last executing test programs: 28m5.214187093s ago: executing program 0 (id=718): mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./file0/file0\x00', 0x62) 28m4.996134491s ago: executing program 0 (id=723): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000100)=[{{&(0x7f0000000700)=@ll={0x11, 0x10, r2, 0x1, 0x2, 0x6, @multicast}, 0x80, &(0x7f0000000140)=[{0x0}, {&(0x7f00000000c0)="0629fdf3836959fb96", 0x9}], 0x2}}], 0x1, 0x400c889) 28m4.794057217s ago: executing program 0 (id=728): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="18020000010001000000000007000000850000002c00000085000000a000000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2107, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 28m4.584012577s ago: executing program 0 (id=733): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r0, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) write(r0, &(0x7f0000000180)="b1c4", 0x2) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, 0x0, 0x0) 28m4.46344406s ago: executing program 0 (id=736): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000080)=0x8, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0xe22}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff00000002000000", 0x57}], 0x1) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 28m4.322283089s ago: executing program 0 (id=740): r0 = socket(0x10, 0x3, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x2a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001d00070f000200000000000007000000", @ANYRES32=r2, @ANYBLOB='\x00\x00g\x00\b\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x3d8d025cf8a459c, 0xfc) 27m49.231366244s ago: executing program 32 (id=740): r0 = socket(0x10, 0x3, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x2a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001d00070f000200000000000007000000", @ANYRES32=r2, @ANYBLOB='\x00\x00g\x00\b\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x3d8d025cf8a459c, 0xfc) 12.388467131s ago: executing program 3 (id=8651): ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000280)={0x200, 0x74fe, 0x1}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e20, 0x901, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3e}}, 0x6}, 0x1c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x9, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x103) write$cgroup_int(r3, &(0x7f0000000000)=0x800, 0x12) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)='./file0\x00', 0x8, 0x1) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) 11.506460229s ago: executing program 4 (id=8654): syz_open_dev$vbi(0x0, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0x14, 0xa, 0x2, 0x0, [{@remote}, {@multicast1}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendfile(r3, r2, &(0x7f0000000080)=0x5, 0x9) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000500)=ANY=[], 0x119) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r4 = syz_io_uring_setup(0x497, &(0x7f00000003c0)={0x0, 0x727b, 0x8, 0x800000, 0x15b}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd=r4, 0x8000000006, 0x0, 0xe448}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000038000000030a01040000000000000000010000010900010073797a30000000000c000240000000000000000109000300030000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 11.10031356s ago: executing program 3 (id=8655): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, &(0x7f0000000040)={0x0, 0xe472, 0x2, 0x0, 0x25a}, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x840000000002, 0x3, 0xfa) getsockname$inet(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0x6, 0x2, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES8=r0], 0x50) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001"], 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$IPT_SO_GET_INFO(r6, 0x0, 0x40, &(0x7f00000004c0)={'nat\x00', 0x0, [0x900, 0xffffffff, 0x7, 0x342, 0x1]}, &(0x7f00000001c0)=0x54) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x3}, [@IFLA_TXQLEN={0x8, 0xd, 0x1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001000010025bd7000f9dbdf25000000003cfa33c427e4f2b637c043c2bb4f6f67e381670e8a2b8a057b6bf1216f44", @ANYRES32=0x0, @ANYBLOB="158804000300040008001b000000000008000d0000000000"], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) unshare(0x2000000) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000240)={0x18, r4}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000032f44910c0090102a40a01020301090212000100ff0000000000000000000400"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 9.775834532s ago: executing program 4 (id=8659): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000009c0)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x4008000) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d88a8", 0x16, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r7, 0x1, 0xd8, 0x6, @multicast}, 0x14) 9.435586344s ago: executing program 2 (id=8618): r0 = socket$netlink(0x10, 0x3, 0x2) getsockopt$netlink(r0, 0x10e, 0x9, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0xc0}}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xc, 0xe, &(0x7f0000001880)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1, 0x0, 0x1}, 0x10}, 0x94) ioctl$SIOCSIFMTU(r4, 0x8923, &(0x7f0000000100)={'vlan0\x00', 0x40}) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876c1d0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000580), 0x7aed979249b5ae9d, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x1000000000000, 0x800, 0x7}, 0x6}, 0x20, 0x1, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) close(r8) madvise(&(0x7f00003cd000/0x1000)=nil, 0x1000, 0x8) readv(r6, &(0x7f0000000080)=[{&(0x7f0000001240)=""/4086, 0xff6}], 0x1) 9.396500119s ago: executing program 1 (id=8661): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000) recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=""/172, 0xac}, {0x0}, {&(0x7f00000028c0)=""/4047, 0xfcf}, {&(0x7f0000001880)=""/4105, 0x1009}, {&(0x7f0000000380)=""/119, 0x77}, {&(0x7f00000000c0)=""/125, 0x7d}], 0x6}, 0x2) 8.680784883s ago: executing program 1 (id=8662): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000480)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x40000) removexattr(0x0, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x80086601, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r5 = getpid() sched_setattr(r5, &(0x7f0000000200)={0x38, 0x0, 0x2b, 0x400, 0x0, 0x4, 0x4, 0x2, 0xffffffff}, 0x0) ioctl$BLKALIGNOFF(r4, 0x127a, &(0x7f0000000140)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r6, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8841}, 0x40804) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000003c0)={'gretap0\x00', 0x0}) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="f2", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e24, 0xff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000001c0)='f', 0x1}], 0x1}}], 0x2, 0x0) shmget$private(0x0, 0x1000, 0x78000a42, &(0x7f0000ff2000/0x1000)=nil) fstat(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f00000005c0)={0x270, 0x27, 0x4, 0x70bd2c, 0x25dfdbfe, {0x12}, [@generic, @nested={0xc, 0xe9, 0x0, 0x1, [@typed={0x8, 0x46, 0x0, 0x0, @uid=r7}]}, @nested={0xda, 0x33, 0x0, 0x1, [@nested={0x4, 0xe7}, @generic="50cde5150d6f1262ff66ffe10af9ecf9d1678960cfbfc5ca603a773c19272c55d2650521411f07f212dc8b9de38aba6d21c78186d85941eca8d3de3f0a874101b98e0e44f461e540b0b51e2758e07447509ca13036c47a8543eb863396c0753bff1add466c0c54d1ac70e88396a56b2c9bf7718454f870f174425f42a1adfe67819c3770dd3e82bdbba3d98ff376eef6dedeb2f8a7e5c717b14fe5f39c05161ee9996b917a503b899acb3b986b26dad17faa3cf5d9b175bbaa0c63971c5597687e75", @typed={0x8, 0xca, 0x0, 0x0, @fd=r0}, @nested={0x4, 0x2c83}, @nested={0x4, 0xc1}]}, @typed={0x5, 0xc3, 0x0, 0x0, @str='\x00'}, @typed={0x4, 0xc4}, @generic="87a32fabd588d4e35d930b7f32f25d5d5bcb2e0c1c49bd7bee845f689402bbe180cdb165a462639370da8c59f0c48a1edb3e13d4635a", @generic="18f765fb31c35f53c37fa29ab8", @nested={0x119, 0x125, 0x0, 0x1, [@typed={0x8, 0x72, 0x0, 0x0, @u32=0x1517}, @nested={0x4, 0x7d}, @nested={0x4, 0x9b}, @nested={0x4, 0x133}, @generic="cdd556f65e336e1a024640962cfbdd765d1ccf345280b97f25c4a2c132f85cba38f100f57521b7d96401b3226275b3354b91fe3fb936a994c2043579b6a0e55eb40dc702d262b6e073782b492f77e7ec8a53a22b89bca2bb707feb042aa8e4d9b66711eba34c623f0c67300f1d37bca2732f58128fb23fd543bf28ca3bd8dcae8ae2755d5a2a22cd4c346868fa8c9696d417ae535dd0371b6df8f9e731546c9891978cdba851e587c136fabaf43787127e5cfe8405bc725b49323899c7cf68c54a113e3272b5c3e5a27bc208ad07b7b4c28cbb8b530fd4a2154eae4d93666e02e3", @nested={0x4, 0x50}, @typed={0xc, 0x119, 0x0, 0x0, @str='gretap0\x00'}, @typed={0x8, 0x49, 0x0, 0x0, @pid=r5}, @typed={0x8, 0x1b, 0x0, 0x0, @u32=0x4}]}, @typed={0x8, 0xc, 0x0, 0x0, @fd=r2}]}, 0x270}, 0x1, 0x0, 0x0, 0x20000014}, 0x4040000) 8.680448768s ago: executing program 4 (id=8663): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 8.570457587s ago: executing program 5 (id=8664): r0 = socket$netlink(0x10, 0x3, 0x2) getsockopt$netlink(r0, 0x10e, 0x9, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0xc0}}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xc, 0xe, &(0x7f0000001880)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1, 0x0, 0x1}, 0x10}, 0x94) ioctl$SIOCSIFMTU(r4, 0x8923, &(0x7f0000000100)={'vlan0\x00', 0x40}) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876c1d0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000580), 0x7aed979249b5ae9d, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x1000000000000, 0x800, 0x7}, 0x6}, 0x20, 0x1, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(r7) madvise(&(0x7f00003cd000/0x1000)=nil, 0x1000, 0x8) readv(r6, &(0x7f0000000080)=[{&(0x7f0000001240)=""/4086, 0xff6}], 0x1) 7.100652653s ago: executing program 4 (id=8665): r0 = socket(0x80000000000000a, 0x2, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0x55b4e85f}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140), 0x20080, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r6, 0x40046103, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000300)=ANY=[], 0x18c) r7 = openat$sysfs(0xffffff9c, &(0x7f00000002c0)='/sys/power/sync_on_suspend', 0x14000, 0x87) unlinkat(r7, &(0x7f00000012c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) unshare(0x70000000) semget$private(0x0, 0x4000, 0x0) semctl$SETALL(0x0, 0x0, 0x14, 0x0) write$UHID_INPUT(r2, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b324c078b089b3438076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b32310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153bdf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000300)={0x191, 0x140, 0xa0, 0x40, 0x8, 0x1, 0x20, 0x0, {}, {0x0, 0xffffffff, 0x1}, {0x0, 0x0, 0xfffffffd}, {0x6, 0x4}, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x6, 0x6, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x2, 0xa}) semctl$SETVAL(0x0, 0x2, 0x10, 0x0) semctl$IPC_STAT(0x0, 0x0, 0x2, &(0x7f00000004c0)=""/88) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f00000005c0)='enc=', 0x0) fsopen(&(0x7f0000000240)='nfsd\x00', 0x1) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x3, 0x0, @mcast1={0xff, 0x7}, 0x8a}}, {{0xa, 0x0, 0x10001, @local}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000080)={0x7abd, {{0xa, 0xfffe, 0x0, @empty, 0x3}}, {{0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x104) 6.239920425s ago: executing program 3 (id=8666): creat(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400010000000000fbdbdf250a00a100", @ANYRES32=r4, @ANYBLOB="14000100ff05000000000000dfce000000000001"], 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) 5.548737776s ago: executing program 1 (id=8667): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000b00)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)="f703010010fff3be522ba800000000", 0xf}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba1282", 0x12}], 0x2, 0x0, 0x0, 0x2000847}], 0x1, 0x40800) recvmmsg$unix(r1, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000001240)=[{0x0}, {&(0x7f0000000640)=""/11, 0xb}], 0x2}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000004c0)=""/192, 0xc0}], 0x1}}], 0x2, 0x40000000, 0x0) 5.258931697s ago: executing program 1 (id=8668): syz_open_dev$vbi(0x0, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0x14, 0xa, 0x2, 0x0, [{@remote}, {@multicast1}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) r4 = socket$key(0xf, 0x3, 0x2) sendfile(r4, r2, &(0x7f0000000080)=0x5, 0x9) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000500)=ANY=[], 0x119) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, 0x0) r6 = syz_io_uring_setup(0x497, &(0x7f00000003c0)={0x0, 0x727b, 0x8, 0x800000, 0x15b}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd=r6, 0x8000000006, 0x0, 0xe448}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 4.970329705s ago: executing program 5 (id=8669): syz_open_dev$vbi(0x0, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0x14, 0xa, 0x2, 0x0, [{@remote}, {@multicast1}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendfile(r3, r2, &(0x7f0000000080)=0x5, 0x9) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000500)=ANY=[], 0x119) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r4 = syz_io_uring_setup(0x497, &(0x7f00000003c0)={0x0, 0x727b, 0x8, 0x800000, 0x15b}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd=r4, 0x8000000006, 0x0, 0xe448}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000038000000030a01040000000000000000010000010900010073797a30000000000c000240000000000000000109000300030000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 4.172225903s ago: executing program 2 (id=8670): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='veth1_to_bond\x00', 0xfffffedb) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) creat(&(0x7f0000000000)='./file0\x00', 0x60) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f0000004200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x11a3ce09}}, 0x50) syz_fuse_handle_req(r2, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c5ba868878d6ff3a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x0, 0x8, {0x0, 0x3572111cb2a712f5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x280, 0x2) close_range(r1, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xa2, &(0x7f0000000640)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}, @void, {@ipv4={0x800, @tcp={{0x20, 0x4, 0x0, 0x0, 0x94, 0x65, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @empty, {[@noop, @noop, @cipso={0x86, 0x21, 0x0, [{0x5, 0x9, "9030630a75fcfb"}, {0x7, 0x9, "0646d2a3e851d1"}, {0x1, 0x9, "3537ff8df23a21"}]}, @generic={0x94, 0x6, "77b794c6"}, @rr={0x7, 0xf, 0x54, [@private=0xa010101, @local, @remote]}, @timestamp_prespec={0x44, 0x34, 0x44, 0x3, 0x3, [{@local, 0x6}, {@multicast1, 0x200}, {@broadcast, 0x2}, {@remote, 0x6}, {@loopback, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}]}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff, 0x0, 0x8}}}}}}, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000440)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x1, 0x74, 0x0, 0x0, 0x8, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x18, 0x2, 0xca, 0x0, 0x1000, {[@timestamp={0x8, 0xa, 0x81000000, 0xfbc}, @exp_fastopen={0xfe, 0x4}, @exp_smc={0xfe, 0x6}, @timestamp={0x8, 0xa, 0x7, 0x88}, @fastopen={0x22, 0x3, "e2"}, @exp_fastopen={0xfe, 0x14, 0xf989, "079d22d6961c5af4c2cc061f44954a96"}, @mptcp=@capable={0x1e, 0x14, 0x4, 0x1, 0x40, 0x8000001, [0x9]}]}}}}}}}, 0x0) r4 = dup(0xffffffffffffffff) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@bridge_newneigh={0x28, 0x1d, 0x1, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r6, 0x80, 0x7e, 0xa}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00080010000d0400177b4c200afd86ea97ae49", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028008000200e0000001"], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000000c0)={'wg0\x00'}) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x18) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079101c0000000000610408000000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) socket$inet(0x10, 0x3, 0x0) 3.704492912s ago: executing program 2 (id=8671): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000900)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x80000, {0x0, 0x0, 0x0, r5, {}, {0xffe6, 0xb}, {0xfff2, 0x3}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4048080) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x5, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000240)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000002b21c90b000000000000721a5dbb56a3d9e16e7c2179c9b5b24722944820e624fc5b17d0822ca4232c98a9936ba722475ca57b558eb9b435e08a74c882358506ae3f5c3d58f5cc9b79b0a9d68e464020c8", 0x91}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b700c9e37eed5653ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d33330e2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb00"/135, 0x87}, {&(0x7f0000001400)="7f4ba13c5a27118dc920175650f0c9ba1809dd13a6e2d5b38f40adfa278c09e0e3bd05add4d780cd753b50f06f3b51f43761c7783f38ceaefc2dad57889d8b3a2d21314410f64ec2fa92e3a14b0141b39c020021d1edd011fbccb808a317fff4cf49aab12da619d67102048ec43c76cdb9d395e8b7b6e589d788aeeecb5080fc3d5ec6ccd656e49c0a642671d3fc363b46240bbc46ad965399b71db3c8f2b269b20870a3d2a6a8de5213b0f9d41c510c827056b7284391da244ec7653648b670f9a3483b314d861992ed7fb369eda093e1643c300b94d996fc592adb22c379be070ce5cd806da85a492dd4199cceb4c5b750222485325cf1073bf87e93bdf7da8af8f5f626541afd", 0x108}], 0x3}, 0x4) 3.692618204s ago: executing program 4 (id=8672): syz_usb_connect(0x0, 0x24, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x237, 0x0, &(0x7f00000002c0)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) io_setup(0x8, &(0x7f0000000680)=0x0) io_pgetevents(r5, 0x2, 0x2, &(0x7f00000000c0)=[{}, {}], &(0x7f0000000700)={0x0, 0x3938700}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000300)=ANY=[@ANYBLOB="180079f3834b5e0026bdf008fcdbdf2504000000040012808782b1458440e61daa447ac7aefdfde224a9ab8141934b87fc09ef4ddfca113cfb69b217f31b8bf8d2db259516ec2cf6691623b57d9c0be14f0f64b0edd2258a87b62aad067bd798b9182661443f875bc0bc91262afbfa5e2b41b0bae08d9362e9a1440c16203c15e5543fbe163ba8ee967d7bb1eff96996a5c0521bd60c2190ebc983b5ea55d903a6e18ab74f1dad78230e29"], 0x18}, 0x1, 0x0, 0x0, 0x2004809c}, 0x20000000) 3.598445966s ago: executing program 3 (id=8673): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) r0 = getpid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000000)=0x9, 0x4) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x41) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/net/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd1l,'}, 0x30) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet6(0xa, 0x4, 0x1000008) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = fsopen(&(0x7f00000003c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r5, 0x2, &(0x7f0000000280)='\xebU\x95\xa4i\xea`\xe0[\x9a\x84\x11\xc9&R:\xe9\xea\xec\xe05@b\x1f\xab\xb7\xe6\xd4\x18\xe7D@\xf5\xb2\xb4\xe8i$\x038\x99\xfb;\xbeR\xbf\xc2\r\x13\xf0\xf0\xec\x94\xad\nA\xee>\xb3i4\\\xc8\xd7 \x8d\xe0D\x953|) \xd8p\x12\x11\x81\x7f\x93\a\xfb!\x83\xc2\xd8\xe4\x98\xae\xb7\f\x0fR\xd3\xad\xa5\xca\xd5\xc2\bv+\x9a\x94\xd0\x05\x8d\xef\x9f94>\xa5?\x9a\x11Et\xef\xea\xe9e\x81\'jB\xca\f\xccz\x15x\x1cn\xe4\xf3\xbd\xb4q{\xb33\xffM\x95Jm\x90\x00\x15\r\xc8R\xb4\xf89>\xb7\x1e\xe3\x99\x99_~\xdb\xdc\xfd\x0f\x8f\xfc\xe4\xa4\xe8\x03K\xea\xb2\x91H|EB\xfd2\x10atXE\xee\xf4\x13c\xb5u\x85w$\xd3}\x19\xe7n\xf9\xe7\x11@\xceB\xd7/\xde\x80F\xe0\xd0dI\xedfq]\xb1\xaa\x9b)\\o\xd1\xdcx\x06\x80\x9f\xb3\xcc\r\b\xcb\xb1\x1c\x03G\xe4\xf0H`\x0e\xe1\xc7\x13\x9e%J\xe6\xe2\xe6\xb4:\xa8\xf51~\xc5\x8a\xfe++s\x0f\xa9\x00\x00A\xb8\xf1\xdb', &(0x7f00000000c0)="8c", 0xff57) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r7 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r7, 0x1, &(0x7f0000000140)={0x100, r8}, 0x0) 3.149920027s ago: executing program 5 (id=8674): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x14, 0x2, [@TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8, 0x6, 0xffffffff}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB], 0x38}}, 0x0) 3.048559341s ago: executing program 1 (id=8675): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000480)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x40000) removexattr(0x0, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x80086601, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r5 = getpid() sched_setattr(r5, &(0x7f0000000200)={0x38, 0x0, 0x2b, 0x400, 0x0, 0x4, 0x4, 0x2, 0xffffffff}, 0x0) ioctl$BLKALIGNOFF(r4, 0x127a, &(0x7f0000000140)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r6, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8841}, 0x40804) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000003c0)={'gretap0\x00', 0x0}) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="f2", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e24, 0xff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000001c0)='f', 0x1}], 0x1}}], 0x2, 0x0) shmget$private(0x0, 0x1000, 0x78000a42, &(0x7f0000ff2000/0x1000)=nil) fstat(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f00000005c0)={0x284, 0x27, 0x4, 0x70bd2c, 0x25dfdbfe, {0x12}, [@generic, @nested={0xc, 0xe9, 0x0, 0x1, [@typed={0x8, 0x46, 0x0, 0x0, @uid=r7}]}, @nested={0xda, 0x33, 0x0, 0x1, [@nested={0x4, 0xe7}, @generic="50cde5150d6f1262ff66ffe10af9ecf9d1678960cfbfc5ca603a773c19272c55d2650521411f07f212dc8b9de38aba6d21c78186d85941eca8d3de3f0a874101b98e0e44f461e540b0b51e2758e07447509ca13036c47a8543eb863396c0753bff1add466c0c54d1ac70e88396a56b2c9bf7718454f870f174425f42a1adfe67819c3770dd3e82bdbba3d98ff376eef6dedeb2f8a7e5c717b14fe5f39c05161ee9996b917a503b899acb3b986b26dad17faa3cf5d9b175bbaa0c63971c5597687e75", @typed={0x8, 0xca, 0x0, 0x0, @fd=r0}, @nested={0x4, 0x2c83}, @nested={0x4, 0xc1}]}, @typed={0x5, 0xc3, 0x0, 0x0, @str='\x00'}, @typed={0x4, 0xc4}, @generic="87a32fabd588d4e35d930b7f32f25d5d5bcb2e0c1c49bd7bee845f689402bbe180cdb165a462639370da8c59f0c48a1edb3e13d4635a", @generic="18f765fb31c35f53c37fa29ab8", @nested={0x130, 0x125, 0x0, 0x1, [@typed={0x8, 0x72, 0x0, 0x0, @u32=0x1517}, @nested={0x4, 0x7d}, @nested={0x4, 0x9b}, @nested={0x4, 0x133}, @generic="cdd556f65e336e1a024640962cfbdd765d1ccf345280b97f25c4a2c132f85cba38f100f57521b7d96401b3226275b3354b91fe3fb936a994c2043579b6a0e55eb40dc702d262b6e073782b492f77e7ec8a53a22b89bca2bb707feb042aa8e4d9b66711eba34c623f0c67300f1d37bca2732f58128fb23fd543bf28ca3bd8dcae8ae2755d5a2a22cd4c346868fa8c9696d417ae535dd0371b6df8f9e731546c9891978cdba851e587c136fabaf43787127e5cfe8405bc725b49323899c7cf68c54a113e3272b5c3e5a27bc208ad07b7b4c28cbb8b530fd4a2154eae4d93666e02e3", @nested={0x4, 0x50}, @typed={0xc, 0x119, 0x0, 0x0, @str='gretap0\x00'}, @typed={0x8, 0x49, 0x0, 0x0, @pid=r5}, @generic="71e47759a135dc010b67faf753a489db88242c2a68a95b", @typed={0x8, 0x1b, 0x0, 0x0, @u32=0x4}]}, @typed={0x8, 0xc, 0x0, 0x0, @fd=r2}]}, 0x284}, 0x1, 0x0, 0x0, 0x20000014}, 0x4040000) 2.967592154s ago: executing program 2 (id=8676): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) getpid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = io_uring_setup(0x36da, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ca}) r1 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r1, 0x0, 0x0, 0xc008000, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) 2.645141025s ago: executing program 2 (id=8677): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES32=r2], 0x1c}}, 0x200040c4) 2.274487929s ago: executing program 3 (id=8678): syz_usb_connect(0x0, 0x24, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x237, &(0x7f0000000140)={0x0, 0x262e, 0x10100, 0x0, 0x170}, &(0x7f00000002c0)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) io_setup(0x8, &(0x7f0000000680)=0x0) io_pgetevents(r5, 0x2, 0x2, &(0x7f00000000c0)=[{}, {}], &(0x7f0000000700)={0x0, 0x3938700}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000300)=ANY=[@ANYBLOB="180079f3834b5e0026bdf008fcdbdf2504000000040012808782b1458440e61daa447ac7aefdfde224a9ab8141934b87fc09ef4ddfca113cfb69b217f31b8bf8d2db259516ec2cf6691623b57d9c0be14f0f64b0edd2258a87b62aad067bd798b9182661443f875bc0bc91262afbfa5e2b41b0bae08d9362e9a1440c16203c15e5543fbe163ba8ee967d7bb1eff96996a5c0521bd60c2190ebc983b5ea55d903a6e18ab74f1dad78230e29"], 0x18}, 0x1, 0x0, 0x0, 0x2004809c}, 0x20000000) 2.272721597s ago: executing program 5 (id=8688): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000009c0)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2001c061}, 0x4008000) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d88a8", 0x16, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r7, 0x1, 0xd8, 0x6, @multicast}, 0x14) 2.232633438s ago: executing program 2 (id=8679): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4622, @multicast1}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f00000000c0)=""/21, 0x15}], 0x2}, 0x4}], 0x2, 0x60, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x1000, 0x2) unshare(0x8040480) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) syz_clone(0x18000a00, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r5, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) socketpair$unix(0x1, 0x3, 0x0, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') ppoll(&(0x7f0000000100)=[{r7, 0x2432}, {r6, 0x4}, {r4}], 0x3, 0x0, 0x0, 0x0) r8 = syz_pidfd_open(0x0, 0x0) setns(r8, 0x8020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x0, &(0x7f00000005c0)={0x8, 0x70, 0x80000, {r7}}, 0x20) 1.838325671s ago: executing program 5 (id=8680): ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000280)={0x200, 0x74fe, 0x1}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e20, 0x901, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3e}}, 0x6}, 0x1c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x9, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x103) write$cgroup_int(r3, &(0x7f0000000000)=0x800, 0x12) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)='./file0\x00', 0x8, 0x1) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) 1.206141231s ago: executing program 4 (id=8681): r0 = socket$netlink(0x10, 0x3, 0x2) getsockopt$netlink(r0, 0x10e, 0x9, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0xc0}}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xc, 0xe, &(0x7f0000001880)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1, 0x0, 0x1}, 0x10}, 0x94) ioctl$SIOCSIFMTU(r4, 0x8923, &(0x7f0000000100)={'vlan0\x00', 0x40}) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876c1d0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000580), 0x7aed979249b5ae9d, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x1000000000000, 0x800, 0x7}, 0x6}, 0x20, 0x1, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(r7) madvise(&(0x7f00003cd000/0x1000)=nil, 0x1000, 0x8) readv(r6, &(0x7f0000000080)=[{&(0x7f0000001240)=""/4086, 0xff6}], 0x1) 554.223097ms ago: executing program 1 (id=8682): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='veth1_to_bond\x00', 0xfffffedb) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) creat(&(0x7f0000000000)='./file0\x00', 0x60) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f0000004200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x11a3ce09}}, 0x50) syz_fuse_handle_req(r2, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c5ba868878d6ff3a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x0, 0x8, {0x0, 0x3572111cb2a712f5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x280, 0x2) close_range(r1, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xa2, &(0x7f0000000640)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}, @void, {@ipv4={0x800, @tcp={{0x20, 0x4, 0x0, 0x0, 0x94, 0x65, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @empty, {[@noop, @noop, @cipso={0x86, 0x21, 0x0, [{0x5, 0x9, "9030630a75fcfb"}, {0x7, 0x9, "0646d2a3e851d1"}, {0x1, 0x9, "3537ff8df23a21"}]}, @generic={0x94, 0x6, "77b794c6"}, @rr={0x7, 0xf, 0x54, [@private=0xa010101, @local, @remote]}, @timestamp_prespec={0x44, 0x34, 0x44, 0x3, 0x3, [{@local, 0x6}, {@multicast1, 0x200}, {@broadcast, 0x2}, {@remote, 0x6}, {@loopback, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}]}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff, 0x0, 0x8}}}}}}, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000440)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x1, 0x74, 0x0, 0x0, 0x8, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x18, 0x2, 0xca, 0x0, 0x1000, {[@timestamp={0x8, 0xa, 0x81000000, 0xfbc}, @exp_fastopen={0xfe, 0x4}, @exp_smc={0xfe, 0x6}, @timestamp={0x8, 0xa, 0x7, 0x88}, @fastopen={0x22, 0x3, "e2"}, @exp_fastopen={0xfe, 0x14, 0xf989, "079d22d6961c5af4c2cc061f44954a96"}, @mptcp=@capable={0x1e, 0x14, 0x4, 0x1, 0x40, 0x8000001, [0x9]}]}}}}}}}, 0x0) r4 = dup(0xffffffffffffffff) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@bridge_newneigh={0x28, 0x1d, 0x1, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r6, 0x80, 0x7e, 0xa}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00080010000d0400177b4c200afd86ea97ae49", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028008000200e0000001"], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000000c0)={'wg0\x00'}) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x18) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079101c0000000000610408000000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) socket$inet(0x10, 0x3, 0x0) 301.928105ms ago: executing program 5 (id=8683): r0 = socket(0x80000000000000a, 0x2, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0x55b4e85f}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140), 0x20080, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r6, 0x40046103, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000300)=ANY=[], 0x18c) r7 = openat$sysfs(0xffffff9c, &(0x7f00000002c0)='/sys/power/sync_on_suspend', 0x14000, 0x87) unlinkat(r7, &(0x7f00000012c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) unshare(0x70000000) semget$private(0x0, 0x4000, 0x0) semctl$SETALL(0x0, 0x0, 0x14, 0x0) write$UHID_INPUT(r2, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b324c078b089b3438076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b32310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153bdf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000300)={0x191, 0x140, 0xa0, 0x40, 0x8, 0x1, 0x20, 0x0, {}, {0x0, 0xffffffff, 0x1}, {0x0, 0x0, 0xfffffffd}, {0x6, 0x4}, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x6, 0x6, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x2, 0xa}) semctl$SETVAL(0x0, 0x2, 0x10, 0x0) semctl$IPC_STAT(0x0, 0x0, 0x2, &(0x7f00000004c0)=""/88) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f00000005c0)='enc=', 0x0) fsopen(&(0x7f0000000240)='nfsd\x00', 0x1) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x3, 0x0, @mcast1={0xff, 0x7}, 0x8a}}, {{0xa, 0x0, 0x10001, @local}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000080)={0x7abd, {{0xa, 0xfffe, 0x0, @empty, 0x3}}, {{0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x104) 0s ago: executing program 3 (id=8684): creat(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400010000000000fbdbdf250a00a100", @ANYRES32=r4, @ANYBLOB="14000100ff05000000000000dfce000000000001"], 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) kernel console output (not intermixed with test programs): : batadv_slave_1 [ 1545.581474][T27634] kye 0003:0458:5016.0023: control desc unexpectedly large [ 1545.608021][T27634] input: HID 0458:5016 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5016.0023/input/input49 [ 1545.648413][T29275] Set syz1 is full, maxelem 65536 reached [ 1545.704646][T27634] input: HID 0458:5016 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5016.0023/input/input50 [ 1545.806421][T27634] kye 0003:0458:5016.0023: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.3-1/input0 [ 1546.114672][T27641] usb 3-1: USB disconnect, device number 83 [ 1546.535744][T29300] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7428'. [ 1547.046619][T29307] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7431'. [ 1547.763051][T25148] usb 4-1: USB disconnect, device number 85 [ 1548.860993][T29342] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7443'. [ 1549.118002][T29348] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7447'. [ 1549.136697][T29348] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7447'. [ 1549.269996][T29355] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7450'. [ 1549.852154][T29380] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7460'. [ 1550.346175][T29388] syzkaller0: entered promiscuous mode [ 1550.442816][T29388] syzkaller0: entered allmulticast mode [ 1551.312084][T29413] syzkaller0: entered promiscuous mode [ 1551.318668][T29413] syzkaller0: entered allmulticast mode [ 1551.382684][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1551.389103][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1551.413906][T29410] tipc: Enabling of bearer rejected, already enabled [ 1551.810133][T29419] QAT: failed to copy from user. [ 1551.977989][T29423] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7474'. [ 1553.112468][T29439] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7478'. [ 1553.584353][T29450] tipc: Started in network mode [ 1553.596712][T29450] tipc: Node identity 4a8252b79f26, cluster identity 4711 [ 1553.646683][T29450] tipc: Enabled bearer , priority 0 [ 1553.760907][T29446] tipc: Disabling bearer [ 1554.251488][T27641] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1554.283409][T29471] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1554.370815][T29474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7492'. [ 1554.428024][T27641] usb 3-1: Using ep0 maxpacket: 8 [ 1554.480106][T27641] usb 3-1: no configurations [ 1554.501845][T27641] usb 3-1: can't read configurations, error -22 [ 1554.674817][T27641] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1554.852848][T27641] usb 3-1: Using ep0 maxpacket: 8 [ 1554.868167][T27641] usb 3-1: no configurations [ 1554.877422][T27641] usb 3-1: can't read configurations, error -22 [ 1554.907768][T29485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7495'. [ 1554.919657][T27641] usb usb3-port1: attempt power cycle [ 1555.352087][T27641] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1555.382654][T27641] usb 3-1: Using ep0 maxpacket: 8 [ 1555.383770][T29492] syzkaller0: entered promiscuous mode [ 1555.388785][T27641] usb 3-1: no configurations [ 1555.393704][T29492] syzkaller0: entered allmulticast mode [ 1555.408230][T27641] usb 3-1: can't read configurations, error -22 [ 1555.563267][T27641] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1555.602444][T27641] usb 3-1: Using ep0 maxpacket: 8 [ 1555.614690][T27641] usb 3-1: no configurations [ 1555.619409][T27641] usb 3-1: can't read configurations, error -22 [ 1555.627809][T27641] usb usb3-port1: unable to enumerate USB device [ 1555.660408][T29502] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7503'. [ 1555.671245][T29503] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1555.871110][T29509] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7507'. [ 1555.884534][T29511] syzkaller0: entered promiscuous mode [ 1555.890323][T29511] syzkaller0: entered allmulticast mode [ 1556.225425][T29523] syzkaller0: entered promiscuous mode [ 1556.231311][T29523] syzkaller0: entered allmulticast mode [ 1556.578359][T29529] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1556.617020][T29533] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7517'. [ 1556.944904][T29537] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7520'. [ 1557.181655][T29541] syzkaller0: entered promiscuous mode [ 1557.187166][T29541] syzkaller0: entered allmulticast mode [ 1558.006112][T29566] tipc: Enabled bearer , priority 0 [ 1558.035317][T29565] tipc: Disabling bearer [ 1558.379374][T29572] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7535'. [ 1558.668549][T29577] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7537'. [ 1560.289990][T29616] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7552'. [ 1560.574254][T29621] syzkaller0: entered promiscuous mode [ 1560.590077][T29621] syzkaller0: entered allmulticast mode [ 1561.656938][T29636] QAT: failed to copy from user. [ 1562.868797][T29649] netlink: 104 bytes leftover after parsing attributes in process `syz.5.7564'. [ 1562.898806][T29649] netlink: 104 bytes leftover after parsing attributes in process `syz.5.7564'. [ 1563.742116][T27641] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 1563.901699][T27641] usb 2-1: Using ep0 maxpacket: 16 [ 1563.920743][T27641] usb 2-1: config 0 has no interfaces? [ 1563.955169][T27641] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1563.993398][T27641] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1564.022584][T27641] usb 2-1: Manufacturer: syz [ 1564.065968][T27641] usb 2-1: config 0 descriptor?? [ 1564.340799][T29687] QAT: failed to copy from user. [ 1564.424833][T29688] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7580'. [ 1564.437252][T29673] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1564.453992][T29688] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7580'. [ 1564.723951][T29673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.744086][T29691] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7581'. [ 1564.763622][T29673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1566.457340][T27641] usb 2-1: USB disconnect, device number 81 [ 1566.518612][T29722] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7595'. [ 1567.059175][T29732] QAT: failed to copy from user. [ 1567.154097][T29590] Set syz1 is full, maxelem 65536 reached [ 1567.191667][ T5925] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1567.341655][ T5925] usb 4-1: Using ep0 maxpacket: 16 [ 1567.353581][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1567.365734][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1567.380031][ T5925] usb 4-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 1567.427957][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1567.452697][T27641] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1567.473754][ T5925] usb 4-1: config 0 descriptor?? [ 1567.611820][T27641] usb 2-1: Using ep0 maxpacket: 8 [ 1567.619115][T27641] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 1567.628958][T27641] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1567.640022][T27641] usb 2-1: config 0 has no interfaces? [ 1567.660922][T27641] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1567.670351][T27641] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.685140][T27641] usb 2-1: Product: syz [ 1567.697839][T27641] usb 2-1: Manufacturer: syz [ 1567.706257][T27641] usb 2-1: SerialNumber: syz [ 1567.725828][T27641] usb 2-1: config 0 descriptor?? [ 1567.862403][T29738] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7602'. [ 1567.920798][ T5925] kye 0003:0458:5016.0024: control desc unexpectedly large [ 1567.921965][T29738] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1567.940826][T25148] usb 2-1: USB disconnect, device number 82 [ 1567.977167][ T5925] input: HID 0458:5016 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5016.0024/input/input51 [ 1568.054716][T29741] tipc: Enabled bearer , priority 0 [ 1568.085965][T29740] tipc: Disabling bearer [ 1568.123093][ T5925] input: HID 0458:5016 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5016.0024/input/input52 [ 1568.247587][ T5925] kye 0003:0458:5016.0024: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.3-1/input0 [ 1568.510400][T29748] syzkaller0: entered promiscuous mode [ 1568.516081][T29748] syzkaller0: entered allmulticast mode [ 1568.698246][T29759] QAT: failed to copy from user. [ 1569.161951][ C1] kye 0003:0458:5016.0024: usb_submit_urb(ctrl) failed: -1 [ 1569.232992][ T5925] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 1569.463519][ T5925] usb 6-1: Using ep0 maxpacket: 16 [ 1569.470986][ T5925] usb 6-1: config 0 has no interfaces? [ 1569.478340][ T5925] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1569.488057][ T5925] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1569.508414][ T5925] usb 6-1: Manufacturer: syz [ 1569.615729][ T5925] usb 6-1: config 0 descriptor?? [ 1569.899634][T29771] Set syz1 is full, maxelem 65536 reached [ 1569.921104][T29780] netlink: 16 bytes leftover after parsing attributes in process `syz.5.7610'. [ 1569.983859][T29784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1569.994945][T29784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1570.023271][T25148] usb 4-1: USB disconnect, device number 86 [ 1570.138952][T29768] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1570.155708][T29788] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7615'. [ 1570.828371][T29797] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7620'. [ 1571.773861][T29816] QAT: failed to copy from user. [ 1571.943838][T27641] usb 6-1: USB disconnect, device number 98 [ 1573.254204][T29831] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7631'. [ 1573.264078][T29831] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7631'. [ 1573.320162][T29835] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7633'. [ 1573.990503][T29852] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7641'. [ 1574.192077][T29856] QAT: failed to copy from user. [ 1574.918840][T29866] QAT: failed to copy from user. [ 1575.492740][T29874] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7648'. [ 1575.715341][T29878] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7650'. [ 1575.807802][T29885] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7653'. [ 1575.930398][T29892] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7655'. [ 1576.031692][T27641] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 1576.181714][T27641] usb 6-1: Using ep0 maxpacket: 16 [ 1576.190907][T27641] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1576.203099][T27641] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1576.214678][T27641] usb 6-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 1576.224581][T27641] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1576.243893][T27641] usb 6-1: config 0 descriptor?? [ 1576.682068][T27641] kye 0003:0458:5016.0025: control desc unexpectedly large [ 1576.708796][T27641] input: HID 0458:5016 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5016.0025/input/input53 [ 1576.847095][T27641] input: HID 0458:5016 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5016.0025/input/input54 [ 1577.122260][T27641] kye 0003:0458:5016.0025: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.5-1/input0 [ 1577.129786][T29902] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7658'. [ 1577.522080][T27641] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1577.681719][T27641] usb 2-1: Using ep0 maxpacket: 8 [ 1577.688967][T27641] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 1577.698425][T27641] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1577.709089][T27641] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1577.734697][T27641] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1577.752168][T27641] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1577.774497][T27641] usb 2-1: Product: syz [ 1577.784542][T27641] usb 2-1: Manufacturer: syz [ 1577.792249][ C1] kye 0003:0458:5016.0025: usb_submit_urb(ctrl) failed: -1 [ 1577.811669][T27641] usb 2-1: SerialNumber: syz [ 1577.840268][T29924] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7668'. [ 1577.850513][T27641] usb 2-1: config 0 descriptor?? [ 1578.065984][ T5925] usb 2-1: USB disconnect, device number 83 [ 1578.515671][T29940] tipc: Enabling of bearer rejected, already enabled [ 1578.643449][T27620] usb 6-1: USB disconnect, device number 99 [ 1578.812660][T29949] __nla_validate_parse: 1 callbacks suppressed [ 1578.812677][T29949] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7677'. [ 1579.211141][T29961] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1579.251356][T29961] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7682'. [ 1579.544510][T29968] QAT: failed to copy from user. [ 1579.818963][T29971] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7685'. [ 1579.937950][T29977] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7687'. [ 1579.950514][T29977] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7687'. [ 1579.971665][ T5925] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1580.141646][ T5925] usb 5-1: Using ep0 maxpacket: 16 [ 1580.167297][ T5925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1580.201684][ T5925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1580.257934][ T5925] usb 5-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 1580.289280][ T5925] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1580.348040][ T5925] usb 5-1: config 0 descriptor?? [ 1580.807518][ T5925] kye 0003:0458:5016.0026: control desc unexpectedly large [ 1580.847957][ T5925] input: HID 0458:5016 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5016.0026/input/input55 [ 1580.878256][T29987] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7692'. [ 1580.968846][ T5925] input: HID 0458:5016 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5016.0026/input/input56 [ 1581.088424][ T5925] kye 0003:0458:5016.0026: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.4-1/input0 [ 1581.106815][T29993] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7694'. [ 1581.211875][T27634] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1581.299491][T29998] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7698'. [ 1581.360849][T30000] syzkaller0: entered promiscuous mode [ 1581.367389][T30000] syzkaller0: entered allmulticast mode [ 1581.396914][T27634] usb 4-1: config 0 has no interfaces? [ 1581.407842][T27634] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1581.431591][T27634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1581.451118][T27634] usb 4-1: config 0 descriptor?? [ 1581.575543][T30011] QAT: failed to copy from user. [ 1581.652702][T30012] QAT: failed to copy from user. [ 1581.690604][T27619] usb 4-1: USB disconnect, device number 87 [ 1581.836635][T30019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7704'. [ 1581.846230][T30019] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7704'. [ 1582.021897][ C0] kye 0003:0458:5016.0026: usb_submit_urb(ctrl) failed: -1 [ 1582.813537][T25148] usb 5-1: USB disconnect, device number 79 [ 1583.168206][T30052] tipc: Enabling of bearer rejected, failed to enable media [ 1583.251712][ T5925] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1583.341658][T25148] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1583.433453][ T5925] usb 3-1: config 0 has no interfaces? [ 1583.439106][ T5925] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1583.448542][ T5925] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1583.473684][ T5925] usb 3-1: config 0 descriptor?? [ 1583.502168][T25148] usb 5-1: Using ep0 maxpacket: 16 [ 1583.509406][T25148] usb 5-1: config 0 has no interfaces? [ 1583.519994][T25148] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1583.530648][T25148] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1583.544088][T25148] usb 5-1: Manufacturer: syz [ 1583.594962][T25148] usb 5-1: config 0 descriptor?? [ 1583.714093][ T5925] usb 3-1: USB disconnect, device number 88 [ 1583.893722][T30049] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1583.916063][T30067] QAT: failed to copy from user. [ 1583.983044][T30070] __nla_validate_parse: 5 callbacks suppressed [ 1583.983076][T30070] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7723'. [ 1584.061339][T30049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1584.061780][T30049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1584.192088][T30070] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7723'. [ 1584.519869][T30079] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7725'. [ 1584.574589][T30079] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7725'. [ 1584.853739][T30083] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7726'. [ 1585.398763][T30092] tipc: Enabling of bearer rejected, failed to enable media [ 1585.447438][T30094] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7731'. [ 1585.717885][T30108] QAT: failed to copy from user. [ 1585.872701][ T5925] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1585.901290][T27633] usb 5-1: USB disconnect, device number 80 [ 1586.021872][ T5925] usb 6-1: Using ep0 maxpacket: 8 [ 1586.030478][ T5925] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 1586.044825][ T5925] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1586.244147][T30121] QAT: failed to copy from user. [ 1586.559593][ T5925] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1586.559619][ T5925] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1586.559634][ T5925] usb 6-1: Product: syz [ 1586.559646][ T5925] usb 6-1: Manufacturer: syz [ 1586.559657][ T5925] usb 6-1: SerialNumber: syz [ 1586.562100][ T5925] usb 6-1: config 0 descriptor?? [ 1586.788475][ T5925] usb 6-1: USB disconnect, device number 100 [ 1587.272546][T30130] tipc: Enabling of bearer rejected, failed to enable media [ 1588.073058][T30146] netlink: 7076 bytes leftover after parsing attributes in process `syz.2.7749'. [ 1588.088001][T30149] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7751'. [ 1588.097617][T30146] openvswitch: netlink: Flow key attr not present in new flow. [ 1588.102640][T30150] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7752'. [ 1588.541951][ T5925] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1588.702884][ T5925] usb 2-1: Using ep0 maxpacket: 8 [ 1588.714748][ T5925] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 1588.730704][ T5925] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1588.745972][ T5925] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1588.757633][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.765903][ T5925] usb 2-1: Product: syz [ 1588.770365][ T5925] usb 2-1: Manufacturer: syz [ 1588.776024][ T5925] usb 2-1: SerialNumber: syz [ 1588.794201][ T5925] usb 2-1: config 0 descriptor?? [ 1588.912039][T30176] netlink: 7048 bytes leftover after parsing attributes in process `syz.5.7763'. [ 1588.922556][T30176] openvswitch: netlink: Flow actions attr not present in new flow. [ 1588.961780][ T30] audit: type=1804 audit(1762595834.601:923): pid=30174 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.7762" name="/newroot/315/file1" dev="fuse" ino=1 res=1 errno=0 [ 1589.011727][ T5925] usb 2-1: USB disconnect, device number 84 [ 1589.082458][T30179] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7764'. [ 1589.290253][T30185] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7766'. [ 1590.642370][T30210] QAT: failed to copy from user. [ 1590.835811][T30213] netlink: 7048 bytes leftover after parsing attributes in process `syz.2.7775'. [ 1590.845288][T30213] openvswitch: netlink: Flow actions attr not present in new flow. [ 1591.099958][ T30] audit: type=1804 audit(1762595836.721:924): pid=30215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.7776" name="/newroot/420/file1" dev="fuse" ino=1 res=1 errno=0 [ 1591.301103][T30219] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7777'. [ 1591.337145][T30222] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7778'. [ 1591.361890][T30222] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7778'. [ 1591.658360][T30228] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7781'. [ 1591.938613][T30238] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7784'. [ 1592.316520][ T30] audit: type=1804 audit(1762595837.961:925): pid=30244 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.7788" name="/newroot/286/file1" dev="fuse" ino=1 res=1 errno=0 [ 1593.001671][T25148] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1593.137641][T30262] tipc: Enabled bearer , priority 0 [ 1593.165193][T25148] usb 3-1: config 0 has no interfaces? [ 1593.170852][T25148] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1593.185332][T30260] tipc: Disabling bearer [ 1593.191291][T25148] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1593.316797][T25148] usb 3-1: config 0 descriptor?? [ 1593.483356][T30271] QAT: failed to copy from user. [ 1593.820828][T25148] usb 3-1: USB disconnect, device number 89 [ 1594.719612][T30282] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7800'. [ 1594.784039][T30284] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7801'. [ 1594.948737][T30287] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7802'. [ 1595.042747][ T30] audit: type=1800 audit(1762595840.691:926): pid=30291 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.7803" name="file1" dev="tmpfs" ino=1671 res=0 errno=0 [ 1595.554152][T30302] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7808'. [ 1595.575635][T30302] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7808'. [ 1595.719557][T30306] syzkaller0: entered promiscuous mode [ 1595.745711][T30306] syzkaller0: entered allmulticast mode [ 1595.801107][T30309] openvswitch: netlink: Flow actions attr not present in new flow. [ 1595.911859][T30313] QAT: failed to copy from user. [ 1597.171868][ T30] audit: type=1800 audit(1762595842.791:927): pid=30328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.7817" name="file1" dev="tmpfs" ino=1024 res=0 errno=0 [ 1597.648032][T30343] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7821'. [ 1597.781973][T30342] tipc: Started in network mode [ 1597.826155][T30342] tipc: Node identity 36777b51146b, cluster identity 4711 [ 1597.870634][T30342] tipc: Enabled bearer , priority 0 [ 1597.949124][T30339] tipc: Disabling bearer [ 1598.032422][T30345] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7823'. [ 1598.910086][ T30] audit: type=1800 audit(1762595844.551:928): pid=30370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.7832" name="file1" dev="tmpfs" ino=1035 res=0 errno=0 [ 1598.930885][ C0] vkms_vblank_simulate: vblank timer overrun [ 1598.969866][T30374] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7833'. [ 1598.981749][T30374] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7833'. [ 1599.340989][T30376] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7834'. [ 1599.661650][ T24] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1599.792093][T30382] tipc: Enabling of bearer rejected, already enabled [ 1599.811636][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 1599.896199][T30384] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1599.918360][ T24] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 1599.943073][ T24] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1599.952526][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1599.990847][ T24] usb 2-1: Product: syz [ 1600.003014][ T24] usb 2-1: Manufacturer: syz [ 1600.016717][ T24] usb 2-1: SerialNumber: syz [ 1600.045212][ T24] usb 2-1: config 0 descriptor?? [ 1600.057815][ T24] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1600.066301][ T24] usb 2-1: setting power ON [ 1600.076967][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 1600.117249][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1600.151977][ T24] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1600.195360][ T24] usb 2-1: media controller created [ 1600.257518][T30378] dvb-usb: bulk message failed: -22 (3/0) [ 1600.264009][T30378] dvb-usb: bulk message failed: -22 (4/0) [ 1600.288069][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1600.296618][T30378] cxusb: i2c read failed [ 1600.302776][T30378] cxusb: i2c rd: len=8192 is too big! [ 1600.302776][T30378] [ 1600.423300][ T24] usb 2-1: selecting invalid altsetting 6 [ 1600.429116][ T24] usb 2-1: digital interface selection failed (-22) [ 1600.441607][ T24] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1600.501616][ T24] usb 2-1: setting power OFF [ 1600.506971][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 1600.514096][T30397] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7843'. [ 1600.547608][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1600.632824][ T24] (NULL device *): no alternate interface [ 1600.862650][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1600.903187][T30404] QAT: failed to copy from user. [ 1600.927807][ T24] usb 2-1: USB disconnect, device number 85 [ 1601.189325][T30413] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7847'. [ 1601.189348][T30413] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7847'. [ 1601.536397][T30417] syzkaller0: entered promiscuous mode [ 1601.544041][T30417] syzkaller0: entered allmulticast mode [ 1601.616045][T30419] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1601.903104][T30417] tipc: Enabled bearer , priority 0 [ 1601.913597][T30416] tipc: Resetting bearer [ 1601.947072][T30416] tipc: Disabling bearer [ 1603.254915][T30447] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1603.621687][ T5925] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1603.914594][ T5925] usb 2-1: config 0 has no interfaces? [ 1603.920160][ T5925] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1603.930091][ T5925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1603.958992][ T5925] usb 2-1: config 0 descriptor?? [ 1604.236399][T27620] usb 2-1: USB disconnect, device number 86 [ 1604.950405][T30476] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7871'. [ 1606.098689][T30487] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7873'. [ 1606.164233][T30492] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7876'. [ 1606.176946][T30492] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7876'. [ 1608.502062][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1608.571796][T30500] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1608.580315][T22485] Bluetooth: hci0: command 0x0406 tx timeout [ 1610.184049][T30500] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1610.190342][T30500] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1610.197049][T30500] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1610.203365][T30500] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1610.209380][T30500] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1610.220498][T30500] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1610.435072][T30528] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7885'. [ 1610.714241][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1610.840002][T30534] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7888'. [ 1610.956620][T30544] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7890'. [ 1610.988972][T30544] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7890'. [ 1611.693354][T30557] QAT: failed to copy from user. [ 1612.256802][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1612.263010][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1612.269306][T26337] Bluetooth: hci5: command 0x0c1a tx timeout [ 1612.279524][T27633] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1612.485437][T27633] usb 5-1: config 0 has no interfaces? [ 1612.543543][T27633] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1612.672583][T27633] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1612.819272][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1612.826359][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1612.854584][T27633] usb 5-1: config 0 descriptor?? [ 1613.087682][ T24] usb 5-1: USB disconnect, device number 81 [ 1613.133401][T30573] syzkaller0: entered promiscuous mode [ 1613.141048][T30573] syzkaller0: entered allmulticast mode [ 1614.274376][T30596] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7905'. [ 1614.350341][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1614.376943][T30596] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7905'. [ 1614.455949][T30597] QAT: failed to copy from user. [ 1614.647145][ T30] audit: type=1800 audit(1762595860.291:929): pid=30602 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.7906" name="file1" dev="tmpfs" ino=1106 res=0 errno=0 [ 1615.521703][ T24] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1615.756462][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 1615.775562][ T24] usb 5-1: config 0 has no interfaces? [ 1615.795351][ T24] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1615.821689][ T24] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1615.829763][ T24] usb 5-1: Manufacturer: syz [ 1615.886340][ T24] usb 5-1: config 0 descriptor?? [ 1616.164313][T30606] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1616.189664][T30615] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7907'. [ 1616.228270][T30606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1616.239005][T30606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1616.413376][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1617.348957][T30628] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7914'. [ 1617.477232][T30631] syzkaller0: entered promiscuous mode [ 1617.509192][T30631] syzkaller0: entered allmulticast mode [ 1617.619860][T30637] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7918'. [ 1617.692121][T30637] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7918'. [ 1618.165529][T27633] usb 5-1: USB disconnect, device number 82 [ 1618.207864][T30646] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7920'. [ 1618.693168][T30650] QAT: failed to copy from user. [ 1619.859347][T30668] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7929'. [ 1620.482722][T30674] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7928'. [ 1620.963948][T30688] tipc: Enabling of bearer rejected, already enabled [ 1621.291889][T25148] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1621.531728][T25148] usb 2-1: Using ep0 maxpacket: 16 [ 1621.686315][T25148] usb 2-1: config 0 has no interfaces? [ 1621.698357][T25148] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1621.709040][T25148] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1621.719408][T25148] usb 2-1: Manufacturer: syz [ 1621.734607][T25148] usb 2-1: config 0 descriptor?? [ 1622.040243][T30691] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1622.505878][T30691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1622.515413][T30691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1622.763961][T30709] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7941'. [ 1622.943786][T30713] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7942'. [ 1623.897681][T25148] usb 2-1: USB disconnect, device number 87 [ 1624.220662][T30725] QAT: failed to copy from user. [ 1624.672555][T30729] syzkaller0: entered promiscuous mode [ 1624.679713][T30729] syzkaller0: entered allmulticast mode [ 1624.690632][T30729] tipc: Enabled bearer , priority 0 [ 1624.705107][T30727] tipc: Resetting bearer [ 1624.713754][T30730] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7949'. [ 1624.751275][T30730] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7949'. [ 1624.775725][T30727] tipc: Disabling bearer [ 1625.486884][T30741] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7953'. [ 1625.514018][T30744] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7955'. [ 1625.925607][T30737] Set syz1 is full, maxelem 65536 reached [ 1626.414594][T30760] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7961'. [ 1626.423897][T30760] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7961'. [ 1626.916928][T30764] syzkaller0: entered promiscuous mode [ 1626.956251][T30764] syzkaller0: entered allmulticast mode [ 1628.189937][T30785] QAT: failed to copy from user. [ 1628.632346][T30792] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7968'. [ 1628.898623][T30793] syzkaller0: entered promiscuous mode [ 1628.953159][T30793] syzkaller0: entered allmulticast mode [ 1629.174061][T30802] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7971'. [ 1629.516225][T30805] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7972'. [ 1629.545322][T30805] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7972'. [ 1632.271634][T27634] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1632.441651][T27634] usb 6-1: Using ep0 maxpacket: 8 [ 1632.456028][T27634] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 1632.468339][T27634] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1632.477736][T27634] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1632.485842][T27634] usb 6-1: Product: syz [ 1632.490275][T27634] usb 6-1: Manufacturer: syz [ 1632.499188][T27634] usb 6-1: SerialNumber: syz [ 1632.520328][T27634] usb 6-1: config 0 descriptor?? [ 1632.528926][T27634] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1632.538702][T27634] usb 6-1: setting power ON [ 1632.548640][T27634] dvb-usb: bulk message failed: -22 (2/0) [ 1632.558045][T27634] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1632.568851][T27634] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1632.577887][T27634] usb 6-1: media controller created [ 1632.621271][T27634] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1632.653551][T27634] usb 6-1: selecting invalid altsetting 6 [ 1632.659397][T27634] usb 6-1: digital interface selection failed (-22) [ 1632.680307][T27634] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1632.690280][T27634] usb 6-1: setting power OFF [ 1632.704857][T27634] dvb-usb: bulk message failed: -22 (2/0) [ 1632.711121][T27634] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1632.720564][T27634] (NULL device *): no alternate interface [ 1632.728629][T30828] dvb-usb: bulk message failed: -22 (3/0) [ 1632.757485][T30828] dvb-usb: bulk message failed: -22 (4/0) [ 1632.774758][T30828] cxusb: i2c read failed [ 1632.787761][T30828] cxusb: i2c rd: len=8192 is too big! [ 1632.787761][T30828] [ 1632.798492][T27634] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1632.818945][T27634] usb 6-1: USB disconnect, device number 101 [ 1633.915531][T30842] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7984'. [ 1633.993966][T30842] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7984'. [ 1634.062721][T30846] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7985'. [ 1634.150946][T30846] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7985'. [ 1634.556141][T30851] QAT: failed to copy from user. [ 1634.752188][T30853] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7997'. [ 1635.079050][T30853] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7997'. [ 1635.723743][T30859] syzkaller0: entered promiscuous mode [ 1635.729298][T30859] syzkaller0: entered allmulticast mode [ 1635.800673][T30867] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7991'. [ 1635.885297][T30870] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7993'. [ 1636.775678][T30883] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7999'. [ 1636.785459][T30885] syzkaller0: entered promiscuous mode [ 1636.791011][T30885] syzkaller0: entered allmulticast mode [ 1636.846029][T30885] tipc: Enabled bearer , priority 0 [ 1636.962192][T30884] tipc: Resetting bearer [ 1636.998170][T30884] tipc: Disabling bearer [ 1637.382606][T30897] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8001'. [ 1638.468451][T30910] @: renamed from vlan0 [ 1639.147024][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1639.371701][T30892] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1639.451840][T26337] Bluetooth: hci0: command 0x0406 tx timeout [ 1639.632673][T30923] __nla_validate_parse: 2 callbacks suppressed [ 1639.632693][T30923] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8007'. [ 1639.757203][T30892] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1639.763688][T30892] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1639.770264][T30892] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1639.781696][T30892] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1639.946683][T30927] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8008'. [ 1640.152951][T30933] tipc: Enabling of bearer rejected, already enabled [ 1640.165028][T30934] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8011'. [ 1640.523996][T30946] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8018'. [ 1640.843228][T30952] syzkaller0: entered promiscuous mode [ 1640.855182][T30952] syzkaller0: entered allmulticast mode [ 1641.021475][T30955] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8019'. [ 1641.492115][T22485] Bluetooth: hci2: command 0x0c1a tx timeout [ 1641.771691][T22485] Bluetooth: hci1: command 0x0405 tx timeout [ 1641.777854][T22485] Bluetooth: hci5: command 0x0c1a tx timeout [ 1641.853281][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1641.860210][T30962] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8023'. [ 1641.872099][T30960] syzkaller0: entered promiscuous mode [ 1641.877626][T30960] syzkaller0: entered allmulticast mode [ 1641.989259][T30968] syzkaller0: entered promiscuous mode [ 1642.023248][T30968] syzkaller0: entered allmulticast mode [ 1642.075436][T30968] tipc: Enabled bearer , priority 0 [ 1642.116691][T30967] tipc: Resetting bearer [ 1642.153585][T30970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8027'. [ 1642.165078][T30967] tipc: Disabling bearer [ 1642.583976][T30983] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8032'. [ 1643.096111][T30996] syzkaller0: entered promiscuous mode [ 1643.102938][T30996] syzkaller0: entered allmulticast mode [ 1643.112381][T30995] syzkaller0: entered promiscuous mode [ 1643.221633][T30995] syzkaller0: entered allmulticast mode [ 1643.845581][T31002] syzkaller0: entered promiscuous mode [ 1643.905675][T31002] syzkaller0: entered allmulticast mode [ 1645.071027][T31018] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8041'. [ 1645.650746][T31029] netlink: 32 bytes leftover after parsing attributes in process `syz.5.8045'. [ 1646.023239][T31031] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8044'. [ 1646.410762][T31037] syzkaller0: entered promiscuous mode [ 1646.417705][T31037] syzkaller0: entered allmulticast mode [ 1646.895537][T31042] netlink: 40 bytes leftover after parsing attributes in process `syz.5.8050'. [ 1647.071316][T31046] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8052'. [ 1647.501372][T31051] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8054'. [ 1648.297493][T31061] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8056'. [ 1648.390253][T31061] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8056'. [ 1648.983863][T31066] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8058'. [ 1649.367009][T31075] syzkaller0: entered promiscuous mode [ 1649.376375][T31075] syzkaller0: entered allmulticast mode [ 1649.492164][ T30] audit: type=1804 audit(1762595895.111:930): pid=31076 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.8062" name="/newroot/418/file1" dev="fuse" ino=1 res=1 errno=0 [ 1649.989672][T31091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8066'. [ 1650.311415][T31099] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8070'. [ 1650.325957][T31099] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8070'. [ 1650.682373][T31095] Set syz1 is full, maxelem 65536 reached [ 1650.766421][T31106] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8073'. [ 1651.049299][ T30] audit: type=1804 audit(1762595896.691:931): pid=31115 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.8075" name="/newroot/341/file1" dev="fuse" ino=1 res=1 errno=0 [ 1651.076723][T31117] netlink: 32 bytes leftover after parsing attributes in process `syz.5.8077'. [ 1651.090762][T31110] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8074'. [ 1651.371885][T31128] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8082'. [ 1651.393380][T31128] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8082'. [ 1651.442644][T31131] QAT: failed to copy from user. [ 1651.829274][T31135] syzkaller0: entered promiscuous mode [ 1651.835863][T31135] syzkaller0: entered allmulticast mode [ 1652.581609][T27632] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1652.742609][T27632] usb 3-1: Using ep0 maxpacket: 16 [ 1652.754502][T27632] usb 3-1: config 0 has no interfaces? [ 1652.773368][T27632] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1652.807273][T27632] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1652.830197][T27632] usb 3-1: Manufacturer: syz [ 1652.850965][T27632] usb 3-1: config 0 descriptor?? [ 1653.244859][T31155] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1653.316616][T31155] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8087'. [ 1653.603868][T31163] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8091'. [ 1653.640639][T31163] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1655.190933][T31175] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8094'. [ 1655.211862][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1655.291675][T22485] Bluetooth: hci0: command 0x0406 tx timeout [ 1655.298168][T31153] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1655.436921][T31179] __nla_validate_parse: 1 callbacks suppressed [ 1655.436942][T31179] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8096'. [ 1656.017501][T31153] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1656.052149][T31153] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1656.058421][T31153] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1656.067657][T31153] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1656.086035][T27620] usb 3-1: USB disconnect, device number 90 [ 1656.308966][T31186] syzkaller0: entered promiscuous mode [ 1656.325766][T31186] syzkaller0: entered allmulticast mode [ 1656.359941][T27634] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1656.692888][T27634] usb 6-1: Using ep0 maxpacket: 16 [ 1656.706403][T27634] usb 6-1: config 0 has no interfaces? [ 1656.724866][T27634] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1656.741083][T27634] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1656.783012][T27634] usb 6-1: Manufacturer: syz [ 1656.846656][T27634] usb 6-1: config 0 descriptor?? [ 1657.072823][T27620] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1657.183700][T31204] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8103'. [ 1657.272034][T31204] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8103'. [ 1657.371677][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1657.372598][T27620] usb 3-1: Using ep0 maxpacket: 16 [ 1657.500151][T31172] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8093'. [ 1657.683301][T31172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1657.695652][T27620] usb 3-1: config 0 has no interfaces? [ 1657.747595][T27620] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1657.769616][T31172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1657.804436][T27620] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1657.821698][T27620] usb 3-1: Manufacturer: syz [ 1657.840379][T27620] usb 3-1: config 0 descriptor?? [ 1658.103492][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1658.110640][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1658.117532][T22485] Bluetooth: hci5: command 0x0c1a tx timeout [ 1658.194331][T31220] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8107'. [ 1658.227781][T31220] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8107'. [ 1658.340903][T31200] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1658.373700][T27620] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1658.474075][T31200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1658.505373][T31200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1658.533195][T27620] usb 5-1: Using ep0 maxpacket: 16 [ 1658.549544][T27620] usb 5-1: config 0 has no interfaces? [ 1658.558595][T27620] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1658.588669][T27620] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1658.600159][T27620] usb 5-1: Manufacturer: syz [ 1658.659424][T27620] usb 5-1: config 0 descriptor?? [ 1658.882984][T27620] usb 6-1: USB disconnect, device number 102 [ 1658.917989][T31217] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1659.006836][T31217] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8108'. [ 1659.013293][T31219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1659.029440][T31219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1659.829990][T27634] usb 3-1: USB disconnect, device number 91 [ 1659.961054][T31234] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8111'. [ 1660.990205][T27634] usb 5-1: USB disconnect, device number 83 [ 1661.209622][T31249] fuse: Bad value for 'fd' [ 1661.268510][ T30] audit: type=1800 audit(1762595906.911:932): pid=31250 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8116" name="file1" dev="tmpfs" ino=1973 res=0 errno=0 [ 1661.691687][T26330] Bluetooth: hci3: command 0x0405 tx timeout [ 1661.771766][T26330] Bluetooth: hci0: command 0x0406 tx timeout [ 1661.771828][T31225] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1662.098122][T31225] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1662.107605][T31225] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1662.114121][T31225] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1662.120416][T31225] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1662.284055][T31252] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8117'. [ 1662.325957][T31252] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8117'. [ 1662.365801][T31256] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8118'. [ 1662.575538][T31264] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8122'. [ 1663.031740][T27632] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1663.201601][T27632] usb 5-1: Using ep0 maxpacket: 16 [ 1663.249489][T27632] usb 5-1: config 0 has no interfaces? [ 1663.277377][T27632] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1663.287180][T27632] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1663.295363][T27632] usb 5-1: Manufacturer: syz [ 1663.373061][T27632] usb 5-1: config 0 descriptor?? [ 1663.700862][T31287] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1663.844336][T31287] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8124'. [ 1663.853521][T22485] Bluetooth: hci2: command 0x0c1a tx timeout [ 1664.175608][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1664.182323][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1664.188975][T26337] Bluetooth: hci5: command 0x0c1a tx timeout [ 1664.244588][T31293] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8130'. [ 1664.244955][T31294] fuse: Bad value for 'fd' [ 1664.496289][ T30] audit: type=1800 audit(1762595910.131:933): pid=31297 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8129" name="file1" dev="tmpfs" ino=2599 res=0 errno=0 [ 1665.053140][T31308] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8134'. [ 1665.063154][T31308] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8134'. [ 1665.149180][T31310] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8135'. [ 1665.691908][T31283] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1665.701793][T22485] Bluetooth: hci0: command 0x0406 tx timeout [ 1666.251755][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1666.401417][T31283] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1666.408547][T31283] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1666.415508][T31283] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1666.421915][T31283] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1666.431092][T27632] usb 5-1: USB disconnect, device number 84 [ 1666.786754][T31328] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8142'. [ 1666.797739][T31321] syzkaller0: entered promiscuous mode [ 1666.803435][T31321] syzkaller0: entered allmulticast mode [ 1667.011871][ T24] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1667.163314][ T24] usb 4-1: device descriptor read/64, error -71 [ 1667.189818][T31345] syzkaller0: entered promiscuous mode [ 1667.195841][T31345] syzkaller0: entered allmulticast mode [ 1667.205860][ T30] audit: type=1804 audit(1762595912.851:934): pid=31341 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.8148" name="/newroot/385/file1" dev="fuse" ino=1 res=1 errno=0 [ 1667.641667][ T24] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1667.781666][ T24] usb 4-1: device descriptor read/64, error -71 [ 1667.792161][T26330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1667.916964][ T24] usb usb4-port1: attempt power cycle [ 1668.171921][T27633] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1668.351664][T27633] usb 5-1: Using ep0 maxpacket: 16 [ 1668.366728][T27633] usb 5-1: config 0 has no interfaces? [ 1668.385499][T27633] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1668.394936][T27633] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1668.403115][T27633] usb 5-1: Manufacturer: syz [ 1668.421663][ T24] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1668.421973][T22485] Bluetooth: hci5: command 0x0c1a tx timeout [ 1668.446264][T27633] usb 5-1: config 0 descriptor?? [ 1668.493000][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1668.499213][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1668.502617][ T24] usb 4-1: device descriptor read/8, error -71 [ 1668.781671][ T24] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1668.801875][T31367] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1668.818553][ T24] usb 4-1: device descriptor read/8, error -71 [ 1668.837433][T31366] __nla_validate_parse: 1 callbacks suppressed [ 1668.837448][T31366] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8153'. [ 1668.857059][T31367] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8150'. [ 1668.933454][ T24] usb usb4-port1: unable to enumerate USB device [ 1669.295484][T31374] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8155'. [ 1670.491916][T22485] Bluetooth: hci0: command 0x0406 tx timeout [ 1670.500467][T31362] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1670.571712][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1671.162731][T31362] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1671.170262][T31362] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1671.177384][T31362] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1671.183895][T31362] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1671.203060][T27633] usb 5-1: USB disconnect, device number 85 [ 1671.477540][T31393] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8161'. [ 1671.585204][T31398] syzkaller0: entered promiscuous mode [ 1671.590814][T31398] syzkaller0: entered allmulticast mode [ 1671.640761][T31402] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8163'. [ 1671.650595][T31402] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8163'. [ 1671.763776][T31403] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8164'. [ 1671.936742][T31408] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8166'. [ 1672.035141][T31410] tipc: Enabling of bearer rejected, already enabled [ 1672.111475][T31413] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8168'. [ 1672.128555][T31413] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8168'. [ 1672.164025][T31414] syzkaller0: entered promiscuous mode [ 1672.199968][T31414] syzkaller0: entered allmulticast mode [ 1672.637843][T26330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1673.022321][ T5925] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1673.211816][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1673.218009][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1673.218050][T22485] Bluetooth: hci5: command 0x0c1a tx timeout [ 1673.281778][ T5925] usb 5-1: Using ep0 maxpacket: 16 [ 1673.291866][ T5925] usb 5-1: config 0 has no interfaces? [ 1673.302649][ T5925] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1673.312144][ T5925] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1673.320206][ T5925] usb 5-1: Manufacturer: syz [ 1673.336628][ T5925] usb 5-1: config 0 descriptor?? [ 1673.514971][T31442] QAT: failed to copy from user. [ 1674.148283][T31444] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1674.199572][T31446] __nla_validate_parse: 2 callbacks suppressed [ 1674.199590][T31446] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8178'. [ 1674.219954][T31447] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8172'. [ 1674.260512][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1674.266993][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1674.891769][T31428] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1674.898909][T26337] Bluetooth: hci0: command 0x0406 tx timeout [ 1674.929911][T31453] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8180'. [ 1675.292501][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1675.569046][T31457] tipc: Enabling of bearer rejected, failed to enable media [ 1675.598733][T31428] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1675.605443][T31428] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1675.612129][T31428] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1675.618257][T31428] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1675.638517][T27620] usb 5-1: USB disconnect, device number 86 [ 1675.894130][T31463] QAT: failed to copy from user. [ 1675.989309][T31469] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8187'. [ 1675.990035][T31466] syzkaller0: entered promiscuous mode [ 1675.990060][T31466] syzkaller0: entered allmulticast mode [ 1676.927599][T27633] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1676.978913][T26330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1677.181595][T27633] usb 3-1: Using ep0 maxpacket: 16 [ 1677.240007][T27633] usb 3-1: config 0 has no interfaces? [ 1677.288072][T27633] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1677.604684][T27633] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1677.622187][T26330] Bluetooth: hci5: command 0x0c1a tx timeout [ 1677.696603][T26330] Bluetooth: hci3: command 0x0405 tx timeout [ 1677.702939][T26330] Bluetooth: hci1: command 0x0405 tx timeout [ 1677.711662][T27633] usb 3-1: Manufacturer: syz [ 1677.806095][T27633] usb 3-1: config 0 descriptor?? [ 1678.236843][T31500] QAT: failed to copy from user. [ 1678.260334][T31482] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1678.417668][T31503] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8189'. [ 1678.842028][T31482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.877131][T31482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.920139][T31506] syzkaller0: entered promiscuous mode [ 1678.929311][T31506] syzkaller0: entered allmulticast mode [ 1679.145722][T31508] syzkaller0: entered promiscuous mode [ 1679.161296][T31508] syzkaller0: entered allmulticast mode [ 1679.222561][T31510] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8195'. [ 1679.236669][T31510] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8195'. [ 1679.354527][T31508] tipc: Enabled bearer , priority 0 [ 1679.408101][T31507] tipc: Resetting bearer [ 1679.454518][T31507] tipc: Disabling bearer [ 1679.694554][T31524] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8200'. [ 1679.725645][T31524] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8200'. [ 1679.834659][T27633] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1679.971641][T27632] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1680.013394][T27633] usb 2-1: Using ep0 maxpacket: 16 [ 1680.111591][T27620] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1680.134191][T27633] usb 2-1: config 0 has no interfaces? [ 1680.192116][T27633] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1680.218305][T27632] usb 5-1: Using ep0 maxpacket: 16 [ 1680.288283][T27633] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1680.292399][T27620] usb 4-1: no configurations [ 1680.313837][T27620] usb 4-1: can't read configurations, error -22 [ 1680.331194][T27632] usb 5-1: config 0 has no interfaces? [ 1680.337361][T27633] usb 2-1: Manufacturer: syz [ 1680.392321][T25148] usb 3-1: USB disconnect, device number 92 [ 1680.412019][T27632] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1680.428823][T27633] usb 2-1: config 0 descriptor?? [ 1680.440106][T27632] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1680.450296][T27632] usb 5-1: Manufacturer: syz [ 1680.452519][T27620] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1680.512712][T27632] usb 5-1: config 0 descriptor?? [ 1680.622749][T27620] usb 4-1: no configurations [ 1680.627649][T27620] usb 4-1: can't read configurations, error -22 [ 1680.638140][T27620] usb usb4-port1: attempt power cycle [ 1680.725763][T31518] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1680.752439][T31518] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8196'. [ 1680.771364][T31518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1680.792376][T31518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1680.927927][T31522] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1680.973912][T31522] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8198'. [ 1681.021762][T27620] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1681.037538][T31522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1681.048908][T31522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1681.053694][T27620] usb 4-1: no configurations [ 1681.062094][T27620] usb 4-1: can't read configurations, error -22 [ 1681.306916][T27620] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1681.344091][T27620] usb 4-1: no configurations [ 1681.349052][T27620] usb 4-1: can't read configurations, error -22 [ 1681.357557][T27620] usb usb4-port1: unable to enumerate USB device [ 1682.166564][T31537] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8205'. [ 1682.592648][T27620] usb 5-1: USB disconnect, device number 87 [ 1682.776314][T31546] netlink: 60 bytes leftover after parsing attributes in process `syz.4.8208'. [ 1682.815165][T31546] netlink: 60 bytes leftover after parsing attributes in process `syz.4.8208'. [ 1683.069191][T27620] usb 2-1: USB disconnect, device number 88 [ 1683.142289][T31550] QAT: failed to copy from user. [ 1683.337609][T31552] syzkaller0: entered promiscuous mode [ 1683.337636][T31552] syzkaller0: entered allmulticast mode [ 1683.460414][T31552] tipc: Enabled bearer , priority 0 [ 1683.471824][T31551] tipc: Resetting bearer [ 1683.535546][T31557] QAT: failed to copy from user. [ 1683.625520][T31551] tipc: Disabling bearer [ 1684.642964][T31563] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8212'. [ 1685.227950][T31567] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1685.244041][T31567] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8214'. [ 1685.479430][T31574] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8215'. [ 1685.632154][T31571] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8216'. [ 1685.797172][T31574] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8215'. [ 1686.041972][T31574] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8215'. [ 1686.527218][T27632] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1686.534918][T27633] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1686.723370][T27632] usb 4-1: Using ep0 maxpacket: 16 [ 1686.729828][T27633] usb 5-1: no configurations [ 1686.734826][T27633] usb 5-1: can't read configurations, error -22 [ 1686.752551][T27632] usb 4-1: config 0 has no interfaces? [ 1686.843212][T27632] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1686.862269][T27632] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1686.892577][T27632] usb 4-1: Manufacturer: syz [ 1686.901885][T27633] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1686.973939][T27632] usb 4-1: config 0 descriptor?? [ 1687.081838][ T5925] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1687.085666][T27633] usb 5-1: no configurations [ 1687.104536][T27633] usb 5-1: can't read configurations, error -22 [ 1687.155680][T27633] usb usb5-port1: attempt power cycle [ 1687.221372][T31589] erspan0: entered promiscuous mode [ 1687.261896][ T5925] usb 2-1: Using ep0 maxpacket: 16 [ 1687.309676][ T5925] usb 2-1: config 0 has no interfaces? [ 1687.343219][ T5925] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1687.361702][ T5925] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1687.391703][ T5925] usb 2-1: Manufacturer: syz [ 1687.458718][ T5925] usb 2-1: config 0 descriptor?? [ 1687.472120][T31594] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8219'. [ 1687.481938][T31589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1687.490871][T31589] 8021q: adding VLAN 0 to HW filter on device team0 [ 1687.523057][T27633] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1687.573208][T27633] usb 5-1: no configurations [ 1687.586256][T27633] usb 5-1: can't read configurations, error -22 [ 1687.680685][T31589] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1687.746320][T27633] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1687.755328][T31593] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1688.046005][T27633] usb 5-1: no configurations [ 1688.051174][T27633] usb 5-1: can't read configurations, error -22 [ 1688.058420][T27633] usb usb5-port1: unable to enumerate USB device [ 1688.121377][T31593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1688.182094][T31593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1688.236485][T31586] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1688.251371][T31586] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1689.163318][T31529] Set syz1 is full, maxelem 65536 reached [ 1689.394427][T31613] syzkaller0: entered promiscuous mode [ 1689.408408][T31613] syzkaller0: entered allmulticast mode [ 1689.411886][ T24] usb 4-1: USB disconnect, device number 96 [ 1689.743461][T31619] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8229'. [ 1689.754032][T31620] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8229'. [ 1690.083251][T31624] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8231'. [ 1690.097538][T31622] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8230'. [ 1690.206889][T27633] usb 2-1: USB disconnect, device number 89 [ 1690.688515][T31632] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8234'. [ 1692.186110][T31658] syzkaller0: entered promiscuous mode [ 1692.201684][T31658] syzkaller0: entered allmulticast mode [ 1692.331940][ T30] audit: type=1804 audit(1762595937.971:935): pid=31656 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.8241" name="/newroot/523/file1" dev="fuse" ino=1 res=1 errno=0 [ 1692.574409][T31668] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8246'. [ 1692.636861][T31671] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8244'. [ 1693.998215][T31688] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8262'. [ 1694.027273][T31688] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8262'. [ 1694.998492][T31705] netlink: 7048 bytes leftover after parsing attributes in process `syz.4.8258'. [ 1695.024394][T31705] openvswitch: netlink: Flow actions attr not present in new flow. [ 1695.068029][ T30] audit: type=1804 audit(1762595940.711:936): pid=31704 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.8256" name="/newroot/383/file1" dev="fuse" ino=1 res=1 errno=0 [ 1695.233481][T31711] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8259'. [ 1695.940328][T31725] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8265'. [ 1695.980620][ T24] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1696.180828][ T24] usb 5-1: no configurations [ 1696.191885][ T24] usb 5-1: can't read configurations, error -22 [ 1696.210280][T31731] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8266'. [ 1696.758947][T31734] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8266'. [ 1696.792300][ T24] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1696.996799][ T24] usb 5-1: no configurations [ 1697.005817][ T24] usb 5-1: can't read configurations, error -22 [ 1697.039910][T31736] syzkaller0: entered promiscuous mode [ 1697.042748][ T24] usb usb5-port1: attempt power cycle [ 1697.072197][T31736] syzkaller0: entered allmulticast mode [ 1697.247764][T31741] QAT: failed to copy from user. [ 1697.508808][ T24] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1697.613977][ T24] usb 5-1: no configurations [ 1697.619466][ T24] usb 5-1: can't read configurations, error -22 [ 1697.752147][ T24] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1697.762126][T31746] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8270'. [ 1697.802264][ T24] usb 5-1: no configurations [ 1697.808602][ T24] usb 5-1: can't read configurations, error -22 [ 1697.821024][ T24] usb usb5-port1: unable to enumerate USB device [ 1698.548192][ T30] audit: type=1804 audit(1762595944.191:937): pid=31759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.8273" name="/newroot/531/file1" dev="fuse" ino=1 res=1 errno=0 [ 1699.256943][T31774] QAT: failed to copy from user. [ 1700.618492][T31788] syzkaller0: entered promiscuous mode [ 1700.711658][T31788] syzkaller0: entered allmulticast mode [ 1701.577843][ T30] audit: type=1804 audit(1762595947.221:938): pid=31801 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.8284" name="/newroot/458/file1" dev="fuse" ino=1 res=1 errno=0 [ 1701.764697][T31806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8286'. [ 1702.067607][T31812] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8288'. [ 1702.118402][T31807] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8285'. [ 1702.341752][T25148] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1702.365509][T31819] syzkaller0: entered promiscuous mode [ 1702.371628][T31819] syzkaller0: entered allmulticast mode [ 1702.411988][ T24] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1702.513044][T25148] usb 2-1: Using ep0 maxpacket: 16 [ 1702.547907][T25148] usb 2-1: config 0 has no interfaces? [ 1702.565812][T25148] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1702.574924][ T24] usb 4-1: no configurations [ 1702.585426][ T24] usb 4-1: can't read configurations, error -22 [ 1702.602087][T31821] QAT: failed to copy from user. [ 1702.607222][T25148] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1702.627588][T25148] usb 2-1: Manufacturer: syz [ 1702.649080][T25148] usb 2-1: config 0 descriptor?? [ 1702.751890][ T24] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1702.847755][T31828] syzkaller0: entered promiscuous mode [ 1702.853696][T31828] syzkaller0: entered allmulticast mode [ 1702.879986][T31813] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1702.914068][ T24] usb 4-1: no configurations [ 1702.918803][ T24] usb 4-1: can't read configurations, error -22 [ 1702.933620][T31813] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8287'. [ 1702.943530][ T24] usb usb4-port1: attempt power cycle [ 1702.960474][T31813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1702.996610][T31813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1703.088937][T31836] QAT: failed to copy from user. [ 1703.291964][ T24] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1703.324368][ T24] usb 4-1: no configurations [ 1703.329051][ T24] usb 4-1: can't read configurations, error -22 [ 1703.484393][ T24] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1703.559084][ T24] usb 4-1: no configurations [ 1703.591710][ T24] usb 4-1: can't read configurations, error -22 [ 1703.653860][ T24] usb usb4-port1: unable to enumerate USB device [ 1704.059113][T31844] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8298'. [ 1704.181175][T31846] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8300'. [ 1704.229230][T31848] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8299'. [ 1704.239149][T31848] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8299'. [ 1704.511000][T31852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8302'. [ 1705.123000][T27620] usb 2-1: USB disconnect, device number 90 [ 1705.679978][T31865] QAT: failed to copy from user. [ 1705.695541][T26330] Bluetooth: hci3: command 0x0405 tx timeout [ 1706.055606][ T30] audit: type=1804 audit(1762595951.701:939): pid=31872 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.8309" name="/newroot/541/file1" dev="fuse" ino=1 res=1 errno=0 [ 1706.118300][T31877] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8310'. [ 1706.498921][T31883] QAT: failed to copy from user. [ 1707.218425][T31896] QAT: failed to copy from user. [ 1709.029386][T31914] __nla_validate_parse: 1 callbacks suppressed [ 1709.029402][T31914] netlink: 60 bytes leftover after parsing attributes in process `syz.5.8321'. [ 1709.053461][T26337] Bluetooth: hci0: command 0x0406 tx timeout [ 1709.060017][T31893] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1709.068381][T31914] netlink: 60 bytes leftover after parsing attributes in process `syz.5.8321'. [ 1710.646140][T31893] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1710.652992][T31893] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1710.659162][T31893] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1710.665717][T31893] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1710.844476][T31922] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8326'. [ 1710.849324][T31926] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8324'. [ 1710.861086][T31922] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8326'. [ 1710.933611][T27633] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1711.099120][T31935] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8337'. [ 1711.109704][T27633] usb 5-1: no configurations [ 1711.114967][T27633] usb 5-1: can't read configurations, error -22 [ 1711.131767][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1711.174079][T31934] fuse: Bad value for 'fd' [ 1711.200781][ T30] audit: type=1800 audit(1762595956.831:940): pid=31934 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8328" name="file1" dev="tmpfs" ino=2047 res=0 errno=0 [ 1711.252723][T27633] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1711.844783][T27633] usb 5-1: device descriptor read/all, error -71 [ 1711.917064][T27633] usb usb5-port1: attempt power cycle [ 1712.166752][T31951] QAT: failed to copy from user. [ 1712.302870][T27620] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1712.429511][T31956] QAT: failed to copy from user. [ 1712.453851][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1712.453896][T27620] usb 4-1: can't read configurations, error -61 [ 1712.504402][T31957] netlink: 40 bytes leftover after parsing attributes in process `syz.5.8332'. [ 1712.621710][T27620] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1712.731654][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1712.731708][T26337] Bluetooth: hci5: command 0x0c1a tx timeout [ 1712.741729][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1712.894669][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1712.903715][T27620] usb 4-1: can't read configurations, error -61 [ 1712.913732][T27620] usb usb4-port1: attempt power cycle [ 1713.088376][T31966] QAT: failed to copy from user. [ 1713.158099][T25148] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1713.269778][T27620] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1713.298798][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1713.309254][T27620] usb 4-1: can't read configurations, error -61 [ 1713.502263][T27620] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1713.524286][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1713.565696][T27620] usb 4-1: can't read configurations, error -61 [ 1713.595317][T27620] usb usb4-port1: unable to enumerate USB device [ 1713.641582][T25148] usb 6-1: Using ep0 maxpacket: 16 [ 1713.705417][T25148] usb 6-1: config 0 has no interfaces? [ 1713.741146][T25148] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1713.751012][T25148] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1713.763240][T25148] usb 6-1: Manufacturer: syz [ 1713.818320][T25148] usb 6-1: config 0 descriptor?? [ 1713.919843][T31969] syzkaller0: entered promiscuous mode [ 1713.928696][T31969] syzkaller0: entered allmulticast mode [ 1714.271082][T31962] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1714.429094][T31962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1714.438089][T31962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1714.710334][T31982] QAT: failed to copy from user. [ 1715.486405][T31989] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8343'. [ 1715.830536][T27620] usb 6-1: USB disconnect, device number 103 [ 1716.125924][T31999] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8346'. [ 1717.941818][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1718.092568][T31996] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1718.099077][T26337] Bluetooth: hci0: command 0x0406 tx timeout [ 1718.187246][T32021] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8351'. [ 1718.196628][T32021] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8351'. [ 1718.436417][T32026] fuse: Bad value for 'fd' [ 1719.011082][T31996] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1719.098262][T31996] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1719.118261][T31996] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1719.128585][T31996] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1719.473665][T32043] QAT: failed to copy from user. [ 1719.622102][T25148] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1719.807818][T25148] usb 3-1: device descriptor read/64, error -71 [ 1720.052359][T25148] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1720.171715][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1720.479607][T25148] usb 3-1: device descriptor read/64, error -71 [ 1720.612164][T25148] usb usb3-port1: attempt power cycle [ 1720.839047][T32053] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1720.961593][T25148] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1720.978420][T32057] netlink: 40 bytes leftover after parsing attributes in process `syz.5.8359'. [ 1721.005641][T32056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8360'. [ 1721.044404][T25148] usb 3-1: device descriptor read/8, error -71 [ 1721.142165][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1721.148356][T26330] Bluetooth: hci1: command 0x0405 tx timeout [ 1721.148416][T31292] Bluetooth: hci5: command 0x0c1a tx timeout [ 1721.303220][T25148] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1721.346067][T25148] usb 3-1: device descriptor read/8, error -71 [ 1721.463048][T25148] usb usb3-port1: unable to enumerate USB device [ 1721.511349][T32065] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8363'. [ 1721.538709][T32065] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8363'. [ 1721.719006][T32072] syzkaller0: entered promiscuous mode [ 1721.728557][T32072] syzkaller0: entered allmulticast mode [ 1721.845132][T32075] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8364'. [ 1721.859515][T32075] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8364'. [ 1722.431170][T32077] fuse: Bad value for 'fd' [ 1722.483984][ T30] audit: type=1800 audit(1762595968.131:941): pid=32077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.8367" name="file1" dev="tmpfs" ino=2448 res=0 errno=0 [ 1722.724207][ T24] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1722.855042][T32085] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8370'. [ 1722.927036][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 1722.963392][ T24] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 1722.985474][ T24] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1722.995995][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.102344][ T24] usb 6-1: Product: syz [ 1723.106925][ T24] usb 6-1: Manufacturer: syz [ 1723.112190][ T24] usb 6-1: SerialNumber: syz [ 1723.151678][ T30] audit: type=1804 audit(1762595968.751:942): pid=32089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.8372" name="/newroot/423/file1" dev="fuse" ino=1 res=1 errno=0 [ 1723.188621][ T24] usb 6-1: config 0 descriptor?? [ 1723.214167][ T24] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1723.246972][ T24] usb 6-1: setting power ON [ 1723.263906][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 1723.313621][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1723.333606][ T24] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1723.351609][ T24] usb 6-1: media controller created [ 1723.419113][T32079] dvb-usb: bulk message failed: -22 (3/0) [ 1723.501834][T32079] dvb-usb: bulk message failed: -22 (4/0) [ 1723.520428][T32079] cxusb: i2c read failed [ 1723.525764][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1724.078641][ T24] usb 6-1: selecting invalid altsetting 6 [ 1724.094144][ T24] usb 6-1: digital interface selection failed (-22) [ 1724.105011][ T24] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1724.133361][ T24] usb 6-1: setting power OFF [ 1724.139748][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 1724.155782][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1724.549364][ T24] (NULL device *): no alternate interface [ 1724.698147][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1724.799884][ T24] usb 6-1: USB disconnect, device number 104 [ 1724.915833][T32123] fuse: Bad value for 'fd' [ 1725.211799][T26337] Bluetooth: hci3: command 0x0405 tx timeout [ 1725.291612][T26337] Bluetooth: hci0: command 0x0406 tx timeout [ 1725.364426][T32095] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1726.813712][T32095] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1726.820311][T32095] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1726.827054][T32095] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1726.833750][T32095] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1727.055865][T32136] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8385'. [ 1727.094720][T32139] syzkaller0: entered promiscuous mode [ 1727.100457][T32139] syzkaller0: entered allmulticast mode [ 1727.141800][T27620] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1727.205850][T32140] syzkaller0: entered promiscuous mode [ 1727.212747][T32140] syzkaller0: entered allmulticast mode [ 1727.220438][T32142] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8387'. [ 1727.291700][T27620] usb 3-1: device descriptor read/64, error -71 [ 1727.535583][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1727.573465][T27620] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1727.656186][ T30] audit: type=1804 audit(1762595973.301:943): pid=32150 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.8389" name="/newroot/314/file1" dev="fuse" ino=1 res=1 errno=0 [ 1727.861774][T27620] usb 3-1: device descriptor read/64, error -71 [ 1728.033598][T27620] usb usb3-port1: attempt power cycle [ 1728.521784][T27620] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1728.550868][T27620] usb 3-1: device descriptor read/8, error -71 [ 1728.811106][T32164] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8392'. [ 1728.830559][T32164] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8392'. [ 1728.941342][T27620] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1728.949574][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1728.960940][T31292] Bluetooth: hci1: command 0x0405 tx timeout [ 1728.967143][T26337] Bluetooth: hci5: command 0x0c1a tx timeout [ 1728.992417][T27620] usb 3-1: device descriptor read/8, error -71 [ 1729.104090][T27620] usb usb3-port1: unable to enumerate USB device [ 1729.397424][T32174] fuse: Bad value for 'fd' [ 1730.491777][T32161] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1730.499785][T26330] Bluetooth: hci0: command 0x0406 tx timeout [ 1731.062673][T26330] Bluetooth: hci3: command 0x0405 tx timeout [ 1731.556670][T32161] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1731.563471][T32161] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1731.569993][T32161] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1731.576743][T32161] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1731.767726][T32192] netlink: 40 bytes leftover after parsing attributes in process `syz.5.8399'. [ 1731.928620][T32198] syzkaller0: entered promiscuous mode [ 1731.935450][T32198] syzkaller0: entered allmulticast mode [ 1731.975785][T32199] syzkaller0: entered promiscuous mode [ 1731.982005][T32199] syzkaller0: entered allmulticast mode [ 1732.582825][T31292] Bluetooth: hci2: command 0x0c1a tx timeout [ 1732.586516][T32207] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8405'. [ 1732.615213][T32207] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8405'. [ 1733.615340][T31292] Bluetooth: hci5: command 0x0c1a tx timeout [ 1733.623143][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1733.629303][T31292] Bluetooth: hci1: command 0x0405 tx timeout [ 1733.721747][ T5925] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1733.871811][ T5925] usb 2-1: device descriptor read/64, error -71 [ 1734.004266][T32224] syzkaller0: entered promiscuous mode [ 1734.025936][T32224] syzkaller0: entered allmulticast mode [ 1734.281658][ T5925] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1734.570954][ T5925] usb 2-1: device descriptor read/64, error -71 [ 1734.811775][ T5925] usb usb2-port1: attempt power cycle [ 1735.301637][ T5925] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1735.604052][ T5925] usb 2-1: device descriptor read/8, error -71 [ 1735.695422][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1735.702140][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1735.907075][T32234] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8412'. [ 1735.948739][ T5925] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1736.241609][ T5925] usb 2-1: device not accepting address 94, error -71 [ 1736.255929][ T5925] usb usb2-port1: unable to enumerate USB device [ 1736.293802][T32243] syzkaller0: entered promiscuous mode [ 1736.299393][T32243] syzkaller0: entered allmulticast mode [ 1736.471456][T25148] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1736.641610][T25148] usb 4-1: Using ep0 maxpacket: 8 [ 1736.712094][T25148] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 1736.759006][T25148] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1736.781838][T32252] @: renamed from vlan0 [ 1736.796403][T25148] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1736.905364][T25148] usb 4-1: Product: syz [ 1736.979274][T25148] usb 4-1: Manufacturer: syz [ 1736.999192][T25148] usb 4-1: SerialNumber: syz [ 1737.262675][T25148] usb 4-1: config 0 descriptor?? [ 1737.349772][T25148] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1737.366610][T25148] usb 4-1: setting power ON [ 1737.371193][T25148] dvb-usb: bulk message failed: -22 (2/0) [ 1737.399042][T32262] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8418'. [ 1737.533257][T32262] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8418'. [ 1737.618197][T25148] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1737.639396][T25148] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1737.661189][T25148] usb 4-1: media controller created [ 1737.718308][T25148] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1737.786190][T25148] usb 4-1: selecting invalid altsetting 6 [ 1737.792488][T25148] usb 4-1: digital interface selection failed (-22) [ 1737.801160][T25148] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1737.829157][T25148] usb 4-1: setting power OFF [ 1737.837479][T25148] dvb-usb: bulk message failed: -22 (2/0) [ 1737.845440][T25148] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1737.855646][T25148] (NULL device *): no alternate interface [ 1737.962421][T25148] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1737.984342][T25148] usb 4-1: USB disconnect, device number 105 [ 1738.651613][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1739.051801][T32253] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1739.058173][T26330] Bluetooth: hci0: command 0x0406 tx timeout [ 1739.312693][T32253] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1739.321918][T32253] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1739.373419][T32253] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1739.401900][T32253] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1739.723921][T32277] syzkaller0: entered promiscuous mode [ 1739.739951][T32277] syzkaller0: entered allmulticast mode [ 1739.764178][T32282] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8421'. [ 1739.781393][T32282] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8421'. [ 1741.140433][T26330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1741.149594][T32294] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8425'. [ 1741.371800][T26330] Bluetooth: hci5: command 0x0c1a tx timeout [ 1741.451631][T26330] Bluetooth: hci3: command 0x0405 tx timeout [ 1741.457694][T26330] Bluetooth: hci1: command 0x0405 tx timeout [ 1741.484339][T32296] syzkaller0: entered promiscuous mode [ 1741.502885][T32296] syzkaller0: entered allmulticast mode [ 1742.079375][ T30] audit: type=1804 audit(1762595987.701:944): pid=32315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.8430" name="/newroot/437/file1" dev="fuse" ino=1 res=1 errno=0 [ 1744.491651][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1744.859717][T32308] syzkaller0: entered promiscuous mode [ 1744.865762][T32308] syzkaller0: entered allmulticast mode [ 1745.254290][T32326] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1745.560302][T32326] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1745.586505][T32326] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1745.593269][T32326] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1745.599670][T32326] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1746.925918][T32353] syzkaller0: entered promiscuous mode [ 1746.931454][T32353] syzkaller0: entered allmulticast mode [ 1747.058220][T26330] Bluetooth: hci0: command 0x0406 tx timeout [ 1747.490848][T32364] syzkaller0: entered promiscuous mode [ 1747.501319][T32366] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8441'. [ 1747.511140][T32364] syzkaller0: entered allmulticast mode [ 1747.530395][T32363] syzkaller0: entered promiscuous mode [ 1747.571637][T32363] syzkaller0: entered allmulticast mode [ 1747.612109][T26330] Bluetooth: hci3: command 0x0405 tx timeout [ 1747.618446][T26330] Bluetooth: hci1: command 0x0405 tx timeout [ 1747.621617][T31292] Bluetooth: hci5: command 0x0c1a tx timeout [ 1747.630615][T31292] Bluetooth: hci2: command 0x0c1a tx timeout [ 1747.769065][T32373] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8442'. [ 1747.783655][T32373] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8442'. [ 1747.938180][T32374] syzkaller0: entered promiscuous mode [ 1747.965172][T32374] syzkaller0: entered allmulticast mode [ 1748.204494][T32378] netlink: 'syz.4.8444': attribute type 2 has an invalid length. [ 1748.835562][T32396] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8447'. [ 1750.576666][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1751.299158][T32386] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1751.313763][T32386] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1751.331956][T32386] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1751.338893][T32386] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1751.345556][T32386] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1752.192510][T32424] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8455'. [ 1752.203755][T32424] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8455'. [ 1752.973973][T31292] Bluetooth: hci0: command 0x0406 tx timeout [ 1753.393559][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1753.411895][T31292] Bluetooth: hci5: command 0x0c1a tx timeout [ 1753.417988][T31292] Bluetooth: hci1: command 0x0405 tx timeout [ 1753.421741][T22485] Bluetooth: hci2: command 0x0c1a tx timeout [ 1753.835122][T32435] netlink: 'syz.2.8458': attribute type 2 has an invalid length. [ 1754.282689][T32444] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8460'. [ 1754.293138][T32444] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8460'. [ 1754.892303][T32453] syzkaller0: entered promiscuous mode [ 1754.898053][T32453] syzkaller0: entered allmulticast mode [ 1754.913448][T32446] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8461'. [ 1755.478351][T32457] syzkaller0: entered promiscuous mode [ 1755.510076][T32457] syzkaller0: entered allmulticast mode [ 1755.769197][T32464] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8467'. [ 1755.788096][T32464] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8467'. [ 1756.223463][ T30] audit: type=1804 audit(1762596001.861:945): pid=32467 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.8469" name="/newroot/494/file1" dev="fuse" ino=1 res=1 errno=0 [ 1756.648785][T32472] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8470'. [ 1757.784213][T32483] syzkaller0: entered promiscuous mode [ 1757.789739][T32483] syzkaller0: entered allmulticast mode [ 1759.381031][T32508] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8476'. [ 1759.447111][T32510] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8479'. [ 1759.468122][T32510] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8479'. [ 1760.280467][T32520] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8482'. [ 1761.772929][T32500] syzkaller0: entered promiscuous mode [ 1761.778545][T32500] syzkaller0: entered allmulticast mode [ 1761.794680][T32515] syzkaller0: entered promiscuous mode [ 1761.801930][T32515] syzkaller0: entered allmulticast mode [ 1761.820284][T32524] @: renamed from vlan0 (while UP) [ 1765.607680][T32569] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8493'. [ 1765.950530][T32575] syzkaller0: entered promiscuous mode [ 1765.967356][T32575] syzkaller0: entered allmulticast mode [ 1765.980710][ T30] audit: type=1804 audit(1762596011.621:946): pid=32571 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.8494" name="/newroot/339/file1" dev="fuse" ino=1 res=1 errno=0 [ 1766.029420][T32574] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8495'. [ 1766.217098][T32580] syzkaller0: entered promiscuous mode [ 1766.227579][T32580] syzkaller0: entered allmulticast mode [ 1766.356084][T32584] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1766.367617][T32584] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8499'. [ 1769.684540][T32615] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8506'. [ 1770.096984][T32619] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8508'. [ 1770.126394][T32621] syzkaller0: entered promiscuous mode [ 1770.141710][T32621] syzkaller0: entered allmulticast mode [ 1770.189988][T32624] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8510'. [ 1770.948018][T32647] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8517'. [ 1772.266272][T32660] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8528'. [ 1772.276025][T32660] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8528'. [ 1773.564172][T32676] syzkaller0: entered promiscuous mode [ 1773.569960][T32676] syzkaller0: entered allmulticast mode [ 1773.893498][T32676] tipc: Enabled bearer , priority 0 [ 1774.022336][T32675] tipc: Resetting bearer [ 1774.108817][T32675] tipc: Disabling bearer [ 1774.477184][T32688] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8525'. [ 1774.543664][T32693] syzkaller0: entered promiscuous mode [ 1774.576803][T32693] syzkaller0: entered allmulticast mode [ 1774.855279][ T30] audit: type=1804 audit(1762596020.501:947): pid=32698 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.8530" name="/newroot/460/file1" dev="fuse" ino=1 res=1 errno=0 [ 1775.850058][T32716] fuse: Bad value for 'fd' [ 1775.988486][T32722] QAT: failed to copy from user. [ 1776.136991][T32710] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1776.137240][T32710] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1776.137432][T32710] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1776.137705][T32710] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1776.159488][ T30] audit: type=1800 audit(1762596021.621:948): pid=32721 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8543" name="file1" dev="tmpfs" ino=2401 res=0 errno=0 [ 1776.162844][T32710] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1776.942966][T32725] syzkaller0: entered promiscuous mode [ 1776.962046][T32725] syzkaller0: entered allmulticast mode [ 1777.881602][T31292] Bluetooth: hci0: command 0x0406 tx timeout [ 1778.171605][T31292] Bluetooth: hci1: command 0x0405 tx timeout [ 1778.171864][T26330] Bluetooth: hci5: command 0x0c1a tx timeout [ 1778.177815][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1778.247764][ T24] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1778.261658][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1778.403913][ T24] usb 6-1: config 0 has no interfaces? [ 1778.409623][ T24] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1778.419916][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1778.457956][ T24] usb 6-1: config 0 descriptor?? [ 1778.682974][ T24] usb 6-1: USB disconnect, device number 105 [ 1778.779379][T32747] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8540'. [ 1780.338323][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1781.307238][ T305] syzkaller0: entered promiscuous mode [ 1781.314141][ T305] syzkaller0: entered allmulticast mode [ 1781.776337][ T311] syzkaller0: entered promiscuous mode [ 1781.784258][ T311] syzkaller0: entered allmulticast mode [ 1782.422160][ T314] syzkaller0: entered promiscuous mode [ 1782.428098][ T314] syzkaller0: entered allmulticast mode [ 1782.446277][ T315] syzkaller0: entered promiscuous mode [ 1782.452277][ T315] syzkaller0: entered allmulticast mode [ 1782.547234][ T322] QAT: failed to copy from user. [ 1782.960179][ T333] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8555'. [ 1783.852020][ T24] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1784.062417][ T343] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8569'. [ 1784.091663][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 1784.100197][ T24] usb 5-1: no configurations [ 1784.111162][ T24] usb 5-1: can't read configurations, error -22 [ 1784.702438][ T24] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1785.061641][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 1785.161823][ T24] usb 5-1: no configurations [ 1785.166589][ T24] usb 5-1: can't read configurations, error -22 [ 1785.183025][ T24] usb usb5-port1: attempt power cycle [ 1785.551638][ T24] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1785.844668][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 1785.850657][ T24] usb 5-1: no configurations [ 1785.869610][ T24] usb 5-1: can't read configurations, error -22 [ 1786.651770][ T347] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1786.663618][T31292] Bluetooth: hci0: command 0x0406 tx timeout [ 1786.701899][ T364] tipc: Enabling of bearer rejected, failed to enable media [ 1786.942083][ T347] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1786.948494][ T347] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1786.955259][ T347] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1786.961917][ T347] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1787.980568][ T380] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8567'. [ 1788.137694][ T383] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8566'. [ 1788.420033][ T390] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8571'. [ 1788.761664][T22485] Bluetooth: hci2: command 0x0c1a tx timeout [ 1789.092959][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1789.099083][T22485] Bluetooth: hci1: command 0x0405 tx timeout [ 1789.105204][T31292] Bluetooth: hci5: command 0x0c1a tx timeout [ 1789.211760][T22485] Bluetooth: hci0: command 0x0406 tx timeout [ 1789.217895][ T372] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1790.251763][ T372] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1790.281289][ T372] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1790.336026][ T372] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1790.342847][ T372] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1790.644022][ T415] tipc: Enabling of bearer rejected, failed to enable media [ 1790.791665][ T24] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1790.842516][ T419] syzkaller0: entered promiscuous mode [ 1790.848056][ T419] syzkaller0: entered allmulticast mode [ 1790.973682][ T24] usb 3-1: config 0 has no interfaces? [ 1790.979292][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1791.023552][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1791.035019][ T24] usb 3-1: config 0 descriptor?? [ 1791.203937][ T425] syzkaller0: entered promiscuous mode [ 1791.216071][ T425] syzkaller0: entered allmulticast mode [ 1791.294822][T22485] Bluetooth: hci2: command 0x0c1a tx timeout [ 1791.343521][ T24] usb 3-1: USB disconnect, device number 101 [ 1791.449631][ T427] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8580'. [ 1791.478443][ T427] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8580'. [ 1791.558588][ T430] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8581'. [ 1791.998757][ T435] syzkaller0: entered promiscuous mode [ 1792.004670][ T435] syzkaller0: entered allmulticast mode [ 1792.121303][ T439] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8584'. [ 1792.331726][T22485] Bluetooth: hci5: command 0x0c1a tx timeout [ 1792.421673][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1792.428421][T22485] Bluetooth: hci3: command 0x0405 tx timeout [ 1793.711593][ T30] audit: type=1804 audit(1762596039.351:949): pid=463 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.8598" name="/newroot/355/file1" dev="fuse" ino=1 res=1 errno=0 [ 1795.562619][ T480] fuse: Bad value for 'fd' [ 1795.617015][ T483] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8593'. [ 1795.626746][ T483] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8593'. [ 1795.899979][ T487] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8594'. [ 1795.945249][ T491] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8596'. [ 1796.088604][ T491] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8596'. [ 1796.454883][ T30] audit: type=1804 audit(1762596042.101:950): pid=496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.8597" name="/newroot/592/file1" dev="fuse" ino=1 res=1 errno=0 [ 1797.187730][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1797.194199][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1797.376333][ T514] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8601'. [ 1797.401851][ T498] syzkaller0: entered promiscuous mode [ 1797.510699][ T498] syzkaller0: entered allmulticast mode [ 1798.090302][T27634] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1798.302659][T27634] usb 6-1: Using ep0 maxpacket: 16 [ 1798.315630][T27634] usb 6-1: no configurations [ 1798.320577][T27634] usb 6-1: can't read configurations, error -22 [ 1798.870641][T27634] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1799.052845][T27634] usb 6-1: Using ep0 maxpacket: 16 [ 1799.059568][T27634] usb 6-1: no configurations [ 1799.065817][T27634] usb 6-1: can't read configurations, error -22 [ 1799.087245][T27634] usb usb6-port1: attempt power cycle [ 1799.128810][ T535] syzkaller0: entered promiscuous mode [ 1799.138037][ T535] syzkaller0: entered allmulticast mode [ 1799.331592][T25148] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1799.456159][T27634] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1799.493013][T27634] usb 6-1: Using ep0 maxpacket: 16 [ 1799.509174][T27634] usb 6-1: no configurations [ 1799.516161][T27634] usb 6-1: can't read configurations, error -22 [ 1799.534538][ T539] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8608'. [ 1799.561951][ T539] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8608'. [ 1799.575304][T25148] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1799.595170][T25148] usb 4-1: can't read configurations, error -61 [ 1799.701714][T27634] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1799.753229][T27634] usb 6-1: Using ep0 maxpacket: 16 [ 1799.773435][T27634] usb 6-1: no configurations [ 1799.778119][T27634] usb 6-1: can't read configurations, error -22 [ 1799.791632][T25148] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 1799.812254][T27634] usb usb6-port1: unable to enumerate USB device [ 1799.938536][ T542] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8610'. [ 1799.955627][ T542] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8610'. [ 1799.975720][T25148] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1800.079323][T25148] usb 4-1: can't read configurations, error -61 [ 1800.151686][T25148] usb usb4-port1: attempt power cycle [ 1800.582305][T25148] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 1800.590521][ T30] audit: type=1804 audit(1762596046.231:951): pid=549 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.8612" name="/newroot/597/file1" dev="fuse" ino=1 res=1 errno=0 [ 1800.676148][T25148] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1800.684284][T25148] usb 4-1: can't read configurations, error -61 [ 1800.922008][T25148] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 1800.945169][T25148] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1800.953152][T25148] usb 4-1: can't read configurations, error -61 [ 1800.961183][T25148] usb usb4-port1: unable to enumerate USB device [ 1801.088040][ T557] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8613'. [ 1801.455435][ T562] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8626'. [ 1801.556433][ T567] QAT: failed to copy from user. [ 1802.188647][ T572] QAT: failed to copy from user. [ 1802.532176][T26337] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1802.560525][T26337] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1802.569730][T26337] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1802.612168][T26337] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1802.621884][T26337] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1802.659579][ T575] syzkaller0: entered promiscuous mode [ 1802.689032][ T575] syzkaller0: entered allmulticast mode [ 1802.825154][ T580] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8620'. [ 1802.835228][ T36] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1802.880170][ T580] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8620'. [ 1803.126057][ T36] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1803.367790][ T36] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1803.469125][ T591] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8624'. [ 1803.686607][ T36] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1804.097109][ T601] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8627'. [ 1804.206258][ T606] syzkaller0: entered promiscuous mode [ 1804.212101][ T606] syzkaller0: entered allmulticast mode [ 1804.338053][ T577] chnl_net:caif_netlink_parms(): no params data found [ 1804.655395][T26337] Bluetooth: hci4: command tx timeout [ 1805.485822][ T577] bridge0: port 1(bridge_slave_0) entered blocking state [ 1805.493921][ T577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1805.503099][ T577] bridge_slave_0: entered allmulticast mode [ 1805.512279][ T577] bridge_slave_0: entered promiscuous mode [ 1805.532190][ T36] bridge_slave_1: left allmulticast mode [ 1805.538440][ T36] bridge_slave_1: left promiscuous mode [ 1805.780026][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 1805.804833][ T36] bridge_slave_0: left allmulticast mode [ 1805.810878][ T36] bridge_slave_0: left promiscuous mode [ 1805.817846][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 1806.743729][T22485] Bluetooth: hci4: command tx timeout [ 1807.126607][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1807.138621][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1807.158416][ T36] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1807.169674][ T36] bond0 (unregistering): Released all slaves [ 1807.205592][ T577] bridge0: port 2(bridge_slave_1) entered blocking state [ 1807.214547][ T577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1807.224613][ T577] bridge_slave_1: entered allmulticast mode [ 1807.235188][ T577] bridge_slave_1: entered promiscuous mode [ 1807.470000][ T632] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8631'. [ 1807.492782][ T632] netlink: 104 bytes leftover after parsing attributes in process `syz.5.8631'. [ 1807.642234][ T36] tipc: Disabling bearer [ 1807.649631][ T36] tipc: Left network mode [ 1807.657549][ T577] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1807.764871][ T577] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1808.286687][ T626] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1808.293229][ T626] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1808.299696][ T626] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1808.311400][ T626] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1808.401735][ T626] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1808.409104][ T626] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1808.452911][ T641] netlink: 60 bytes leftover after parsing attributes in process `syz.5.8633'. [ 1808.515626][ T626] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1808.598137][ T577] team0: Port device team_slave_0 added [ 1808.651651][ T642] netlink: 60 bytes leftover after parsing attributes in process `syz.5.8633'. [ 1808.807740][ T577] team0: Port device team_slave_1 added [ 1809.139718][ T663] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8637'. [ 1809.204889][ T36] hsr_slave_0: left promiscuous mode [ 1809.272001][ T36] hsr_slave_1: left promiscuous mode [ 1809.278746][ T30] audit: type=1804 audit(1762596054.921:952): pid=659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.8636" name="/newroot/364/file1" dev="fuse" ino=1 res=1 errno=0 [ 1809.303113][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1809.453508][T26337] Bluetooth: hci2: command 0x0c1a tx timeout [ 1810.201566][ T5925] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 1810.331622][T26337] Bluetooth: hci1: command 0x0405 tx timeout [ 1810.331674][T31292] Bluetooth: hci5: command 0x0c1a tx timeout [ 1810.406458][ T5925] usb 4-1: config 0 has no interfaces? [ 1810.414533][ T5925] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1810.427033][T31292] Bluetooth: hci3: command 0x0405 tx timeout [ 1810.441800][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1810.506499][T31292] Bluetooth: hci4: command 0x040f tx timeout [ 1810.536856][ T5925] usb 4-1: config 0 descriptor?? [ 1810.970679][ T36] team0 (unregistering): Port device team_slave_1 removed [ 1811.111565][T25148] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1811.281584][T25148] usb 6-1: Using ep0 maxpacket: 16 [ 1811.303406][T25148] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1811.311351][T25148] usb 6-1: can't read configurations, error -61 [ 1811.441632][T25148] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1811.611577][T25148] usb 6-1: Using ep0 maxpacket: 16 [ 1811.639711][T25148] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1811.648674][T25148] usb 6-1: can't read configurations, error -61 [ 1811.655663][T25148] usb usb6-port1: attempt power cycle [ 1811.710085][ T577] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1811.717264][ T577] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1811.747297][ T577] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1811.844925][T27634] usb 4-1: USB disconnect, device number 110 [ 1811.862790][ T577] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1811.892541][ T577] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1811.925946][ T577] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1812.007164][T25148] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1812.032683][T25148] usb 6-1: Using ep0 maxpacket: 16 [ 1812.058681][T25148] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1812.176537][T25148] usb 6-1: can't read configurations, error -61 [ 1812.440486][ T577] hsr_slave_0: entered promiscuous mode [ 1812.473188][ T577] hsr_slave_1: entered promiscuous mode [ 1812.486563][ T577] debugfs: 'hsr0' already exists in 'hsr' [ 1812.499211][ T577] Cannot create hsr debugfs directory [ 1812.531633][T25148] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1812.570501][T25148] usb 6-1: Using ep0 maxpacket: 16 [ 1812.576236][T31292] Bluetooth: hci4: command 0x040f tx timeout [ 1812.596000][T25148] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1812.793580][T25148] usb 6-1: can't read configurations, error -61 [ 1812.917346][T25148] usb usb6-port1: unable to enumerate USB device [ 1814.221713][ T577] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1814.302834][ T577] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1814.320526][ T577] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1814.363587][ T577] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1814.525260][ T724] syzkaller0: entered promiscuous mode [ 1814.560192][ T724] syzkaller0: entered allmulticast mode [ 1814.821935][T31292] Bluetooth: hci4: command 0x040f tx timeout [ 1814.902538][ T733] syzkaller0: entered promiscuous mode [ 1814.908138][ T733] syzkaller0: entered allmulticast mode [ 1815.056020][ T577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1815.454146][ T577] 8021q: adding VLAN 0 to HW filter on device team0 [ 1815.514110][ T30] audit: type=1804 audit(1762596061.161:953): pid=737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.8649" name="/newroot/462/file1" dev="fuse" ino=1 res=1 errno=0 [ 1815.589524][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 1815.596825][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1815.672493][ T1005] bridge0: port 2(bridge_slave_1) entered blocking state [ 1815.679706][ T1005] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1816.149061][ T577] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1816.173547][ T753] syzkaller0: entered promiscuous mode [ 1816.179423][ T753] syzkaller0: entered allmulticast mode [ 1816.498217][ T577] veth0_vlan: entered promiscuous mode [ 1816.791743][ T577] veth1_vlan: entered promiscuous mode [ 1816.892033][ T765] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8653'. [ 1816.905323][T31292] Bluetooth: hci4: command 0x040f tx timeout [ 1817.095620][ T577] veth0_macvtap: entered promiscuous mode [ 1817.149557][ T577] veth1_macvtap: entered promiscuous mode [ 1817.187434][ T577] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1817.201043][ T577] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1817.216885][T17977] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1817.250357][T17977] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1817.301190][T17977] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1817.486432][T17977] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1817.662894][ T782] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8657'. [ 1817.727213][ T782] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8657'. [ 1817.791689][T27620] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 1817.943656][T27620] usb 4-1: Using ep0 maxpacket: 16 [ 1817.965654][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1817.995902][T27620] usb 4-1: can't read configurations, error -61 [ 1818.001689][ T3018] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1818.010223][ T3018] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1818.106465][ T788] syzkaller0: entered promiscuous mode [ 1818.126804][ T788] syzkaller0: entered allmulticast mode [ 1818.183367][T27620] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 1818.269083][ T3018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1818.280391][ T3018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1818.361642][T27620] usb 4-1: Using ep0 maxpacket: 16 [ 1818.438213][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1818.448006][T27620] usb 4-1: can't read configurations, error -61 [ 1818.501834][T27620] usb usb4-port1: attempt power cycle [ 1818.627711][ T794] syzkaller0: entered promiscuous mode [ 1818.719291][ T794] syzkaller0: entered allmulticast mode [ 1818.776559][ T801] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8661'. [ 1818.961180][T27620] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 1818.962361][ T798] syzkaller0: entered promiscuous mode [ 1818.994605][T31292] Bluetooth: hci4: command 0x040f tx timeout [ 1819.013109][ T798] syzkaller0: entered allmulticast mode [ 1819.089705][T27620] usb 4-1: Using ep0 maxpacket: 16 [ 1819.122326][ T810] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8661'. [ 1819.255492][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1819.303862][ T813] @: renamed from vlan0 (while UP) [ 1819.392689][T27620] usb 4-1: can't read configurations, error -61 [ 1819.552521][T27620] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 1819.571945][ T828] syzkaller0: entered promiscuous mode [ 1819.586719][ T828] syzkaller0: entered allmulticast mode [ 1819.618041][T27620] usb 4-1: Using ep0 maxpacket: 16 [ 1820.116640][T27620] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1820.260063][T27620] usb 4-1: can't read configurations, error -61 [ 1821.016756][T27620] usb usb4-port1: unable to enumerate USB device [ 1821.556660][ T843] QAT: failed to copy from user. [ 1822.303509][ T853] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8666'. [ 1822.510580][ T853] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8666'. [ 1824.637863][ T884] syzkaller0: entered promiscuous mode [ 1824.644352][ T884] syzkaller0: entered allmulticast mode [ 1825.008531][ T895] syzkaller0: entered promiscuous mode [ 1825.031058][ T895] syzkaller0: entered allmulticast mode [ 1825.779394][ T908] syzkaller0: entered promiscuous mode [ 1825.785549][ T908] syzkaller0: entered allmulticast mode [ 1827.658136][ T944] fuse: Bad value for 'fd' [ 1828.176896][ T920] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 1828.184912][T26337] Bluetooth: hci4: command 0x040f tx timeout [ 1828.193301][T31292] Bluetooth: hci2: command 0x0c1a tx timeout [ 1828.228565][ T955] QAT: failed to copy from user. [ 1828.462230][ T959] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8684'. [ 1828.596434][ T961] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8684'. [ 1828.789850][ T920] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1828.816809][ T920] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1828.850450][ T920] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1828.898950][ T920] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1828.960294][T22485] ================================================================== [ 1828.968509][T22485] BUG: KASAN: slab-use-after-free in l2cap_disconn_ind+0x79/0xc0 [ 1828.976353][T22485] Read of size 1 at addr ffff888071013ab0 by task kworker/u9:0/22485 [ 1828.984453][T22485] [ 1828.986831][T22485] CPU: 1 UID: 0 PID: 22485 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 1828.986857][T22485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1828.986872][T22485] Workqueue: hci4 hci_conn_timeout [ 1828.986979][T22485] Call Trace: [ 1828.986988][T22485] [ 1828.986998][T22485] dump_stack_lvl+0x189/0x250 [ 1828.987029][T22485] ? __virt_addr_valid+0x1c8/0x5c0 [ 1828.987058][T22485] ? rcu_is_watching+0x15/0xb0 [ 1828.987081][T22485] ? __kasan_check_byte+0x12/0x40 [ 1828.987104][T22485] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1828.987132][T22485] ? rcu_is_watching+0x15/0xb0 [ 1828.987155][T22485] ? lock_release+0x4b/0x3e0 [ 1828.987178][T22485] ? __virt_addr_valid+0x1c8/0x5c0 [ 1828.987218][T22485] ? __virt_addr_valid+0x4a5/0x5c0 [ 1828.987248][T22485] print_report+0xca/0x240 [ 1828.987275][T22485] ? l2cap_disconn_ind+0x79/0xc0 [ 1828.987302][T22485] kasan_report+0x118/0x150 [ 1828.987325][T22485] ? l2cap_disconn_ind+0x79/0xc0 [ 1828.987358][T22485] l2cap_disconn_ind+0x79/0xc0 [ 1828.987386][T22485] hci_conn_timeout+0xdd/0x290 [ 1828.987408][T22485] ? process_scheduled_works+0x9ef/0x17b0 [ 1828.987433][T22485] process_scheduled_works+0xae1/0x17b0 [ 1828.987472][T22485] ? __pfx_process_scheduled_works+0x10/0x10 [ 1828.987504][T22485] worker_thread+0x8a0/0xda0 [ 1828.987529][T22485] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1828.987563][T22485] ? __kthread_parkme+0x7b/0x200 [ 1828.987594][T22485] kthread+0x711/0x8a0 [ 1828.987624][T22485] ? __pfx_worker_thread+0x10/0x10 [ 1828.987647][T22485] ? __pfx_kthread+0x10/0x10 [ 1828.987676][T22485] ? _raw_spin_unlock_irq+0x23/0x50 [ 1828.987702][T22485] ? lockdep_hardirqs_on+0x9c/0x150 [ 1828.987730][T22485] ? __pfx_kthread+0x10/0x10 [ 1828.987759][T22485] ret_from_fork+0x4bc/0x870 [ 1828.987783][T22485] ? __pfx_ret_from_fork+0x10/0x10 [ 1828.987808][T22485] ? __switch_to_asm+0x39/0x70 [ 1828.987825][T22485] ? __switch_to_asm+0x33/0x70 [ 1828.987842][T22485] ? __pfx_kthread+0x10/0x10 [ 1828.987870][T22485] ret_from_fork_asm+0x1a/0x30 [ 1828.987898][T22485] [ 1828.987906][T22485] [ 1829.187748][T22485] Allocated by task 920: [ 1829.192695][T22485] kasan_save_track+0x3e/0x80 [ 1829.197405][T22485] __kasan_kmalloc+0x93/0xb0 [ 1829.202021][T22485] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 1829.207416][T22485] l2cap_conn_add+0xaa/0x8d0 [ 1829.212114][T22485] l2cap_chan_connect+0x6c8/0xe30 [ 1829.217170][T22485] lowpan_control_write+0x421/0x6c0 [ 1829.222572][T22485] full_proxy_write+0x127/0x1f0 [ 1829.227474][T22485] vfs_write+0x27e/0xb30 [ 1829.231735][T22485] ksys_write+0x145/0x250 [ 1829.236076][T22485] __do_fast_syscall_32+0xb6/0x2b0 [ 1829.241257][T22485] do_fast_syscall_32+0x34/0x80 [ 1829.246150][T22485] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1829.252597][T22485] [ 1829.254934][T22485] Freed by task 920: [ 1829.258837][T22485] kasan_save_track+0x3e/0x80 [ 1829.263538][T22485] __kasan_save_free_info+0x46/0x50 [ 1829.268751][T22485] __kasan_slab_free+0x5c/0x80 [ 1829.273533][T22485] kfree+0x19a/0x6d0 [ 1829.277441][T22485] l2cap_connect_cfm+0x11d/0x1040 [ 1829.282556][T22485] hci_conn_failed+0x1ce/0x310 [ 1829.287361][T22485] hci_abort_conn_sync+0x658/0xe30 [ 1829.292543][T22485] hci_disconnect_all_sync+0x1b5/0x350 [ 1829.298016][T22485] hci_suspend_sync+0x3fc/0xc60 [ 1829.302881][T22485] hci_suspend_dev+0x28d/0x4d0 [ 1829.307741][T22485] hci_suspend_notifier+0xf2/0x290 [ 1829.312866][T22485] notifier_call_chain+0x1b6/0x3e0 [ 1829.317999][T22485] blocking_notifier_call_chain_robust+0x85/0x100 [ 1829.324426][T22485] pm_notifier_call_chain_robust+0x2c/0x60 [ 1829.330269][T22485] snapshot_open+0x19c/0x280 [ 1829.334869][T22485] misc_open+0x2d5/0x350 [ 1829.339206][T22485] chrdev_open+0x4cc/0x5e0 [ 1829.343635][T22485] do_dentry_open+0x953/0x13f0 [ 1829.348544][T22485] vfs_open+0x3b/0x340 [ 1829.352638][T22485] path_openat+0x2ee5/0x3830 [ 1829.357261][T22485] do_filp_open+0x1fa/0x410 [ 1829.361902][T22485] do_sys_openat2+0x121/0x1c0 [ 1829.366786][T22485] __ia32_compat_sys_openat+0x131/0x160 [ 1829.372418][T22485] __do_fast_syscall_32+0xb6/0x2b0 [ 1829.377560][T22485] do_fast_syscall_32+0x34/0x80 [ 1829.382431][T22485] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1829.388867][T22485] [ 1829.391198][T22485] The buggy address belongs to the object at ffff888071013800 [ 1829.391198][T22485] which belongs to the cache kmalloc-1k of size 1024 [ 1829.405614][T22485] The buggy address is located 688 bytes inside of [ 1829.405614][T22485] freed 1024-byte region [ffff888071013800, ffff888071013c00) [ 1829.419594][T22485] [ 1829.421925][T22485] The buggy address belongs to the physical page: [ 1829.428387][T22485] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x71010 [ 1829.437162][T22485] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1829.445688][T22485] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1829.453249][T22485] page_type: f5(slab) [ 1829.457324][T22485] raw: 00fff00000000040 ffff88801a026dc0 dead000000000100 dead000000000122 [ 1829.465919][T22485] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1829.474602][T22485] head: 00fff00000000040 ffff88801a026dc0 dead000000000100 dead000000000122 [ 1829.483290][T22485] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1829.492069][T22485] head: 00fff00000000003 ffffea0001c40401 00000000ffffffff 00000000ffffffff [ 1829.500747][T22485] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1829.509435][T22485] page dumped because: kasan: bad access detected [ 1829.515882][T22485] page_owner tracks the page as allocated [ 1829.521627][T22485] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 36, tgid 36 (kworker/u8:2), ts 96735937063, free_ts 96724452488 [ 1829.540563][T22485] post_alloc_hook+0x240/0x2a0 [ 1829.545352][T22485] get_page_from_freelist+0x2365/0x2440 [ 1829.550909][T22485] __alloc_frozen_pages_noprof+0x181/0x370 [ 1829.556808][T22485] alloc_pages_mpol+0x232/0x4a0 [ 1829.561668][T22485] allocate_slab+0x96/0x350 [ 1829.566188][T22485] ___slab_alloc+0xf56/0x1990 [ 1829.570895][T22485] __slab_alloc+0x65/0x100 [ 1829.575333][T22485] __kmalloc_noprof+0x471/0x7f0 [ 1829.580200][T22485] ___neigh_create+0x6d5/0x2260 [ 1829.585064][T22485] ip6_finish_output2+0x1175/0x1480 [ 1829.590466][T22485] ip6_output+0x340/0x550 [ 1829.594808][T22485] ndisc_send_skb+0xbce/0x1510 [ 1829.599616][T22485] addrconf_dad_completed+0x7ae/0xd60 [ 1829.605048][T22485] addrconf_dad_work+0xc36/0x14b0 [ 1829.610193][T22485] process_scheduled_works+0xae1/0x17b0 [ 1829.615766][T22485] worker_thread+0x8a0/0xda0 [ 1829.620410][T22485] page last free pid 812 tgid 812 stack trace: [ 1829.626679][T22485] __free_frozen_pages+0xbc4/0xd30 [ 1829.632008][T22485] __put_partials+0x146/0x170 [ 1829.636972][T22485] put_cpu_partial+0x1f2/0x2e0 [ 1829.642025][T22485] __slab_free+0x2b9/0x390 [ 1829.646466][T22485] qlist_free_all+0x97/0x140 [ 1829.651099][T22485] kasan_quarantine_reduce+0x148/0x160 [ 1829.656677][T22485] __kasan_slab_alloc+0x22/0x80 [ 1829.661677][T22485] __kmalloc_node_track_caller_noprof+0x519/0x800 [ 1829.668116][T22485] kmalloc_reserve+0x136/0x290 [ 1829.672985][T22485] __alloc_skb+0x142/0x2d0 [ 1829.677408][T22485] mld_newpack+0x13c/0xc40 [ 1829.681921][T22485] add_grhead+0x5a/0x2a0 [ 1829.686207][T22485] add_grec+0x1452/0x1740 [ 1829.690559][T22485] mld_ifc_work+0x6ed/0xd60 [ 1829.695071][T22485] process_scheduled_works+0xae1/0x17b0 [ 1829.700726][T22485] worker_thread+0x8a0/0xda0 [ 1829.705344][T22485] [ 1829.707678][T22485] Memory state around the buggy address: [ 1829.713325][T22485] ffff888071013980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1829.721487][T22485] ffff888071013a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1829.729557][T22485] >ffff888071013a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1829.737622][T22485] ^ [ 1829.743347][T22485] ffff888071013b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1829.751410][T22485] ffff888071013b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1829.759480][T22485] ================================================================== [ 1829.811597][T22485] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1829.818855][T22485] CPU: 1 UID: 0 PID: 22485 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 1829.828726][T22485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1829.838800][T22485] Workqueue: hci4 hci_conn_timeout [ 1829.844047][T22485] Call Trace: [ 1829.847369][T22485] [ 1829.850325][T22485] dump_stack_lvl+0x99/0x250 [ 1829.854963][T22485] ? __asan_memcpy+0x40/0x70 [ 1829.859594][T22485] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1829.864838][T22485] ? __pfx__printk+0x10/0x10 [ 1829.869464][T22485] vpanic+0x237/0x6d0 [ 1829.873748][T22485] ? __pfx_vpanic+0x10/0x10 [ 1829.878293][T22485] ? preempt_schedule_common+0x83/0xd0 [ 1829.883787][T22485] ? preempt_schedule+0xae/0xc0 [ 1829.888683][T22485] panic+0xb9/0xc0 [ 1829.892428][T22485] ? __pfx_panic+0x10/0x10 [ 1829.896966][T22485] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1829.903412][T22485] ? l2cap_disconn_ind+0x79/0xc0 [ 1829.908411][T22485] check_panic_on_warn+0x89/0xb0 [ 1829.913390][T22485] ? l2cap_disconn_ind+0x79/0xc0 [ 1829.918377][T22485] end_report+0x78/0x160 [ 1829.922664][T22485] kasan_report+0x129/0x150 [ 1829.927286][T22485] ? l2cap_disconn_ind+0x79/0xc0 [ 1829.932274][T22485] l2cap_disconn_ind+0x79/0xc0 [ 1829.937062][T22485] hci_conn_timeout+0xdd/0x290 [ 1829.942052][T22485] ? process_scheduled_works+0x9ef/0x17b0 [ 1829.947777][T22485] process_scheduled_works+0xae1/0x17b0 [ 1829.953368][T22485] ? __pfx_process_scheduled_works+0x10/0x10 [ 1829.959375][T22485] worker_thread+0x8a0/0xda0 [ 1829.963971][T22485] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1829.970308][T22485] ? __kthread_parkme+0x7b/0x200 [ 1829.975265][T22485] kthread+0x711/0x8a0 [ 1829.979346][T22485] ? __pfx_worker_thread+0x10/0x10 [ 1829.984477][T22485] ? __pfx_kthread+0x10/0x10 [ 1829.989080][T22485] ? _raw_spin_unlock_irq+0x23/0x50 [ 1829.994286][T22485] ? lockdep_hardirqs_on+0x9c/0x150 [ 1829.999499][T22485] ? __pfx_kthread+0x10/0x10 [ 1830.004096][T22485] ret_from_fork+0x4bc/0x870 [ 1830.008696][T22485] ? __pfx_ret_from_fork+0x10/0x10 [ 1830.013826][T22485] ? __switch_to_asm+0x39/0x70 [ 1830.019431][T22485] ? __switch_to_asm+0x33/0x70 [ 1830.024381][T22485] ? __pfx_kthread+0x10/0x10 [ 1830.029012][T22485] ret_from_fork_asm+0x1a/0x30 [ 1830.033989][T22485] [ 1830.037633][T22485] Kernel Offset: disabled [ 1830.041968][T22485] Rebooting in 86400 seconds..