit(1681596957.181:1957): pid=11787 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/208/file0" dev="sda1" ino=1175 res=1 errno=0 [ 721.912224][T11794] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 722.011938][ T26] audit: type=1800 audit(1681596957.551:1958): pid=11801 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 [ 722.073646][ T26] audit: type=1804 audit(1681596957.551:1959): pid=11801 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/209/file0" dev="sda1" ino=1175 res=1 errno=0 [ 722.133978][T11782] bond32 (unregistering): (slave batadv201): Releasing backup interface [ 722.178958][T11782] bond32 (unregistering): Released all slaves [ 722.226867][ T26] audit: type=1804 audit(1681596957.551:1960): pid=11801 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/209/file0" dev="sda1" ino=1175 res=1 errno=0 [ 722.270112][ T1065] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 722.283241][T11796] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 722.295804][ T26] audit: type=1804 audit(1681596957.661:1961): pid=11802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/209/file0" dev="sda1" ino=1175 res=1 errno=0 [ 722.324970][T11799] bond35 (unregistering): Released all slaves 22:15:57 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:15:58 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, 0x0, 0x0) [ 722.432618][T11805] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 722.470144][ T3685] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 722.483400][T11805] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 722.512127][T11805] 8021q: adding VLAN 0 to HW filter on device batadv202 [ 722.538821][T11805] bond32: (slave batadv202): Enslaving as a backup interface with an up link [ 722.566716][T11808] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 722.636867][T11805] bond32 (unregistering): (slave batadv202): Releasing backup interface [ 722.660327][ T3685] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 722.679996][ T3685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.690233][ T1065] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 722.698161][ T3685] usb 5-1: Product: syz [ 722.709785][ T1065] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 722.720188][ T1065] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 722.732364][ T3685] usb 5-1: Manufacturer: syz 22:15:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 722.748289][ T3685] usb 5-1: SerialNumber: syz 22:15:58 executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 722.790213][T11805] bond32 (unregistering): Released all slaves [ 722.826798][T11811] 8021q: adding VLAN 0 to HW filter on device batadv53 [ 722.841439][T11811] bond35: (slave batadv53): Enslaving as an active interface with an up link [ 722.922701][ T26] audit: type=1800 audit(1681596958.431:1962): pid=11817 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1161 res=0 errno=0 [ 722.980321][ T26] audit: type=1804 audit(1681596958.431:1963): pid=11817 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/210/file0" dev="sda1" ino=1161 res=1 errno=0 [ 723.009064][ T1065] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 723.035226][ T1065] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.072460][ T1065] usb 6-1: Product: syz [ 723.082081][ T1065] usb 6-1: Manufacturer: syz [ 723.093151][ T1065] usb 6-1: SerialNumber: syz [ 723.650127][ T3685] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 723.656566][ T3685] cdc_ncm 5-1:1.0: bind() failure [ 723.666343][ T3685] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 723.673722][ T3685] cdc_ncm 5-1:1.1: bind() failure [ 723.691566][ T3685] usb 5-1: USB disconnect, device number 85 [ 723.840022][ T1065] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 723.846096][ T1065] cdc_ncm 6-1:1.0: bind() failure [ 723.866032][ T1065] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 723.889962][ T1065] cdc_ncm 6-1:1.1: bind() failure 22:16:00 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:00 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:00 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:00 executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:00 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 724.832401][ T25] usb 6-1: USB disconnect, device number 51 [ 724.862459][T11829] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 724.913557][T11829] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 724.936138][T11829] 8021q: adding VLAN 0 to HW filter on device batadv203 [ 724.945318][T11829] bond32: (slave batadv203): Enslaving as a backup interface with an up link [ 724.960450][T11829] bond32 (unregistering): (slave batadv203): Releasing backup interface [ 724.978082][T11829] bond32 (unregistering): Released all slaves [ 725.150216][ T3685] usb 5-1: new high-speed USB device number 86 using dummy_hcd 22:16:00 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 725.297299][T11843] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 725.310136][ T25] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 725.418595][T11845] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 725.430090][ T3687] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 725.487616][T11846] 8021q: adding VLAN 0 to HW filter on device batadv204 [ 725.520239][ T3685] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 725.532152][T11846] bond32: (slave batadv204): Enslaving as a backup interface with an up link [ 725.546889][T11843] bond32 (unregistering): (slave batadv204): Releasing backup interface [ 725.571988][T11843] bond32 (unregistering): Released all slaves 22:16:01 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 725.680241][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 725.699356][ T25] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 725.709603][ T3685] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 22:16:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 725.724262][ T3685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.725304][T11848] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 725.740412][ T25] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 725.760179][ T3685] usb 5-1: Product: syz [ 725.764515][ T3685] usb 5-1: Manufacturer: syz [ 725.770511][ T3685] usb 5-1: SerialNumber: syz [ 725.820341][ T3687] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 725.833444][T11850] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 725.846637][ T3687] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 725.931994][ T25] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 726.007453][ T25] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.039406][ T25] usb 6-1: Product: syz [ 726.057374][ T25] usb 6-1: Manufacturer: syz [ 726.077306][ T25] usb 6-1: SerialNumber: syz [ 726.101681][T11848] bond32 (unregistering): Released all slaves [ 726.213877][ T3687] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 22:16:01 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:01 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 726.318069][T11858] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 726.375770][T11860] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 726.390045][ T3687] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 726.399109][ T3687] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.410680][T11858] 8021q: adding VLAN 0 to HW filter on device batadv205 [ 726.419914][ T3687] usb 4-1: Product: syz [ 726.423016][T11858] bond32: (slave batadv205): Enslaving as a backup interface with an up link [ 726.424113][ T3687] usb 4-1: Manufacturer: syz [ 726.424132][ T3687] usb 4-1: SerialNumber: syz [ 726.462701][T11858] bond32 (unregistering): (slave batadv205): Releasing backup interface [ 726.499428][T11858] bond32 (unregistering): Released all slaves [ 726.510102][ T3685] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 726.517583][ T3685] cdc_ncm 5-1:1.0: bind() failure [ 726.542380][ T3685] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 726.558702][ T3685] cdc_ncm 5-1:1.1: bind() failure [ 726.569307][ T3685] usb 5-1: USB disconnect, device number 86 22:16:02 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x0, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 726.719264][T11866] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 726.768913][T11868] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 726.820006][ T25] cdc_ncm 6-1:1.0: failed GET_NTB_PARAMETERS [ 726.827506][ T25] cdc_ncm 6-1:1.0: bind() failure [ 726.858307][T11866] 8021q: adding VLAN 0 to HW filter on device batadv206 [ 726.865889][ T25] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 726.884435][ T25] cdc_ncm 6-1:1.1: bind() failure [ 726.898930][T11866] bond32: (slave batadv206): Enslaving as a backup interface with an up link [ 726.951643][T11868] bond32 (unregistering): (slave batadv206): Releasing backup interface [ 726.990744][T11868] bond32 (unregistering): Released all slaves [ 727.164416][ T3687] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 727.171762][ T3687] cdc_ncm 4-1:1.0: bind() failure [ 727.188969][ T3687] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 727.209137][ T3687] cdc_ncm 4-1:1.1: bind() failure [ 727.247721][ T3687] usb 4-1: USB disconnect, device number 8 22:16:03 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:03 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:03 executing program 4: syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 22:16:03 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x0, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:03 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:03 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x0, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 727.892421][ T3725] usb 6-1: USB disconnect, device number 52 [ 727.922473][T11878] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 728.014155][T11879] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 728.027867][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 728.027884][ T26] audit: type=1800 audit(1681596963.581:1975): pid=11888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 728.204596][T11886] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 728.216485][ T26] audit: type=1804 audit(1681596963.581:1976): pid=11888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/213/file0" dev="sda1" ino=1181 res=1 errno=0 [ 728.277226][T11878] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 728.331288][ T26] audit: type=1804 audit(1681596963.581:1977): pid=11888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/213/file0" dev="sda1" ino=1181 res=1 errno=0 [ 728.357064][ T26] audit: type=1804 audit(1681596963.641:1978): pid=11889 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/213/file0" dev="sda1" ino=1181 res=1 errno=0 [ 728.364730][T11892] 8021q: adding VLAN 0 to HW filter on device batadv54 [ 728.394381][T11892] bond36: (slave batadv54): Enslaving as a backup interface with an up link [ 728.403436][ T3725] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 728.417707][T11887] 8021q: adding VLAN 0 to HW filter on device batadv207 22:16:04 executing program 4: syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) [ 728.427165][T11887] bond32: (slave batadv207): Enslaving as a backup interface with an up link [ 728.439086][T11894] bond36 (unregistering): (slave batadv54): Releasing backup interface [ 728.482756][T11894] bond36 (unregistering): Released all slaves [ 728.528397][T11890] bond32 (unregistering): (slave batadv207): Releasing backup interface [ 728.562206][T11890] bond32 (unregistering): Released all slaves 22:16:04 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x0, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:04 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x0, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 728.709637][T11899] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:04 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 728.803653][T11901] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 728.820181][ T3725] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 728.834578][ T3725] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 728.883891][ T3725] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 728.895610][T11903] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 728.912277][T11904] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 728.937532][T11899] 8021q: adding VLAN 0 to HW filter on device batadv208 [ 728.952068][T11899] bond32: (slave batadv208): Enslaving as a backup interface with an up link [ 728.993178][ T26] audit: type=1800 audit(1681596964.541:1979): pid=11912 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1173 res=0 errno=0 22:16:04 executing program 4: syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) [ 729.141947][T11907] 8021q: adding VLAN 0 to HW filter on device batadv55 [ 729.208919][T11907] bond36: (slave batadv55): Enslaving as a backup interface with an up link [ 729.265497][T11905] bond32 (unregistering): (slave batadv208): Releasing backup interface [ 729.274589][ T3725] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 729.291854][ T26] audit: type=1804 audit(1681596964.551:1980): pid=11912 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/214/file0" dev="sda1" ino=1173 res=1 errno=0 [ 729.326374][T11905] bond32 (unregistering): Released all slaves [ 729.327907][ T3725] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.344627][T11901] bond36 (unregistering): (slave batadv55): Releasing backup interface [ 729.360951][T11901] bond36 (unregistering): Released all slaves [ 729.374162][ T3725] usb 6-1: Product: syz [ 729.377253][ T26] audit: type=1804 audit(1681596964.551:1981): pid=11912 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/214/file0" dev="sda1" ino=1173 res=1 errno=0 [ 729.389929][ T3725] usb 6-1: Manufacturer: syz 22:16:05 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 729.423223][ T26] audit: type=1804 audit(1681596964.601:1982): pid=11913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/214/file0" dev="sda1" ino=1173 res=1 errno=0 [ 729.451876][ T3725] usb 6-1: SerialNumber: syz [ 729.502215][T11917] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 729.550592][T11917] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 729.569074][T11917] 8021q: adding VLAN 0 to HW filter on device batadv209 [ 729.579166][T11917] bond32: (slave batadv209): Enslaving as a backup interface with an up link [ 729.594442][T11917] bond32 (unregistering): (slave batadv209): Releasing backup interface [ 729.614029][T11917] bond32 (unregistering): Released all slaves [ 730.620471][ T3725] cdc_ncm 6-1:1.0: bind() failure [ 730.650195][ T3725] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 730.670078][ T3725] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 730.690076][ T3725] usbtest: probe of 6-1:1.1 failed with error -71 [ 730.711066][ T3725] usb 6-1: USB disconnect, device number 53 22:16:06 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:06 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:06 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:06 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:06 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 731.141234][T11925] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 731.197527][T11927] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 731.276362][ T26] audit: type=1800 audit(1681596966.811:1983): pid=11937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 731.301783][ T26] audit: type=1804 audit(1681596966.821:1984): pid=11937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/215/file0" dev="sda1" ino=1178 res=1 errno=0 [ 731.836502][T11933] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 731.864582][T11925] 8021q: adding VLAN 0 to HW filter on device batadv56 [ 731.882506][T11925] bond36: (slave batadv56): Enslaving as a backup interface with an up link [ 731.899611][T11935] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 731.930630][T11939] bond36 (unregistering): (slave batadv56): Releasing backup interface [ 731.950229][ T3725] usb 6-1: new high-speed USB device number 54 using dummy_hcd 22:16:07 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 731.987062][T11939] bond36 (unregistering): Released all slaves [ 732.047709][T11944] 8021q: adding VLAN 0 to HW filter on device batadv210 [ 732.061877][T11944] bond32: (slave batadv210): Enslaving as a backup interface with an up link [ 732.449409][T11946] bond32 (unregistering): (slave batadv210): Releasing backup interface 22:16:08 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:08 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 732.769644][T11946] bond32 (unregistering): Released all slaves 22:16:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:08 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 732.874958][T11959] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 732.930087][ T3725] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 732.941630][ T3725] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 732.951861][ T3725] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 732.966277][T11963] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 732.997887][T11964] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 733.098455][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 733.112286][ T26] audit: type=1800 audit(1681596968.631:1993): pid=11969 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 733.629419][ T26] audit: type=1804 audit(1681596968.631:1994): pid=11969 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/217/file0" dev="sda1" ino=1178 res=1 errno=0 [ 733.652509][T11972] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:09 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 733.674490][ T26] audit: type=1804 audit(1681596968.631:1995): pid=11969 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/217/file0" dev="sda1" ino=1178 res=1 errno=0 [ 733.700135][ T3725] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 733.709488][ T3725] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.717646][ T3725] usb 6-1: Product: syz [ 733.722014][ T3725] usb 6-1: Manufacturer: syz [ 733.726710][ T3725] usb 6-1: SerialNumber: syz [ 733.730730][ T26] audit: type=1804 audit(1681596968.711:1996): pid=11970 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/217/file0" dev="sda1" ino=1178 res=1 errno=0 [ 733.764115][T11959] 8021q: adding VLAN 0 to HW filter on device batadv57 [ 733.794536][T11959] bond36: (slave batadv57): Enslaving as a backup interface with an up link [ 733.853367][T11964] 8021q: adding VLAN 0 to HW filter on device batadv211 [ 733.878497][T11964] bond32: (slave batadv211): Enslaving as a backup interface with an up link [ 733.895069][T11967] bond32 (unregistering): (slave batadv211): Releasing backup interface [ 733.924151][T11967] bond32 (unregistering): Released all slaves [ 733.969677][T11959] bond36 (unregistering): (slave batadv57): Releasing backup interface [ 733.983194][T11959] bond36 (unregistering): Released all slaves [ 734.870290][ T3725] cdc_ncm 6-1:1.0: bind() failure [ 734.899124][ T3725] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 734.920095][ T3725] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 734.940116][ T3725] usbtest: probe of 6-1:1.1 failed with error -71 [ 734.959713][ T3725] usb 6-1: USB disconnect, device number 54 22:16:10 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 22:16:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:10 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:10 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:10 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 735.393600][T11983] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 735.434801][T11985] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 735.470276][T11983] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 735.492304][T11985] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 735.526397][T11983] 8021q: adding VLAN 0 to HW filter on device batadv58 [ 735.536378][ T26] audit: type=1800 audit(1681596971.101:1997): pid=11994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1182 res=0 errno=0 [ 735.588786][T11983] bond36: (slave batadv58): Enslaving as a backup interface with an up link [ 735.623782][ T26] audit: type=1804 audit(1681596971.121:1998): pid=11994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/218/file0" dev="sda1" ino=1182 res=1 errno=0 [ 735.659988][ T1065] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 735.684547][T11985] 8021q: adding VLAN 0 to HW filter on device batadv212 [ 735.723439][T11985] bond32: (slave batadv212): Enslaving as a backup interface with an up link [ 735.729934][ T3725] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 735.740273][ T26] audit: type=1804 audit(1681596971.131:1999): pid=11994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/218/file0" dev="sda1" ino=1182 res=1 errno=0 [ 735.766542][ T26] audit: type=1804 audit(1681596971.261:2000): pid=11997 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/218/file0" dev="sda1" ino=1182 res=1 errno=0 [ 735.803949][T11991] bond32 (unregistering): (slave batadv212): Releasing backup interface [ 735.852185][T11991] bond32 (unregistering): Released all slaves [ 735.859978][ T1065] usb 5-1: device descriptor read/64, error 18 [ 735.929117][T11995] bond36 (unregistering): (slave batadv58): Releasing backup interface [ 735.968929][T11995] bond36 (unregistering): Released all slaves 22:16:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:11 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 736.121520][T11999] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 736.130064][ T1065] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 736.150290][ T3725] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 736.180773][ T3725] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 736.226318][ T3725] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 736.263610][T12000] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 736.293817][T12002] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 736.330416][ T1065] usb 5-1: device descriptor read/64, error 18 [ 736.342375][T12005] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 736.389121][T11999] 8021q: adding VLAN 0 to HW filter on device batadv213 [ 736.430751][T11999] bond32: (slave batadv213): Enslaving as a backup interface with an up link [ 736.441812][ T3725] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 736.450110][ T1065] usb usb5-port1: attempt power cycle [ 736.456415][ T3725] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.484535][ T3725] usb 6-1: Product: syz [ 736.493451][ T3725] usb 6-1: Manufacturer: syz [ 736.507145][ T3725] usb 6-1: SerialNumber: syz [ 736.540164][T12000] bond32 (unregistering): (slave batadv213): Releasing backup interface [ 736.583597][T12000] bond32 (unregistering): Released all slaves [ 736.643211][T12002] 8021q: adding VLAN 0 to HW filter on device batadv59 [ 736.674059][T12002] bond36: (slave batadv59): Enslaving as a backup interface with an up link 22:16:12 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 736.706493][T12005] bond36 (unregistering): (slave batadv59): Releasing backup interface [ 736.748496][T12005] bond36 (unregistering): Released all slaves 22:16:12 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 736.860124][ T1065] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 736.870717][ T26] audit: type=1800 audit(1681596972.431:2001): pid=12010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1144 res=0 errno=0 22:16:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 736.903294][T12012] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 736.938905][ T26] audit: type=1804 audit(1681596972.461:2002): pid=12010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/219/file0" dev="sda1" ino=1144 res=1 errno=0 [ 736.980143][ T1065] usb 5-1: Invalid ep0 maxpacket: 0 [ 736.986131][T12014] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 737.040474][T12017] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 737.129106][T12012] 8021q: adding VLAN 0 to HW filter on device batadv214 [ 737.129971][ T1065] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 737.149128][T12012] bond32: (slave batadv214): Enslaving as a backup interface with an up link 22:16:12 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 737.170079][T12018] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 737.187410][T12014] bond32 (unregistering): (slave batadv214): Releasing backup interface [ 737.202115][T12014] bond32 (unregistering): Released all slaves [ 737.257494][T12020] 8021q: adding VLAN 0 to HW filter on device batadv60 [ 737.270264][ T1065] usb 5-1: Invalid ep0 maxpacket: 0 [ 737.275932][ T1065] usb usb5-port1: unable to enumerate USB device [ 737.293873][T12020] bond36: (slave batadv60): Enslaving as a backup interface with an up link [ 737.336241][T12017] bond36 (unregistering): (slave batadv60): Releasing backup interface [ 737.403525][T12017] bond36 (unregistering): Released all slaves [ 737.451103][ T3725] cdc_ncm 6-1:1.0: bind() failure [ 737.468887][ T3725] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 737.493922][ T3725] cdc_ncm 6-1:1.1: bind() failure [ 737.517090][ T3725] usb 6-1: USB disconnect, device number 55 22:16:13 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:13 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:13 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) [ 737.978935][T12028] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 738.150300][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 738.150499][ T26] audit: type=1800 audit(1681596973.641:2005): pid=12033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1179 res=0 errno=0 22:16:14 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 738.676917][ T26] audit: type=1804 audit(1681596973.641:2006): pid=12033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/136/file0" dev="sda1" ino=1179 res=1 errno=0 [ 738.703138][ T26] audit: type=1804 audit(1681596973.651:2007): pid=12033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/136/file0" dev="sda1" ino=1179 res=1 errno=0 [ 738.760115][ T26] audit: type=1804 audit(1681596973.781:2008): pid=12034 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/136/file0" dev="sda1" ino=1179 res=1 errno=0 [ 738.764627][T12035] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:14 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 738.820081][ T4017] usb 6-1: new high-speed USB device number 56 using dummy_hcd 22:16:14 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 738.903626][T12036] 8021q: adding VLAN 0 to HW filter on device batadv215 [ 738.915892][T12036] bond32: (slave batadv215): Enslaving as a backup interface with an up link [ 738.929303][T12037] bond32 (unregistering): (slave batadv215): Releasing backup interface [ 739.249505][ T26] audit: type=1800 audit(1681596974.551:2009): pid=12045 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1140 res=0 errno=0 [ 739.379319][T12037] bond32 (unregistering): Released all slaves [ 739.390445][ T4017] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 739.531571][ T4017] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 739.573648][ T26] audit: type=1804 audit(1681596974.561:2010): pid=12045 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/137/file0" dev="sda1" ino=1140 res=1 errno=0 [ 739.614469][ T26] audit: type=1804 audit(1681596974.571:2011): pid=12045 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/137/file0" dev="sda1" ino=1140 res=1 errno=0 [ 739.627454][ T4017] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 739.640927][ T26] audit: type=1804 audit(1681596974.641:2012): pid=12046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/137/file0" dev="sda1" ino=1140 res=1 errno=0 22:16:15 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:15 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 739.769963][ T3685] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 739.778435][ T26] audit: type=1800 audit(1681596975.331:2013): pid=12050 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1140 res=0 errno=0 [ 739.831798][ T26] audit: type=1804 audit(1681596975.361:2014): pid=12050 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/220/file0" dev="sda1" ino=1140 res=1 errno=0 [ 739.850614][ T4017] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 739.878391][ T4017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.888071][T12055] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 739.903569][ T4017] usb 6-1: Product: syz [ 739.915727][ T4017] usb 6-1: Manufacturer: syz [ 739.970207][ T3685] usb 5-1: device descriptor read/64, error 18 [ 739.977576][ T4017] usb 6-1: SerialNumber: syz [ 740.270020][ T3685] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 740.594688][T12058] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 740.612374][T12062] bond32 (unregistering): Released all slaves 22:16:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 740.669927][ T3685] usb 5-1: device descriptor read/64, error 18 22:16:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 740.754437][T12067] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 740.810396][ T3685] usb usb5-port1: attempt power cycle [ 740.855953][T12070] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 740.885404][T12071] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 740.981527][T12067] 8021q: adding VLAN 0 to HW filter on device batadv61 [ 741.008810][T12067] bond36: (slave batadv61): Enslaving as a backup interface with an up link [ 741.041419][T12073] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:16 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 741.099222][T12071] 8021q: adding VLAN 0 to HW filter on device batadv216 [ 741.131984][T12071] bond32: (slave batadv216): Enslaving as a backup interface with an up link [ 741.170211][T12070] bond36 (unregistering): (slave batadv61): Releasing backup interface [ 741.199713][T12070] bond36 (unregistering): Released all slaves [ 741.240118][ T3685] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 741.254530][T12073] bond32 (unregistering): (slave batadv216): Releasing backup interface [ 741.300407][T12073] bond32 (unregistering): Released all slaves [ 741.350280][ T3685] usb 5-1: Invalid ep0 maxpacket: 0 22:16:16 executing program 3: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 741.500695][ T3685] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 741.520001][ T4017] cdc_ncm 6-1:1.0: bind() failure [ 741.534117][ T4017] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 741.578696][ T4017] cdc_ncm 6-1:1.1: bind() failure [ 741.590117][ T3685] usb 5-1: Invalid ep0 maxpacket: 0 [ 741.595661][ T3685] usb usb5-port1: unable to enumerate USB device [ 741.606237][ T4017] usb 6-1: USB disconnect, device number 56 22:16:17 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 22:16:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:17 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:17 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 742.052610][T12087] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 742.142393][T12094] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 742.208306][T12087] 8021q: adding VLAN 0 to HW filter on device batadv217 [ 742.252078][T12087] bond32: (slave batadv217): Enslaving as a backup interface with an up link [ 742.329274][T12087] bond32 (unregistering): (slave batadv217): Releasing backup interface [ 742.329931][ T3685] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 742.337987][ T2922] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 742.409549][T12087] bond32 (unregistering): Released all slaves 22:16:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 742.540173][ T3685] usb 5-1: device descriptor read/64, error 18 [ 742.568569][T12099] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 742.669829][T12101] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 742.740124][ T2922] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 742.772340][ T2922] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 742.796891][T12099] 8021q: adding VLAN 0 to HW filter on device batadv218 [ 742.820801][ T3685] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 742.825832][ T2922] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 742.855303][T12099] bond32: (slave batadv218): Enslaving as a backup interface with an up link [ 742.908192][T12101] bond32 (unregistering): (slave batadv218): Releasing backup interface [ 742.931905][T12101] bond32 (unregistering): Released all slaves [ 743.029916][ T3685] usb 5-1: device descriptor read/64, error 18 [ 743.040143][ T2922] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 743.061167][ T2922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 22:16:18 executing program 3: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 743.085975][ T2922] usb 6-1: Product: syz [ 743.100500][ T2922] usb 6-1: Manufacturer: syz [ 743.115735][ T2922] usb 6-1: SerialNumber: syz 22:16:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:18 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 743.150119][ T3685] usb usb5-port1: attempt power cycle [ 743.214632][T12106] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 743.272661][T12111] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 743.345939][T12106] 8021q: adding VLAN 0 to HW filter on device batadv219 [ 743.371243][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 743.371260][ T26] audit: type=1800 audit(1681596978.891:2029): pid=12113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1166 res=0 errno=0 [ 743.437469][T12106] bond32: (slave batadv219): Enslaving as a backup interface with an up link [ 743.506534][ T26] audit: type=1804 audit(1681596978.921:2030): pid=12113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/141/file0" dev="sda1" ino=1166 res=1 errno=0 [ 743.536664][T12111] bond32 (unregistering): (slave batadv219): Releasing backup interface [ 743.601896][T12111] bond32 (unregistering): Released all slaves [ 743.654372][ T26] audit: type=1804 audit(1681596978.961:2031): pid=12113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/141/file0" dev="sda1" ino=1166 res=1 errno=0 [ 743.682316][ T26] audit: type=1804 audit(1681596978.991:2032): pid=12113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/141/file0" dev="sda1" ino=1166 res=1 errno=0 22:16:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 743.863471][T12119] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 743.948824][T12122] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 743.959935][ T3685] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 743.970114][ T26] audit: type=1800 audit(1681596979.531:2033): pid=12123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 743.992437][ T26] audit: type=1804 audit(1681596979.531:2034): pid=12123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/222/file0" dev="sda1" ino=1178 res=1 errno=0 [ 744.018671][ T26] audit: type=1804 audit(1681596979.531:2035): pid=12123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/222/file0" dev="sda1" ino=1178 res=1 errno=0 [ 744.059672][ T26] audit: type=1804 audit(1681596979.581:2036): pid=12123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/222/file0" dev="sda1" ino=1178 res=1 errno=0 [ 744.062694][T12119] 8021q: adding VLAN 0 to HW filter on device batadv220 [ 744.093354][ T2922] cdc_ncm 6-1:1.0: bind() failure [ 744.100137][ T3685] usb 5-1: Invalid ep0 maxpacket: 0 22:16:19 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 744.109615][ T2922] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 744.141426][T12119] bond32: (slave batadv220): Enslaving as a backup interface with an up link [ 744.148597][ T2922] cdc_ncm 6-1:1.1: bind() failure [ 744.186786][ T2922] usb 6-1: USB disconnect, device number 57 [ 744.198260][T12122] bond32 (unregistering): (slave batadv220): Releasing backup interface [ 744.320208][ T3685] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 744.440936][ T3685] usb 5-1: Invalid ep0 maxpacket: 0 [ 744.459531][ T3685] usb usb5-port1: unable to enumerate USB device [ 744.503513][T12122] bond32 (unregistering): Released all slaves 22:16:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 744.778724][T12131] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 744.882516][T12134] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 744.929539][T12131] 8021q: adding VLAN 0 to HW filter on device batadv221 [ 744.938658][T12131] bond32: (slave batadv221): Enslaving as a backup interface with an up link [ 744.959742][T12131] bond32 (unregistering): (slave batadv221): Releasing backup interface 22:16:20 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:20 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 745.056068][T12131] bond32 (unregistering): Released all slaves 22:16:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 745.477578][T12143] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 745.589968][T12144] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 745.632460][T12143] 8021q: adding VLAN 0 to HW filter on device batadv222 [ 745.686896][T12143] bond32: (slave batadv222): Enslaving as a backup interface with an up link [ 745.739790][T12144] bond32 (unregistering): (slave batadv222): Releasing backup interface [ 745.769573][T12144] bond32 (unregistering): Released all slaves 22:16:21 executing program 3: sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 745.903279][T12148] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 745.919973][ T2922] usb 5-1: new high-speed USB device number 99 using dummy_hcd 22:16:21 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:21 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 745.953392][T12148] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 746.006865][T12148] 8021q: adding VLAN 0 to HW filter on device batadv223 [ 746.062720][T12148] bond32: (slave batadv223): Enslaving as a backup interface with an up link [ 746.075420][ T26] audit: type=1800 audit(1681596981.641:2037): pid=12158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 746.181159][ T26] audit: type=1804 audit(1681596981.661:2038): pid=12158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/142/file0" dev="sda1" ino=1178 res=1 errno=0 [ 746.238846][T12148] bond32 (unregistering): (slave batadv223): Releasing backup interface [ 746.300198][ T2922] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 746.340426][ T2922] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 746.420387][T12148] bond32 (unregistering): Released all slaves 22:16:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 746.546364][T12169] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 746.580169][ T2922] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 746.596640][ T2922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.608059][T12169] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 746.625934][ T2922] usb 5-1: Product: syz [ 746.639941][ T2922] usb 5-1: Manufacturer: syz [ 746.645099][ T2922] usb 5-1: SerialNumber: syz [ 746.672493][T12169] 8021q: adding VLAN 0 to HW filter on device batadv224 [ 746.684113][T12169] bond32: (slave batadv224): Enslaving as a backup interface with an up link [ 746.709349][T12169] bond32 (unregistering): (slave batadv224): Releasing backup interface [ 746.736583][T12169] bond32 (unregistering): Released all slaves 22:16:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 746.922938][T12172] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 747.063654][ T1376] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.069995][ T1376] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.078075][T12174] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 747.275905][T12172] 8021q: adding VLAN 0 to HW filter on device batadv225 [ 747.344781][T12172] bond32: (slave batadv225): Enslaving as a backup interface with an up link [ 747.447540][T12178] bond32 (unregistering): (slave batadv225): Releasing backup interface [ 747.529019][T12178] bond32 (unregistering): Released all slaves 22:16:23 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x0, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 747.732879][T12186] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:23 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 747.839383][T12188] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 747.910048][ T2922] cdc_ncm 5-1:1.0: bind() failure [ 747.954538][ T2922] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 748.000024][ T2922] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 748.008596][T12186] 8021q: adding VLAN 0 to HW filter on device batadv226 [ 748.133756][T12186] bond32: (slave batadv226): Enslaving as a backup interface with an up link [ 748.213641][T12188] bond32 (unregistering): (slave batadv226): Releasing backup interface [ 748.301696][T12188] bond32 (unregistering): Released all slaves 22:16:24 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 748.440015][ T2922] usbtest: probe of 5-1:1.1 failed with error -71 [ 748.481209][ T2922] usb 5-1: USB disconnect, device number 99 22:16:24 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x0, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 748.609055][T12198] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 748.674892][T12200] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:24 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 748.762184][T12198] 8021q: adding VLAN 0 to HW filter on device batadv227 [ 748.773245][T12198] bond32: (slave batadv227): Enslaving as a backup interface with an up link [ 748.793882][T12198] bond32 (unregistering): (slave batadv227): Releasing backup interface 22:16:24 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 748.851112][T12198] bond32 (unregistering): Released all slaves [ 748.891536][T12204] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 748.910050][ T2922] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 748.938013][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 748.938029][ T26] audit: type=1800 audit(1681596984.491:2045): pid=12208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1173 res=0 errno=0 [ 749.163103][ T26] audit: type=1804 audit(1681596984.531:2046): pid=12208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/224/file0" dev="sda1" ino=1173 res=1 errno=0 [ 749.280255][ T2922] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 749.305323][T12209] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. 22:16:24 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x0, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 749.330248][ T26] audit: type=1804 audit(1681596984.531:2047): pid=12208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/224/file0" dev="sda1" ino=1173 res=1 errno=0 [ 749.335881][ T2922] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 749.368711][ T26] audit: type=1804 audit(1681596984.651:2048): pid=12214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/224/file0" dev="sda1" ino=1173 res=1 errno=0 [ 749.383282][T12213] 8021q: adding VLAN 0 to HW filter on device batadv62 [ 749.441911][T12213] bond36: (slave batadv62): Enslaving as a backup interface with an up link 22:16:25 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 749.631130][T12215] bond36 (unregistering): (slave batadv62): Releasing backup interface [ 749.676609][T12215] bond36 (unregistering): Released all slaves [ 749.690510][ T2922] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 749.700327][ T2922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.708516][ T2922] usb 5-1: Product: syz [ 749.713664][ T2922] usb 5-1: Manufacturer: syz [ 749.718533][ T2922] usb 5-1: SerialNumber: syz 22:16:25 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 749.766219][T12217] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 749.830589][T12218] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 749.880413][T12219] 8021q: adding VLAN 0 to HW filter on device batadv228 [ 749.890508][T12219] bond32: (slave batadv228): Enslaving as a backup interface with an up link [ 749.912896][T12220] bond32 (unregistering): (slave batadv228): Releasing backup interface [ 749.942164][T12220] bond32 (unregistering): Released all slaves [ 750.043083][T12222] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 750.059673][T12223] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 22:16:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:25 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 750.332208][T12234] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 750.371721][T12232] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x0, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 750.436642][T12234] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 750.465487][T12236] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 750.541779][T12232] 8021q: adding VLAN 0 to HW filter on device batadv229 [ 750.564149][T12232] bond32: (slave batadv229): Enslaving as a backup interface with an up link [ 750.594466][T12234] 8021q: adding VLAN 0 to HW filter on device batadv63 [ 750.617413][T12234] bond36: (slave batadv63): Enslaving as a backup interface with an up link [ 750.640877][T12236] bond32 (unregistering): (slave batadv229): Releasing backup interface [ 750.668359][T12236] bond32 (unregistering): Released all slaves 22:16:26 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 750.716715][T12238] bond36 (unregistering): (slave batadv63): Releasing backup interface [ 750.749434][T12238] bond36 (unregistering): Released all slaves [ 750.783894][T12241] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 750.797405][T12242] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 750.880099][ T2922] cdc_ncm 5-1:1.0: bind() failure [ 750.910054][ T2922] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 750.950121][ T2922] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 750.981923][ T2922] usbtest: probe of 5-1:1.1 failed with error -71 [ 751.046284][ T2922] usb 5-1: USB disconnect, device number 100 22:16:26 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:26 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 751.400679][T12250] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 751.486445][T12258] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 751.511582][ T26] audit: type=1800 audit(1681596987.061:2049): pid=12265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=1177 res=0 errno=0 [ 751.632670][ T26] audit: type=1804 audit(1681596987.061:2050): pid=12265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/31/file0" dev="sda1" ino=1177 res=1 errno=0 [ 751.659780][T12263] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 751.761608][T12262] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:27 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 751.870118][ T26] audit: type=1804 audit(1681596987.061:2051): pid=12265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/31/file0" dev="sda1" ino=1177 res=1 errno=0 [ 751.871991][T12250] 8021q: adding VLAN 0 to HW filter on device batadv230 [ 751.895309][ T26] audit: type=1804 audit(1681596987.121:2052): pid=12266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/31/file0" dev="sda1" ino=1177 res=1 errno=0 [ 751.929268][ T26] audit: type=1800 audit(1681596987.251:2053): pid=12267 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 [ 751.951870][ T26] audit: type=1804 audit(1681596987.251:2054): pid=12267 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/225/file0" dev="sda1" ino=1178 res=1 errno=0 [ 752.007498][ T1195] usb 5-1: new high-speed USB device number 101 using dummy_hcd 22:16:28 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:28 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 752.761702][T12250] bond32: (slave batadv230): Enslaving as a backup interface with an up link [ 752.815665][T12268] bond32 (unregistering): (slave batadv230): Releasing backup interface [ 752.849740][T12268] bond32 (unregistering): Released all slaves [ 753.564386][T12263] bond36 (unregistering): Released all slaves 22:16:29 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:29 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:29 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) 22:16:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 754.340338][ T1195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:16:29 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 754.414536][ T1195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 754.420837][T12287] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. [ 755.128172][T12290] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 755.141901][ T1195] usb 5-1: string descriptor 0 read error: -71 [ 755.141983][ T1195] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 755.142005][ T1195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 22:16:30 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 755.190058][ T1195] usb 5-1: can't set config #1, error -71 [ 755.208917][ T1195] usb 5-1: USB disconnect, device number 101 [ 755.219280][T12292] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 755.302546][T12301] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 755.322863][T12304] 8021q: adding VLAN 0 to HW filter on device batadv231 [ 755.871503][T12304] bond32: (slave batadv231): Enslaving as a backup interface with an up link [ 756.009265][T12306] bond32 (unregistering): (slave batadv231): Releasing backup interface [ 756.047459][T12306] bond32 (unregistering): Released all slaves [ 756.086380][T12302] bond36 (unregistering): Released all slaves 22:16:31 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:31 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:31 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:31 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:33 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 757.738480][ T1195] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 757.760304][T12325] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:33 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 757.828397][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 757.828436][ T26] audit: type=1800 audit(1681596993.381:2061): pid=12327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1183 res=0 errno=0 [ 757.923554][T12329] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 757.933623][ T26] audit: type=1804 audit(1681596993.421:2062): pid=12330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/226/file0" dev="sda1" ino=1183 res=1 errno=0 [ 757.961587][ T26] audit: type=1804 audit(1681596993.431:2063): pid=12327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/226/file0" dev="sda1" ino=1183 res=1 errno=0 [ 758.010784][T12331] 8021q: adding VLAN 0 to HW filter on device batadv232 22:16:33 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 758.019394][T12331] bond32: (slave batadv232): Enslaving as a backup interface with an up link 22:16:33 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 758.046433][T12337] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 758.046570][ T26] audit: type=1804 audit(1681596993.601:2064): pid=12330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/226/file0" dev="sda1" ino=1183 res=1 errno=0 [ 758.086036][T12325] bond32 (unregistering): (slave batadv232): Releasing backup interface [ 758.203621][T12325] bond32 (unregistering): Released all slaves [ 759.670065][ T1195] usb 5-1: device descriptor read/64, error -71 22:16:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:35 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 759.732580][T12337] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 759.773366][T12337] bond36 (unregistering): Released all slaves [ 759.838069][T12353] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 22:16:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:35 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 759.929901][T12356] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 759.959917][ T1195] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 760.015522][T12358] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 760.023789][T12358] bond2: (slave batadv1): Enslaving as a backup interface with an up link [ 760.050886][T12353] bond2 (unregistering): (slave batadv1): Releasing backup interface [ 760.067271][T12353] bond2 (unregistering): Released all slaves [ 760.085230][T12364] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 760.108895][T12364] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 760.146311][T12364] 8021q: adding VLAN 0 to HW filter on device batadv233 [ 760.157380][T12364] bond32: (slave batadv233): Enslaving as a backup interface with an up link [ 760.206515][T12364] bond32 (unregistering): (slave batadv233): Releasing backup interface [ 760.263188][T12364] bond32 (unregistering): Released all slaves [ 760.279965][ T3686] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 760.390328][ T1195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 760.449509][ T1195] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 760.461636][ T1195] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 22:16:36 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:36 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:36 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 760.553309][T12368] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 760.614758][T12373] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 760.650174][ T3686] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 760.650179][ T1195] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 760.650212][ T3686] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 760.661225][ T1195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 760.688194][ T1195] usb 5-1: Product: syz [ 760.692652][ T1195] usb 5-1: Manufacturer: syz [ 760.697331][ T1195] usb 5-1: SerialNumber: syz [ 760.709957][ T26] audit: type=1800 audit(1681596996.261:2065): pid=12375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1174 res=0 errno=0 [ 760.739476][ T26] audit: type=1804 audit(1681596996.271:2066): pid=12375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/227/file0" dev="sda1" ino=1174 res=1 errno=0 [ 760.748144][T12368] 8021q: adding VLAN 0 to HW filter on device batadv234 [ 760.765244][ T26] audit: type=1804 audit(1681596996.271:2067): pid=12375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/227/file0" dev="sda1" ino=1174 res=1 errno=0 [ 760.790076][ T3686] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 760.801631][T12368] bond32: (slave batadv234): Enslaving as a backup interface with an up link [ 760.819082][ T26] audit: type=1804 audit(1681596996.371:2068): pid=12376 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/227/file0" dev="sda1" ino=1174 res=1 errno=0 [ 760.852468][ T3686] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 760.865244][T12368] bond32 (unregistering): (slave batadv234): Releasing backup interface [ 760.884921][ T3686] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 760.887711][T12368] bond32 (unregistering): Released all slaves 22:16:36 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 761.057016][T12379] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 761.070036][ T3686] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 761.079538][ T3687] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 761.089468][ T3686] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.119481][ T3686] usb 4-1: Product: syz [ 761.123988][ T3686] usb 4-1: Manufacturer: syz [ 761.128666][ T3686] usb 4-1: SerialNumber: syz [ 761.130835][T12381] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 761.229202][T12379] 8021q: adding VLAN 0 to HW filter on device batadv235 [ 761.271570][T12379] bond32: (slave batadv235): Enslaving as a backup interface with an up link [ 761.316899][T12381] bond32 (unregistering): (slave batadv235): Releasing backup interface [ 761.365571][T12381] bond32 (unregistering): Released all slaves 22:16:37 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 761.450320][ T3687] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.469674][ T3687] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 761.492412][ T3687] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 761.528953][ T3687] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 761.710161][ T3687] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 761.719264][ T3687] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.749904][ T3687] usb 6-1: Product: syz [ 761.754139][ T3687] usb 6-1: Manufacturer: syz [ 761.789897][ T3687] usb 6-1: SerialNumber: syz [ 761.910051][ T1195] cdc_ncm 5-1:1.0: bind() failure [ 761.940514][ T1195] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 761.970080][ T1195] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 762.000036][ T1195] usbtest: probe of 5-1:1.1 failed with error -71 [ 762.018291][ T1195] usb 5-1: USB disconnect, device number 103 [ 762.280187][ T3686] cdc_ncm 4-1:1.0: bind() failure [ 762.310091][ T3686] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 762.330296][ T3686] cdc_mbim: probe of 4-1:1.1 failed with error -71 22:16:37 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:37 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:37 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 762.360002][ T3686] usbtest: probe of 4-1:1.1 failed with error -71 [ 762.383085][ T3686] usb 4-1: USB disconnect, device number 9 [ 762.434355][T12389] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 762.536606][T12394] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 762.537105][ T26] audit: type=1800 audit(1681596998.091:2069): pid=12395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1172 res=0 errno=0 [ 762.610051][ T26] audit: type=1804 audit(1681596998.111:2070): pid=12395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/228/file0" dev="sda1" ino=1172 res=1 errno=0 [ 762.625594][T12389] 8021q: adding VLAN 0 to HW filter on device batadv236 22:16:38 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 762.707167][T12389] bond32: (slave batadv236): Enslaving as a backup interface with an up link [ 762.720001][ T1195] usb 5-1: new high-speed USB device number 104 using dummy_hcd 22:16:38 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 762.755194][T12394] bond32 (unregistering): (slave batadv236): Releasing backup interface [ 762.803623][T12394] bond32 (unregistering): Released all slaves 22:16:38 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 762.940130][ T3687] cdc_ncm 6-1:1.0: bind() failure [ 762.970237][ T3687] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 763.010235][ T3687] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 763.026199][T12405] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 763.030094][ T3687] usbtest: probe of 6-1:1.1 failed with error -71 [ 763.074776][ T3687] usb 6-1: USB disconnect, device number 58 [ 763.125306][T12407] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 763.135256][ T3725] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 763.143529][ T1195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 763.171814][ T1195] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 763.201783][T12405] 8021q: adding VLAN 0 to HW filter on device batadv237 [ 763.219440][ T1195] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 763.262863][T12405] bond32: (slave batadv237): Enslaving as a backup interface with an up link [ 763.304515][T12407] bond32 (unregistering): (slave batadv237): Releasing backup interface [ 763.344065][T12407] bond32 (unregistering): Released all slaves 22:16:39 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 763.460333][ T1195] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 763.511112][ T1195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.527014][T12409] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 763.536974][ T1195] usb 5-1: Product: syz [ 763.549746][ T1195] usb 5-1: Manufacturer: syz [ 763.560606][ T1195] usb 5-1: SerialNumber: syz [ 763.570437][ T3725] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 763.610409][T12411] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 763.704862][T12413] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 763.733608][T12414] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 763.780185][ T3725] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 763.780213][T12409] 8021q: adding VLAN 0 to HW filter on device batadv238 [ 763.793897][ T3725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.817357][ T3725] usb 4-1: Product: syz [ 763.827479][ T3725] usb 4-1: Manufacturer: syz [ 763.839588][ T3725] usb 4-1: SerialNumber: syz [ 763.853041][T12409] bond32: (slave batadv238): Enslaving as a backup interface with an up link [ 763.877373][T12416] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 763.919388][T12417] bond32 (unregistering): (slave batadv238): Releasing backup interface [ 763.961629][T12417] bond32 (unregistering): Released all slaves [ 763.992221][T12418] bond2 (unregistering): Released all slaves 22:16:39 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32=r5], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 764.148553][T12421] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:39 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:39 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 764.255051][T12421] 8021q: adding VLAN 0 to HW filter on device batadv239 [ 764.286663][T12421] bond32: (slave batadv239): Enslaving as a backup interface with an up link [ 764.345988][T12423] bond32 (unregistering): (slave batadv239): Releasing backup interface [ 764.360867][T12423] bond32 (unregistering): Released all slaves [ 764.434605][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 764.434620][ T26] audit: type=1800 audit(1681596999.991:2073): pid=12434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1174 res=0 errno=0 [ 764.482564][ T26] audit: type=1804 audit(1681597000.021:2074): pid=12434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/229/file0" dev="sda1" ino=1174 res=1 errno=0 [ 764.508798][ T26] audit: type=1804 audit(1681597000.021:2075): pid=12434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/229/file0" dev="sda1" ino=1174 res=1 errno=0 [ 764.509136][T12425] bond2 (unregistering): Released all slaves [ 764.561559][ T26] audit: type=1804 audit(1681597000.111:2076): pid=12436 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/229/file0" dev="sda1" ino=1174 res=1 errno=0 [ 764.700484][ T1195] cdc_ncm 5-1:1.0: bind() failure [ 764.730227][ T1195] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 764.750197][ T1195] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 764.790034][ T1195] usbtest: probe of 5-1:1.1 failed with error -71 [ 764.823002][ T1195] usb 5-1: USB disconnect, device number 104 [ 765.030042][ T3725] cdc_ncm 4-1:1.0: failed to get mac address [ 765.050589][ T3725] cdc_ncm 4-1:1.0: bind() failure [ 765.090014][ T3725] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 765.110825][ T3725] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 765.130059][ T3725] usbtest: probe of 4-1:1.1 failed with error -71 22:16:40 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:40 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:40 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 765.163573][ T3725] usb 4-1: USB disconnect, device number 10 [ 765.216886][T12440] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 765.280999][T12440] __nla_validate_parse: 3 callbacks suppressed [ 765.281043][T12440] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:41 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 765.997594][T12440] 8021q: adding VLAN 0 to HW filter on device batadv240 [ 766.012375][T12440] bond32: (slave batadv240): Enslaving as a backup interface with an up link [ 766.030288][T12443] bond32 (unregistering): (slave batadv240): Releasing backup interface 22:16:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 766.105679][T12443] bond32 (unregistering): Released all slaves 22:16:41 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 766.875142][ T1065] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 766.907084][T12455] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 766.949941][ T3686] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 766.973522][T12457] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 767.049241][T12455] 8021q: adding VLAN 0 to HW filter on device batadv241 [ 767.063214][T12455] bond32: (slave batadv241): Enslaving as a backup interface with an up link [ 767.579546][T12455] bond32 (unregistering): (slave batadv241): Releasing backup interface [ 767.745119][T12455] bond32 (unregistering): Released all slaves 22:16:43 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 767.850252][ T1065] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 767.877951][ T1065] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 767.886779][T12463] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 22:16:43 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 767.900318][ T3686] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 767.924783][ T1065] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 22:16:43 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 767.968570][T12465] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 768.014385][T12467] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 768.090940][ T3686] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 768.106742][T12463] 8021q: adding VLAN 0 to HW filter on device batadv242 [ 768.120112][ T1065] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 768.130367][ T3686] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 22:16:43 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 768.146313][ T1065] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.156354][T12463] bond32: (slave batadv242): Enslaving as a backup interface with an up link [ 768.175668][ T3686] usb 4-1: Product: syz [ 768.187386][ T1065] usb 5-1: Product: syz [ 768.193611][T12470] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 768.212707][ T3686] usb 4-1: Manufacturer: syz [ 768.227954][ T1065] usb 5-1: Manufacturer: syz [ 768.251141][T12465] bond32 (unregistering): (slave batadv242): Releasing backup interface [ 768.256166][ T3686] usb 4-1: SerialNumber: syz [ 768.271488][ T1065] usb 5-1: SerialNumber: syz [ 768.273711][T12465] bond32 (unregistering): Released all slaves 22:16:43 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 768.290747][ T26] audit: type=1800 audit(1681597003.841:2077): pid=12476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 22:16:43 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 768.360913][T12467] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 768.376919][ T1065] usb 5-1: can't set config #1, error -71 [ 768.401465][ T26] audit: type=1804 audit(1681597003.841:2078): pid=12476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/230/file0" dev="sda1" ino=1178 res=1 errno=0 [ 768.426849][ T1065] usb 5-1: USB disconnect, device number 105 [ 768.431597][T12467] bond2: (slave batadv3): Enslaving as a backup interface with an up link [ 768.484394][ T26] audit: type=1804 audit(1681597003.851:2079): pid=12476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/230/file0" dev="sda1" ino=1178 res=1 errno=0 [ 768.532615][T12474] bond2 (unregistering): (slave batadv3): Releasing backup interface [ 768.546312][ T26] audit: type=1804 audit(1681597003.901:2080): pid=12477 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/230/file0" dev="sda1" ino=1178 res=1 errno=0 22:16:44 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 768.600673][T12474] bond2 (unregistering): Released all slaves [ 768.660469][ T26] audit: type=1800 audit(1681597004.031:2081): pid=12481 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1174 res=0 errno=0 22:16:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 768.711013][ T26] audit: type=1804 audit(1681597004.031:2082): pid=12481 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/231/file0" dev="sda1" ino=1174 res=1 errno=0 [ 768.850048][ T1065] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 769.070743][ T3894] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.171960][ T3894] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.211084][ T1065] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 769.231398][ T1065] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 769.259927][ T1065] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 769.318286][ T3894] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.420214][ T1065] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 769.439953][ T1065] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.459922][ T1065] usb 5-1: Product: syz [ 769.464118][ T1065] usb 5-1: Manufacturer: syz [ 769.468725][ T1065] usb 5-1: SerialNumber: syz [ 769.510031][ T3686] cdc_ncm 4-1:1.0: failed to get mac address [ 769.530380][ T3894] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.542551][ T3686] cdc_ncm 4-1:1.0: bind() failure [ 769.570085][ T3686] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 769.600016][ T3686] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 769.620035][ T3686] usbtest: probe of 4-1:1.1 failed with error -71 [ 769.670171][ T3686] usb 4-1: USB disconnect, device number 11 22:16:45 executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:45 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(r1, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:45 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:45 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 770.049441][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 770.049456][ T26] audit: type=1800 audit(1681597005.601:2089): pid=12493 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1166 res=0 errno=0 22:16:45 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(r1, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 770.169165][ T26] audit: type=1804 audit(1681597005.631:2090): pid=12493 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/233/file0" dev="sda1" ino=1166 res=1 errno=0 [ 770.280149][ T26] audit: type=1804 audit(1681597005.631:2091): pid=12493 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/233/file0" dev="sda1" ino=1166 res=1 errno=0 [ 770.341320][ T26] audit: type=1804 audit(1681597005.691:2092): pid=12501 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/233/file0" dev="sda1" ino=1166 res=1 errno=0 [ 770.379953][ T1195] usb 6-1: new high-speed USB device number 59 using dummy_hcd 22:16:46 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(r1, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 770.400336][ T26] audit: type=1800 audit(1681597005.861:2093): pid=12509 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1173 res=0 errno=0 [ 770.422531][ T3685] usb 4-1: new high-speed USB device number 12 using dummy_hcd 22:16:46 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 770.501845][ T26] audit: type=1804 audit(1681597005.861:2094): pid=12509 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/234/file0" dev="sda1" ino=1173 res=1 errno=0 [ 770.751206][ T1065] cdc_ncm 5-1:1.0: bind() failure [ 770.820564][ T1195] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 770.835393][ T26] audit: type=1804 audit(1681597005.861:2095): pid=12509 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/234/file0" dev="sda1" ino=1173 res=1 errno=0 [ 770.880322][ T3685] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 770.927602][ T3894] device hsr_slave_0 left promiscuous mode [ 770.962443][ T3894] device hsr_slave_1 left promiscuous mode [ 770.999167][ T3894] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 771.005741][ T26] audit: type=1804 audit(1681597005.921:2096): pid=12510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/234/file0" dev="sda1" ino=1173 res=1 errno=0 [ 771.031790][ T1065] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 771.038540][ T26] audit: type=1800 audit(1681597006.031:2097): pid=12514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1173 res=0 errno=0 [ 771.042886][ T3894] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 771.059956][ T1065] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 771.075117][ T26] audit: type=1804 audit(1681597006.031:2098): pid=12514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/235/file0" dev="sda1" ino=1173 res=1 errno=0 [ 771.123525][ T3894] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 771.130106][ T1065] usbtest: probe of 5-1:1.1 failed with error -71 [ 771.131810][ T3685] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 771.146657][ T1195] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 771.151175][ T1065] usb 5-1: USB disconnect, device number 106 22:16:46 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 771.182096][ T1195] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.224503][ T3685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.240044][ T3894] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 771.254763][ T1195] usb 6-1: Product: syz [ 771.270512][ T1195] usb 6-1: Manufacturer: syz [ 771.278637][ T3685] usb 4-1: Product: syz [ 771.287798][ T1195] usb 6-1: SerialNumber: syz [ 771.290082][ T3894] device bridge_slave_1 left promiscuous mode [ 771.293862][ T3685] usb 4-1: Manufacturer: syz [ 771.298628][ T3894] bridge0: port 2(bridge_slave_1) entered disabled state [ 771.311224][ T3685] usb 4-1: SerialNumber: syz [ 771.391193][ T3894] device bridge_slave_0 left promiscuous mode [ 771.397428][ T3894] bridge0: port 1(bridge_slave_0) entered disabled state 22:16:47 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 771.508137][ T3894] device veth1_macvtap left promiscuous mode [ 771.532504][ T3894] device veth0_macvtap left promiscuous mode [ 771.543155][ T3860] batman_adv: batadv241: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 771.545460][ T3894] device veth1_vlan left promiscuous mode [ 771.681125][ T1065] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 771.747587][ T3894] device veth0_vlan left promiscuous mode [ 772.051657][ T1065] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 772.100335][ T1065] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 772.138849][ T1065] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 22:16:47 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 772.330579][ T1065] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 772.390720][ T1065] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.398871][ T1065] usb 5-1: Product: syz [ 772.419953][ T1065] usb 5-1: Manufacturer: syz [ 772.424686][ T1065] usb 5-1: SerialNumber: syz 22:16:48 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 772.830155][ T3685] cdc_ncm 4-1:1.0: failed to get mac address [ 772.839058][ T1195] cdc_ncm 6-1:1.0: failed to get mac address [ 772.860576][ T1195] cdc_ncm 6-1:1.0: bind() failure [ 772.866313][ T3685] cdc_ncm 4-1:1.0: bind() failure [ 772.900082][ T3685] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 772.906861][ T1195] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 772.931074][ T1195] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 772.937740][ T3685] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 772.970035][ T3685] usbtest: probe of 4-1:1.1 failed with error -71 [ 772.976682][ T1195] usbtest: probe of 6-1:1.1 failed with error -71 [ 772.986133][ T3685] usb 4-1: USB disconnect, device number 12 [ 773.006054][ T1195] usb 6-1: USB disconnect, device number 59 [ 773.268957][ T3894] bond31 (unregistering): (slave batadv185): Releasing backup interface [ 773.285827][ T3894] bond31 (unregistering): Released all slaves [ 773.302045][ T3894] bond30 (unregistering): (slave batadv184): Releasing backup interface [ 773.316487][ T3894] bond30 (unregistering): Released all slaves [ 773.334928][ T3894] bond29 (unregistering): (slave batadv183): Releasing backup interface [ 773.349027][ T3894] bond29 (unregistering): Released all slaves [ 773.363588][ T3894] bond28 (unregistering): (slave batadv182): Releasing backup interface [ 773.378484][ T3894] bond28 (unregistering): Released all slaves [ 773.392183][ T3894] bond27 (unregistering): (slave batadv181): Releasing backup interface [ 773.415848][ T3894] bond27 (unregistering): Released all slaves [ 773.447040][ T3894] bond26 (unregistering): (slave batadv180): Releasing backup interface [ 773.478885][ T3894] bond26 (unregistering): Released all slaves [ 773.506026][ T3894] bond25 (unregistering): (slave batadv179): Releasing backup interface [ 773.537448][ T3894] bond25 (unregistering): Released all slaves [ 773.569381][ T3894] bond24 (unregistering): (slave batadv178): Releasing backup interface [ 773.578269][ T1065] cdc_ncm 5-1:1.0: bind() failure [ 773.600011][ T1065] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 773.618749][ T3894] bond24 (unregistering): Released all slaves [ 773.625503][ T1065] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 773.652477][ T1065] usbtest: probe of 5-1:1.1 failed with error -71 [ 773.669572][ T1065] usb 5-1: USB disconnect, device number 107 [ 773.700291][ T3894] bond23 (unregistering): (slave batadv177): Releasing backup interface [ 773.722650][ T3894] bond23 (unregistering): Released all slaves [ 773.822002][ T3894] bond22 (unregistering): Released all slaves [ 773.853931][ T3894] bond9 (unregistering): (slave batadv164): Releasing backup interface [ 773.886386][ T3894] bond9 (unregistering): (slave batadv163): Releasing backup interface [ 773.915076][ T3894] bond9 (unregistering): (slave batadv162): Releasing backup interface [ 773.966780][ T3894] bond9 (unregistering): (slave batadv158): Releasing backup interface [ 773.996481][ T3894] bond9 (unregistering): (slave batadv157): Releasing backup interface [ 774.024072][ T3894] bond9 (unregistering): (slave batadv156): Releasing backup interface [ 774.046686][ T3894] bond9 (unregistering): (slave batadv155): Releasing backup interface [ 774.059329][ T3894] bond9 (unregistering): (slave batadv154): Releasing backup interface [ 774.072957][ T3894] bond9 (unregistering): (slave batadv153): Releasing backup interface [ 774.097125][ T3894] bond9 (unregistering): (slave batadv152): Releasing backup interface [ 774.125105][ T3894] bond9 (unregistering): (slave batadv151): Releasing backup interface [ 774.137822][ T3894] bond9 (unregistering): (slave batadv150): Releasing backup interface [ 774.440803][ T3894] bond21 (unregistering): Released all slaves [ 774.459811][ T3894] bond20 (unregistering): Released all slaves [ 774.476510][ T3894] bond19 (unregistering): Released all slaves [ 774.493107][ T3894] bond18 (unregistering): Released all slaves [ 774.509455][ T3894] bond17 (unregistering): Released all slaves [ 774.525281][ T3894] bond16 (unregistering): Released all slaves [ 774.543906][ T3894] bond15 (unregistering): Released all slaves [ 774.564694][ T3894] bond14 (unregistering): Released all slaves [ 774.580699][ T3894] bond13 (unregistering): Released all slaves [ 774.593475][ T3894] bond9 (unregistering): (slave batadv45): Releasing backup interface [ 774.605956][ T3894] bond9 (unregistering): (slave batadv44): Releasing backup interface [ 774.618453][ T3894] bond9 (unregistering): (slave batadv43): Releasing backup interface [ 774.631934][ T3894] bond9 (unregistering): (slave batadv42): Releasing backup interface [ 774.646553][ T3894] bond9 (unregistering): (slave batadv41): Releasing backup interface [ 774.660473][ T3894] bond9 (unregistering): (slave batadv40): Releasing backup interface [ 774.673079][ T3894] bond9 (unregistering): (slave batadv39): Releasing backup interface [ 774.686802][ T3894] bond9 (unregistering): (slave batadv38): Releasing backup interface [ 774.699522][ T3894] bond9 (unregistering): (slave batadv37): Releasing backup interface [ 774.716697][ T3894] bond12 (unregistering): Released all slaves [ 774.734853][ T3894] bond11 (unregistering): Released all slaves [ 774.751723][ T3894] bond10 (unregistering): Released all slaves [ 774.765686][ T3894] bond9 (unregistering): Released all slaves [ 774.812563][ T3894] bond8 (unregistering): (slave batadv21): Releasing backup interface [ 774.825865][ T3894] bond8 (unregistering): Released all slaves [ 774.840813][ T3894] bond7 (unregistering): (slave batadv20): Releasing backup interface [ 774.854711][ T3894] bond7 (unregistering): Released all slaves [ 774.867744][ T3894] bond6 (unregistering): (slave batadv19): Releasing backup interface [ 774.882686][ T3894] bond6 (unregistering): Released all slaves [ 774.895495][ T3894] bond5 (unregistering): (slave batadv18): Releasing backup interface [ 774.910493][ T3894] bond5 (unregistering): Released all slaves [ 774.922844][ T3894] bond4 (unregistering): (slave batadv17): Releasing backup interface [ 774.936461][ T3894] bond4 (unregistering): Released all slaves [ 774.950217][ T3894] bond3 (unregistering): (slave batadv16): Releasing backup interface [ 774.964611][ T3894] bond3 (unregistering): Released all slaves [ 774.996377][ T3894] bond2 (unregistering): (slave batadv8): Releasing backup interface [ 775.011464][ T3894] bond2 (unregistering): Released all slaves [ 775.042635][ T3894] bond1 (unregistering): Released all slaves [ 775.154356][ T3894] team0 (unregistering): Port device team_slave_1 removed [ 775.170776][ T3894] team0 (unregistering): Port device team_slave_0 removed [ 775.185259][ T3894] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 775.205267][ T3894] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 775.287180][ T3894] bond0 (unregistering): Released all slaves [ 775.564387][T12547] chnl_net:caif_netlink_parms(): no params data found [ 775.636080][T12547] bridge0: port 1(bridge_slave_0) entered blocking state [ 775.643428][T12547] bridge0: port 1(bridge_slave_0) entered disabled state [ 775.652115][T12547] device bridge_slave_0 entered promiscuous mode [ 775.665941][T12547] bridge0: port 2(bridge_slave_1) entered blocking state [ 775.673703][T12547] bridge0: port 2(bridge_slave_1) entered disabled state [ 775.683359][T12547] device bridge_slave_1 entered promiscuous mode [ 775.728737][T12547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 775.744756][T12547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 775.808754][T12547] team0: Port device team_slave_0 added [ 775.828115][T12547] team0: Port device team_slave_1 added [ 775.850225][ T3685] Bluetooth: hci4: command 0x0409 tx timeout [ 775.885280][T12547] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 775.900569][T12547] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 775.926903][T12547] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 775.951719][T12547] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 775.958773][T12547] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 775.999598][T12547] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 776.082671][T12547] device hsr_slave_0 entered promiscuous mode [ 776.089647][T12547] device hsr_slave_1 entered promiscuous mode [ 776.110720][T12547] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 776.118393][T12547] Cannot create hsr debugfs directory [ 776.730062][T12547] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 776.739741][T12547] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 776.769210][T12547] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 776.780936][T12547] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 776.922568][T12547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 776.943554][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 776.952090][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 776.963782][T12547] 8021q: adding VLAN 0 to HW filter on device team0 [ 776.989705][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 776.999775][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 777.008619][ T3686] bridge0: port 1(bridge_slave_0) entered blocking state [ 777.015755][ T3686] bridge0: port 1(bridge_slave_0) entered forwarding state [ 777.049031][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 777.058298][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 777.067489][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 777.076550][ T2922] bridge0: port 2(bridge_slave_1) entered blocking state [ 777.083708][ T2922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 777.092017][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 777.101130][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 777.115329][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 777.129261][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 777.147218][T12547] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 777.163819][T12547] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 777.181889][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 777.195668][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 777.208806][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 777.220599][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 777.229103][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 777.238000][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 777.247759][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 777.266589][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 777.465123][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 777.473453][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 777.485628][T12547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 777.531265][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 777.540839][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 777.568046][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 777.576780][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 777.587691][T12547] device veth0_vlan entered promiscuous mode [ 777.602798][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 777.613182][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 777.633134][T12547] device veth1_vlan entered promiscuous mode [ 777.680200][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 777.688371][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 777.707357][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 777.721356][ T3686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 777.739032][T12547] device veth0_macvtap entered promiscuous mode [ 777.772892][T12547] device veth1_macvtap entered promiscuous mode [ 777.807755][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 777.825423][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 777.840447][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 777.860394][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 777.880043][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 777.902675][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 777.916244][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 777.930394][ T3725] Bluetooth: hci4: command 0x041b tx timeout [ 777.931852][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 777.953472][T12547] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 777.970012][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 777.981789][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 777.990437][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 777.999376][ T4017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 778.014244][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 778.026695][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 778.039359][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 778.050617][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 778.060908][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 778.074570][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 778.099919][T12547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 778.119904][T12547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 778.132102][T12547] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 778.148232][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 778.158624][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 778.171970][T12547] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.185467][T12547] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.195088][T12547] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.215275][T12547] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.339148][ T3862] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.360479][ T3862] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.384791][ T3860] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.386548][ T2922] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 778.400270][ T3860] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.414364][ T3725] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 778.484014][T12643] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 778.521319][T12643] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:54 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:16:54 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:54 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000006c0)={0x14, 0x0, &(0x7f0000000440)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 22:16:54 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:54 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:54 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 778.787967][T12666] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 778.798101][T12666] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:16:55 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:55 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 780.096276][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 780.096295][ T26] audit: type=1800 audit(1681597014.591:2113): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1179 res=0 errno=0 [ 780.096331][ T26] audit: type=1804 audit(1681597014.691:2114): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/239/file0" dev="sda1" ino=1179 res=1 errno=0 [ 780.096364][ T26] audit: type=1804 audit(1681597014.791:2115): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/239/file0" dev="sda1" ino=1179 res=1 errno=0 22:16:56 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 780.270872][ T3692] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 780.271282][ T26] audit: type=1804 audit(1681597015.831:2116): pid=12672 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/239/file0" dev="sda1" ino=1179 res=1 errno=0 [ 780.401760][ T26] audit: type=1800 audit(1681597015.951:2117): pid=12684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1179 res=0 errno=0 [ 780.401803][ T26] audit: type=1804 audit(1681597015.951:2118): pid=12684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/153/file0" dev="sda1" ino=1179 res=1 errno=0 [ 780.401834][ T26] audit: type=1804 audit(1681597015.951:2119): pid=12684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/153/file0" dev="sda1" ino=1179 res=1 errno=0 [ 780.452180][ T26] audit: type=1804 audit(1681597016.011:2120): pid=12685 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3567933697/syzkaller.sAwSVm/153/file0" dev="sda1" ino=1179 res=1 errno=0 [ 780.506990][ T26] audit: type=1800 audit(1681597016.061:2121): pid=12687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1152 res=0 errno=0 [ 780.507032][ T26] audit: type=1804 audit(1681597016.061:2122): pid=12687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/240/file0" dev="sda1" ino=1152 res=1 errno=0 22:16:56 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 780.638642][T12690] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 780.639761][T12690] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 780.880207][ T3692] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 781.040183][ T3692] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 781.085383][ T25] Bluetooth: hci1: command 0x0406 tx timeout [ 781.172996][ T3692] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 781.176464][ T25] Bluetooth: hci4: command 0x040f tx timeout [ 781.188490][ T3692] usb 5-1: Product: syz [ 781.690282][ T25] usb 6-1: new high-speed USB device number 60 using dummy_hcd 22:16:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:57 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:57 executing program 5: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000006c0)={0x14, 0x0, &(0x7f0000000440)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) [ 781.847665][ T3692] usb 5-1: Manufacturer: syz [ 781.853363][ T3692] usb 5-1: SerialNumber: syz 22:16:57 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 781.902644][ T3692] usb 5-1: can't set config #1, error -71 [ 781.931418][ T3692] usb 5-1: USB disconnect, device number 108 22:16:57 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 782.163489][T12716] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 782.352139][T12717] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 782.372264][T12719] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 782.409021][T12720] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 782.449476][T12722] 8021q: adding VLAN 0 to HW filter on device batadv67 [ 782.460400][T12722] bond36: (slave batadv67): Enslaving as a backup interface with an up link [ 782.473684][T12723] bridge0: port 3(batadv1) entered blocking state [ 782.480666][T12723] bridge0: port 3(batadv1) entered disabled state [ 782.490727][ T3692] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 782.491409][T12723] device batadv1 entered promiscuous mode [ 782.519193][T12728] device batadv1 left promiscuous mode [ 782.532667][T12728] bridge0: port 3(batadv1) entered disabled state [ 782.566403][T12728] device bridge_slave_1 left promiscuous mode [ 782.585561][T12728] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.597037][T12728] device bridge_slave_0 left promiscuous mode [ 782.599974][ T25] usb 6-1: device descriptor read/64, error -71 22:16:58 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 782.615203][T12728] bridge0: port 1(bridge_slave_0) entered disabled state 22:16:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 782.739342][T12716] bond36 (unregistering): (slave batadv67): Releasing backup interface [ 782.775133][T12716] bond36 (unregistering): Released all slaves [ 782.855027][ T3692] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 782.891596][ T25] usb 6-1: new high-speed USB device number 61 using dummy_hcd 22:16:58 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 783.046402][T12751] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 783.055645][ T3692] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 783.070606][ T3692] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.096770][ T3692] usb 5-1: Product: syz [ 783.110623][ T3692] usb 5-1: Manufacturer: syz [ 783.118481][ T3692] usb 5-1: SerialNumber: syz [ 783.149001][T12753] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 783.216466][ T3689] Bluetooth: hci4: command 0x0419 tx timeout [ 783.239579][T12751] 8021q: adding VLAN 0 to HW filter on device batadv68 [ 783.248197][T12751] bond36: (slave batadv68): Enslaving as a backup interface with an up link [ 783.281211][T12753] bond36 (unregistering): (slave batadv68): Releasing backup interface [ 783.310439][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 783.312205][T12753] bond36 (unregistering): Released all slaves 22:16:59 executing program 3: r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) io_setup(0x800, &(0x7f0000000040)=0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14713e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) ftruncate(r0, 0x7fff) fcntl$setstatus(r0, 0x4, 0x6800) io_getevents(0x0, 0x1, 0x1, &(0x7f0000000240)=[{}], 0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 783.530880][ T25] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 783.545382][ T25] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.568445][ T25] usb 6-1: Product: syz [ 783.579301][ T25] usb 6-1: Manufacturer: syz [ 783.590965][ T25] usb 6-1: SerialNumber: syz 22:16:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:16:59 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 783.840028][ T3692] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 783.875889][ T3692] cdc_ncm 5-1:1.0: bind() failure [ 783.902136][ T3692] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 783.917122][ T3692] cdc_ncm 5-1:1.1: bind() failure [ 783.948870][ T3692] usb 5-1: USB disconnect, device number 109 22:16:59 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:16:59 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 784.660023][ T3692] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 784.750073][ T25] cdc_ncm 6-1:1.0: failed to get mac address [ 784.780042][ T25] cdc_ncm 6-1:1.0: bind() failure [ 784.820090][ T25] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 784.850943][ T25] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 784.870674][ T25] usbtest: probe of 6-1:1.1 failed with error -71 [ 784.908931][ T25] usb 6-1: USB disconnect, device number 61 [ 785.030142][ T3692] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:17:00 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32, @ANYBLOB], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r8}}, 0x20}}, 0x0) 22:17:00 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 785.210419][ T3692] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 785.227124][ T3692] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.278784][T12815] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 785.281454][ T3692] usb 5-1: Product: syz [ 785.310248][T12816] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 785.335296][ T3692] usb 5-1: Manufacturer: syz [ 785.356521][ T3692] usb 5-1: SerialNumber: syz 22:17:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 785.416754][T12815] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 785.455336][T12818] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 785.540893][T12821] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 785.598288][T12824] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 785.609603][ T26] kauditd_printk_skb: 24 callbacks suppressed [ 785.609617][ T26] audit: type=1800 audit(1681597021.171:2147): pid=12833 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1164 res=0 errno=0 [ 785.701027][T12825] 8021q: adding VLAN 0 to HW filter on device batadv69 [ 785.721408][T12825] bond36: (slave batadv69): Enslaving as a backup interface with an up link [ 785.743992][ T26] audit: type=1804 audit(1681597021.201:2148): pid=12833 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/245/file0" dev="sda1" ino=1164 res=1 errno=0 [ 785.782879][T12826] 8021q: adding VLAN 0 to HW filter on device batadv4 [ 785.802055][T12826] bond2: (slave batadv4): Enslaving as a backup interface with an up link [ 785.820648][ T26] audit: type=1804 audit(1681597021.201:2149): pid=12833 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/245/file0" dev="sda1" ino=1164 res=1 errno=0 [ 785.846413][ T26] audit: type=1804 audit(1681597021.251:2150): pid=12834 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/245/file0" dev="sda1" ino=1164 res=1 errno=0 [ 785.888751][T12816] bond36 (unregistering): (slave batadv69): Releasing backup interface [ 785.918820][T12816] bond36 (unregistering): Released all slaves [ 785.955978][T12828] bond2 (unregistering): (slave batadv4): Releasing backup interface [ 785.978439][T12828] bond2 (unregistering): Released all slaves 22:17:01 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:01 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 786.080090][ T3692] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 786.088496][T12837] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 786.094625][ T3692] cdc_ncm 5-1:1.0: bind() failure 22:17:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 786.133498][ T3692] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 786.138439][T12837] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 786.147469][ T3692] cdc_ncm 5-1:1.1: bind() failure [ 786.210429][ T3692] usb 5-1: USB disconnect, device number 110 [ 786.320921][ T26] audit: type=1800 audit(1681597021.841:2151): pid=12844 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1177 res=0 errno=0 22:17:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:02 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 787.153843][ T26] audit: type=1800 audit(1681597022.531:2152): pid=12848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=1142 res=0 errno=0 [ 787.153886][ T26] audit: type=1804 audit(1681597022.531:2153): pid=12848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/48/file0" dev="sda1" ino=1142 res=1 errno=0 [ 787.153919][ T26] audit: type=1804 audit(1681597022.531:2154): pid=12848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/48/file0" dev="sda1" ino=1142 res=1 errno=0 [ 787.153951][ T26] audit: type=1804 audit(1681597022.711:2155): pid=12849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/48/file0" dev="sda1" ino=1142 res=1 errno=0 22:17:03 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:03 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:03 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:03 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:03 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 787.308862][ T26] audit: type=1800 audit(1681597022.861:2156): pid=12854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1177 res=0 errno=0 [ 788.179611][T12859] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 788.200443][T12864] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 788.235279][T12859] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:17:04 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:04 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 789.040316][T12876] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 789.153138][T12864] 8021q: adding VLAN 0 to HW filter on device batadv5 [ 789.174456][T12864] bond2: (slave batadv5): Enslaving as a backup interface with an up link [ 789.429872][ T1065] usb 5-1: new high-speed USB device number 111 using dummy_hcd 22:17:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:05 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 789.975286][T12876] bond2 (unregistering): (slave batadv5): Releasing backup interface [ 790.025110][T12876] bond2 (unregistering): Released all slaves 22:17:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 790.300228][ T1065] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 790.480169][ T1065] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 22:17:06 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 790.520861][ T1065] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 790.542386][T12899] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 790.580714][ T1065] usb 5-1: Product: syz [ 790.609151][ T1065] usb 5-1: Manufacturer: syz [ 790.636662][T12901] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 790.647515][ T1065] usb 5-1: SerialNumber: syz [ 790.687690][T12903] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 790.709662][T12904] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 790.776541][T12899] 8021q: adding VLAN 0 to HW filter on device batadv6 [ 790.791930][T12899] bond2: (slave batadv6): Enslaving as a backup interface with an up link [ 790.907556][T12899] bond2 (unregistering): (slave batadv6): Releasing backup interface [ 790.926806][T12899] bond2 (unregistering): Released all slaves [ 791.370247][ T1065] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 791.376423][ T1065] cdc_ncm 5-1:1.0: bind() failure [ 791.387812][ T1065] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 791.401655][ T1065] cdc_ncm 5-1:1.1: bind() failure [ 791.417621][ T1065] usb 5-1: USB disconnect, device number 111 22:17:07 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:07 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:07 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:07 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r2, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:07 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 791.887931][T12911] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 791.930926][ T26] kauditd_printk_skb: 22 callbacks suppressed [ 791.930942][ T26] audit: type=1800 audit(1681597027.491:2179): pid=12917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1176 res=0 errno=0 [ 791.976588][T12915] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 792.000712][ T26] audit: type=1800 audit(1681597027.511:2180): pid=12920 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=1177 res=0 errno=0 [ 792.072362][T12921] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 792.081451][ T26] audit: type=1804 audit(1681597027.511:2181): pid=12920 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/51/file0" dev="sda1" ino=1177 res=1 errno=0 [ 792.108536][ T26] audit: type=1804 audit(1681597027.511:2182): pid=12917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/250/file0" dev="sda1" ino=1176 res=1 errno=0 [ 792.135651][ T26] audit: type=1804 audit(1681597027.511:2183): pid=12920 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/51/file0" dev="sda1" ino=1177 res=1 errno=0 [ 792.146966][T12922] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 792.172258][ T26] audit: type=1804 audit(1681597027.511:2184): pid=12917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/250/file0" dev="sda1" ino=1176 res=1 errno=0 [ 792.220148][ T26] audit: type=1804 audit(1681597027.581:2185): pid=12926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir3890904881/syzkaller.RAhnRp/51/file0" dev="sda1" ino=1177 res=1 errno=0 [ 792.245969][ T26] audit: type=1804 audit(1681597027.581:2186): pid=12928 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/250/file0" dev="sda1" ino=1176 res=1 errno=0 [ 792.280957][ T3685] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 792.288961][T12927] 8021q: adding VLAN 0 to HW filter on device batadv70 [ 792.308771][T12927] bond36: (slave batadv70): Enslaving as a backup interface with an up link [ 792.401163][T12929] bond0: (slave bond_slave_1): Releasing backup interface [ 792.443223][T12915] bond36 (unregistering): (slave batadv70): Releasing backup interface [ 792.477447][T12915] bond36 (unregistering): Released all slaves 22:17:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 792.660594][ T3685] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:17:08 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:08 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:08 executing program 5: r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) io_setup(0x800, &(0x7f0000000040)=0x0) open(&(0x7f0000000400)='./bus\x00', 0x14713e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x7fff) fcntl$setstatus(r0, 0x4, 0x6800) io_getevents(r1, 0x1, 0x1, &(0x7f0000000240)=[{}], 0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 792.774560][T12932] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 792.805549][T12932] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 792.826600][ T26] audit: type=1800 audit(1681597028.381:2187): pid=12937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=1172 res=0 errno=0 [ 792.871116][ T26] audit: type=1800 audit(1681597028.431:2188): pid=12939 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 [ 792.902741][ T3685] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 793.353907][ T3685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.588093][ T3685] usb 5-1: Product: syz [ 793.630101][ T3685] usb 5-1: Manufacturer: syz [ 793.635746][ T3685] usb 5-1: SerialNumber: syz 22:17:09 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:09 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 793.775248][T12940] team0: Port device team_slave_1 removed [ 795.130273][ T3685] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 795.136342][ T3685] cdc_ncm 5-1:1.0: bind() failure [ 795.163996][ T3685] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 795.171693][ T3685] cdc_ncm 5-1:1.1: bind() failure [ 795.190889][ T3685] usb 5-1: USB disconnect, device number 112 22:17:11 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:11 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:11 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:11 executing program 5: r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) io_setup(0x800, &(0x7f0000000040)=0x0) open(&(0x7f0000000400)='./bus\x00', 0x14713e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x7fff) fcntl$setstatus(r0, 0x4, 0x6800) io_getevents(r1, 0x1, 0x1, &(0x7f0000000240)=[{}], 0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 22:17:11 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 795.658000][T12961] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 795.703209][T12961] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 796.958889][ T26] kauditd_printk_skb: 23 callbacks suppressed [ 797.002299][ T26] audit: type=1804 audit(1681597032.511:2212): pid=12975 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/253/file0" dev="sda1" ino=1183 res=1 errno=0 22:17:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:12 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:12 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 797.186705][T12977] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 797.247902][ T26] audit: type=1800 audit(1681597032.801:2213): pid=12980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1156 res=0 errno=0 [ 797.321926][ T3687] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 797.794510][ T26] audit: type=1804 audit(1681597032.821:2214): pid=12980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/254/file0" dev="sda1" ino=1156 res=1 errno=0 22:17:13 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:13 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 798.062942][ T26] audit: type=1804 audit(1681597032.831:2215): pid=12980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/254/file0" dev="sda1" ino=1156 res=1 errno=0 [ 798.122596][T12977] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 798.129971][ T26] audit: type=1804 audit(1681597032.891:2216): pid=12989 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/254/file0" dev="sda1" ino=1156 res=1 errno=0 [ 798.196410][T12981] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 798.205605][ T26] audit: type=1800 audit(1681597033.761:2217): pid=12999 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1163 res=0 errno=0 [ 798.237652][ T26] audit: type=1804 audit(1681597033.781:2218): pid=12999 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/255/file0" dev="sda1" ino=1163 res=1 errno=0 [ 798.238067][T12983] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 798.267410][ T26] audit: type=1804 audit(1681597033.781:2219): pid=12999 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/255/file0" dev="sda1" ino=1163 res=1 errno=0 22:17:14 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:14 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 798.979555][ T26] audit: type=1804 audit(1681597033.861:2220): pid=13005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/255/file0" dev="sda1" ino=1163 res=1 errno=0 [ 799.049927][T12988] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 799.080219][ T3687] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 799.087821][ T3687] usb 5-1: can't read configurations, error -71 22:17:14 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:14 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r6], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r7}}, 0x20}}, 0x0) [ 799.216214][T13020] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 799.237099][ T26] audit: type=1800 audit(1681597034.781:2221): pid=13013 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1177 res=0 errno=0 22:17:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 799.262318][T13022] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 22:17:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r1, 0x0, 0xffffffff054) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r3, 0x100000011, 0xff97000f, 0x2811fdff) [ 799.366461][T13020] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:17:14 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:15 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r1, 0x0, 0xffffffff054) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r3, 0x100000011, 0xff97000f, 0x2811fdff) [ 799.432986][T13024] 8021q: adding VLAN 0 to HW filter on device batadv71 [ 799.442670][T13024] bond36: (slave batadv71): Enslaving as a backup interface with an up link 22:17:15 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r1, 0x0, 0xffffffff054) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r3, 0x100000011, 0xff97000f, 0x2811fdff) [ 799.499994][ T3687] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 799.525528][T13029] bond36 (unregistering): (slave batadv71): Releasing backup interface 22:17:15 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 799.563456][T13029] bond36 (unregistering): Released all slaves [ 799.654456][T13036] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 799.677851][T13038] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 799.749439][T13036] bond2 (unregistering): Released all slaves [ 799.870569][ T3687] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 800.070108][ T3687] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 800.084500][ T3687] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.113901][ T3687] usb 5-1: Product: syz [ 800.118276][ T3687] usb 5-1: Manufacturer: syz [ 800.123474][ T3687] usb 5-1: SerialNumber: syz [ 800.843736][ T3687] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 800.849796][ T3687] cdc_ncm 5-1:1.0: bind() failure [ 800.859117][ T3687] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 800.866679][ T3687] cdc_ncm 5-1:1.1: bind() failure [ 800.882804][ T3687] usb 5-1: USB disconnect, device number 114 22:17:16 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:16 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(0x0, 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:16 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:16 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 801.364633][T13055] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 801.414589][T13056] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 801.434018][T13054] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 22:17:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(0x0, 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 802.608572][T13055] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 802.676877][T13058] 8021q: adding VLAN 0 to HW filter on device batadv72 [ 802.697913][T13058] bond36: (slave batadv72): Enslaving as a backup interface with an up link [ 802.721379][T12702] usb 5-1: new high-speed USB device number 115 using dummy_hcd 22:17:18 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 803.230494][T12702] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 803.433762][T13069] 8021q: adding VLAN 0 to HW filter on device batadv7 [ 803.444435][T13069] bond2: (slave batadv7): Enslaving as a backup interface with an up link [ 803.520586][T13066] device hsr_slave_1 left promiscuous mode 22:17:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(0x0, 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 803.597659][T13071] bond36 (unregistering): (slave batadv72): Releasing backup interface [ 803.653552][T13071] bond36 (unregistering): Released all slaves [ 803.991081][T13067] bond2 (unregistering): (slave batadv7): Releasing backup interface 22:17:20 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:20 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:20 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 804.505244][T13067] bond2 (unregistering): Released all slaves [ 804.560566][T12702] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 804.569652][T12702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.581569][T12702] usb 5-1: Product: syz [ 804.585882][T12702] usb 5-1: Manufacturer: syz 22:17:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 804.630074][T12702] usb 5-1: can't set config #1, error -71 [ 804.638514][T12702] usb 5-1: USB disconnect, device number 115 22:17:21 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:21 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) [ 806.044338][T13100] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 806.077185][T13098] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 806.141731][T13100] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 807.230797][T13103] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 807.288564][T13099] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. 22:17:22 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 807.373044][T13103] 8021q: adding VLAN 0 to HW filter on device batadv8 [ 807.382029][T13103] bond2: (slave batadv8): Enslaving as a backup interface with an up link [ 807.490195][T12702] usb 5-1: new high-speed USB device number 116 using dummy_hcd 22:17:23 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:23 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 808.431596][T13109] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 808.496603][T13098] 8021q: adding VLAN 0 to HW filter on device batadv73 [ 808.506169][ T1376] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.512525][ T1376] ieee802154 phy1 wpan1: encryption failed: -22 22:17:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) 22:17:24 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(0x0, 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 808.621539][T13098] bond36: (slave batadv73): Enslaving as a backup interface with an up link [ 808.638702][T13099] bond36 (unregistering): (slave batadv73): Releasing backup interface [ 808.815678][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 808.816002][ T26] audit: type=1800 audit(1681597044.291:2225): pid=13140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1174 res=0 errno=0 [ 808.937184][T12702] usb 5-1: device descriptor read/64, error -71 [ 809.231080][T12702] usb 5-1: new high-speed USB device number 117 using dummy_hcd 22:17:24 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:24 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 809.332974][T13099] bond36 (unregistering): Released all slaves [ 809.371588][T13137] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 809.527694][T13139] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 809.585383][T13141] 8021q: adding VLAN 0 to HW filter on device batadv9 [ 809.608784][T13141] bond3: (slave batadv9): Enslaving as a backup interface with an up link 22:17:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:25 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(0x0, 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:25 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) [ 809.638737][T13148] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 809.675426][T13149] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 809.900355][ T26] audit: type=1800 audit(1681597045.321:2226): pid=13156 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1160 res=0 errno=0 22:17:25 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 810.420284][T12702] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 22:17:26 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(0x0, 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 810.595713][T13159] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 810.630248][T12702] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 810.643580][T12702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.652506][T12702] usb 5-1: Product: syz [ 810.656877][T12702] usb 5-1: Manufacturer: syz [ 810.661828][T12702] usb 5-1: SerialNumber: syz [ 810.672069][T13157] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 810.780950][ T26] audit: type=1800 audit(1681597046.281:2227): pid=13173 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1160 res=0 errno=0 22:17:26 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 811.327733][T13162] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. [ 811.357764][T13163] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 22:17:27 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 811.402303][T13166] 8021q: adding VLAN 0 to HW filter on device batadv10 [ 811.431894][T13166] bond4: (slave batadv10): Enslaving as a backup interface with an up link [ 811.584637][T13180] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 811.610206][T12702] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 811.616258][T12702] cdc_ncm 5-1:1.0: bind() failure [ 811.622538][T13180] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 811.643039][T12702] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 811.670235][T12702] cdc_ncm 5-1:1.1: bind() failure 22:17:28 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:28 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:28 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:28 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(0x0, 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:28 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 812.613691][ T3689] usb 5-1: USB disconnect, device number 117 [ 812.650929][T13185] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 812.667757][T13191] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 814.304633][T13185] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 814.349707][T13191] 8021q: adding VLAN 0 to HW filter on device batadv11 [ 814.386966][T13191] bond5: (slave batadv11): Enslaving as a backup interface with an up link [ 814.441727][ T26] audit: type=1800 audit(1681597048.501:2228): pid=13198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1182 res=0 errno=0 22:17:30 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(0x0, 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:30 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 814.507322][ T26] audit: type=1800 audit(1681597048.631:2229): pid=13199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1183 res=0 errno=0 22:17:30 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 814.541751][ T26] audit: type=1804 audit(1681597048.801:2230): pid=13199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/266/file0" dev="sda1" ino=1183 res=1 errno=0 [ 814.551281][T13203] bond5 (unregistering): (slave batadv11): Releasing backup interface [ 814.640153][ T3689] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 815.252377][ T26] audit: type=1804 audit(1681597048.981:2231): pid=13199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/266/file0" dev="sda1" ino=1183 res=1 errno=0 [ 815.281461][T13203] bond5 (unregistering): Released all slaves [ 815.289036][ T26] audit: type=1800 audit(1681597050.211:2232): pid=13209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1164 res=0 errno=0 [ 815.317780][ T26] audit: type=1804 audit(1681597050.211:2233): pid=13209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/267/file0" dev="sda1" ino=1164 res=1 errno=0 22:17:31 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 815.863902][ T26] audit: type=1804 audit(1681597050.221:2234): pid=13209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/267/file0" dev="sda1" ino=1164 res=1 errno=0 [ 816.004010][ T26] audit: type=1804 audit(1681597050.291:2235): pid=13210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/267/file0" dev="sda1" ino=1164 res=1 errno=0 22:17:31 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(0x0, 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:31 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 816.035986][ T26] audit: type=1800 audit(1681597050.981:2236): pid=13216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1182 res=0 errno=0 22:17:31 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 816.120714][ T3689] usb 5-1: unable to read config index 0 descriptor/all [ 816.129774][ T3689] usb 5-1: can't read configurations, error -71 [ 816.155309][T13204] device veth0_macvtap left promiscuous mode [ 816.274192][ T26] audit: type=1800 audit(1681597051.771:2237): pid=13223 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1168 res=0 errno=0 22:17:33 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(0x0, 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:33 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 818.100117][ T3689] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 818.580240][T13240] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 818.632498][T13240] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 22:17:34 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:34 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:34 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(0x0, 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 818.750345][ T3689] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 818.808024][T13240] 8021q: adding VLAN 0 to HW filter on device batadv12 [ 818.829338][T13240] bond5: (slave batadv12): Enslaving as a backup interface with an up link [ 818.840250][T13252] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 818.852984][T13247] bond5 (unregistering): (slave batadv12): Releasing backup interface [ 818.986928][T13247] bond5 (unregistering): Released all slaves [ 819.011614][ T3689] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 819.077385][ T3689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 819.367193][ T3689] usb 5-1: Product: syz 22:17:35 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r6], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r7}}, 0x20}}, 0x0) 22:17:35 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:35 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 819.523177][ T3689] usb 5-1: Manufacturer: syz [ 819.528063][ T3689] usb 5-1: SerialNumber: syz 22:17:35 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(0x0, 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 819.580219][ T3689] usb 5-1: can't set config #1, error -71 [ 819.591354][T13252] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 819.612907][ T3689] usb 5-1: USB disconnect, device number 119 [ 819.725438][T13258] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 820.022007][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 820.022371][ T26] audit: type=1800 audit(1681597055.351:2252): pid=13269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1180 res=0 errno=0 22:17:36 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 820.453794][ T26] audit: type=1804 audit(1681597055.351:2253): pid=13269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/271/file0" dev="sda1" ino=1180 res=1 errno=0 22:17:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:36 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 820.481147][ T26] audit: type=1804 audit(1681597055.371:2254): pid=13269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/271/file0" dev="sda1" ino=1180 res=1 errno=0 [ 820.557556][T13263] 8021q: adding VLAN 0 to HW filter on device batadv74 [ 820.606309][T13263] bond36: (slave batadv74): Enslaving as a backup interface with an up link [ 820.659551][T13267] bond36 (unregistering): (slave batadv74): Releasing backup interface [ 820.850300][ T26] audit: type=1800 audit(1681597056.281:2255): pid=13281 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 821.272346][ T26] audit: type=1804 audit(1681597056.291:2256): pid=13281 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/272/file0" dev="sda1" ino=1181 res=1 errno=0 [ 821.285737][T13267] bond36 (unregistering): Released all slaves [ 821.330240][T13274] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 821.345510][ T26] audit: type=1804 audit(1681597056.291:2257): pid=13281 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/272/file0" dev="sda1" ino=1181 res=1 errno=0 [ 821.371449][ T3689] usb 5-1: new high-speed USB device number 120 using dummy_hcd 22:17:36 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:37 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 821.387684][T13277] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 821.409600][ T26] audit: type=1804 audit(1681597056.291:2258): pid=13281 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/272/file0" dev="sda1" ino=1181 res=1 errno=0 22:17:37 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:37 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) fallocate(0xffffffffffffffff, 0x100000011, 0xff97000f, 0x2811fdff) [ 821.510073][T13286] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 821.523679][T13286] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 821.786392][ T26] audit: type=1800 audit(1681597057.191:2259): pid=13292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1140 res=0 errno=0 [ 822.130279][ T26] audit: type=1804 audit(1681597057.201:2260): pid=13292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/273/file0" dev="sda1" ino=1140 res=1 errno=0 22:17:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 822.247101][ T26] audit: type=1804 audit(1681597057.201:2261): pid=13292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/273/file0" dev="sda1" ino=1140 res=1 errno=0 22:17:37 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 822.417413][T13298] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 822.430018][ T3689] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 822.491477][T13301] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 822.514589][ T3843] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.534717][T13298] 8021q: adding VLAN 0 to HW filter on device batadv13 22:17:38 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:38 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:38 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r8}}, 0x20}}, 0x0) [ 822.543282][T13298] bond5: (slave batadv13): Enslaving as a backup interface with an up link [ 822.564786][T13298] bond5 (unregistering): (slave batadv13): Releasing backup interface [ 822.598704][T13298] bond5 (unregistering): Released all slaves [ 822.620162][ T3689] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 822.633231][ T3689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.696722][ T3689] usb 5-1: Product: syz [ 823.010108][ T3689] usb 5-1: Manufacturer: syz 22:17:38 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:39 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x0) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 823.411836][T13305] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 823.447125][ T3689] usb 5-1: can't set config #1, error -71 [ 823.537820][ T3689] usb 5-1: USB disconnect, device number 120 22:17:39 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 824.276355][T13310] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:17:39 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x0) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 824.413436][T13311] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 824.442336][T13311] bond1: (slave batadv2): Enslaving as a backup interface with an up link [ 824.463038][ T3843] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.760620][ T3689] usb 5-1: new high-speed USB device number 121 using dummy_hcd 22:17:40 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:40 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r8}}, 0x20}}, 0x0) [ 825.275275][ T3843] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.362037][T13333] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 825.383223][ T3689] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 825.448814][T13335] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 825.487334][T13337] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 825.500363][T13337] bond2: (slave batadv3): Enslaving as a backup interface with an up link [ 825.527123][ T3843] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.590318][ T3689] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 825.629985][ T3689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.638206][ T3689] usb 5-1: Product: syz [ 825.649270][ T3689] usb 5-1: Manufacturer: syz [ 825.687228][ T3689] usb 5-1: SerialNumber: syz [ 825.730050][ T3689] usb 5-1: can't set config #1, error -71 [ 825.752845][ T3689] usb 5-1: USB disconnect, device number 121 [ 826.435125][ T3843] device veth1_vlan left promiscuous mode [ 826.457053][ T3843] device veth0_vlan left promiscuous mode [ 826.616491][ T3843] bond35 (unregistering): (slave batadv53): Releasing backup interface [ 826.632959][ T3843] bond35 (unregistering): Released all slaves [ 826.646885][ T3843] bond34 (unregistering): (slave batadv52): Releasing backup interface [ 826.662914][ T3843] bond34 (unregistering): Released all slaves [ 826.675167][ T3843] bond33 (unregistering): (slave batadv51): Releasing backup interface [ 826.690975][ T3843] bond33 (unregistering): Released all slaves [ 826.705582][ T3843] bond32 (unregistering): (slave batadv50): Releasing backup interface [ 826.728139][ T3843] bond32 (unregistering): Released all slaves [ 826.741769][ T3843] bond31 (unregistering): (slave batadv49): Releasing backup interface [ 826.757286][ T3843] bond31 (unregistering): Released all slaves [ 826.770114][ T3843] bond30 (unregistering): (slave batadv48): Releasing backup interface [ 826.784696][ T3843] bond30 (unregistering): Released all slaves [ 826.797166][ T3843] bond29 (unregistering): (slave batadv47): Releasing backup interface [ 826.814580][ T3843] bond29 (unregistering): Released all slaves [ 826.827151][ T3843] bond28 (unregistering): (slave batadv46): Releasing backup interface [ 826.842024][ T3843] bond28 (unregistering): Released all slaves [ 826.854358][ T3843] bond27 (unregistering): (slave batadv45): Releasing backup interface [ 826.868420][ T3843] bond27 (unregistering): Released all slaves [ 826.883157][ T3843] bond26 (unregistering): (slave batadv44): Releasing backup interface [ 826.896937][ T3843] bond26 (unregistering): Released all slaves [ 826.910874][ T3843] bond25 (unregistering): (slave batadv43): Releasing backup interface [ 826.927987][ T3843] bond25 (unregistering): Released all slaves [ 826.940655][ T3843] bond24 (unregistering): (slave batadv42): Releasing backup interface [ 826.954199][ T3843] bond24 (unregistering): Released all slaves [ 826.966441][ T3843] bond23 (unregistering): (slave batadv41): Releasing backup interface [ 826.983469][ T3843] bond23 (unregistering): Released all slaves [ 826.995616][ T3843] bond22 (unregistering): (slave batadv40): Releasing backup interface [ 827.016222][ T3843] bond22 (unregistering): Released all slaves [ 827.028910][ T3843] bond21 (unregistering): (slave batadv39): Releasing backup interface [ 827.045079][ T3843] bond21 (unregistering): Released all slaves [ 827.061312][ T3843] bond20 (unregistering): (slave batadv38): Releasing backup interface [ 827.087242][ T3843] bond20 (unregistering): Released all slaves [ 827.100320][ T3843] bond19 (unregistering): (slave batadv37): Releasing backup interface [ 827.113932][ T3843] bond19 (unregistering): Released all slaves [ 827.126621][ T3843] bond18 (unregistering): (slave batadv36): Releasing backup interface [ 827.153431][ T3843] bond18 (unregistering): Released all slaves [ 827.181534][ T3843] bond17 (unregistering): (slave batadv35): Releasing backup interface [ 827.195966][ T3843] bond17 (unregistering): Released all slaves [ 827.216223][ T3843] bond16 (unregistering): (slave batadv34): Releasing backup interface [ 827.250952][ T3843] bond16 (unregistering): Released all slaves [ 827.263959][ T3843] bond15 (unregistering): (slave batadv33): Releasing backup interface [ 827.277826][ T3843] bond15 (unregistering): Released all slaves [ 827.291213][ T3843] bond14 (unregistering): (slave batadv32): Releasing backup interface [ 827.306563][ T3843] bond14 (unregistering): Released all slaves [ 827.318743][ T3843] bond13 (unregistering): (slave batadv31): Releasing backup interface [ 827.334291][ T3843] bond13 (unregistering): Released all slaves [ 827.346908][ T3843] bond12 (unregistering): (slave batadv30): Releasing backup interface [ 827.361365][ T3843] bond12 (unregistering): Released all slaves [ 827.375019][ T3843] bond11 (unregistering): (slave batadv29): Releasing backup interface [ 827.392405][ T3843] bond11 (unregistering): Released all slaves [ 827.405964][ T3843] bond10 (unregistering): (slave batadv28): Releasing backup interface [ 827.419509][ T3843] bond10 (unregistering): Released all slaves [ 827.432585][ T3843] bond9 (unregistering): (slave batadv27): Releasing backup interface [ 827.446318][ T3843] bond9 (unregistering): Released all slaves [ 827.459453][ T3843] bond8 (unregistering): (slave batadv26): Releasing backup interface [ 827.476928][ T3843] bond8 (unregistering): Released all slaves [ 827.489724][ T3843] bond7 (unregistering): (slave batadv25): Releasing backup interface [ 827.505442][ T3843] bond7 (unregistering): Released all slaves [ 827.517680][ T3843] bond6 (unregistering): (slave batadv24): Releasing backup interface [ 827.531401][ T3843] bond6 (unregistering): Released all slaves [ 827.544293][ T3843] bond5 (unregistering): Released all slaves [ 827.557433][ T3843] bond4 (unregistering): Released all slaves [ 827.582342][ T3843] bond3 (unregistering): Released all slaves [ 827.608385][ T3843] bond2 (unregistering): Released all slaves [ 827.631233][ T3843] bond1 (unregistering): (slave batadv12): Releasing backup interface [ 827.643335][ T3843] bond1 (unregistering): (slave batadv11): Releasing backup interface [ 827.656491][ T3843] bond1 (unregistering): (slave batadv10): Releasing backup interface [ 827.677143][ T3843] bond1 (unregistering): (slave batadv4): Releasing backup interface [ 827.689769][ T3843] bond1 (unregistering): (slave batadv0): Releasing backup interface [ 827.706765][ T3843] bond1 (unregistering): (slave batadv7): Releasing backup interface [ 827.719276][ T3843] bond1 (unregistering): (slave batadv5): Releasing backup interface [ 827.733751][ T3843] bond1 (unregistering): (slave batadv3): Releasing backup interface [ 827.746323][ T3843] bond1 (unregistering): (slave batadv1): Releasing backup interface [ 827.763635][ T3843] team0 (unregistering): Port device batadv2 removed [ 827.775734][ T3843] bond1 (unregistering): Released all slaves [ 827.826299][ T3843] team0 (unregistering): Port device team_slave_0 removed [ 827.884896][ T3843] bond0 (unregistering): Released all slaves [ 828.058180][T13362] chnl_net:caif_netlink_parms(): no params data found [ 828.151702][T13362] bridge0: port 1(bridge_slave_0) entered blocking state [ 828.170373][T13362] bridge0: port 1(bridge_slave_0) entered disabled state [ 828.178797][T13362] device bridge_slave_0 entered promiscuous mode [ 828.202170][T13362] bridge0: port 2(bridge_slave_1) entered blocking state [ 828.209330][T13362] bridge0: port 2(bridge_slave_1) entered disabled state [ 828.231532][T13362] device bridge_slave_1 entered promiscuous mode [ 828.285467][T13362] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 828.317825][T13362] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 828.368020][T13362] team0: Port device team_slave_0 added [ 828.392091][T13362] team0: Port device team_slave_1 added [ 828.440354][T13362] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 828.447333][T13362] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 828.498286][T13362] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 828.533691][T13362] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 828.540921][T13362] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 828.567446][T13362] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 828.611708][T13362] device hsr_slave_0 entered promiscuous mode [ 828.618808][T13362] device hsr_slave_1 entered promiscuous mode [ 828.626632][T13362] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 828.635852][T13362] Cannot create hsr debugfs directory [ 829.235400][T13362] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 829.246134][T13362] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 829.256292][T13362] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 829.267925][T13362] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 829.310696][ T3689] Bluetooth: hci2: command 0x0409 tx timeout [ 829.388740][T13362] 8021q: adding VLAN 0 to HW filter on device bond0 [ 829.404136][ T3725] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 829.413846][ T3725] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 829.425200][T13362] 8021q: adding VLAN 0 to HW filter on device team0 [ 829.456302][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 829.465993][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 829.475805][ T3685] bridge0: port 1(bridge_slave_0) entered blocking state [ 829.482924][ T3685] bridge0: port 1(bridge_slave_0) entered forwarding state [ 829.523119][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 829.532427][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 829.543950][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 829.552850][T12702] bridge0: port 2(bridge_slave_1) entered blocking state [ 829.560099][T12702] bridge0: port 2(bridge_slave_1) entered forwarding state [ 829.568141][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 829.577548][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 829.601372][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 829.612369][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 829.621307][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 829.630952][T12702] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 829.660501][T13362] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 829.690646][T13362] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 829.704361][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 829.713198][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 829.722274][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 829.731379][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 829.750926][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 829.771416][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 829.940689][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 829.948215][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 829.972265][T13362] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 830.006041][ T3688] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 830.015907][ T3688] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 830.052357][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 830.062672][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 830.074227][T13362] device veth0_vlan entered promiscuous mode [ 830.108243][ T3688] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 830.117103][ T3688] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 830.135795][T13362] device veth1_vlan entered promiscuous mode [ 830.187890][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 830.210750][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 830.219001][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 830.239470][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 830.252437][T13362] device veth0_macvtap entered promiscuous mode [ 830.282001][T13362] device veth1_macvtap entered promiscuous mode [ 830.301833][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 830.313289][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.324954][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 830.336968][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.355656][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 830.368817][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.379620][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 830.390438][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.404612][T13362] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 830.414154][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 830.423261][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 830.432162][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 830.441630][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 830.461848][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 830.499880][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.519893][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 830.539877][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.549713][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 830.600782][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.611243][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 830.623192][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.633432][T13362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 830.644219][T13362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 830.656009][T13362] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 830.665234][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 830.675652][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 830.691097][T13362] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 830.699965][T13362] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 830.708779][T13362] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 830.721122][T13362] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 830.816097][ T3888] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 830.830172][ T3888] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 830.846765][ T3688] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 830.878453][ T3888] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 830.902040][ T3888] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 830.937920][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 831.124054][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 831.124370][ T26] audit: type=1800 audit(1681597066.651:2272): pid=13471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=1159 res=0 errno=0 [ 831.427942][ T3689] Bluetooth: hci2: command 0x041b tx timeout [ 831.739955][ T26] audit: type=1804 audit(1681597066.651:2273): pid=13471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir907528464/syzkaller.pf47Ft/0/file0" dev="sda1" ino=1159 res=1 errno=0 [ 831.789375][ T26] audit: type=1804 audit(1681597066.661:2274): pid=13471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir907528464/syzkaller.pf47Ft/0/file0" dev="sda1" ino=1159 res=1 errno=0 22:17:47 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:47 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r8}}, 0x20}}, 0x0) 22:17:47 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x0) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:47 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 22:17:47 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(0x0, 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 831.899161][T13478] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 831.943007][T13486] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 833.339863][ T26] audit: type=1800 audit(1681597067.741:2275): pid=13496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1179 res=0 errno=0 22:17:48 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:49 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(0x0, 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 833.499757][ T26] audit: type=1804 audit(1681597067.861:2276): pid=13496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/277/file0" dev="sda1" ino=1179 res=1 errno=0 [ 833.538063][T13491] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 833.573332][T13478] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 833.582955][ T26] audit: type=1804 audit(1681597067.971:2277): pid=13496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/277/file0" dev="sda1" ino=1179 res=1 errno=0 [ 833.601749][T13493] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 833.611791][ T3689] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 833.618724][ T26] audit: type=1804 audit(1681597068.281:2278): pid=13496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/277/file0" dev="sda1" ino=1179 res=1 errno=0 [ 834.969892][ T3688] Bluetooth: hci2: command 0x040f tx timeout 22:17:50 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 835.128664][T13502] 8021q: adding VLAN 0 to HW filter on device batadv4 22:17:50 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(0x0, 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 835.169792][T13502] bond3: (slave batadv4): Enslaving as a backup interface with an up link 22:17:50 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) [ 835.211642][ T26] audit: type=1800 audit(1681597069.381:2279): pid=13511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1179 res=0 errno=0 [ 835.330878][ T3689] usb 5-1: device descriptor read/all, error -71 [ 835.354190][T13492] bond5 (unregistering): Released all slaves [ 835.513030][ T26] audit: type=1804 audit(1681597069.491:2280): pid=13511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/278/file0" dev="sda1" ino=1179 res=1 errno=0 22:17:51 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, 0x0, 0x0) [ 835.868455][ T26] audit: type=1804 audit(1681597069.601:2281): pid=13511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/278/file0" dev="sda1" ino=1179 res=1 errno=0 22:17:51 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:51 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:51 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 836.350242][ T3689] usb 5-1: new high-speed USB device number 123 using dummy_hcd 22:17:52 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 836.642796][T13526] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 836.701976][T13532] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 22:17:53 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 838.166314][T12702] Bluetooth: hci2: command 0x0419 tx timeout [ 838.224535][T13533] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 838.264655][T13536] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 838.300567][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 838.300582][ T26] audit: type=1800 audit(1681597072.531:2287): pid=13541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1180 res=0 errno=0 22:17:53 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 838.370213][ T3689] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 838.383822][ T26] audit: type=1804 audit(1681597072.641:2288): pid=13541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/280/file0" dev="sda1" ino=1180 res=1 errno=0 [ 838.413032][ T26] audit: type=1804 audit(1681597072.761:2289): pid=13541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/280/file0" dev="sda1" ino=1180 res=1 errno=0 [ 838.443479][ T26] audit: type=1804 audit(1681597073.071:2290): pid=13541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/280/file0" dev="sda1" ino=1180 res=1 errno=0 [ 839.877005][T13537] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 22:17:55 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:55 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:55 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) [ 839.922423][ T26] audit: type=1800 audit(1681597074.261:2291): pid=13557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1179 res=0 errno=0 [ 839.959716][T13546] 8021q: adding VLAN 0 to HW filter on device batadv5 [ 839.991953][ T26] audit: type=1804 audit(1681597074.401:2292): pid=13557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/281/file0" dev="sda1" ino=1179 res=1 errno=0 [ 840.011371][T13546] bond4: (slave batadv5): Enslaving as a backup interface with an up link [ 841.300257][ T3689] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 841.419993][ T3689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.451561][T13532] 8021q: adding VLAN 0 to HW filter on device batadv14 22:17:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(r3, 0xffffffffffffffff, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:57 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, 0x0, 0x0) 22:17:57 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(0x0, 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 841.550340][ T3689] usb 5-1: can't set config #1, error -71 [ 841.575301][T13532] bond5: (slave batadv14): Enslaving as a backup interface with an up link [ 841.588476][ T3689] usb 5-1: USB disconnect, device number 123 [ 841.658634][ T26] audit: type=1804 audit(1681597074.521:2293): pid=13557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/281/file0" dev="sda1" ino=1179 res=1 errno=0 [ 842.160137][ T3689] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 842.357023][ T26] audit: type=1804 audit(1681597074.901:2294): pid=13557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/281/file0" dev="sda1" ino=1179 res=1 errno=0 [ 842.419904][T13580] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 842.431211][T13580] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 842.444904][ T26] audit: type=1800 audit(1681597075.801:2295): pid=13570 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1179 res=0 errno=0 [ 842.920477][ T3689] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 843.007917][ T26] audit: type=1804 audit(1681597075.921:2296): pid=13570 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/282/file0" dev="sda1" ino=1179 res=1 errno=0 [ 843.209990][ T3689] usb 5-1: string descriptor 0 read error: -71 [ 843.216291][ T3689] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 843.239013][ T3689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.290159][ T3689] usb 5-1: can't set config #1, error -71 [ 843.298533][ T3689] usb 5-1: USB disconnect, device number 124 [ 843.800708][ T3843] ------------[ cut here ]------------ [ 843.806555][ T3843] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x80 [ 843.830444][ T3843] WARNING: CPU: 1 PID: 3843 at lib/debugobjects.c:515 debug_check_no_obj_freed+0x451/0x610 [ 843.840954][ T3843] Modules linked in: [ 843.844968][ T3843] CPU: 1 PID: 3843 Comm: kworker/u4:7 Not tainted 5.15.107-syzkaller #0 [ 843.854598][ T3843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 843.867984][ T3843] Workqueue: netns cleanup_net [ 843.873483][ T3843] RIP: 0010:debug_check_no_obj_freed+0x451/0x610 [ 843.889999][ T3843] Code: 74 08 48 89 ef e8 df 6a be fd 48 8b 13 4c 8b 45 00 48 c7 c7 60 5b d8 8a 48 c7 c6 20 58 d8 8a 44 89 f1 4d 89 f9 e8 df f5 40 fd <0f> 0b 48 ba 00 00 00 00 00 fc ff df 4c 8b 74 24 38 ff 05 74 a9 d8 [ 843.924144][ T3843] RSP: 0018:ffffc90004d47758 EFLAGS: 00010246 [ 843.933852][ T3843] RAX: 8207328011413100 RBX: ffffffff8ad85bd8 RCX: ffff88802e2e3a00 [ 843.944135][ T3843] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 843.958386][ T3843] RBP: ffffffff8a8c70a0 R08: ffffffff816612ec R09: ffffed10173667a0 [ 843.967329][ T3843] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffff8a8c70a0 [ 843.975793][ T3843] R13: ffff8880771ed020 R14: 0000000000000000 R15: ffffffff81524fe0 [ 843.985511][ T3843] FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 843.994955][ T3843] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 22:17:59 executing program 3: r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) io_setup(0x800, &(0x7f0000000040)=0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14713e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) ftruncate(r0, 0x0) fcntl$setstatus(r0, 0x4, 0x6800) io_getevents(r1, 0x1, 0x1, &(0x7f0000000240)=[{}], 0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 22:17:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) 22:17:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0x0) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:59 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(0x0, 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) 22:17:59 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x7a, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x10}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 22:17:59 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, 0x0, 0x0) [ 844.001868][ T3843] CR2: 000055fb66b3e950 CR3: 000000002358f000 CR4: 00000000003506e0 [ 844.046794][ T3843] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 844.047507][T13627] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 844.067113][ T3843] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 22:18:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0x0) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 845.625152][ T3843] Call Trace: [ 845.642326][ T3843] [ 845.650255][ T26] kauditd_printk_skb: 6 callbacks suppressed 22:18:01 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r4 = creat(0x0, 0x0) fallocate(r4, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r5, 0x100000011, 0xff97000f, 0x2811fdff) [ 845.650269][ T26] audit: type=1800 audit(1681597079.861:2303): pid=13634 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1175 res=0 errno=0 [ 845.692789][T13628] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 845.707735][ T3843] slab_free_freelist_hook+0x86/0x160 [ 845.713699][ T3843] ? device_release+0x91/0x1c0 [ 845.718574][ T3843] kfree+0xf1/0x270 [ 845.723351][ T3843] ? netdev_uevent+0x90/0x90 [ 845.728053][ T3843] device_release+0x91/0x1c0 [ 845.734148][ T3843] kobject_put+0x224/0x460 [ 845.743337][ T3843] netdev_run_todo+0xaaf/0xc40 [ 845.748294][ T3843] ? alloc_netdev_mqs+0xc10/0xc10 [ 845.758997][ T3843] ? netdev_refcnt_read+0x50/0x50 [ 845.765192][ T26] audit: type=1804 audit(1681597079.971:2304): pid=13634 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/284/file0" dev="sda1" ino=1175 res=1 errno=0 [ 845.793709][ T3843] ? unregister_netdevice_queue+0x258/0x350 [ 845.799705][ T3843] ? list_netdevice+0x450/0x450 [ 845.804697][ T3843] ? vxcan_dellink+0x12a/0x140 [ 845.809706][ T3843] default_device_exit_batch+0x395/0x3f0 [ 845.815508][ T3843] ? default_device_exit+0x390/0x390 [ 845.820932][ T3843] ? wait_woken+0x1b0/0x1b0 [ 845.826375][ T3843] ? mutex_lock_nested+0x17/0x20 [ 845.831544][ T3843] ? default_device_exit+0x390/0x390 [ 845.836905][ T3843] cleanup_net+0x763/0xb60 [ 845.841432][ T3843] ? ops_free_list+0x340/0x340 [ 846.998761][ T3843] process_one_work+0x8a1/0x10c0 22:18:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0x0) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) [ 847.059666][T13640] 8021q: adding VLAN 0 to HW filter on device batadv6 [ 847.068892][ T3843] ? worker_detach_from_pool+0x260/0x260 [ 847.084930][ T3843] ? _raw_spin_lock_irqsave+0x120/0x120 [ 847.166564][ T3843] ? kthread_data+0x4e/0xc0 22:18:02 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0x0) r6 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:18:02 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) [ 847.198497][ T26] audit: type=1804 audit(1681597080.071:2305): pid=13634 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/284/file0" dev="sda1" ino=1175 res=1 errno=0 [ 847.225058][ T3843] ? wq_worker_running+0x97/0x170 [ 847.231773][ T3686] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 847.246130][T13640] bond5: (slave batadv6): Enslaving as a backup interface with an up link [ 847.261631][T13627] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 847.261798][ T26] audit: type=1804 audit(1681597080.381:2306): pid=13634 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/284/file0" dev="sda1" ino=1175 res=1 errno=0 [ 847.283594][ T3843] worker_thread+0xaca/0x1280 [ 847.296165][ T26] audit: type=1800 audit(1681597081.411:2307): pid=13651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1180 res=0 errno=0 [ 847.326459][ T26] audit: type=1804 audit(1681597081.421:2308): pid=13651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/285/file0" dev="sda1" ino=1180 res=1 errno=0 22:18:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x7400, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x20, 0x11, 0x455, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0) [ 849.619948][ T26] audit: type=1804 audit(1681597081.421:2309): pid=13651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/285/file0" dev="sda1" ino=1180 res=1 errno=0 [ 849.646199][ T26] audit: type=1804 audit(1681597081.451:2310): pid=13651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir1277145524/syzkaller.UDxRgM/285/file0" dev="sda1" ino=1180 res=1 errno=0 [ 849.702268][ T26] audit: type=1800 audit(1681597083.091:2311): pid=13662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1178 res=0 errno=0 22:18:05 executing program 3: r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) io_setup(0x800, &(0x7f0000000040)=0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14713e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) ftruncate(r0, 0x0) fcntl$setstatus(r0, 0x4, 0x6800) io_getevents(r1, 0x1, 0x1, &(0x7f0000000240)=[{}], 0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 22:18:05 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) fallocate(0xffffffffffffffff, 0x100000011, 0xff97000f, 0x2811fdff) 22:18:05 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) sched_setscheduler(0x0, 0x422d3af7d1e3b374, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x4103fe) sendfile(0xffffffffffffffff, r3, 0x0, 0xffffffff054) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fallocate(r4, 0x100000011, 0xff97000f, 0x2811fdff) 22:18:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x1e8) r5 = creat(&(0x7f0000000300)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x4103fe) sendfile(r3, r4, 0x0, 0xffffffff054) r6 = creat(0x0, 0x0) fallocate(r6, 0x100000011, 0xff97000f, 0x2811fdff) 22:18:05 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000004cd284485218fcf6d38042a872906f401d4ad5e6061b80773f27693828cbba503fd02ccfd98b71dfcb7852255860acf409a8936dc1eff8feff6e1d5218bf1f1bed2c5d35d55809bc117674b348678e60bfb08feba4ac034ab36e0b3d954f698e853709de7f713abe24704d11cabd9fbeaf87293b633987dbc93860854522b68e994b4d4599300246f492b70c304c6eab604d835f3d9f4aaf40ea6fe94cdbea0818f8e8403c57e8e22ce3caf9a8fd82a5ce2a7d0e4b42586b6401141a47d371bb30122300"/225, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r5, @ANYBLOB], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000740)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x6, 0xc}, {0x0, 0x3}, {0x9, 0xffff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000400}, 0x48000) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 849.760232][T13669] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 849.775196][ T26] audit: type=1800 audit(1681597083.231:2312): pid=13664 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.4" name="file0" dev="sda1" ino=1180 res=0 errno=0 [ 849.823009][ T3843] kthread+0x3f6/0x4f0 [ 849.827909][ T3843] ? rcu_lock_release+0x20/0x20 [ 849.836773][ T3843] ? kthread_blkcg+0xd0/0xd0 [ 849.841816][ T3843] ret_from_fork+0x1f/0x30 [ 849.846611][ T3843] [ 849.850169][ T3843] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 849.857455][ T3843] CPU: 0 PID: 3843 Comm: kworker/u4:7 Not tainted 5.15.107-syzkaller #0 [ 849.865788][ T3843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 849.871483][T13674] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 849.875861][ T3843] Workqueue: netns cleanup_net [ 849.875889][ T3843] Call Trace: [ 849.875897][ T3843] [ 849.875905][ T3843] dump_stack_lvl+0x1e3/0x2cb [ 849.901025][ T3843] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 849.906675][ T3843] ? panic+0x84d/0x84d [ 849.910757][ T3843] ? debug_check_no_obj_freed+0x370/0x610 [ 849.916498][ T3843] ? debug_check_no_obj_freed+0x370/0x610 [ 849.922226][ T3843] panic+0x318/0x84d [ 849.922522][T13680] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 849.926146][ T3843] ? __warn+0x16a/0x300 [ 849.938403][ T3843] ? fb_is_primary_device+0xcc/0xcc [ 849.943624][ T3843] ? ret_from_fork+0x1f/0x30 [ 849.948232][ T3843] ? debug_check_no_obj_freed+0x451/0x610 [ 849.953962][ T3843] __warn+0x2b2/0x300 [ 849.957964][ T3843] ? debug_check_no_obj_freed+0x451/0x610 [ 849.963690][ T3843] report_bug+0x1b7/0x2e0 [ 849.968036][ T3843] handle_bug+0x3d/0x70 [ 849.972247][ T3843] exc_invalid_op+0x16/0x40 [ 849.976757][ T3843] asm_exc_invalid_op+0x16/0x20 [ 849.981612][ T3843] RIP: 0010:debug_check_no_obj_freed+0x451/0x610 [ 849.987942][ T3843] Code: 74 08 48 89 ef e8 df 6a be fd 48 8b 13 4c 8b 45 00 48 c7 c7 60 5b d8 8a 48 c7 c6 20 58 d8 8a 44 89 f1 4d 89 f9 e8 df f5 40 fd <0f> 0b 48 ba 00 00 00 00 00 fc ff df 4c 8b 74 24 38 ff 05 74 a9 d8 [ 850.007555][ T3843] RSP: 0018:ffffc90004d47758 EFLAGS: 00010246 [ 850.013633][ T3843] RAX: 8207328011413100 RBX: ffffffff8ad85bd8 RCX: ffff88802e2e3a00 [ 850.021611][ T3843] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 850.029676][ T3843] RBP: ffffffff8a8c70a0 R08: ffffffff816612ec R09: ffffed10173667a0 [ 850.037655][ T3843] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffff8a8c70a0 [ 850.045640][ T3843] R13: ffff8880771ed020 R14: 0000000000000000 R15: ffffffff81524fe0 [ 850.053628][ T3843] ? queue_work_node+0x420/0x420 [ 850.058583][ T3843] ? __wake_up_klogd+0xcc/0x100 [ 850.063534][ T3843] ? debug_check_no_obj_freed+0x451/0x610 [ 850.069274][ T3843] slab_free_freelist_hook+0x86/0x160 [ 850.074663][ T3843] ? device_release+0x91/0x1c0 [ 850.079443][ T3843] kfree+0xf1/0x270 [ 850.083262][ T3843] ? netdev_uevent+0x90/0x90 [ 850.087860][ T3843] device_release+0x91/0x1c0 [ 850.092462][ T3843] kobject_put+0x224/0x460 [ 850.096897][ T3843] netdev_run_todo+0xaaf/0xc40 [ 850.101672][ T3843] ? alloc_netdev_mqs+0xc10/0xc10 [ 850.106711][ T3843] ? netdev_refcnt_read+0x50/0x50 [ 850.111742][ T3843] ? unregister_netdevice_queue+0x258/0x350 [ 850.117644][ T3843] ? list_netdevice+0x450/0x450 [ 850.122521][ T3843] ? vxcan_dellink+0x12a/0x140 [ 850.127315][ T3843] default_device_exit_batch+0x395/0x3f0 [ 850.132960][ T3843] ? default_device_exit+0x390/0x390 [ 850.138258][ T3843] ? wait_woken+0x1b0/0x1b0 [ 850.142782][ T3843] ? mutex_lock_nested+0x17/0x20 [ 850.147730][ T3843] ? default_device_exit+0x390/0x390 [ 850.153070][ T3843] cleanup_net+0x763/0xb60 [ 850.157505][ T3843] ? ops_free_list+0x340/0x340 [ 850.162304][ T3843] process_one_work+0x8a1/0x10c0 [ 850.167267][ T3843] ? worker_detach_from_pool+0x260/0x260 [ 850.172919][ T3843] ? _raw_spin_lock_irqsave+0x120/0x120 [ 850.178489][ T3843] ? kthread_data+0x4e/0xc0 [ 850.183008][ T3843] ? wq_worker_running+0x97/0x170 [ 850.188047][ T3843] worker_thread+0xaca/0x1280 [ 850.192765][ T3843] kthread+0x3f6/0x4f0 [ 850.196853][ T3843] ? rcu_lock_release+0x20/0x20 [ 850.201816][ T3843] ? kthread_blkcg+0xd0/0xd0 [ 850.206428][ T3843] ret_from_fork+0x1f/0x30 [ 850.210877][ T3843] [ 850.214147][ T3843] Kernel Offset: disabled [ 850.218630][ T3843] Rebooting in 86400 seconds..