last executing test programs: 3.161053586s ago: executing program 2 (id=2533): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, 0x0, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00'}, 0x10) ppoll(&(0x7f0000000500)=[{r3, 0x8}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x0, 0x0, 0x0, 0x6}, 0x0, &(0x7f00000002c0)={0x3bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffffffd, 0xfffffffffffffffc}, 0x0, 0x0) listen(r1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(r0) 2.985043924s ago: executing program 1 (id=2535): unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4) getsockopt$sock_buf(r0, 0x1, 0x1a, 0x0, &(0x7f00000004c0)) 2.751864263s ago: executing program 1 (id=2536): sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c0000000706"], 0x2c}, 0x1, 0x0, 0x0, 0xc001}, 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16, @ANYBLOB="010028bd7000fcdbdf2517000000500006800800060006000000440004"], 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x4804) 2.675717749s ago: executing program 1 (id=2537): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), r1) sendmsg$NL802154_CMD_NEW_SEC_DEV(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) 2.52065197s ago: executing program 4 (id=2538): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)=@newqdisc={0x3f0, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c0, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x4, 0x4, 0x7, 0x0, 0x10, 0x2, 0x400f09, 0xfffffff8, 0x2542d461, 0xa000000, 0xa, 0x3, 0x9, 0xcc, 0x6}}, @TCA_GRED_STAB={0x104, 0x2, "e929b9fb04f5a8edd148cabc6d5f1cd5053427b4a9fb97db39b75d8606dffa123c7af8cdf3c1a000f5547bc6e490ceaffe0054774d1c2c84d32c390e9cd6c5308d5c8e74367fd4a40d509ba1c681d2babf2e765e2a446bbbfd07e566d2bdff2c6092a95167b7b56896f18f8ff36474f77e6e1ca3cde2b2bc892d06a7d769ef15ca3715fca5b5d125979b9dca8a0f4bd6647fa35bc1f7d487a69a1fb0c6ed201cf63935fb413634fac4c42820f4f8e6648b5855f38902ea986f8defb06dcb7857cb457fc7b3b053414aced9c0c99955720ffa59d696252494e05aad2610b49aefdf0962543d656c0b55a50ba1e4f46ae377f6b1dcb306ec688bd86bc8f4316d63"}, @TCA_GRED_PARMS={0x38, 0x1, {0x6, 0x3f, 0x9, 0xa, 0x1, 0xaf, 0x0, 0x4, 0xfffffff8, 0x6, 0x2, 0x1f, 0x6, 0xe, 0x7}}, @TCA_GRED_PARMS={0x38, 0x1, {0x2, 0x2, 0x3, 0x5, 0x5, 0x34, 0x7fff, 0x5, 0x3fe000, 0x6603, 0x12, 0x18, 0x3, 0x1, 0x2, 0x6}}, @TCA_GRED_STAB={0x104, 0x2, "406157f0e2b1d7b4917a42124fdd9ec1ad15e7350335f3e917fe072936a820531da00dd939075e064e5aade93f1fe6f90372da330feac3045aef78ff175c04f734652514bb5f82e31babf3aeac4fcabbe147563607aa7bd931eb63269f275fc897409b124f535573d2ed67b8b4da4c7c5481e60d6d9da1a6c61e3a7da896f23f18c1e47be9079a9e0af15e8dcf2b5093045d61cfa52eeee2c0b497f1c71e24dda2663795ddd2ddae560bf4157f7df72e02c20ff082ac4697aa2142062ab1bd82ef5894cfe42ff343f54b399c3a8ca024c1bcba6fb6d2b660adb5db59853dce38d78ee9c56018f1757fc8361b3d1f3ff6830503aeacea70c4e8daca550c10ae51"}, @TCA_GRED_MAX_P={0x8, 0x4, 0x10}, @TCA_GRED_STAB={0x104, 0x2, "6e68fec84ba0ec7fc98f3fb805afc35949b2b2c01280c94e96a262eb2d7ca7f9b8bfbda026277bfd888fa92a7553e0bdc79afb2707d12790b2446b881a469c67c254d68287d7d9af602bbb615da20b05af2017ffa0ffeee82c443abdc54cf3a8f2edc22304ed4553dc50bcf61a4757d1fa8c88f16207851dbdcf1731af835bcbf02dac6f1b75fd2f4bb798b69753bd83547000d0c795f2902fc87e035523c91d08fe5cc0297637a47d4af52884471e133ebc913d34afeadade24a69c362c27955f672a90b9c75c9b735fe9d03d207752208c76a4daaa413ea37804d6750eeca5b0fe5c863969c841e19eb77b90e84aa8ed81d1fa3159170d2110ba728f0ab169"}]}}]}, 0x3f0}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 2.46876633s ago: executing program 1 (id=2539): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x60, 0x0, 0x0, 0x0, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0x7}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x3c}}, 0x40440c0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010028bd7000f6dbdf250900020073797a31001800000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x810) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x2, 0x4, 0x1, 0x9}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x3, 0x7, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018100000", @ANYRES32=r4, @ANYBLOB="000000000000000018100000", @ANYRES32=r5, @ANYBLOB="000000000000000095"], &(0x7f0000000a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) socket(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x9, 0x42, 0x8}, 0x48) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0xd}}, &(0x7f00000000c0)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x23}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}]}}}]}], {0x14, 0x10}}, 0xa4}}, 0x4) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180)={r6, r8}, 0xc) getsockname$packet(r3, 0x0, &(0x7f00000001c0)) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x3f, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8}]}, 0x3c}, 0x1, 0x300000000000000, 0x0, 0xc004}, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="20000000021401002abd700001dcdf2508000100000000000500540041"], 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private, @multicast2}}}}}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001000)={0x50, 0x0, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}]}, 0x50}}, 0x40c0800) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000070000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r11, 0x2000012, 0x8ff, 0xb8, &(0x7f00000004c0)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 2.315674148s ago: executing program 4 (id=2541): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030e000000000700000000000004000900a000000001d78771b90bd8a3b4914783c58777003d5b95380000000003000600000000000200000000000000000900000000000002"], 0x70}, 0x1, 0x7}, 0x0) 2.100603397s ago: executing program 4 (id=2542): r0 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}}, 0x24}}, 0x24004000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.882181391s ago: executing program 4 (id=2545): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000020603000000000000000000ffea000005000100070000000900020073797a300000000014000780080012401b0000000800084000000000050005000000"], 0x5c}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)}], 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_init_net_socket$ax25(0x3, 0x2, 0xcc) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x8f) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r3, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r4], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r3, {0x3}, {}, {0xa, 0x1}}, [@TCA_RATE={0x6, 0x5, {0x39, 0x1}}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004140}, 0x0) 1.839598452s ago: executing program 0 (id=2546): pipe(&(0x7f0000000100)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x48, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @in6={0xa, 0x4e20, 0x0, @loopback, 0x3}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}]}, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.638593861s ago: executing program 4 (id=2547): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendmsg$BATADV_CMD_GET_HARDIF(r1, 0x0, 0x8800) listen(r0, 0x4) 1.637590454s ago: executing program 3 (id=2548): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000340)=0x8000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000540)=""/4114, 0x104d}], 0x1) 1.558304484s ago: executing program 1 (id=2549): socket$inet6(0xa, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r0, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000003880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/29, 0x1d}}], 0x1, 0x12141, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000880)={0x0, @in6={{0xa, 0x4e22, 0x1, @empty, 0x1f8}}, 0x1, 0xfe15}, 0x90) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) r3 = socket$qrtr(0x2a, 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket$inet(0xa, 0x801, 0x84) listen(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000640)={'wg0\x00', 0x0}) sendmmsg$inet6(r4, &(0x7f0000002940)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x6, @dev={0xfe, 0x80, '\x00', 0x38}, 0x1000}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)="88b52dfc750a3f5567cc3c3c6edb5aae7239c2b34961ce9038c44556772929a92e59683a0832e1326d262f5bd8bfaa163079913fde64522721bffba4654b2673ef7d60a3d32526c5de8dd71960627e1696c8ff8412672c01eb97f6c62156ab609a27a53f19a1581398c755eea2b423f89167c6aa4b4aee55", 0x78}, {&(0x7f0000000300)}, {&(0x7f00000004c0)="4bf12cc52c6584c4e84a7892332e635a37aea5f738f66ac72eb86adcc8de7a4e686d969d24162248c26be4d8ece0245d07a3142e296ae787e9cef0b2c0547969ed490609793217bd8e3b315e7942be96261523323b8e73040040f0901409e560337ccf6685d55d88d16271790256e8ef382475cca7ca22", 0x77}, {&(0x7f0000000540)="5051cc55e46caa7d688851e729e246c8c6dc37fb4c8cc41808844870c901deaa4777e05091b93680f6c520b051455327f58799f3a019fd346103afd2c95f8085dc25477843be0be62a919ba15912ff58bb3ac86e113f3106b6b3a42077cd86a2f1e438c24d482fe37440f20b8a2010716b123fed15a9e2128242629acd60efeeb586dfe19c41bb2763d16fbaa08b624bbacd077c0308f2581ae5213159279092e47ae10a5d43b81bb742a4a057d4b65cdd4bc5d54d2dfb565dcd82c79f7556", 0xbf}], 0x4, &(0x7f00000006c0)=[@dontfrag={{0x14, 0x29, 0x3e, 0x1ff}}, @dstopts={{0x20, 0x29, 0x37, {0x3a, 0x0, '\x00', [@ra={0x5, 0x2, 0x6}, @pad1]}}}, @rthdrdstopts={{0x28, 0x29, 0x37, {0x3c, 0x1, '\x00', [@enc_lim={0x4, 0x1, 0xf9}, @jumbo={0xc2, 0x4, 0x9}]}}}, @rthdr={{0x28, 0x29, 0x39, {0x16, 0x2, 0x1, 0x6, 0x0, [@loopback]}}}, @rthdr={{0x38, 0x29, 0x39, {0x3b, 0x4, 0x0, 0x2, 0x0, [@loopback, @remote]}}}], 0xc0}}, {{&(0x7f0000000400)={0xa, 0x4e24, 0xc1b, @private2, 0x113}, 0x1c, &(0x7f0000000600), 0x0, &(0x7f0000001e40)=[@hopopts_2292={{0xa8, 0x29, 0x36, {0x73, 0x11, '\x00', [@generic={0x40, 0x4b, "2c3ade41d1c1c211e572b89e75cbba8c3359bf7b4ada9166b01bbcf3352e07f0f4a0234c9ae613e23a163306e6bd497bdfdf6beade4ba8b2d0110056fce06722d62450fa38107aab4c2c51"}, @ra={0x5, 0x2, 0x86}, @jumbo={0xc2, 0x4, 0x3ba0}, @ra={0x5, 0x2, 0x7}, @calipso={0x7, 0x10, {0x1, 0x2, 0x8, 0x0, [0xfc]}}, @calipso={0x7, 0x20, {0x0, 0x6, 0xf5, 0xf9ba, [0x701, 0x100, 0xa3]}}]}}}, @dstopts={{0x18, 0x29, 0x37, {0x6}}}, @pktinfo={{0x24, 0x29, 0x32, {@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, r5}}}], 0xe8}}], 0x2, 0x8090) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) 1.471816577s ago: executing program 2 (id=2550): unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt(0xffffffffffffffff, 0x1c0000, 0x4, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x6dac59bdc021e4fb) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) listen(r0, 0x6d5) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x4}, &(0x7f00000001c0)=0x8) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x0) 1.444884938s ago: executing program 0 (id=2551): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)=@newqdisc={0x3f0, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c0, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x4, 0x4, 0x7, 0x0, 0x10, 0x2, 0x400f09, 0xfffffff8, 0x2542d461, 0xa000000, 0xa, 0x3, 0x9, 0xcc, 0x6}}, @TCA_GRED_STAB={0x104, 0x2, "e929b9fb04f5a8edd148cabc6d5f1cd5053427b4a9fb97db39b75d8606dffa123c7af8cdf3c1a000f5547bc6e490ceaffe0054774d1c2c84d32c390e9cd6c5308d5c8e74367fd4a40d509ba1c681d2babf2e765e2a446bbbfd07e566d2bdff2c6092a95167b7b56896f18f8ff36474f77e6e1ca3cde2b2bc892d06a7d769ef15ca3715fca5b5d125979b9dca8a0f4bd6647fa35bc1f7d487a69a1fb0c6ed201cf63935fb413634fac4c42820f4f8e6648b5855f38902ea986f8defb06dcb7857cb457fc7b3b053414aced9c0c99955720ffa59d696252494e05aad2610b49aefdf0962543d656c0b55a50ba1e4f46ae377f6b1dcb306ec688bd86bc8f4316d63"}, @TCA_GRED_PARMS={0x38, 0x1, {0x6, 0x3f, 0x9, 0xa, 0x1, 0xaf, 0x0, 0x4, 0xfffffff8, 0x6, 0x2, 0x1f, 0x6, 0xe, 0x7}}, @TCA_GRED_PARMS={0x38, 0x1, {0x2, 0x2, 0x3, 0x5, 0x5, 0x34, 0x7fff, 0x5, 0x3fe000, 0x6603, 0x12, 0x18, 0x3, 0x1, 0x2, 0x6}}, @TCA_GRED_STAB={0x104, 0x2, "406157f0e2b1d7b4917a42124fdd9ec1ad15e7350335f3e917fe072936a820531da00dd939075e064e5aade93f1fe6f90372da330feac3045aef78ff175c04f734652514bb5f82e31babf3aeac4fcabbe147563607aa7bd931eb63269f275fc897409b124f535573d2ed67b8b4da4c7c5481e60d6d9da1a6c61e3a7da896f23f18c1e47be9079a9e0af15e8dcf2b5093045d61cfa52eeee2c0b497f1c71e24dda2663795ddd2ddae560bf4157f7df72e02c20ff082ac4697aa2142062ab1bd82ef5894cfe42ff343f54b399c3a8ca024c1bcba6fb6d2b660adb5db59853dce38d78ee9c56018f1757fc8361b3d1f3ff6830503aeacea70c4e8daca550c10ae51"}, @TCA_GRED_MAX_P={0x8, 0x4, 0x10}, @TCA_GRED_STAB={0x104, 0x2, "6e68fec84ba0ec7fc98f3fb805afc35949b2b2c01280c94e96a262eb2d7ca7f9b8bfbda026277bfd888fa92a7553e0bdc79afb2707d12790b2446b881a469c67c254d68287d7d9af602bbb615da20b05af2017ffa0ffeee82c443abdc54cf3a8f2edc22304ed4553dc50bcf61a4757d1fa8c88f16207851dbdcf1731af835bcbf02dac6f1b75fd2f4bb798b69753bd83547000d0c795f2902fc87e035523c91d08fe5cc0297637a47d4af52884471e133ebc913d34afeadade24a69c362c27955f672a90b9c75c9b735fe9d03d207752208c76a4daaa413ea37804d6750eeca5b0fe5c863969c841e19eb77b90e84aa8ed81d1fa3159170d2110ba728f0ab169"}]}}]}, 0x3f0}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 1.415020145s ago: executing program 3 (id=2552): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x421}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x40}, {{0x0, 0x0, 0x0}, 0x409}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000540)=""/130, 0x82}, {&(0x7f0000001a00)=""/4109, 0x100d}, {&(0x7f0000006080)=""/4073, 0xfe9}, {&(0x7f0000000240)=""/112, 0x70}, {&(0x7f0000000040)=""/113, 0x71}, {&(0x7f00000004c0)=""/68, 0x44}, {&(0x7f0000000100)=""/98, 0x62}, {&(0x7f00000003c0)=""/100, 0x64}, {&(0x7f00000007c0)=""/206, 0xce}, {0x0}], 0xa}, 0x4db}, {{0x0, 0x0, 0x0}, 0x8}], 0x8, 0x0, 0x0) 1.230334898s ago: executing program 0 (id=2553): syz_emit_ethernet(0xf6, &(0x7f0000000640)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0xc0, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, '\t\x00', 0x0, 0x11, 0x0, @local, @empty, [@hopopts={0x0, 0x10, '\x00', [@generic, @ra, @generic={0x0, 0x75, "65fd1a52737fa1ec91495f4d25a766a5dd36bcffb376f4b35d4a5bc51b0f8fb9a273282a9c8ef192a4de26c8732765dbeb6ce083e81cebf0612d1cc7956b78fb34ce0e4a867c8b4094bab04b23680ba97ad5c624055e8504a7a121cf38a402a7aa80e05dbe56fecab8b014420231c0e997cbfda9bd"}, @calipso={0x7, 0x8}]}]}}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r1}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000180)={'netdevsim0\x00', 0x7fff}) 1.156147354s ago: executing program 3 (id=2554): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.008001294s ago: executing program 0 (id=2555): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x20004804) sendmsg$nl_route_sched(r0, 0x0, 0x20004800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r3, 0x0, 0x40000) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'bridge0\x00', 0x0}) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f00000002c0)={0x0, 0x3938700}, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, 0x0, 0x4040000) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000800) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_SPLIT(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x40080b1}, 0x8000) 704.884905ms ago: executing program 2 (id=2556): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x82, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'ipvlan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000fedbdf25080000001800028014000380100001800400030008000100050000000c00018008000100", @ANYRES32=r3], 0x38}, 0x1, 0x0, 0x0, 0x4000804}, 0x0) 539.816708ms ago: executing program 4 (id=2557): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000004c0)={@val={0x0, 0x88f8}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}, @val={@void, {0x8100, 0x0, 0x0, 0xfff}}, {@generic={0x88fb}}}}, 0x16) 539.265896ms ago: executing program 0 (id=2558): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000020603000000000000000000ffea000005000100070000000900020073797a300000000014000780080012401b0000000800084000000000050005000000"], 0x5c}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)}], 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_init_net_socket$ax25(0x3, 0x2, 0xcc) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x8f) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r3, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r4], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r3, {0x3}, {}, {0xa, 0x1}}, [@TCA_RATE={0x6, 0x5, {0x39, 0x1}}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004140}, 0x0) 539.116859ms ago: executing program 2 (id=2559): r0 = socket$inet(0x2, 0x3, 0xa) sendmmsg$inet(r0, &(0x7f0000000900)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="240000000000000000000000070000008610000000030164"], 0x28}}], 0x1, 0x24000004) 535.179466ms ago: executing program 1 (id=2560): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, 0x0, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) ppoll(&(0x7f0000000500)=[{0xffffffffffffffff, 0x8}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x0, 0x0, 0x0, 0x6}, 0x0, &(0x7f00000002c0)={0x3bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffffffd, 0xfffffffffffffffc}, 0x0, 0x0) listen(r1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(r0) 496.464705ms ago: executing program 3 (id=2561): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000680)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r2, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) 368.5658ms ago: executing program 3 (id=2562): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000340)=0x8000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000540)=""/4114, 0x104d}], 0x1) 284.030439ms ago: executing program 2 (id=2563): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = socket(0x11, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'gre0\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000300)=0xe9, 0x4) sendmsg$netlink(r1, &(0x7f0000002ac0)={0x0, 0x0, 0x0}, 0x20040051) 186.436079ms ago: executing program 3 (id=2564): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000050000000400000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)="1f000000190081054e81f782db4cb9040263cb848a0ef30b1bffff070a000a", 0x1f}], 0x1}, 0x14) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0xc, &(0x7f0000000200)=0x5, 0x4) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002500)={{r1}, &(0x7f0000002480), &(0x7f00000024c0)=r0}, 0x20) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000773ec8f3969729e91faef0fbfdee720754a2b859140df3b5994a9a912c7c8b3874f44609007b9b9f08000000994e7fbc2779e8c461dc2a72c60a34cebcfb9eb3716f6093644ca31ff4e742d7db1da5b106eb2a8a976731e14a48d23c19b000b2351f51d88f88c3b01adc89a07e4dd8efd7b1cb948302c6e45a7ce9093b6582ce8e5121ef58cc01c25ed825742e366fc8e9fd7facdeedc22800f73e9f032c67b54561ec18f2bff9bf7764be437f4bd181f9b92bf068c7bfde", @ANYRES32, @ANYRES32=r6, @ANYRES32=0x0, @ANYRES32], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x1b, &(0x7f0000000400)=ANY=[@ANYRES32=r6, @ANYRES16=r7, @ANYBLOB="0000000000820000b702000014000000b7030000000000008500001083000000bf090000000000fb550900"/59, @ANYRES32=r7, @ANYRES64=r6, @ANYRES32=r7, @ANYRESHEX=0x0, @ANYBLOB="294402765547e4a216c63654a06bf6ba93417acb5416204e087cacd0f3856c440000", @ANYRES8=r7], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xed41d0969ec4053c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x8800}, 0x240400c1) unshare(0x22020600) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40003, 0x0) vmsplice(r10, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000680)='svcrdma_small_wrch_err\x00', r8, 0x0, 0xfffffffffffffffe}, 0x18) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00'}) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) r11 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r11, &(0x7f00000002c0)=@name={0x1e, 0x2, 0x2, {{0x2, 0x1}, 0x3}}, 0x10) r12 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000180), &(0x7f0000000040)=@udp=r12}, 0x20) 166.456442ms ago: executing program 0 (id=2565): syz_emit_ethernet(0xf6, &(0x7f0000000640)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0xc0, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, '\t\x00', 0x0, 0x11, 0x0, @local, @empty, [@hopopts={0x0, 0x10, '\x00', [@generic, @ra, @generic={0x0, 0x75, "65fd1a52737fa1ec91495f4d25a766a5dd36bcffb376f4b35d4a5bc51b0f8fb9a273282a9c8ef192a4de26c8732765dbeb6ce083e81cebf0612d1cc7956b78fb34ce0e4a867c8b4094bab04b23680ba97ad5c624055e8504a7a121cf38a402a7aa80e05dbe56fecab8b014420231c0e997cbfda9bd"}, @calipso={0x7, 0x8}]}]}}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r1}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000180)={'netdevsim0\x00', 0x7fff}) 0s ago: executing program 2 (id=2566): sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c0000000706"], 0x2c}, 0x1, 0x0, 0x0, 0xc001}, 0x5) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010028bd7000fcdbdf2517000000500006800800060006000000440004"], 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x4804) kernel console output (not intermixed with test programs): ially beyond EOD, truncated [ 157.652621][ T6682] team_slave_1: left promiscuous mode [ 157.653338][ T6687] loop2: p3 start 335544320 is beyond EOD, truncated [ 157.853340][ T5836] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 158.075765][ T5836] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 158.115769][ T5836] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 158.152388][ T5836] usb 4-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice=e5.83 [ 158.393223][ T5836] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.401289][ T5836] usb 4-1: Product: syz [ 158.405522][ T5836] usb 4-1: Manufacturer: syz [ 158.410141][ T5836] usb 4-1: SerialNumber: syz [ 158.419622][ T5836] usb 4-1: config 0 descriptor?? [ 158.523847][ T6701] overlayfs: failed to resolve './file1': -2 [ 159.447415][ T6706] netlink: 8 bytes leftover after parsing attributes in process `syz.1.215'. [ 160.063745][ T5836] usb 4-1: USB disconnect, device number 8 [ 160.115838][ T6706] bond0: entered promiscuous mode [ 160.301273][ T6706] bond_slave_0: entered promiscuous mode [ 160.335059][ T6706] bond_slave_1: entered promiscuous mode [ 160.378827][ T6706] batadv0: entered promiscuous mode [ 160.404709][ T6706] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 160.444555][ T6706] Cannot create hsr debugfs directory [ 160.653470][ T5908] udevd[5908]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 161.583345][ T5836] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 161.694945][ T6724] Zero length message leads to an empty skb [ 161.938574][ T5836] usb 2-1: device descriptor read/64, error -71 [ 162.483332][ T5836] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 162.713200][ T5836] usb 2-1: device descriptor read/64, error -71 [ 162.846959][ T5836] usb usb2-port1: attempt power cycle [ 164.117040][ T5836] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 164.158286][ T5836] usb 2-1: device descriptor read/8, error -71 [ 164.558970][ T6747] overlayfs: failed to resolve './file1': -2 [ 165.493689][ T6764] loop2: detected capacity change from 0 to 7 [ 165.572815][ T6764] Dev loop2: unable to read RDB block 7 [ 165.606453][ T6764] loop2: AHDI p2 p3 [ 165.649431][ T6764] loop2: partition table partially beyond EOD, truncated [ 165.672865][ T6764] loop2: p3 start 335544320 is beyond EOD, truncated [ 166.052825][ T5925] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 166.694904][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.803244][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 167.053210][ T5925] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 167.137579][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.200975][ T5925] usb 4-1: config 0 descriptor?? [ 167.273148][ T6504] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 167.436623][ T6793] ipvlan2: entered promiscuous mode [ 167.442022][ T6793] ipvlan2: entered allmulticast mode [ 167.659533][ T5925] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 167.685817][ T6504] usb 3-1: config 1 has an invalid descriptor of length 122, skipping remainder of the config [ 167.712783][ T5925] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 167.714281][ T6793] hsr0: entered allmulticast mode [ 168.463093][ T6504] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 168.481677][ T6504] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 168.515164][ T6793] hsr_slave_0: entered allmulticast mode [ 168.554126][ T6793] hsr_slave_1: entered allmulticast mode [ 168.567918][ T5925] cp2112 0003:10C4:EA90.0002: Part Number: 0x82 Device Version: 0xFE [ 168.751737][ T6504] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 168.761802][ T6504] usb 3-1: SerialNumber: syz [ 168.856750][ T6504] usb 3-1: 0:2 : does not exist [ 168.862826][ T6504] usb 3-1: unit 5 not found! [ 169.330129][ T6504] usb 3-1: USB disconnect, device number 3 [ 169.448537][ T6812] FAULT_INJECTION: forcing a failure. [ 169.448537][ T6812] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 169.461909][ T6812] CPU: 1 UID: 0 PID: 6812 Comm: syz.1.246 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 169.461934][ T6812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 169.461944][ T6812] Call Trace: [ 169.461952][ T6812] [ 169.461960][ T6812] dump_stack_lvl+0x189/0x250 [ 169.461989][ T6812] ? __pfx____ratelimit+0x10/0x10 [ 169.462012][ T6812] ? __pfx_dump_stack_lvl+0x10/0x10 [ 169.462034][ T6812] ? __pfx__printk+0x10/0x10 [ 169.462059][ T6812] ? __might_fault+0xb0/0x130 [ 169.462091][ T6812] should_fail_ex+0x414/0x560 [ 169.462117][ T6812] _copy_from_iter+0x1db/0x16f0 [ 169.462146][ T6812] ? rcu_is_watching+0x15/0xb0 [ 169.462170][ T6812] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 169.462192][ T6812] ? __pfx__copy_from_iter+0x10/0x10 [ 169.462219][ T6812] ? __build_skb_around+0x257/0x3e0 [ 169.462248][ T6812] ? netlink_sendmsg+0x642/0xb30 [ 169.462273][ T6812] ? skb_put+0x11b/0x210 [ 169.462304][ T6812] netlink_sendmsg+0x6b2/0xb30 [ 169.462341][ T6812] ? __pfx_netlink_sendmsg+0x10/0x10 [ 169.462376][ T6812] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 169.462396][ T6812] ? __pfx_netlink_sendmsg+0x10/0x10 [ 169.462423][ T6812] __sock_sendmsg+0x21c/0x270 [ 169.462450][ T6812] ____sys_sendmsg+0x505/0x830 [ 169.462485][ T6812] ? __pfx_____sys_sendmsg+0x10/0x10 [ 169.462597][ T6812] ? import_iovec+0x74/0xa0 [ 169.462629][ T6812] ___sys_sendmsg+0x21f/0x2a0 [ 169.462660][ T6812] ? __pfx____sys_sendmsg+0x10/0x10 [ 169.462733][ T6812] ? __fget_files+0x2a/0x420 [ 169.462754][ T6812] ? __fget_files+0x3a0/0x420 [ 169.462788][ T6812] __x64_sys_sendmsg+0x19b/0x260 [ 169.462821][ T6812] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 169.462860][ T6812] ? __pfx_ksys_write+0x10/0x10 [ 169.462876][ T6812] ? rcu_is_watching+0x15/0xb0 [ 169.462904][ T6812] ? do_syscall_64+0xbe/0x3b0 [ 169.462931][ T6812] do_syscall_64+0xfa/0x3b0 [ 169.462949][ T6812] ? lockdep_hardirqs_on+0x9c/0x150 [ 169.462975][ T6812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.462995][ T6812] ? clear_bhb_loop+0x60/0xb0 [ 169.463020][ T6812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.463039][ T6812] RIP: 0033:0x7f37cb38ebe9 [ 169.463058][ T6812] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 169.463074][ T6812] RSP: 002b:00007f37cc22c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 169.463095][ T6812] RAX: ffffffffffffffda RBX: 00007f37cb5b5fa0 RCX: 00007f37cb38ebe9 [ 169.463109][ T6812] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 169.463122][ T6812] RBP: 00007f37cc22c090 R08: 0000000000000000 R09: 0000000000000000 [ 169.463134][ T6812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 169.463146][ T6812] R13: 00007f37cb5b6038 R14: 00007f37cb5b5fa0 R15: 00007ffe3ae12048 [ 169.463180][ T6812] [ 169.854587][ T6771] sctp: failed to load transform for md5: -2 [ 169.927039][ T5925] cp2112 0003:10C4:EA90.0002: error reading lock byte: -71 [ 169.986554][ T5908] udevd[5908]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 170.802829][ T5925] usb 4-1: USB disconnect, device number 9 [ 171.223618][ T6837] loop2: detected capacity change from 0 to 7 [ 171.388169][ T6839] process 'syz.0.252' launched './file1' with NULL argv: empty string added [ 171.591334][ T6837] Dev loop2: unable to read RDB block 7 [ 171.597295][ T6837] loop2: AHDI p2 p3 [ 171.601423][ T6837] loop2: partition table partially beyond EOD, truncated [ 172.717159][ T6837] loop2: p3 start 335544320 is beyond EOD, truncated [ 174.132349][ T6861] netlink: 12 bytes leftover after parsing attributes in process `syz.2.259'. [ 178.517283][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 178.672933][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 178.680456][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 178.688393][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 178.696168][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 178.703695][ T6523] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 178.712344][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 178.726064][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.042232][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.055442][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.064446][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.143943][ T6523] usb 4-1: Using ep0 maxpacket: 32 [ 179.154778][ T6523] usb 4-1: config 0 has an invalid interface number: 92 but max is 0 [ 179.162888][ T6523] usb 4-1: config 0 has no interface number 0 [ 179.186649][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.208109][ T6523] usb 4-1: config 0 interface 92 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 179.233442][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.269731][ T6523] usb 4-1: config 0 interface 92 has no altsetting 0 [ 179.278409][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.310141][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.321243][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.329061][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.337233][ T5925] hid-generic 0002:0004:0009.0003: unknown main item tag 0x0 [ 179.346334][ T6523] usb 4-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=a8.eb [ 179.359285][ T6523] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.388768][ T6523] usb 4-1: Product: syz [ 179.401136][ T6523] usb 4-1: Manufacturer: syz [ 179.409276][ T6523] usb 4-1: SerialNumber: syz [ 179.421823][ T5925] hid-generic 0002:0004:0009.0003: hidraw0: HID v0.04 Device [syz0] on syz0 [ 179.448684][ T6523] usb 4-1: config 0 descriptor?? [ 179.472201][ T6886] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 179.706536][ T6886] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 179.818327][ T6907] Cannot find add_set index 0 as target [ 180.517897][ T6523] redrat3 4-1:0.92: Couldn't find all endpoints [ 180.757093][ T6523] usb 4-1: USB disconnect, device number 10 [ 180.904427][ T6913] tmpfs: Unknown parameter 'mpkl' [ 183.557007][ T10] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 184.033119][ T6937] Lens B: ================= START STATUS ================= [ 184.040620][ T6937] Lens B: Focus, Absolute: 0 [ 184.045484][ T6937] Lens B: ================== END STATUS ================== [ 184.723214][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 184.788457][ T10] usb 5-1: config 7 has an invalid interface number: 46 but max is 0 [ 184.924541][ T10] usb 5-1: config 7 has no interface number 0 [ 184.933116][ T10] usb 5-1: config 7 interface 46 has no altsetting 0 [ 185.085213][ T10] usb 5-1: New USB device found, idVendor=9fdb, idProduct=cfba, bcdDevice=f1.37 [ 185.133620][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.182281][ T10] usb 5-1: can't set config #7, error -71 [ 185.248797][ T10] usb 5-1: USB disconnect, device number 8 [ 185.514758][ T6952] FAULT_INJECTION: forcing a failure. [ 185.514758][ T6952] name failslab, interval 1, probability 0, space 0, times 0 [ 185.527691][ T6952] CPU: 0 UID: 0 PID: 6952 Comm: syz.0.287 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 185.527716][ T6952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 185.527727][ T6952] Call Trace: [ 185.527735][ T6952] [ 185.527743][ T6952] dump_stack_lvl+0x189/0x250 [ 185.527770][ T6952] ? __pfx____ratelimit+0x10/0x10 [ 185.527790][ T6952] ? __pfx_dump_stack_lvl+0x10/0x10 [ 185.527810][ T6952] ? __pfx__printk+0x10/0x10 [ 185.527840][ T6952] ? __pfx___might_resched+0x10/0x10 [ 185.527860][ T6952] ? fs_reclaim_acquire+0x7d/0x100 [ 185.527890][ T6952] should_fail_ex+0x414/0x560 [ 185.527915][ T6952] should_failslab+0xa8/0x100 [ 185.527937][ T6952] kmem_cache_alloc_noprof+0x73/0x3c0 [ 185.527954][ T6952] ? skb_clone+0x212/0x3a0 [ 185.527977][ T6952] skb_clone+0x212/0x3a0 [ 185.527993][ T6952] ? nfnetlink_rcv+0x486/0x2520 [ 185.528017][ T6952] nfnetlink_rcv+0x4b4/0x2520 [ 185.528043][ T6952] ? __dev_queue_xmit+0x1cd7/0x3a70 [ 185.528069][ T6952] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 185.528089][ T6952] ? __dev_queue_xmit+0x27e/0x3a70 [ 185.528108][ T6952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.528136][ T6952] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 185.528170][ T6952] ? ref_tracker_free+0x63a/0x7d0 [ 185.528189][ T6952] ? __copy_skb_header+0xa7/0x550 [ 185.528208][ T6952] ? __pfx_ref_tracker_free+0x10/0x10 [ 185.528230][ T6952] ? __skb_clone+0x63/0x7a0 [ 185.528253][ T6952] ? __skb_clone+0x483/0x7a0 [ 185.528281][ T6952] ? skb_clone+0x246/0x3a0 [ 185.528305][ T6952] ? __netlink_deliver_tap+0x807/0x850 [ 185.528333][ T6952] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.528365][ T6952] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.528388][ T6952] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.528419][ T6952] netlink_unicast+0x75c/0x8e0 [ 185.528454][ T6952] netlink_sendmsg+0x805/0xb30 [ 185.528493][ T6952] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.528527][ T6952] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 185.528545][ T6952] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.528572][ T6952] __sock_sendmsg+0x21c/0x270 [ 185.528597][ T6952] ____sys_sendmsg+0x505/0x830 [ 185.528641][ T6952] ? __pfx_____sys_sendmsg+0x10/0x10 [ 185.528680][ T6952] ? import_iovec+0x74/0xa0 [ 185.528709][ T6952] ___sys_sendmsg+0x21f/0x2a0 [ 185.528739][ T6952] ? __pfx____sys_sendmsg+0x10/0x10 [ 185.528809][ T6952] ? __fget_files+0x2a/0x420 [ 185.528829][ T6952] ? __fget_files+0x3a0/0x420 [ 185.528861][ T6952] __x64_sys_sendmsg+0x19b/0x260 [ 185.528891][ T6952] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 185.528931][ T6952] ? __pfx_ksys_write+0x10/0x10 [ 185.528956][ T6952] ? do_syscall_64+0xbe/0x3b0 [ 185.528980][ T6952] do_syscall_64+0xfa/0x3b0 [ 185.528998][ T6952] ? lockdep_hardirqs_on+0x9c/0x150 [ 185.529017][ T6952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.529034][ T6952] ? clear_bhb_loop+0x60/0xb0 [ 185.529056][ T6952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.529075][ T6952] RIP: 0033:0x7f106cd8ebe9 [ 185.529094][ T6952] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 185.529109][ T6952] RSP: 002b:00007f106dcc1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 185.529128][ T6952] RAX: ffffffffffffffda RBX: 00007f106cfb5fa0 RCX: 00007f106cd8ebe9 [ 185.529141][ T6952] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 185.529152][ T6952] RBP: 00007f106dcc1090 R08: 0000000000000000 R09: 0000000000000000 [ 185.529163][ T6952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 185.529173][ T6952] R13: 00007f106cfb6038 R14: 00007f106cfb5fa0 R15: 00007ffc0fbbc668 [ 185.529225][ T6952] [ 186.884310][ T6970] Lens B: ================= START STATUS ================= [ 186.891844][ T6970] Lens B: Focus, Absolute: 0 [ 186.896636][ T6970] Lens B: ================== END STATUS ================== [ 188.003291][ T6982] netlink: 36 bytes leftover after parsing attributes in process `syz.3.297'. [ 188.181246][ T6984] Cannot find add_set index 0 as target [ 192.168873][ T7017] netlink: 'syz.2.308': attribute type 1 has an invalid length. [ 193.638364][ T7025] Lens B: ================= START STATUS ================= [ 193.645946][ T7025] Lens B: Focus, Absolute: 0 [ 193.652572][ T7025] Lens B: ================== END STATUS ================== [ 194.429607][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.437295][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.464991][ T7017] 8021q: adding VLAN 0 to HW filter on device bond1 [ 194.549726][ T7027] bond1: (slave gretap1): making interface the new active one [ 194.574877][ T7027] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 195.089627][ T7034] autofs: Unknown parameter '0x0000000000000000' [ 195.126062][ T7027] syz.2.308 (7027) used greatest stack depth: 19216 bytes left [ 198.480725][ T7056] netlink: 20 bytes leftover after parsing attributes in process `syz.2.317'. [ 198.853150][ T6520] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 199.204441][ T6520] usb 3-1: config 0 has an invalid interface number: 200 but max is 0 [ 199.438563][ T6520] usb 3-1: config 0 has no interface number 0 [ 199.446261][ T6520] usb 3-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 199.458285][ T6520] usb 3-1: config 0 interface 200 has no altsetting 0 [ 199.470274][ T6520] usb 3-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 199.485829][ T6520] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.494208][ T6520] usb 3-1: Product: syz [ 199.498499][ T6520] usb 3-1: Manufacturer: syz [ 199.503566][ T6520] usb 3-1: SerialNumber: syz [ 200.315539][ T7070] Lens B: ================= START STATUS ================= [ 200.323094][ T7070] Lens B: Focus, Absolute: 0 [ 200.327854][ T7070] Lens B: ================== END STATUS ================== [ 200.512373][ T6520] usb 3-1: config 0 descriptor?? [ 202.147907][ T6520] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.200/input/input9 [ 202.173750][ T6504] libceph: connect (1)[c::]:6789 error -101 [ 202.196237][ T6504] libceph: mon0 (1)[c::]:6789 connect error [ 202.222285][ T6520] usb 3-1: USB disconnect, device number 4 [ 202.368034][ T7075] ceph: No mds server is up or the cluster is laggy [ 202.375272][ T30] audit: type=1326 audit(1755336820.609:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7082 comm="syz.4.324" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x0 [ 202.470855][ T7087] netlink: 4 bytes leftover after parsing attributes in process `syz.4.324'. [ 202.655124][ T6504] libceph: connect (1)[c::]:6789 error -101 [ 202.665528][ T6504] libceph: mon0 (1)[c::]:6789 connect error [ 202.930797][ T7091] sctp: failed to load transform for md5: -2 [ 203.037534][ T7096] overlayfs: missing 'lowerdir' [ 203.709892][ T5836] libceph: connect (1)[c::]:6789 error -101 [ 203.734070][ T5836] libceph: mon0 (1)[c::]:6789 connect error [ 207.470448][ T7127] mmap: syz.4.334 (7127): VmData 25841664 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 207.864040][ T7136] fuse: Bad value for 'fd' [ 210.057042][ T7150] overlayfs: missing 'lowerdir' [ 211.596085][ T7162] netlink: 20 bytes leftover after parsing attributes in process `syz.1.344'. [ 211.762530][ T7165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.346'. [ 211.885021][ T7165] bond0: entered promiscuous mode [ 211.891456][ T7165] bond_slave_0: entered promiscuous mode [ 211.899115][ T7165] bond_slave_1: entered promiscuous mode [ 211.944017][ T7165] batadv0: entered promiscuous mode [ 211.969443][ T7165] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 212.010797][ T7165] Cannot create hsr debugfs directory [ 212.425550][ T5158] Bluetooth: hci1: command 0x0406 tx timeout [ 212.431661][ T5158] Bluetooth: hci0: command 0x0406 tx timeout [ 212.439486][ T5839] Bluetooth: hci2: command 0x0406 tx timeout [ 212.445570][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 213.648398][ T7186] netlink: 292 bytes leftover after parsing attributes in process `syz.3.350'. [ 214.643936][ T7193] overlayfs: missing 'lowerdir' [ 218.084273][ T7219] netlink: 24 bytes leftover after parsing attributes in process `syz.1.361'. [ 221.592726][ T7246] overlayfs: missing 'lowerdir' [ 229.113624][ T7295] overlayfs: missing 'lowerdir' [ 229.983442][ T6520] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 230.295622][ T7304] netlink: 8 bytes leftover after parsing attributes in process `syz.0.381'. [ 230.355891][ T6520] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 230.355925][ T6520] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.355946][ T6520] usb 2-1: Product: syz [ 230.355960][ T6520] usb 2-1: Manufacturer: syz [ 230.355986][ T6520] usb 2-1: SerialNumber: syz [ 230.359544][ T6520] usb 2-1: config 0 descriptor?? [ 230.486813][ C0] raw-gadget.0 gadget.1: ignoring, device is not running [ 230.524608][ T6520] usb 2-1: can't set config #0, error -32 [ 230.541810][ T6520] usb 2-1: USB disconnect, device number 8 [ 230.553213][ T5890] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 230.659854][ T7313] netlink: 'syz.2.384': attribute type 1 has an invalid length. [ 230.795680][ T7313] netlink: 184 bytes leftover after parsing attributes in process `syz.2.384'. [ 230.848098][ T5890] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 230.979129][ T5890] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 231.121634][ T5890] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 231.273363][ T5890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.294883][ T5890] usb 4-1: config 0 descriptor?? [ 231.643330][ T7318] netlink: 292 bytes leftover after parsing attributes in process `syz.0.387'. [ 232.295201][ T5890] arvo 0003:1E7D:30D4.0004: unknown main item tag 0x0 [ 232.383512][ T5890] arvo 0003:1E7D:30D4.0004: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.3-1/input0 [ 235.120103][ T5890] usb 4-1: USB disconnect, device number 11 [ 235.671313][ T7329] fido_id[7329]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 236.205628][ T7346] overlayfs: missing 'lowerdir' [ 239.369499][ T7349] delete_channel: no stack [ 239.428534][ T7367] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 239.447676][ T7358] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 240.052128][ T7387] netlink: 8 bytes leftover after parsing attributes in process `syz.3.403'. [ 243.973300][ T7411] netlink: 'syz.0.410': attribute type 1 has an invalid length. [ 244.127335][ T7411] 8021q: adding VLAN 0 to HW filter on device bond1 [ 244.175479][ T7415] bond1: (slave gretap1): making interface the new active one [ 244.185686][ T7415] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 245.572787][ T7440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.419'. [ 247.285896][ T7456] Lens B: ================= START STATUS ================= [ 247.293504][ T7456] Lens B: Focus, Absolute: 0 [ 247.298315][ T7456] Lens B: ================== END STATUS ================== [ 249.593618][ T7477] netlink: 24 bytes leftover after parsing attributes in process `syz.0.430'. [ 249.837695][ T7482] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 252.369616][ T7496] Lens B: ================= START STATUS ================= [ 252.377207][ T7496] Lens B: Focus, Absolute: 0 [ 252.381967][ T7496] Lens B: ================== END STATUS ================== [ 254.897646][ T7515] netlink: 16 bytes leftover after parsing attributes in process `syz.0.439'. [ 255.876174][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.882738][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.024358][ T7548] Lens B: ================= START STATUS ================= [ 258.024381][ T7548] Lens B: Focus, Absolute: 0 [ 258.024412][ T7548] Lens B: ================== END STATUS ================== [ 261.024074][ T30] audit: type=1800 audit(1755336879.119:3): pid=7572 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.454" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 262.513774][ T7569] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.521656][ T7569] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.706554][ T7581] netlink: 'syz.0.458': attribute type 6 has an invalid length. [ 262.776275][ T7582] 9pnet_virtio: no channels available for device syz [ 262.783976][ T7582] 9pnet_virtio: no channels available for device syz [ 263.080259][ T7569] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 263.115665][ T7569] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 263.285611][ T7588] Lens B: ================= START STATUS ================= [ 263.293144][ T7588] Lens B: Focus, Absolute: 0 [ 263.297911][ T7588] Lens B: ================== END STATUS ================== [ 263.922710][ T43] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 264.093096][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 264.098092][ T43] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 264.098145][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 264.100908][ T43] usb 2-1: New USB device found, idVendor=413c, idProduct=819b, bcdDevice=a7.c0 [ 264.100938][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.100960][ T43] usb 2-1: Product: syz [ 264.100976][ T43] usb 2-1: Manufacturer: syz [ 264.100992][ T43] usb 2-1: SerialNumber: syz [ 264.110653][ T43] usb 2-1: config 0 descriptor?? [ 264.191514][ T43] qmi_wwan 2-1:0.0: probe with driver qmi_wwan failed with error -22 [ 264.279837][ T7569] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.303021][ T7569] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.312528][ T7569] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.325996][ T7569] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.794475][ T7594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.816336][ T7594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.858492][ T6518] usb 2-1: USB disconnect, device number 9 [ 266.521854][ T7618] warning: `syz.2.469' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 266.611725][ T7619] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 266.976605][ T10] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 267.702090][ T10] usb 3-1: New USB device found, idVendor=2c7c, idProduct=030e, bcdDevice=81.28 [ 267.825614][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.959629][ T10] usb 3-1: Product: syz [ 268.028415][ T10] usb 3-1: Manufacturer: syz [ 268.115028][ T10] usb 3-1: SerialNumber: syz [ 268.187263][ T5842] Bluetooth: hci4: command 0x0406 tx timeout [ 268.666793][ T10] usb 3-1: config 0 descriptor?? [ 268.974767][ T10] option 3-1:0.0: GSM modem (1-port) converter detected [ 270.194930][ T6503] usb 3-1: USB disconnect, device number 5 [ 270.234856][ T7630] netlink: 48 bytes leftover after parsing attributes in process `syz.0.475'. [ 270.253475][ T7631] netlink: 'syz.1.474': attribute type 1 has an invalid length. [ 270.262715][ T6503] option 3-1:0.0: device disconnected [ 270.303254][ T7630] netlink: 'syz.0.475': attribute type 1 has an invalid length. [ 271.946107][ T7631] 8021q: adding VLAN 0 to HW filter on device bond1 [ 271.977319][ T7637] bond1: (slave gretap1): making interface the new active one [ 271.989526][ T7637] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 317.307148][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.313798][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 347.232366][ T7663] netlink: 8 bytes leftover after parsing attributes in process `syz.2.481'. [ 347.502294][ T6518] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 348.395400][ T6518] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 348.444148][ T6518] usb 5-1: config 0 has no interface number 0 [ 348.483941][ T6518] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 348.493292][ T6518] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.501795][ T6518] usb 5-1: Product: syz [ 348.528067][ T7680] netlink: 24 bytes leftover after parsing attributes in process `syz.1.488'. [ 348.573002][ T6518] usb 5-1: Manufacturer: syz [ 348.577776][ T6518] usb 5-1: SerialNumber: syz [ 348.631904][ T6518] usb 5-1: config 0 descriptor?? [ 350.213500][ T6518] usb 5-1: Found UVC 0.00 device syz (046d:0823) [ 350.220069][ T6518] usb 5-1: No valid video chain found. [ 350.242226][ T6518] usb 5-1: USB disconnect, device number 9 [ 350.708447][ T7716] netlink: 'syz.1.498': attribute type 1 has an invalid length. [ 350.905557][ T7716] 8021q: adding VLAN 0 to HW filter on device bond2 [ 352.419316][ T7741] netlink: 4 bytes leftover after parsing attributes in process `syz.0.505'. [ 352.469112][ T7741] netlink: 'syz.0.505': attribute type 10 has an invalid length. [ 352.480195][ T7741] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.491247][ T7741] bridge_slave_1: left allmulticast mode [ 352.503222][ T7741] bridge_slave_1: left promiscuous mode [ 352.509091][ T7741] bridge0: port 2(bridge_slave_1) entered disabled state [ 353.747564][ T7741] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 354.989919][ T7763] binder: BINDER_SET_CONTEXT_MGR already set [ 355.018394][ T7763] binder: 7762:7763 ioctl 4018620d 200000000040 returned -16 [ 355.126392][ T6503] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 356.021616][ T30] audit: type=1326 audit(1755336974.259:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 356.103008][ T6503] usb 2-1: Using ep0 maxpacket: 32 [ 356.137937][ T6503] usb 2-1: unable to get BOS descriptor or descriptor too short [ 356.168217][ T6503] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 356.209204][ T6503] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 356.255865][ T30] audit: type=1326 audit(1755336974.259:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 356.278185][ T30] audit: type=1326 audit(1755336974.259:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 356.288816][ T6503] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 356.303007][ T30] audit: type=1326 audit(1755336974.259:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 356.579993][ T6503] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 356.728233][ T6503] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.852657][ T6503] usb 2-1: Product: syz [ 356.877251][ T6503] usb 2-1: Manufacturer: syz [ 356.905161][ T6503] usb 2-1: SerialNumber: syz [ 357.050636][ T7779] loop2: detected capacity change from 0 to 7 [ 357.053826][ T30] audit: type=1326 audit(1755336974.269:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=263 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 357.079417][ T30] audit: type=1326 audit(1755336974.269:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 357.091111][ T5837] Dev loop2: unable to read RDB block 7 [ 357.113457][ T30] audit: type=1326 audit(1755336974.269:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 357.143481][ T5837] loop2: AHDI p2 p3 [ 357.152641][ T5837] loop2: partition table partially beyond EOD, truncated [ 357.178964][ T6503] usb 2-1: 0:2 : does not exist [ 357.181793][ T5837] loop2: p3 start 335544320 is beyond EOD, [ 357.186805][ T30] audit: type=1326 audit(1755336974.269:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 357.215455][ T5837] truncated [ 357.220239][ T30] audit: type=1326 audit(1755336974.269:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d7578ebe9 code=0x7ffc0000 [ 357.222470][ T7779] Dev loop2: unable to read RDB block 7 [ 357.242199][ T30] audit: type=1326 audit(1755336974.269:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7771 comm="syz.4.513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3d75790b07 code=0x7ffc0000 [ 357.269515][ T7779] loop2: AHDI p2 p3 [ 357.286663][ T6503] usb 2-1: USB disconnect, device number 10 [ 357.321429][ T7779] loop2: partition table partially beyond EOD, truncated [ 357.340714][ T7779] loop2: p3 start 335544320 is beyond EOD, truncated [ 359.182145][ T7780] udevd[7780]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 361.293048][ T6509] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 362.396917][ T6509] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 362.523037][ T6509] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 362.532163][ T6509] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.617201][ T6509] usb 5-1: config 0 descriptor?? [ 362.636678][ T6509] pwc: Askey VC010 type 2 USB webcam detected. [ 363.199302][ T6509] pwc: recv_control_msg error -32 req 02 val 2b00 [ 363.310690][ T6509] pwc: recv_control_msg error -32 req 02 val 2700 [ 363.548940][ T6509] pwc: recv_control_msg error -32 req 02 val 2c00 [ 363.583580][ T6509] pwc: recv_control_msg error -32 req 04 val 1000 [ 363.634235][ T6509] pwc: recv_control_msg error -32 req 04 val 1300 [ 363.670325][ T6509] pwc: recv_control_msg error -32 req 04 val 1400 [ 363.751016][ T6509] pwc: recv_control_msg error -32 req 02 val 2000 [ 363.807906][ T6509] pwc: recv_control_msg error -32 req 02 val 2100 [ 363.871095][ T6509] pwc: recv_control_msg error -32 req 04 val 1500 [ 363.920954][ T6509] pwc: recv_control_msg error -32 req 02 val 2500 [ 364.024475][ T6509] pwc: recv_control_msg error -32 req 02 val 2400 [ 364.095034][ T6509] pwc: recv_control_msg error -71 req 02 val 2600 [ 364.332780][ T6509] pwc: recv_control_msg error -71 req 02 val 2900 [ 364.711327][ T6509] pwc: recv_control_msg error -71 req 02 val 2800 [ 364.743137][ T6509] pwc: recv_control_msg error -71 req 04 val 1100 [ 364.800341][ T6509] pwc: recv_control_msg error -71 req 04 val 1200 [ 364.853643][ T6509] pwc: Registered as video103. [ 364.898510][ T6509] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input10 [ 365.323726][ T6509] usb 5-1: USB disconnect, device number 10 [ 367.711273][ T7873] netlink: 24 bytes leftover after parsing attributes in process `syz.2.542'. [ 370.471443][ T7896] loop2: detected capacity change from 0 to 7 [ 370.489015][ T7896] Dev loop2: unable to read RDB block 7 [ 370.511293][ T7896] loop2: AHDI p2 p3 [ 370.536899][ T7896] loop2: partition table partially beyond EOD, truncated [ 370.575937][ T7896] loop2: p3 start 335544320 is beyond EOD, truncated [ 370.877975][ T6503] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 371.038371][ T6509] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 371.224392][ T6503] usb 5-1: Using ep0 maxpacket: 16 [ 371.235704][ T6503] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 371.248109][ T6503] usb 5-1: config 1 has no interface number 0 [ 371.255658][ T6503] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 371.266156][ T6503] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 371.277351][ T6503] usb 5-1: config 1 interface 105 has no altsetting 0 [ 371.365268][ T6509] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 371.376625][ T6509] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 371.390121][ T6509] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 371.406002][ T6503] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 371.417495][ T6503] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.428673][ T6503] usb 5-1: Product: syz [ 371.428940][ T6509] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 371.447887][ T6503] usb 5-1: Manufacturer: syz [ 371.453279][ T6509] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.461353][ T6503] usb 5-1: SerialNumber: syz [ 371.474605][ T6509] usb 2-1: Product: syz [ 371.481357][ T7898] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 371.491627][ T6509] usb 2-1: Manufacturer: syz [ 371.496660][ T7898] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 371.506094][ T6509] usb 2-1: SerialNumber: syz [ 372.043914][ T7898] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 372.843283][ T7898] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 373.397548][ T6503] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 373.552642][ T6503] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 373.648093][ T6503] aqc111 5-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 20:dc:94:2f:29:41 [ 373.686078][ T6503] usb 5-1: USB disconnect, device number 11 [ 373.722432][ T6503] aqc111 5-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 374.426504][ T6503] aqc111 5-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 374.939092][ T6503] aqc111 5-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 374.949358][ T6503] aqc111 5-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 374.986583][ T7780] udevd[7780]: setting owner of /dev/bus/usb/005/011 to uid=0, gid=0 failed: No such file or directory [ 375.242622][ T6509] cdc_ncm 2-1:1.0: bind() failure [ 375.258658][ T7938] netlink: 8 bytes leftover after parsing attributes in process `syz.4.561'. [ 375.269871][ T6509] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 375.269938][ T6509] cdc_ncm 2-1:1.1: bind() failure [ 375.278765][ T6509] usb 2-1: USB disconnect, device number 11 [ 377.052144][ T7958] netlink: 8 bytes leftover after parsing attributes in process `syz.4.564'. [ 378.493947][ T7970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.570'. [ 378.600609][ T7970] syz_tun: entered promiscuous mode [ 378.618657][ T7974] netlink: 'syz.4.571': attribute type 10 has an invalid length. [ 378.636772][ T7974] netlink: 40 bytes leftover after parsing attributes in process `syz.4.571'. [ 378.652418][ T7970] syz_tun: left promiscuous mode [ 378.751966][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.759320][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.787488][ T7974] team0: Port device geneve0 added [ 379.591821][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.621346][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.648295][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.659035][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.669370][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.678141][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.687116][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.699039][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.707828][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.716440][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.725014][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.733603][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.742572][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.751737][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.760396][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.769097][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.777687][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.787355][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.795924][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.804547][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.812814][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.896862][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.962023][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.970712][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.979116][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 379.987463][ T7991] comedi comedi0: rti800: I/O port conflict (0xffffffff80000000,16) [ 382.423249][ T8017] ubi31: attaching mtd0 [ 382.436725][ T8017] ubi31: scanning is finished [ 382.436795][ T8017] ubi31: empty MTD device detected [ 383.114783][ T8017] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 383.122987][ T8017] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 383.130324][ T8017] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 383.138252][ T8017] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 383.146020][ T8017] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 383.153199][ T8017] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 383.161297][ T8017] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2979143730 [ 383.171488][ T8017] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 383.182774][ T8026] ubi31: background thread "ubi_bgt31d" started, PID 8026 [ 383.292087][ T8028] loop2: detected capacity change from 0 to 7 [ 383.316639][ T8028] Dev loop2: unable to read RDB block 7 [ 383.322611][ T8032] tun0: tun_chr_ioctl cmd 1074025673 [ 383.341737][ T8028] loop2: AHDI p2 p3 [ 383.350439][ T8032] tun0: tun_chr_ioctl cmd 1074025673 [ 383.357085][ T8028] loop2: partition table partially beyond EOD, truncated [ 383.373226][ T8028] loop2: p3 start 335544320 is beyond EOD, truncated [ 383.388894][ T8033] tun0: tun_chr_ioctl cmd 1074025675 [ 383.426831][ T8033] tun0: persist enabled [ 383.469854][ T8032] tun0: tun_chr_ioctl cmd 1074025673 [ 383.711615][ T8044] autofs: Unknown parameter 'GPL' [ 385.284556][ T8052] netlink: 8 bytes leftover after parsing attributes in process `syz.1.595'. [ 389.297906][ T8087] netlink: 72 bytes leftover after parsing attributes in process `syz.3.605'. [ 389.928951][ T8098] netlink: 12 bytes leftover after parsing attributes in process `syz.0.610'. [ 389.958573][ T8098] syz_tun: entered promiscuous mode [ 389.972587][ T8098] syz_tun: left promiscuous mode [ 390.008292][ T5925] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 390.206281][ T5925] usb 2-1: Using ep0 maxpacket: 8 [ 391.053391][ T5925] usb 2-1: device descriptor read/all, error -71 [ 391.219469][ T8113] netlink: 8 bytes leftover after parsing attributes in process `syz.2.613'. [ 391.510274][ T8122] netlink: 8 bytes leftover after parsing attributes in process `syz.1.614'. [ 391.553027][ T8122] netlink: 312 bytes leftover after parsing attributes in process `syz.1.614'. [ 391.577080][ T8122] netlink: 'syz.1.614': attribute type 1 has an invalid length. [ 391.882867][ T8132] netlink: 20 bytes leftover after parsing attributes in process `syz.4.617'. [ 392.213199][ T6509] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 392.530687][ T6509] usb 5-1: config 0 has an invalid interface number: 200 but max is 0 [ 392.606945][ T6509] usb 5-1: config 0 has no interface number 0 [ 392.640121][ T6509] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 392.670158][ T6509] usb 5-1: config 0 interface 200 has no altsetting 0 [ 392.691058][ T6509] usb 5-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 392.743190][ T6509] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.794778][ T6509] usb 5-1: Product: syz [ 392.799296][ T6509] usb 5-1: Manufacturer: syz [ 392.853781][ T6509] usb 5-1: SerialNumber: syz [ 392.973424][ T6509] usb 5-1: config 0 descriptor?? [ 393.217009][ T8141] FAULT_INJECTION: forcing a failure. [ 393.217009][ T8141] name failslab, interval 1, probability 0, space 0, times 0 [ 393.235726][ T8141] CPU: 1 UID: 0 PID: 8141 Comm: syz.1.621 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 393.235759][ T8141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 393.235771][ T8141] Call Trace: [ 393.235779][ T8141] [ 393.235788][ T8141] dump_stack_lvl+0x189/0x250 [ 393.235809][ T8141] ? lockdep_hardirqs_on+0x9c/0x150 [ 393.235825][ T8141] ? __pfx_dump_stack_lvl+0x10/0x10 [ 393.235841][ T8141] ? __pfx__printk+0x10/0x10 [ 393.235864][ T8141] should_fail_ex+0x414/0x560 [ 393.235881][ T8141] should_failslab+0xa8/0x100 [ 393.235896][ T8141] __kmalloc_noprof+0xcb/0x4f0 [ 393.235908][ T8141] ? tomoyo_encode+0x28b/0x550 [ 393.235926][ T8141] tomoyo_encode+0x28b/0x550 [ 393.235945][ T8141] tomoyo_realpath_from_path+0x58d/0x5d0 [ 393.235968][ T8141] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 393.235980][ T8141] tomoyo_path_number_perm+0x1e8/0x5a0 [ 393.235995][ T8141] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 393.236008][ T8141] ? __pfx_rcu_preempt_deferred_qs_irqrestore+0x10/0x10 [ 393.236037][ T8141] ? rcu_read_unlock_special+0x3fe/0x4c0 [ 393.236053][ T8141] ? __fget_files+0x2a/0x420 [ 393.236080][ T8141] ? __rcu_read_unlock+0x84/0xe0 [ 393.236096][ T8141] ? __fget_files+0x2a/0x420 [ 393.236108][ T8141] ? __fget_files+0x3a0/0x420 [ 393.236120][ T8141] ? __fget_files+0x2a/0x420 [ 393.236136][ T8141] security_file_ioctl+0xcb/0x2d0 [ 393.236151][ T8141] __se_sys_ioctl+0x47/0x170 [ 393.236171][ T8141] do_syscall_64+0xfa/0x3b0 [ 393.236185][ T8141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.236196][ T8141] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 393.236207][ T8141] ? clear_bhb_loop+0x60/0xb0 [ 393.236221][ T8141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.236233][ T8141] RIP: 0033:0x7f37cb38ebe9 [ 393.236245][ T8141] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 393.236255][ T8141] RSP: 002b:00007f37cc22c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 393.236269][ T8141] RAX: ffffffffffffffda RBX: 00007f37cb5b5fa0 RCX: 00007f37cb38ebe9 [ 393.236278][ T8141] RDX: 00002000000019c0 RSI: 00000000c018937e RDI: 0000000000000003 [ 393.236286][ T8141] RBP: 00007f37cc22c090 R08: 0000000000000000 R09: 0000000000000000 [ 393.236293][ T8141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.236300][ T8141] R13: 00007f37cb5b6038 R14: 00007f37cb5b5fa0 R15: 00007ffe3ae12048 [ 393.236319][ T8141] [ 393.236538][ T8141] ERROR: Out of memory at tomoyo_realpath_from_path. [ 393.748421][ T8118] overlayfs: failed to clone lowerpath [ 394.611318][ T6509] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.200/input/input11 [ 394.813372][ T6509] usb 5-1: USB disconnect, device number 12 [ 395.072260][ T8154] loop2: detected capacity change from 0 to 7 [ 395.143656][ T8156] Cannot find add_set index 0 as target [ 395.797181][ T6509] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 395.819177][ T8154] Dev loop2: unable to read RDB block 7 [ 395.837162][ T8154] loop2: AHDI p2 p3 [ 395.859207][ T8154] loop2: partition table partially beyond EOD, truncated [ 395.879658][ T8154] loop2: p3 start 335544320 is beyond EOD, truncated [ 395.985971][ T6509] usb 5-1: unable to get BOS descriptor or descriptor too short [ 396.943397][ T6509] usb 5-1: not running at top speed; connect to a high speed hub [ 396.953633][ T6509] usb 5-1: config 129 has an invalid interface number: 144 but max is 0 [ 396.974841][ T6509] usb 5-1: config 129 has no interface number 0 [ 396.981578][ T6509] usb 5-1: config 129 interface 144 altsetting 250 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 397.094753][ T6509] usb 5-1: config 129 interface 144 altsetting 250 endpoint 0x8D has invalid maxpacket 18502, setting to 64 [ 397.152238][ T6509] usb 5-1: config 129 interface 144 altsetting 250 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 397.206841][ T6509] usb 5-1: config 129 interface 144 has no altsetting 0 [ 399.317463][ T6509] usb 5-1: New USB device found, idVendor=1b3d, idProduct=01b8, bcdDevice=4c.10 [ 399.320563][ T8183] 9pnet_fd: Insufficient options for proto=fd [ 399.347580][ T6509] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.440721][ T6509] usb 5-1: can't set config #129, error -71 [ 399.493314][ T6509] usb 5-1: USB disconnect, device number 13 [ 399.843100][ T6518] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 400.343306][ T5836] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 400.627785][ T5836] usb 3-1: Using ep0 maxpacket: 32 [ 400.636239][ T5836] usb 3-1: config 0 has an invalid interface number: 66 but max is 0 [ 400.653547][ T5836] usb 3-1: config 0 has no interface number 0 [ 400.666241][ T5836] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 400.682992][ T5836] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.701444][ T5836] usb 3-1: Product: syz [ 400.706968][ T5836] usb 3-1: Manufacturer: syz [ 400.717391][ T5836] usb 3-1: SerialNumber: syz [ 400.738930][ T5836] usb 3-1: config 0 descriptor?? [ 400.757700][ T6509] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 400.778787][ T6518] usb 4-1: device descriptor read/64, error -71 [ 401.015357][ T5836] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 401.038281][ T6509] usb 2-1: Using ep0 maxpacket: 8 [ 401.131694][ T5836] dvb-usb: bulk message failed: -22 (2/0) [ 401.170563][ T6509] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 401.184200][ T6518] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 401.234038][ T6509] usb 2-1: config 0 has no interface number 0 [ 401.309149][ T6509] usb 2-1: config 0 interface 1 has no altsetting 0 [ 401.345690][ T5836] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 401.419041][ T6509] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 401.428787][ T6509] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.437777][ T5836] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 401.451350][ T6509] usb 2-1: Product: syz [ 401.459658][ T5836] usb 3-1: media controller created [ 401.465253][ T6509] usb 2-1: Manufacturer: syz [ 401.473105][ T6518] usb 4-1: device descriptor read/64, error -71 [ 401.473159][ T6509] usb 2-1: SerialNumber: syz [ 401.627525][ T6509] usb 2-1: config 0 descriptor?? [ 401.658973][ T5836] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 402.293802][ T6518] usb usb4-port1: attempt power cycle [ 402.446935][ T6509] i2c-cp2615 2-1:0.1: probe with driver i2c-cp2615 failed with error -71 [ 402.475156][ T6509] usb 2-1: USB disconnect, device number 14 [ 402.482323][ T5836] cxusb: set interface failed [ 402.489701][ T5836] dvb-usb: bulk message failed: -22 (1/0) [ 402.708218][ T5836] DVB: Unable to find symbol lgdt330x_attach() [ 402.727922][ T8217] loop2: detected capacity change from 0 to 7 [ 402.758872][ T5836] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 402.769424][ T8217] Dev loop2: unable to read RDB block 7 [ 402.775060][ T6518] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 402.914704][ T8217] loop2: AHDI p2 p3 [ 402.981163][ T8217] loop2: partition table partially beyond EOD, truncated [ 403.145871][ T8217] loop2: p3 start 335544320 is beyond EOD, truncated [ 403.447384][ T6518] usb 4-1: device descriptor read/8, error -71 [ 403.520242][ T8223] netlink: 'syz.0.647': attribute type 5 has an invalid length. [ 403.527982][ T8223] netlink: 12 bytes leftover after parsing attributes in process `syz.0.647'. [ 404.147090][ T5836] rc_core: IR keymap rc-dvico-portable not found [ 404.220682][ T5836] Registered IR keymap rc-empty [ 404.547738][ T8234] netlink: 8 bytes leftover after parsing attributes in process `syz.1.651'. [ 404.553388][ T5836] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 404.617586][ T5836] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input12 [ 404.646173][ T5836] dvb-usb: schedule remote query interval to 100 msecs. [ 404.669101][ T5836] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 404.741629][ T5836] usb 3-1: USB disconnect, device number 6 [ 404.947662][ T5836] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 404.964492][ T8240] netlink: 24 bytes leftover after parsing attributes in process `syz.2.654'. [ 405.575206][ T8253] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 405.753237][ T5890] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 406.012434][ T5890] usb 3-1: config 0 has an invalid interface number: 25 but max is 0 [ 406.798668][ T5890] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.813736][ T5890] usb 3-1: config 0 has no interface number 0 [ 406.822215][ T5890] usb 3-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 406.857748][ T5890] usb 3-1: config 0 interface 25 has no altsetting 0 [ 406.910715][ T5890] usb 3-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 406.935766][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.963426][ T5890] usb 3-1: Product: syz [ 406.967666][ T5890] usb 3-1: Manufacturer: syz [ 406.972299][ T5890] usb 3-1: SerialNumber: syz [ 407.053150][ T5890] usb 3-1: config 0 descriptor?? [ 407.148320][ T8272] netlink: 'syz.0.664': attribute type 1 has an invalid length. [ 407.265933][ T8272] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 407.287462][ T8276] Lens B: ================= START STATUS ================= [ 407.295153][ T8276] Lens B: Focus, Absolute: 0 [ 407.299899][ T8276] Lens B: ================== END STATUS ================== [ 407.662630][ T8250] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 407.884284][ T8277] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 408.027728][ T5890] usb 3-1: Found UVC 0.00 device syz (1b3b:2951) [ 408.035333][ T5890] usb 3-1: No valid video chain found. [ 408.042357][ T8277] bond2 (unregistering): Released all slaves [ 408.076063][ T5890] usb 3-1: USB disconnect, device number 7 [ 408.893412][ T5925] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 409.089799][ T5925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 409.148756][ T5925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 410.114940][ T5925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 410.129003][ T5925] usb 5-1: New USB device found, idVendor=1949, idProduct=85a5, bcdDevice=a3.3a [ 410.138282][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.146446][ T5925] usb 5-1: Product: syz [ 410.150737][ T5925] usb 5-1: Manufacturer: syz [ 410.156194][ T5925] usb 5-1: SerialNumber: syz [ 410.989092][ T8318] Lens B: ================= START STATUS ================= [ 410.996637][ T8318] Lens B: Focus, Absolute: 0 [ 411.001299][ T8318] Lens B: ================== END STATUS ================== [ 411.119038][ T5925] usb 5-1: config 0 descriptor?? [ 411.627041][ T10] usb 5-1: USB disconnect, device number 14 [ 413.317649][ T8340] vim2m vim2m.0: Fourcc format (0x42474752) invalid. [ 417.185367][ T8373] FAULT_INJECTION: forcing a failure. [ 417.185367][ T8373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 417.199332][ T8373] CPU: 0 UID: 0 PID: 8373 Comm: syz.2.692 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 417.199359][ T8373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 417.199370][ T8373] Call Trace: [ 417.199379][ T8373] [ 417.199388][ T8373] dump_stack_lvl+0x189/0x250 [ 417.199427][ T8373] ? __pfx____ratelimit+0x10/0x10 [ 417.199448][ T8373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 417.199470][ T8373] ? __pfx__printk+0x10/0x10 [ 417.199510][ T8373] should_fail_ex+0x414/0x560 [ 417.199538][ T8373] _copy_to_user+0x31/0xb0 [ 417.199569][ T8373] simple_read_from_buffer+0xe1/0x170 [ 417.199597][ T8373] proc_fail_nth_read+0x1df/0x250 [ 417.199625][ T8373] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 417.199652][ T8373] ? rw_verify_area+0x258/0x650 [ 417.199681][ T8373] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 417.199707][ T8373] vfs_read+0x200/0x980 [ 417.199745][ T8373] ? __pfx___mutex_lock+0x10/0x10 [ 417.199768][ T8373] ? __pfx_vfs_read+0x10/0x10 [ 417.199800][ T8373] ? __fget_files+0x2a/0x420 [ 417.199828][ T8373] ? __fget_files+0x3a0/0x420 [ 417.199848][ T8373] ? __fget_files+0x2a/0x420 [ 417.199881][ T8373] ksys_read+0x145/0x250 [ 417.199902][ T8373] ? __pfx_ksys_read+0x10/0x10 [ 417.199918][ T8373] ? rcu_is_watching+0x15/0xb0 [ 417.199946][ T8373] ? do_syscall_64+0xbe/0x3b0 [ 417.199973][ T8373] do_syscall_64+0xfa/0x3b0 [ 417.199993][ T8373] ? lockdep_hardirqs_on+0x9c/0x150 [ 417.200014][ T8373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.200033][ T8373] ? clear_bhb_loop+0x60/0xb0 [ 417.200059][ T8373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.200078][ T8373] RIP: 0033:0x7fe26b38d5fc [ 417.200096][ T8373] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 417.200113][ T8373] RSP: 002b:00007fe26c24f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 417.200134][ T8373] RAX: ffffffffffffffda RBX: 00007fe26b5b5fa0 RCX: 00007fe26b38d5fc [ 417.200149][ T8373] RDX: 000000000000000f RSI: 00007fe26c24f0a0 RDI: 0000000000000004 [ 417.200161][ T8373] RBP: 00007fe26c24f090 R08: 0000000000000000 R09: 0000000000000000 [ 417.200173][ T8373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 417.200190][ T8373] R13: 00007fe26b5b6038 R14: 00007fe26b5b5fa0 R15: 00007ffe0983b988 [ 417.200225][ T8373] [ 417.636709][ T8379] usb usb1: check_ctrlrecip: process 8379 (syz.3.694) requesting ep 01 but needs 81 [ 417.655467][ T8379] tmpfs: Unknown parameter 'Í' [ 422.033344][ T10] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 422.130179][ T8402] Lens B: ================= START STATUS ================= [ 422.138107][ T8402] Lens B: Focus, Absolute: 0 [ 422.143298][ T8402] Lens B: ================== END STATUS ================== [ 422.934016][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 422.962703][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 422.985340][ T10] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 423.003063][ T10] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 423.018328][ T10] usb 2-1: Product: syz [ 423.113048][ T10] usb 2-1: Manufacturer: syz [ 423.230960][ T10] usb 2-1: SerialNumber: syz [ 423.254187][ T8408] netlink: 24 bytes leftover after parsing attributes in process `syz.3.704'. [ 423.276237][ T10] usb 2-1: config 0 descriptor?? [ 423.322246][ T8400] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 423.634172][ T8409] random: crng reseeded on system resumption [ 423.860707][ T10] usb 2-1: USB disconnect, device number 15 [ 425.506914][ T5890] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 425.519986][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 425.520005][ T30] audit: type=1800 audit(1755337043.669:33): pid=8414 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.705" name="/" dev="fuse" ino=0 res=0 errno=0 [ 425.655448][ T8427] syz_tun: entered promiscuous mode [ 425.688183][ T8427] syz_tun: left promiscuous mode [ 425.735235][ T5890] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 425.748927][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.765015][ T5890] usb 3-1: config 0 descriptor?? [ 425.787659][ T5890] cp210x 3-1:0.0: cp210x converter detected [ 426.082795][ T8439] Lens B: ================= START STATUS ================= [ 426.090532][ T8439] Lens B: Focus, Absolute: 0 [ 426.095700][ T8439] Lens B: ================== END STATUS ================== [ 426.899049][ T8440] netlink: 292 bytes leftover after parsing attributes in process `syz.3.715'. [ 428.020801][ T8451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.717'. [ 429.091718][ T8453] 9pnet_virtio: no channels available for device syz [ 430.208892][ T43] IPVS: starting estimator thread 0... [ 430.364756][ T8460] IPVS: using max 21 ests per chain, 50400 per kthread [ 430.525784][ T8470] netlink: 72 bytes leftover after parsing attributes in process `syz.3.723'. [ 435.134809][ T5890] cp210x 3-1:0.0: failed to get vendor val 0x0010 size 3: -110 [ 435.147085][ T5890] cp210x 3-1:0.0: failed to get vendor val 0x000e size 678: -32 [ 435.155245][ T5890] cp210x 3-1:0.0: GPIO initialisation failed: -32 [ 435.166191][ T5890] usb 3-1: cp210x converter now attached to ttyUSB0 [ 438.773241][ T6509] usb 3-1: USB disconnect, device number 8 [ 438.905712][ T6509] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 439.071351][ T6509] cp210x 3-1:0.0: device disconnected [ 439.729881][ T8500] netlink: 24 bytes leftover after parsing attributes in process `syz.0.732'. [ 440.082106][ T8513] netlink: 32 bytes leftover after parsing attributes in process `syz.2.737'. [ 440.264300][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.282982][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.121036][ T8531] xt_hashlimit: max too large, truncated to 1048576 [ 442.121520][ T8544] netlink: 8 bytes leftover after parsing attributes in process `syz.4.745'. [ 442.364360][ T8555] netlink: 'syz.4.749': attribute type 1 has an invalid length. [ 442.472017][ T8555] 8021q: adding VLAN 0 to HW filter on device bond3 [ 444.005071][ T8573] Cannot find add_set index 0 as target [ 445.952515][ T8596] netlink: 292 bytes leftover after parsing attributes in process `syz.2.760'. [ 446.942250][ T8611] netlink: 8 bytes leftover after parsing attributes in process `syz.1.767'. [ 447.036082][ T8611] team0: entered promiscuous mode [ 447.078603][ T8611] team_slave_0: entered promiscuous mode [ 447.256077][ T8611] team_slave_1: entered promiscuous mode [ 447.455879][ T8611] geneve0: entered promiscuous mode [ 447.959603][ T8611] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 448.065110][ T8611] team0: left promiscuous mode [ 448.095002][ T8611] team_slave_0: left promiscuous mode [ 448.127780][ T8611] team_slave_1: left promiscuous mode [ 448.134229][ T8624] netlink: 'syz.0.770': attribute type 1 has an invalid length. [ 448.168830][ T8611] geneve0: left promiscuous mode [ 448.871511][ T8624] 8021q: adding VLAN 0 to HW filter on device bond2 [ 448.873527][ T8634] netlink: 8 bytes leftover after parsing attributes in process `syz.2.774'. [ 451.037411][ T8664] Lens B: ================= START STATUS ================= [ 451.044944][ T8664] Lens B: Focus, Absolute: 0 [ 451.049744][ T8664] Lens B: ================== END STATUS ================== [ 453.660628][ T8684] netlink: 20 bytes leftover after parsing attributes in process `syz.0.791'. [ 453.710588][ T8684] netlink: 20 bytes leftover after parsing attributes in process `syz.0.791'. [ 453.872006][ T8688] overlayfs: failed to clone upperpath [ 454.735315][ T8699] netlink: 24 bytes leftover after parsing attributes in process `syz.1.794'. [ 455.158081][ T8705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.798'. [ 456.176166][ T8703] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 459.334514][ T5925] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 459.580687][ T5925] usb 2-1: config 0 has an invalid interface number: 200 but max is 0 [ 459.601559][ T5925] usb 2-1: config 0 has no interface number 0 [ 460.128257][ T5925] usb 2-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 460.144128][ T5925] usb 2-1: config 0 interface 200 has no altsetting 0 [ 460.161992][ T5925] usb 2-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 460.182084][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.191477][ T5925] usb 2-1: Product: syz [ 460.200229][ T5925] usb 2-1: Manufacturer: syz [ 460.228322][ T5925] usb 2-1: SerialNumber: syz [ 460.243369][ T6518] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 460.260544][ T5925] usb 2-1: config 0 descriptor?? [ 460.313852][ T8783] netlink: 292 bytes leftover after parsing attributes in process `syz.0.818'. [ 460.433662][ T6518] usb 3-1: Using ep0 maxpacket: 32 [ 460.447374][ T6518] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 460.482679][ T6518] usb 3-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 460.510496][ T8788] netlink: 20 bytes leftover after parsing attributes in process `syz.3.820'. [ 460.542468][ T6518] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.551478][ T6518] usb 3-1: Product: syz [ 460.558946][ T6518] usb 3-1: Manufacturer: syz [ 460.578856][ T6518] usb 3-1: SerialNumber: syz [ 460.593229][ T6509] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 460.611094][ T6518] usb 3-1: config 0 descriptor?? [ 460.654367][ T6518] usb 3-1: bad CDC descriptors [ 460.675391][ T6518] usb 3-1: unsupported MDLM descriptors [ 460.733004][ T6509] usb 5-1: device descriptor read/64, error -71 [ 460.971552][ T10] usb 3-1: USB disconnect, device number 9 [ 461.852104][ T5925] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.200/input/input13 [ 461.853097][ T6509] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 461.913242][ T5836] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 461.941319][ T5925] usb 2-1: USB disconnect, device number 16 [ 462.016475][ T8801] netlink: 8 bytes leftover after parsing attributes in process `syz.0.823'. [ 462.074098][ T6509] usb 5-1: device descriptor read/64, error -71 [ 462.081096][ T5836] usb 4-1: Using ep0 maxpacket: 16 [ 462.092267][ T5836] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 462.108358][ T5836] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 462.119390][ T5836] usb 4-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 462.132964][ T5836] usb 4-1: config 0 interface 0 has no altsetting 0 [ 462.139636][ T5836] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 462.149724][ T5836] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.170436][ T5836] usb 4-1: config 0 descriptor?? [ 462.193399][ T6509] usb usb5-port1: attempt power cycle [ 462.352970][ T5925] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 462.534989][ T5925] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 462.553213][ T5925] usb 2-1: config 0 has no interface number 0 [ 462.569941][ T5925] usb 2-1: config 0 interface 188 has no altsetting 0 [ 462.582118][ T6509] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 462.589843][ T5925] usb 2-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=dc.ab [ 462.608177][ T5836] usbhid 4-1:0.0: can't add hid device: -71 [ 462.624054][ T6509] usb 5-1: device descriptor read/8, error -71 [ 462.633548][ T5836] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 462.647659][ T5925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.672144][ T5836] usb 4-1: USB disconnect, device number 16 [ 462.693290][ T5925] usb 2-1: config 0 descriptor?? [ 462.886968][ T6509] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 463.261510][ T5925] ftdi_sio 2-1:0.188: FTDI USB Serial Device converter detected [ 463.274565][ T5925] ftdi_sio ttyUSB0: unknown device type: 0xdcab [ 463.395842][ T6509] usb 5-1: device descriptor read/8, error -71 [ 463.539425][ T6509] usb usb5-port1: unable to enumerate USB device [ 463.618206][ T30] audit: type=1326 audit(1755337081.859:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 463.700152][ T30] audit: type=1326 audit(1755337081.859:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 463.749334][ T30] audit: type=1326 audit(1755337081.889:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe26b38d550 code=0x7ffc0000 [ 463.792990][ T30] audit: type=1326 audit(1755337081.889:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 463.835890][ T30] audit: type=1326 audit(1755337081.899:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 463.902088][ T30] audit: type=1326 audit(1755337081.909:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 463.959688][ T30] audit: type=1326 audit(1755337081.909:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 464.021739][ T30] audit: type=1326 audit(1755337081.909:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 464.068017][ T6509] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 464.086740][ T30] audit: type=1326 audit(1755337081.909:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 464.112782][ T30] audit: type=1326 audit(1755337081.909:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8829 comm="syz.2.829" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe26b38ebe9 code=0x7ffc0000 [ 464.524668][ T6509] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 464.635272][ T6509] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 464.777233][ T6509] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.799488][ T6509] usb 5-1: config 0 descriptor?? [ 464.972068][ T8799] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 465.063446][ T6509] usbhid 5-1:0.0: can't add hid device: -71 [ 465.142256][ T6509] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 465.354376][ T5853] Bluetooth: hci0: command 0x0406 tx timeout [ 465.436587][ T6509] usb 5-1: USB disconnect, device number 19 [ 465.768748][ T5890] usb 2-1: USB disconnect, device number 17 [ 465.775345][ T6509] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 465.816027][ T5890] ftdi_sio 2-1:0.188: device disconnected [ 465.967300][ T6509] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 465.997597][ T6509] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 466.063306][ T6509] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 466.104335][ T6509] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.145441][ T6509] usb 5-1: config 0 descriptor?? [ 467.990045][ T6509] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 468.757452][ T6523] usb 5-1: USB disconnect, device number 20 [ 468.943052][ T6509] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 469.133024][ T6509] usb 4-1: Using ep0 maxpacket: 8 [ 469.140876][ T6509] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 470.089899][ T6509] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 470.103269][ T6509] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.131105][ T6509] usb 4-1: config 0 descriptor?? [ 470.140737][ T6509] usb 4-1: can't set config #0, error -71 [ 470.159957][ T6509] usb 4-1: USB disconnect, device number 17 [ 470.560672][ T8908] netlink: 'syz.2.852': attribute type 4 has an invalid length. [ 470.641877][ T8914] netlink: 292 bytes leftover after parsing attributes in process `syz.3.855'. [ 471.223018][ T8917] loop4: detected capacity change from 0 to 524255232 [ 471.373514][ T8919] netlink: 8 bytes leftover after parsing attributes in process `syz.0.854'. [ 471.416401][ T8918] loop4: detected capacity change from 524255232 to 524287956 [ 471.703328][ T8919] netlink: 24 bytes leftover after parsing attributes in process `syz.0.854'. [ 473.241577][ T8938] comedi comedi0: Cannot bond this driver to itself! [ 473.756462][ T8943] loop2: detected capacity change from 0 to 7 [ 474.229872][ T8943] Dev loop2: unable to read RDB block 7 [ 474.249484][ T8943] loop2: AHDI p2 p3 [ 474.263271][ T8943] loop2: partition table partially beyond EOD, truncated [ 474.280609][ T8943] loop2: p3 start 335544320 is beyond EOD, truncated [ 481.193769][ T6523] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 482.160962][ T6523] usb 5-1: unable to get BOS descriptor or descriptor too short [ 482.608550][ T6523] usb 5-1: not running at top speed; connect to a high speed hub [ 482.735655][ T6523] usb 5-1: config 219 has 1 interface, different from the descriptor's value: 2 [ 482.819699][ T6523] usb 5-1: config 219 interface 0 has no altsetting 0 [ 482.892642][ T6523] usb 5-1: config 219 interface 0 has no altsetting 1 [ 482.990462][ T6523] usb 5-1: string descriptor 0 read error: -71 [ 483.005638][ T6523] usb 5-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 483.093404][ T6523] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.743556][ T6523] usb 5-1: can't set config #219, error -71 [ 484.027030][ T6523] usb 5-1: USB disconnect, device number 21 [ 487.573458][ T9038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.887'. [ 488.925593][ T9051] 9pnet_fd: Insufficient options for proto=fd [ 490.001226][ T9061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.896'. [ 490.045973][ T9061] netlink: 20 bytes leftover after parsing attributes in process `syz.3.896'. [ 490.285844][ T9075] netlink: 4 bytes leftover after parsing attributes in process `syz.0.901'. [ 490.327639][ T9075] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (511) [ 490.342575][ T9075] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 491.576888][ T9085] netlink: 24 bytes leftover after parsing attributes in process `syz.2.903'. [ 492.282937][ T10] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 492.769325][ T10] usb 5-1: config 0 has an invalid interface number: 200 but max is 0 [ 492.784841][ T10] usb 5-1: config 0 has no interface number 0 [ 492.796346][ T10] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 492.806839][ T10] usb 5-1: config 0 interface 200 has no altsetting 0 [ 492.831411][ T10] usb 5-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 492.861179][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.882931][ T10] usb 5-1: Product: syz [ 492.887155][ T10] usb 5-1: Manufacturer: syz [ 492.912242][ T10] usb 5-1: SerialNumber: syz [ 492.944868][ T10] usb 5-1: config 0 descriptor?? [ 494.821694][ T10] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.200/input/input15 [ 494.857335][ T10] usb 5-1: USB disconnect, device number 22 [ 494.938959][ T9123] syz.1.917: attempt to access beyond end of device [ 494.938959][ T9123] nbd1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 495.092112][ T9123] syz.1.917: attempt to access beyond end of device [ 495.092112][ T9123] nbd1: rw=0, sector=120, nr_sectors = 8 limit=0 [ 495.129290][ T9123] Mount JFS Failure: -5 [ 497.225950][ T9158] Cannot find add_set index 0 as target [ 498.643621][ T5890] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 498.698627][ T9167] netlink: 292 bytes leftover after parsing attributes in process `syz.0.930'. [ 498.783059][ T5890] usb 3-1: device descriptor read/64, error -71 [ 498.822597][ T9170] trusted_key: syz.0.931 sent an empty control message without MSG_MORE. [ 499.023094][ T5890] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 499.942067][ T5890] usb 3-1: device descriptor read/64, error -71 [ 500.067428][ T5890] usb usb3-port1: attempt power cycle [ 500.503032][ T5890] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 500.525210][ T5890] usb 3-1: device descriptor read/8, error -71 [ 500.763576][ T5890] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 501.242697][ T5890] usb 3-1: device descriptor read/8, error -71 [ 501.373613][ T5890] usb usb3-port1: unable to enumerate USB device [ 501.670181][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.682380][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.740651][ T9205] netlink: 292 bytes leftover after parsing attributes in process `syz.0.946'. [ 502.848684][ T9210] Lens B: ================= START STATUS ================= [ 502.856221][ T9210] Lens B: Focus, Absolute: 0 [ 502.861086][ T9210] Lens B: ================== END STATUS ================== [ 507.376532][ T9333] netlink: 16 bytes leftover after parsing attributes in process `syz.0.997'. [ 508.114288][ T9350] syzkaller0: entered promiscuous mode [ 508.128527][ T9350] syzkaller0: entered allmulticast mode [ 509.242665][ T9395] bridge_slave_1: left allmulticast mode [ 509.256198][ T9395] bridge_slave_1: left promiscuous mode [ 509.269711][ T9395] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.294522][ T9395] bridge_slave_0: left allmulticast mode [ 509.300605][ T9395] bridge_slave_0: left promiscuous mode [ 509.319618][ T9395] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.977246][ T9411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1029'. [ 511.282186][ T9454] tipc: Started in network mode [ 511.288018][ T9454] tipc: Node identity 6a5f4b19ee5, cluster identity 4711 [ 511.295931][ T9454] tipc: Enabled bearer , priority 0 [ 511.311667][ T9454] syzkaller0: entered promiscuous mode [ 511.320955][ T9454] syzkaller0: entered allmulticast mode [ 511.348777][ T2931] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 511.359146][ T9454] tipc: Resetting bearer [ 511.378349][ T2931] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 511.379183][ T9453] tipc: Resetting bearer [ 511.431812][ T9453] tipc: Disabling bearer [ 511.475309][ T9456] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 512.735654][ T9512] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1071'. [ 512.746288][ T5853] Bluetooth: hci0: command 0x0406 tx timeout [ 514.056364][ T9570] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1095'. [ 515.797382][ T9627] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1121'. [ 516.275951][ T9635] tipc: Enabling of bearer rejected, failed to enable media [ 516.331962][ T9635] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1124'. [ 519.170080][ T9746] netlink: 'syz.3.1167': attribute type 12 has an invalid length. [ 519.356182][ T9753] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1172'. [ 519.479090][ T9753] netlink: 'syz.4.1172': attribute type 1 has an invalid length. [ 519.803409][ T9771] Bluetooth: MGMT ver 1.23 [ 521.611856][ T9765] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1173'. [ 521.814464][ T9776] tipc: Enabling of bearer rejected, failed to enable media [ 521.848335][ T9791] bridge_slave_0: left allmulticast mode [ 521.854865][ T9791] bridge_slave_0: left promiscuous mode [ 521.860960][ T9791] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.896154][ T9791] bond0: (slave bridge_slave_1): Releasing backup interface [ 521.929303][ T9791] bond0: (slave bond_slave_0): Releasing backup interface [ 521.968992][ T9791] bond0: (slave bond_slave_1): Releasing backup interface [ 522.004321][ T9791] team0: Port device team_slave_0 removed [ 522.015362][ T9791] team0: Port device team_slave_1 removed [ 522.021874][ T9791] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 522.035342][ T9791] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 522.047072][ T9791] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 522.058139][ T9791] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 522.086168][ T9791] bond1: (slave gretap1): Releasing active interface [ 522.522529][ T9818] batadv_slave_0: entered promiscuous mode [ 522.781853][ T9822] tipc: Started in network mode [ 522.789017][ T9822] tipc: Node identity 6a1b184cf16d, cluster identity 4711 [ 522.804372][ T9822] tipc: Enabled bearer , priority 0 [ 522.874428][ T9822] syzkaller0: entered promiscuous mode [ 522.879953][ T9822] syzkaller0: entered allmulticast mode [ 522.986243][ T9822] tipc: Resetting bearer [ 523.036682][ T9821] tipc: Resetting bearer [ 523.094808][ T9821] tipc: Disabling bearer [ 523.295890][ T9839] bridge_slave_0: left allmulticast mode [ 523.301615][ T9839] bridge_slave_0: left promiscuous mode [ 523.331128][ T9839] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.364215][ T9839] bridge_slave_1: left allmulticast mode [ 523.374199][ T9839] bridge_slave_1: left promiscuous mode [ 523.380024][ T9839] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.400498][ T9839] bond0: (slave bond_slave_0): Releasing backup interface [ 523.409636][ T9839] bond_slave_0: left promiscuous mode [ 523.420457][ T9839] bond0: (slave bond_slave_1): Releasing backup interface [ 523.431590][ T9839] bond_slave_1: left promiscuous mode [ 523.456800][ T9839] team0: Port device team_slave_0 removed [ 523.469589][ T9839] team0: Port device team_slave_1 removed [ 523.476249][ T9839] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.486696][ T9839] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 523.495903][ T9839] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.504541][ T9839] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.525752][ T9839] team0: Port device geneve0 removed [ 523.535273][ T9839] bond2: (slave gretap1): Releasing active interface [ 523.883941][ T9863] netlink: 'syz.4.1200': attribute type 1 has an invalid length. [ 523.896968][ T9863] netlink: 'syz.4.1200': attribute type 2 has an invalid length. [ 523.906352][ T9863] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1200'. [ 524.190404][ T9878] C: renamed from team_slave_0 [ 524.203486][ T9878] netlink: 'syz.3.1210': attribute type 2 has an invalid length. [ 524.212130][ T9878] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1210'. [ 524.222406][ T9878] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 524.298046][ T9880] bridge_slave_0: left allmulticast mode [ 524.306633][ T9880] bridge_slave_0: left promiscuous mode [ 524.312511][ T9880] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.340692][ T9880] bridge_slave_1: left allmulticast mode [ 524.366305][ T9880] bridge_slave_1: left promiscuous mode [ 524.372223][ T9880] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.402393][ T9880] bond0: (slave bond_slave_0): Releasing backup interface [ 524.441069][ T9880] bond0: (slave bond_slave_1): Releasing backup interface [ 524.477314][ T9880] team0: Port device team_slave_0 removed [ 524.491085][ T9880] team0: Port device team_slave_1 removed [ 524.498515][ T9880] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 524.508132][ T9888] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1213'. [ 524.518976][ T9880] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 524.554809][ T9880] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 524.573378][ T9880] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 524.630464][ T9880] bond1: (slave gretap1): Releasing active interface [ 524.819513][ T9902] syzkaller0: entered promiscuous mode [ 524.838279][ T9902] syzkaller0: entered allmulticast mode [ 524.855893][ T9897] tipc: Started in network mode [ 524.881221][ T9897] tipc: Node identity bac653b4c494, cluster identity 4711 [ 524.910374][ T9897] tipc: Enabled bearer , priority 0 [ 524.935385][ T9891] tipc: Resetting bearer [ 524.988574][ T9890] tipc: Resetting bearer [ 525.002260][ T9909] netlink: 'syz.4.1220': attribute type 6 has an invalid length. [ 525.059357][ T9890] tipc: Disabling bearer [ 525.131015][ T9913] openvswitch: netlink: Tunnel attr 1 has unexpected len 3 expected 4 [ 525.252927][ T9909] bond4: entered promiscuous mode [ 525.436775][ T9924] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1225'. [ 525.481874][ T9924] netlink: 'syz.4.1225': attribute type 2 has an invalid length. [ 525.509553][ T9924] k›*·]‘: entered promiscuous mode [ 525.545172][ T9924] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 525.627261][ C1] Illegal XDP return value 16128 on prog (id 335) dev lo, expect packet loss! [ 525.747801][ T9932] netlink: 'syz.3.1228': attribute type 7 has an invalid length. [ 525.759732][ T9932] netlink: 'syz.3.1228': attribute type 8 has an invalid length. [ 525.916775][ T9937] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1231'. [ 526.367005][ T9953] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1237'. [ 527.026019][ T9980] tipc: Enabled bearer , priority 0 [ 527.047983][ T9980] syzkaller0: entered promiscuous mode [ 527.063438][ T9980] syzkaller0: entered allmulticast mode [ 527.117966][ T9980] tipc: Resetting bearer [ 527.166550][ T9979] tipc: Resetting bearer [ 527.264100][ T9979] tipc: Disabling bearer [ 527.488113][T10000] syz_tun: entered allmulticast mode [ 527.498758][ T9999] syz_tun: left allmulticast mode [ 527.720685][T10004] bridge_slave_0: left allmulticast mode [ 527.737226][T10004] bridge_slave_0: left promiscuous mode [ 527.749573][T10004] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.767802][T10004] bridge_slave_1: left allmulticast mode [ 527.777341][T10004] bridge_slave_1: left promiscuous mode [ 527.799113][T10004] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.829845][T10004] bond0: (slave bond_slave_0): Releasing backup interface [ 527.865568][T10004] bond_slave_0: left promiscuous mode [ 527.876303][T10004] bond_slave_0: left allmulticast mode [ 527.905416][T10004] bond0: (slave bond_slave_1): Releasing backup interface [ 527.922708][T10004] bond_slave_1: left promiscuous mode [ 527.940806][T10004] bond_slave_1: left allmulticast mode [ 527.977257][T10004] team0: Port device C removed [ 527.999005][T10004] team0: Port device team_slave_1 removed [ 528.010627][T10004] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 528.040177][T10004] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 528.247663][T10023] tipc: Enabled bearer , priority 0 [ 528.288572][T10023] syzkaller0: entered promiscuous mode [ 528.306203][T10023] syzkaller0: entered allmulticast mode [ 528.362285][T10023] tipc: Resetting bearer [ 528.390640][T10033] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1274'. [ 528.392153][T10022] tipc: Resetting bearer [ 528.473729][T10022] tipc: Disabling bearer [ 530.322160][T10112] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1309'. [ 530.657206][T10120] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1312'. [ 531.798792][T10153] tipc: Enabled bearer , priority 0 [ 531.817904][T10153] syzkaller0: entered promiscuous mode [ 531.843022][T10153] syzkaller0: entered allmulticast mode [ 531.854635][T10153] tipc: Resetting bearer [ 531.875401][T10152] tipc: Resetting bearer [ 531.911810][T10152] tipc: Disabling bearer [ 532.148626][T10166] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 532.213520][T10166] veth0_to_team: entered promiscuous mode [ 532.238969][T10166] veth0_to_team: entered allmulticast mode [ 532.750365][T10161] syz.2.1328 (10161) used greatest stack depth: 17992 bytes left [ 532.772600][T10186] netlink: 'syz.1.1333': attribute type 12 has an invalid length. [ 533.286235][T10207] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1343'. [ 533.318878][T10207] bond0: entered promiscuous mode [ 533.334564][T10207] bond0: left promiscuous mode [ 533.521605][T10218] bond0: default FDB implementation only supports local addresses [ 534.520501][T10250] Set syz0 is full, maxelem 0 reached [ 534.927948][T10268] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 535.861686][T10308] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 536.277786][T10324] tipc: New replicast peer: 255.255.255.255 [ 536.297581][T10324] tipc: Enabled bearer , priority 10 [ 536.913849][T10344] tipc: Enabling of bearer rejected, failed to enable media [ 537.001614][T10349] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 537.094963][T10362] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1403'. [ 537.130208][T10359] sctp: [Deprecated]: syz.1.1402 (pid 10359) Use of struct sctp_assoc_value in delayed_ack socket option. [ 537.130208][T10359] Use struct sctp_sack_info instead [ 537.297884][ T10] tipc: Node number set to 2608207948 [ 537.383415][T10370] netlink: 648 bytes leftover after parsing attributes in process `syz.0.1406'. [ 537.630336][T10382] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1412'. [ 538.082008][T10400] syzkaller0: entered promiscuous mode [ 538.098075][T10400] syzkaller0: entered allmulticast mode [ 538.730247][T10428] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1425'. [ 539.076002][T10443] tipc: Started in network mode [ 539.096128][T10443] tipc: Node identity 1e964562eef4, cluster identity 4711 [ 539.118852][T10443] tipc: Enabled bearer , priority 0 [ 539.139599][T10449] syzkaller0: entered promiscuous mode [ 539.150005][T10449] syzkaller0: entered allmulticast mode [ 539.248517][T10440] tipc: Resetting bearer [ 539.339380][T10440] tipc: Disabling bearer [ 539.628391][T10464] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1441'. [ 539.713418][T10462] syzkaller1: entered promiscuous mode [ 539.718965][T10462] syzkaller1: entered allmulticast mode [ 539.753722][T10462] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1440'. [ 539.944654][T10474] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1442'. [ 540.229646][T10462] bond0 (unregistering): Released all slaves [ 541.424296][T10522] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1461'. [ 541.557924][T10527] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1463'. [ 543.026442][T10561] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1476'. [ 543.058862][T10561] vlan0: entered promiscuous mode [ 543.121633][T10568] tipc: Enabled bearer , priority 0 [ 543.351010][T10568] syzkaller0: entered promiscuous mode [ 543.358837][T10568] syzkaller0: entered allmulticast mode [ 543.435202][T10581] tipc: Resetting bearer [ 543.474046][T10566] tipc: Resetting bearer [ 544.178593][ T6503] tipc: Node number set to 4032972130 [ 545.558226][T10566] tipc: Disabling bearer [ 546.676621][T10634] tipc: Enabled bearer , priority 0 [ 546.684733][T10634] syzkaller0: entered promiscuous mode [ 546.690349][T10634] syzkaller0: entered allmulticast mode [ 546.731337][T10634] tipc: Resetting bearer [ 546.758046][T10633] tipc: Resetting bearer [ 546.793510][T10633] tipc: Disabling bearer [ 547.017960][T10643] tipc: Enabled bearer , priority 0 [ 547.031101][T10643] tipc: Resetting bearer [ 547.047615][T10641] tipc: Disabling bearer [ 547.615189][T10664] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1513'. [ 547.805144][T10666] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 548.057343][T10678] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1518'. [ 549.218061][T10710] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 550.021611][T10728] syzkaller0: entered promiscuous mode [ 550.037926][T10728] syzkaller0: entered allmulticast mode [ 550.373140][T10756] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 550.759728][T10771] vlan2: entered promiscuous mode [ 550.765923][T10771] vlan2: entered allmulticast mode [ 550.771164][T10771] hsr_slave_1: entered allmulticast mode [ 550.827564][T10772] tipc: Enabled bearer , priority 0 [ 550.840291][T10775] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1547'. [ 550.869160][T10772] syzkaller0: entered promiscuous mode [ 550.883597][T10772] syzkaller0: entered allmulticast mode [ 551.142495][T10781] tipc: Resetting bearer [ 551.360937][T10768] tipc: Resetting bearer [ 551.428787][T10768] tipc: Disabling bearer [ 551.569723][T10792] syzkaller0: entered promiscuous mode [ 551.593287][T10792] syzkaller0: entered allmulticast mode [ 551.637725][T10795] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 552.372089][T10832] bond0: (slave bond_slave_0): Releasing backup interface [ 552.420834][T10832] bond_slave_0: left promiscuous mode [ 552.493528][T10832] bond0: (slave bond_slave_1): Releasing backup interface [ 552.528025][T10832] bond_slave_1: left promiscuous mode [ 552.581021][T10832] team0: Port device team_slave_0 removed [ 552.618402][T10832] team0: Port device team_slave_1 removed [ 552.639171][T10832] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 552.671026][T10832] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 552.714297][T10832] team0: Port device geneve0 removed [ 552.744205][T10832] bond1: (slave gretap1): Releasing active interface [ 552.841721][T10834] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 553.817989][T10889] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 553.824037][T10883] nbd0: detected capacity change from 0 to 875674160 [ 553.870331][T10880] block nbd0: Receive control failed (result -104) [ 553.871617][T10896] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20131 [ 554.261932][T10912] syzkaller1: entered promiscuous mode [ 554.269518][T10912] syzkaller1: entered allmulticast mode [ 554.756453][T10927] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 554.811550][T10932] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1605'. [ 555.580387][T10962] netlink: 19 bytes leftover after parsing attributes in process `syz.0.1617'. [ 555.857971][T10966] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 557.371936][T11010] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 558.005957][T11035] netlink: 'syz.1.1643': attribute type 11 has an invalid length. [ 558.043391][T11035] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1643'. [ 558.115267][T11042] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1647'. [ 558.377745][T11052] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 558.977530][T11074] tipc: Enabled bearer , priority 0 [ 559.010389][T11074] tipc: Resetting bearer [ 559.844756][T11083] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 560.250351][T11102] tipc: Enabled bearer , priority 0 [ 560.272139][T11107] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1674'. [ 560.301109][T11102] tipc: Resetting bearer [ 560.328816][T11100] tipc: Disabling bearer [ 560.452157][T11114] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1676'. [ 561.609366][T11153] netlink: 'syz.0.1692': attribute type 12 has an invalid length. [ 561.851772][T11160] tipc: Enabled bearer , priority 0 [ 561.915047][T11163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1697'. [ 562.037402][T11164] syzkaller0: entered promiscuous mode [ 562.054522][T11164] syzkaller0: entered allmulticast mode [ 562.148475][T11167] tipc: Resetting bearer [ 562.211763][T11154] tipc: Resetting bearer [ 562.945204][ T10] tipc: Node number set to 2215594777 [ 563.066577][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.073337][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.800979][T11183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1704'. [ 563.980116][T11189] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1708'. [ 565.153130][T11154] tipc: Disabling bearer [ 565.178507][T11187] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1707'. [ 565.190184][T11187] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1707'. [ 565.354167][T11199] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1711'. [ 565.528223][T11208] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1717'. [ 565.742344][T11214] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1719'. [ 565.782532][T11219] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1730'. [ 565.810590][T11216] vlan2: entered promiscuous mode [ 565.835571][T11216] vlan2: entered allmulticast mode [ 565.856733][T11216] hsr_slave_1: entered allmulticast mode [ 565.928497][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1720'. [ 566.248093][T11233] tipc: Enabling of bearer rejected, failed to enable media [ 566.441812][T11235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1726'. [ 566.846436][T11249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1733'. [ 566.968499][T11254] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1734'. [ 567.711695][T11278] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 568.912277][T11326] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 569.011353][T11335] openvswitch: netlink: Tunnel attr 1 has unexpected len 3 expected 4 [ 569.528030][T11358] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1778'. [ 569.809736][T11366] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 570.118532][T11383] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1790'. [ 570.684776][T11411] tipc: Enabling of bearer rejected, failed to enable media [ 571.253495][T11432] __nla_validate_parse: 1 callbacks suppressed [ 571.253515][T11432] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1805'. [ 571.314140][T11434] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1806'. [ 572.122085][T11470] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1821'. [ 572.136840][T11470] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1821'. [ 572.138041][T11473] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1822'. [ 572.175848][T11470] batadv0: entered promiscuous mode [ 572.200188][T11470] team0: entered promiscuous mode [ 572.207611][T11470] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 572.221058][T11470] Cannot create hsr debugfs directory [ 572.230121][T11470] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 572.247795][T11470] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 572.277153][T11477] tipc: Enabling of bearer rejected, failed to enable media [ 572.612185][T11495] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1828'. [ 572.639629][T11495] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1828'. [ 573.638626][T11536] tipc: Enabling of bearer rejected, failed to enable media [ 574.823485][T11578] tipc: Enabling of bearer rejected, already enabled [ 574.844978][T11578] syzkaller0: entered promiscuous mode [ 574.857738][T11578] syzkaller0: entered allmulticast mode [ 578.004714][T11615] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1878'. [ 578.031353][T11614] tipc: Enabling of bearer rejected, failed to enable media [ 579.005178][T11649] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1889'. [ 579.154303][T11657] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1892'. [ 580.037872][T11676] tipc: Enabling of bearer rejected, already enabled [ 580.436028][T11691] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1906'. [ 580.504390][T11693] netlink: 'syz.1.1907': attribute type 1 has an invalid length. [ 580.533291][T11693] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1907'. [ 580.555677][T11693] netlink: 'syz.1.1907': attribute type 2 has an invalid length. [ 580.573246][T11693] netlink: 'syz.1.1907': attribute type 1 has an invalid length. [ 580.779635][T11708] tipc: Enabling of bearer rejected, already enabled [ 581.226360][T11723] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1920'. [ 581.564231][T11738] tipc: Enabling of bearer rejected, failed to enable media [ 582.098245][T11755] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1932'. [ 582.583405][T11774] tipc: Enabling of bearer rejected, failed to enable media [ 584.074289][T11821] tipc: Enabled bearer , priority 0 [ 584.124643][T11833] tipc: Resetting bearer [ 584.202407][ T55] block nbd0: Possible stuck request ffff8880255b7000: control (read@0,4096B). Runtime 30 seconds [ 584.219271][T11818] tipc: Disabling bearer [ 584.273221][T11834] syz_tun: entered allmulticast mode [ 584.295136][T11829] syz_tun: left allmulticast mode [ 584.996320][T11866] syz_tun: entered allmulticast mode [ 585.020875][T11865] syz_tun: left allmulticast mode [ 585.104825][T11870] tipc: Enabling of bearer rejected, failed to enable media [ 586.044793][T11901] syz_tun: entered allmulticast mode [ 586.055892][T11900] syz_tun: left allmulticast mode [ 586.273446][T11905] tipc: Enabling of bearer rejected, failed to enable media [ 586.803219][T11916] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 586.810920][T11916] IPv6: NLM_F_CREATE should be set when creating new route [ 587.421079][T11932] syz_tun: entered allmulticast mode [ 587.431454][T11931] syz_tun: left allmulticast mode [ 590.084858][T11991] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2026'. [ 590.499954][T12000] syzkaller0: entered promiscuous mode [ 590.517273][T12000] syzkaller0: entered allmulticast mode [ 592.812225][T12046] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2048'. [ 593.910589][T11876] Set syz1 is full, maxelem 65536 reached [ 594.091868][T12079] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2061'. [ 594.336186][T12083] syzkaller0: entered promiscuous mode [ 594.358680][T12083] syzkaller0: entered allmulticast mode [ 595.182749][T12104] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2073'. [ 595.642423][T12123] Bluetooth: hci4: Opcode 0x080f failed: -4 [ 595.665715][T12121] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 596.051966][T12140] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2088'. [ 596.321730][T12148] syzkaller0: entered promiscuous mode [ 596.334268][T12148] syzkaller0: entered allmulticast mode [ 597.045497][T12172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2101'. [ 597.235526][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 597.235547][ T30] audit: type=1800 audit(1755337468.473:73): pid=12180 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.2104" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=2547 res=0 errno=0 [ 597.567688][T12195] tipc: Enabled bearer , priority 0 [ 597.592104][T12195] syzkaller0: entered promiscuous mode [ 597.616133][T12199] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2114'. [ 597.631280][T12195] syzkaller0: entered allmulticast mode [ 597.703597][ T5853] Bluetooth: hci4: command 0x0406 tx timeout [ 597.878737][T12204] tipc: Resetting bearer [ 597.912389][T12191] tipc: Resetting bearer [ 597.963153][T12191] tipc: Disabling bearer [ 598.569960][T12228] tls_set_device_offload_rx: netdev not found [ 598.897533][T12235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2127'. [ 599.772624][T12266] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2139'. [ 601.074371][T12301] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2152'. [ 601.095557][T12300] tipc: Enabled bearer , priority 0 [ 601.249085][T12300] syzkaller0: entered promiscuous mode [ 601.258449][T12300] syzkaller0: entered allmulticast mode [ 601.334367][T12299] tipc: Resetting bearer [ 602.193128][ T6503] tipc: Node number set to 2119324596 [ 602.342614][T12331] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2165'. [ 603.966159][T12299] tipc: Disabling bearer [ 604.422324][T12353] netlink: 'syz.3.2171': attribute type 1 has an invalid length. [ 604.449751][T12353] netlink: 136 bytes leftover after parsing attributes in process `syz.3.2171'. [ 604.482999][T12353] netlink: 'syz.3.2171': attribute type 2 has an invalid length. [ 604.518174][T12353] netlink: 'syz.3.2171': attribute type 1 has an invalid length. [ 604.870608][T12368] syzkaller0: entered promiscuous mode [ 604.876965][T12368] syzkaller0: entered allmulticast mode [ 605.126554][T12375] syz_tun: entered allmulticast mode [ 605.143919][T12372] syz_tun: left allmulticast mode [ 605.384523][T12390] netlink: 'syz.2.2187': attribute type 1 has an invalid length. [ 605.416859][T12390] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2187'. [ 605.441135][T12390] netlink: 'syz.2.2187': attribute type 2 has an invalid length. [ 605.470421][T12390] netlink: 'syz.2.2187': attribute type 1 has an invalid length. [ 605.816314][T12406] syz_tun: entered allmulticast mode [ 605.827184][T12405] syz_tun: left allmulticast mode [ 605.957462][T12410] syzkaller0: entered promiscuous mode [ 605.977820][T12410] syzkaller0: entered allmulticast mode [ 606.007590][T12417] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2199'. [ 606.071799][T12417] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2199'. [ 606.120641][T12417] macvtap1: entered promiscuous mode [ 606.127964][T12417] team0: entered promiscuous mode [ 606.134165][T12417] macvtap1: entered allmulticast mode [ 606.139766][T12417] team0: entered allmulticast mode [ 606.151372][T12417] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 606.205577][T12422] macvtap1: left promiscuous mode [ 606.210903][T12422] team0: left promiscuous mode [ 606.216892][T12422] macvtap1: left allmulticast mode [ 606.222218][T12422] team0: left allmulticast mode [ 607.148597][T12455] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2215'. [ 607.219954][T12455] erspan0: entered promiscuous mode [ 607.236394][T12455] macvtap1: entered promiscuous mode [ 607.246883][ T30] audit: type=1107 audit(1755337478.493:74): pid=12458 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='' [ 607.252470][T12455] macvtap1: entered allmulticast mode [ 607.275943][T12455] erspan0: entered allmulticast mode [ 607.304545][T12457] macvtap1: left promiscuous mode [ 607.314836][T12457] macvtap1: left allmulticast mode [ 607.331809][T12457] erspan0: left allmulticast mode [ 607.360932][T12461] lo speed is unknown, defaulting to 1000 [ 607.382063][T12469] netlink: 'syz.4.2220': attribute type 1 has an invalid length. [ 607.395293][T12461] lo speed is unknown, defaulting to 1000 [ 607.417120][T12469] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2220'. [ 607.430057][T12461] lo speed is unknown, defaulting to 1000 [ 607.447362][T12469] netlink: 'syz.4.2220': attribute type 2 has an invalid length. [ 607.469264][T12461] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 607.478877][T12469] netlink: 'syz.4.2220': attribute type 1 has an invalid length. [ 607.562411][T12461] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 607.640799][T12476] lo speed is unknown, defaulting to 1000 [ 607.831690][T12461] lo speed is unknown, defaulting to 1000 [ 607.889621][T12461] lo speed is unknown, defaulting to 1000 [ 607.931798][T12461] lo speed is unknown, defaulting to 1000 [ 607.959014][T12461] lo speed is unknown, defaulting to 1000 [ 607.972307][T12487] syzkaller0: entered promiscuous mode [ 607.991052][T12487] syzkaller0: entered allmulticast mode [ 608.007465][T12461] lo speed is unknown, defaulting to 1000 [ 608.757256][T12512] netlink: 'syz.2.2234': attribute type 1 has an invalid length. [ 608.775156][T12512] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2234'. [ 609.853024][T12551] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2241'. [ 610.101284][T12564] syzkaller0: entered promiscuous mode [ 610.136245][T12564] syzkaller0: entered allmulticast mode [ 610.352261][T12571] lo speed is unknown, defaulting to 1000 [ 610.617434][T12582] validate_nla: 2 callbacks suppressed [ 610.617457][T12582] netlink: 'syz.3.2250': attribute type 1 has an invalid length. [ 610.651304][T12582] netlink: 136 bytes leftover after parsing attributes in process `syz.3.2250'. [ 610.662978][T10880] Bluetooth: hci4: command 0x0406 tx timeout [ 610.670540][T12582] netlink: 'syz.3.2250': attribute type 2 has an invalid length. [ 610.680596][T12582] netlink: 'syz.3.2250': attribute type 1 has an invalid length. [ 611.441843][T12609] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.640050][T12609] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.850203][T12609] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.868368][T12635] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2269'. [ 611.981839][T12609] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.225674][T12609] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.262140][T12609] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.304064][T12609] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.346269][T12609] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.389829][T12648] lo speed is unknown, defaulting to 1000 [ 613.346182][T12688] netlink: 'syz.2.2291': attribute type 1 has an invalid length. [ 613.378710][T12688] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2291'. [ 613.426459][T12688] netlink: 'syz.2.2291': attribute type 2 has an invalid length. [ 613.473324][T12688] netlink: 'syz.2.2291': attribute type 1 has an invalid length. [ 613.748634][T12702] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2299'. [ 613.760776][T12702] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2299'. [ 613.779629][T12702] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 614.184752][T12718] lo speed is unknown, defaulting to 1000 [ 614.266894][ T55] block nbd0: Possible stuck request ffff8880255b7000: control (read@0,4096B). Runtime 60 seconds [ 614.407533][T12726] netlink: 'syz.3.2308': attribute type 1 has an invalid length. [ 614.433224][T12726] netlink: 136 bytes leftover after parsing attributes in process `syz.3.2308'. [ 614.442329][T12726] netlink: 'syz.3.2308': attribute type 2 has an invalid length. [ 614.487449][T12726] netlink: 'syz.3.2308': attribute type 1 has an invalid length. [ 615.107273][T12741] lo speed is unknown, defaulting to 1000 [ 616.428794][T12797] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2335'. [ 616.683975][T12805] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2338'. [ 616.719068][T12805] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 617.112622][T12825] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2347'. [ 617.441845][T12847] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2355'. [ 617.815712][T12860] syzkaller0: entered promiscuous mode [ 617.827878][T12860] syzkaller0: entered allmulticast mode [ 617.994775][T12864] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2362'. [ 618.794504][T12892] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2375'. [ 618.944841][T12897] syzkaller0: entered promiscuous mode [ 618.961984][T12897] syzkaller0: entered allmulticast mode [ 619.601586][T12919] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.333668][T12937] syzkaller0: entered promiscuous mode [ 620.342653][T12937] syzkaller0: entered allmulticast mode [ 620.523709][T12945] netlink: 'syz.0.2398': attribute type 13 has an invalid length. [ 620.782528][T12954] netlink: 'syz.3.2402': attribute type 1 has an invalid length. [ 620.805501][T12954] netlink: 136 bytes leftover after parsing attributes in process `syz.3.2402'. [ 620.841776][T12954] netlink: 'syz.3.2402': attribute type 2 has an invalid length. [ 620.870066][T12954] netlink: 'syz.3.2402': attribute type 1 has an invalid length. [ 621.331826][T12945] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.345766][T12945] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.355972][T12945] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.368614][T12945] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.637451][T12953] lo speed is unknown, defaulting to 1000 [ 622.117044][T12985] tipc: Enabling of bearer rejected, failed to enable media [ 622.147986][T12982] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2414'. [ 622.177022][T12986] lo speed is unknown, defaulting to 1000 [ 622.198771][T12982] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2414'. [ 622.602294][T13002] syz_tun: entered allmulticast mode [ 622.609330][T13001] syz_tun: left allmulticast mode [ 623.595108][T13039] netlink: 'syz.3.2437': attribute type 1 has an invalid length. [ 623.605821][T13039] netlink: 180 bytes leftover after parsing attributes in process `syz.3.2437'. [ 623.763258][T13047] tipc: Started in network mode [ 623.768382][T13047] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 623.775986][T13047] tipc: Enabled bearer , priority 0 [ 623.978284][T13054] tipc: Enabling of bearer rejected, failed to enable media [ 624.189324][T13065] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2448'. [ 624.231921][T13065] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2448'. [ 624.249878][T13062] lo speed is unknown, defaulting to 1000 [ 624.258939][T13069] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2447'. [ 624.285109][T13065] macvtap2: entered promiscuous mode [ 624.290456][T13065] team0: entered promiscuous mode [ 624.301333][T13065] macvtap2: entered allmulticast mode [ 624.307039][T13065] team0: entered allmulticast mode [ 624.317470][T13065] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 624.511414][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.618745][T13081] lo speed is unknown, defaulting to 1000 [ 624.743350][T13084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2452'. [ 624.773570][ T5925] tipc: Node number set to 11578026 [ 625.203046][T13090] syz_tun: entered allmulticast mode [ 625.233419][T13089] syz_tun: left allmulticast mode [ 625.594560][T13104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2460'. [ 625.900330][T13118] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2466'. [ 625.922605][T13118] netlink: 'syz.2.2466': attribute type 1 has an invalid length. [ 625.942620][T13118] netlink: 'syz.2.2466': attribute type 2 has an invalid length. [ 625.957839][T13118] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2466'. [ 625.991307][T13122] syz_tun: entered allmulticast mode [ 626.004688][T13121] syz_tun: left allmulticast mode [ 626.167487][T13129] lo speed is unknown, defaulting to 1000 [ 626.470129][T13139] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2476'. [ 627.154550][T13163] syz_tun: entered allmulticast mode [ 627.194555][T13161] syz_tun: left allmulticast mode [ 627.684026][T13176] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2488'. [ 627.778321][T13182] syzkaller0: entered promiscuous mode [ 627.788988][T13182] syzkaller0: entered allmulticast mode [ 627.916093][T13188] tipc: Enabling of bearer rejected, already enabled [ 628.028026][T13192] syz_tun: entered allmulticast mode [ 628.034780][T13191] syz_tun: left allmulticast mode [ 628.229087][T13199] lo speed is unknown, defaulting to 1000 [ 628.347925][T13208] netlink: 'syz.4.2500': attribute type 13 has an invalid length. [ 628.644827][T13216] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2503'. [ 629.299978][T13208] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.323184][T13208] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.332229][T13208] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.363044][T13208] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.502214][T13212] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20001 - 0 [ 629.513887][T13212] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20001 - 0 [ 629.527660][T13212] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20001 - 0 [ 629.538724][T13212] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20001 - 0 [ 629.841551][T13242] syz_tun: entered allmulticast mode [ 629.857821][T13241] syz_tun: left allmulticast mode [ 629.987164][T13246] tipc: Enabling of bearer rejected, failed to enable media [ 630.003559][T13246] syzkaller0: entered promiscuous mode [ 630.009273][T13246] syzkaller0: entered allmulticast mode [ 630.302721][T13259] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2516'. [ 630.321401][T13259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2516'. [ 630.399418][T13263] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2518'. [ 630.606492][T13276] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0 [ 630.619866][T13275] IPVS: stopping backup sync thread 13276 ... [ 631.036774][T13288] tipc: Enabling of bearer rejected, failed to enable media [ 631.210073][T13290] lo speed is unknown, defaulting to 1000 [ 631.333068][T13297] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2530'. [ 632.129792][T13320] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2537'. [ 632.348026][T13325] tipc: Enabling of bearer rejected, failed to enable media [ 632.371648][T13326] lo speed is unknown, defaulting to 1000 [ 632.403964][T13326] lo speed is unknown, defaulting to 1000 [ 632.410933][T13326] lo speed is unknown, defaulting to 1000 [ 632.511712][T13326] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 632.634633][T13326] lo speed is unknown, defaulting to 1000 [ 632.683299][T13326] lo speed is unknown, defaulting to 1000 [ 632.707910][T13326] lo speed is unknown, defaulting to 1000 [ 632.717391][T13326] lo speed is unknown, defaulting to 1000 [ 632.729646][T13326] lo speed is unknown, defaulting to 1000 [ 632.942007][T13343] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2545'. [ 632.977251][T13343] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2545'. [ 633.279993][T13353] lo speed is unknown, defaulting to 1000 [ 633.299122][T13353] lo speed is unknown, defaulting to 1000 [ 633.628375][T13363] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 633.738374][T13366] tipc: Enabling of bearer rejected, failed to enable media [ 633.770666][T13366] syzkaller0: entered promiscuous mode [ 633.779886][T13366] syzkaller0: entered allmulticast mode [ 633.991261][T13368] siw: device registration error -23 [ 634.223003][T13374] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2558'. [ 634.303990][T13374] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2558'. [ 634.370754][T13374] macvtap1: entered promiscuous mode [ 634.403260][T13374] ip6gretap0: entered promiscuous mode [ 634.421666][T13374] macvtap1: entered allmulticast mode [ 634.443350][T13374] ip6gretap0: entered allmulticast mode [ 634.639777][T13392] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 634.679890][T13394] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2564'. [ 634.691389][T13394] [ 634.694188][T13394] ============================= [ 634.699159][T13394] WARNING: suspicious RCU usage [ 634.704293][T13394] 6.16.0-syzkaller #0 Not tainted [ 634.709364][T13394] ----------------------------- [ 634.714884][T13394] net/core/netclassid_cgroup.c:24 suspicious rcu_dereference_check() usage! [ 634.724188][T13394] [ 634.724188][T13394] other info that might help us debug this: [ 634.724188][T13394] [ 634.734614][T13394] [ 634.734614][T13394] rcu_scheduler_active = 2, debug_locks = 1 [ 634.744897][T13394] 1 lock held by syz.3.2564/13394: [ 634.750057][T13394] #0: ffffffff8e13f2c0 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x38/0x80 [ 634.760390][T13394] [ 634.760390][T13394] stack backtrace: [ 634.766358][T13394] CPU: 0 UID: 0 PID: 13394 Comm: syz.3.2564 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 634.766387][T13394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 634.766400][T13394] Call Trace: [ 634.766409][T13394] [ 634.766418][T13394] dump_stack_lvl+0x189/0x250 [ 634.766452][T13394] ? __pfx_dump_stack_lvl+0x10/0x10 [ 634.766477][T13394] ? __pfx__printk+0x10/0x10 [ 634.766509][T13394] ? print_lock_name+0xde/0x100 [ 634.766543][T13394] lockdep_rcu_suspicious+0x140/0x1d0 [ 634.766571][T13394] task_cls_state+0x1a5/0x1d0 [ 634.766594][T13394] bpf_get_cgroup_classid_curr+0x18/0x60 [ 634.766622][T13394] bpf_prog_cd2e46495e8fe8a5+0x20/0x26 [ 634.766643][T13394] bpf_prog_run_pin_on_cpu+0x67/0x150 [ 634.766680][T13394] bpf_prog_test_run_syscall+0x312/0x4b0 [ 634.766715][T13394] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 634.766745][T13394] ? __fget_files+0x2a/0x420 [ 634.766777][T13394] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 634.766808][T13394] bpf_prog_test_run+0x2c7/0x340 [ 634.766851][T13394] __sys_bpf+0x4a4/0x860 [ 634.766885][T13394] ? __pfx___sys_bpf+0x10/0x10 [ 634.766938][T13394] ? rcu_is_watching+0x15/0xb0 [ 634.766969][T13394] __x64_sys_bpf+0x7c/0x90 [ 634.766997][T13394] do_syscall_64+0xfa/0x3b0 [ 634.767020][T13394] ? lockdep_hardirqs_on+0x9c/0x150 [ 634.767042][T13394] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.767063][T13394] ? clear_bhb_loop+0x60/0xb0 [ 634.767089][T13394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.767109][T13394] RIP: 0033:0x7f706458ebe9 [ 634.767128][T13394] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 634.767147][T13394] RSP: 002b:00007f7065441038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 634.767170][T13394] RAX: ffffffffffffffda RBX: 00007f70647b5fa0 RCX: 00007f706458ebe9 [ 634.767186][T13394] RDX: 000000000000003a RSI: 0000200000000340 RDI: 000000000000000a [ 634.767199][T13394] RBP: 00007f7064611e19 R08: 0000000000000000 R09: 0000000000000000 [ 634.767212][T13394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 634.767224][T13394] R13: 00007f70647b6038 R14: 00007f70647b5fa0 R15: 00007fff648e65b8 [ 634.767260][T13394] [ 634.834043][T13400] tipc: Can't bind to reserved service type 2 [ 638.073257][ T5208] udevd[5208]: worker [8795] /devices/virtual/block/nbd0 is taking a long time [ 644.343783][ T55] block nbd0: Possible stuck request ffff8880255b7000: control (read@0,4096B). Runtime 90 seconds