last executing test programs: 11m31.857465311s ago: executing program 4 (id=47): r0 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000e, 0x11, r0, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0xc4a, 0x9, 0xfffffffffffffffd, 0x1, 0x3ff, 0x3, 0x4002004c2, 0x1000, 0x9, 0x10001, 0xfffffffffffffffb, 0x8, 0x6, 0x0, 0x8, 0xda91], 0x41000, 0x2008c0}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 11m31.638723918s ago: executing program 4 (id=49): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$afs(0x0, &(0x7f0000000340)='./mnt\x00', &(0x7f0000000380), 0x800, &(0x7f0000000500)={[{@dyn}, {@flock_write}, {@flock_openafs}, {@flock_local}, {@flock_write}], [{@subj_type={'subj_type', 0x3d, '/dev/vga_arbiter\x00'}}, {@fowner_eq}, {@uid_gt}]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000fea000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0}, 0x68) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x2}}, './mnt/test2\x00'}) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r2, r1, 0x0, 0x20000) 11m29.768512264s ago: executing program 4 (id=53): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00)='Linux Foundation\n', 0x11) close(r1) write(0xffffffffffffffff, &(0x7f0000000e00)='Multifunction Ga', 0x10) close(0xffffffffffffffff) mkdir(&(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0) mkdir(&(0x7f0000001300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0) write(r2, &(0x7f0000001d00)='veth0\n', 0x6) close(r2) symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/ecm.usb0\x00', &(0x7f0000001500)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000001900)={'veth0\x00', 0x1}) 11m25.79787595s ago: executing program 4 (id=59): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) setns(0xc9, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x3ba9bfc6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000280)={0x1f, 0xfffe, @none, 0x0, 0x1}, 0xe) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) execve(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x1c3425, 0x0) execve(0x0, &(0x7f00000004c0)={[&(0x7f0000000340)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)=')o', 0x2) 11m24.188030502s ago: executing program 4 (id=62): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$afs(&(0x7f00000001c0), &(0x7f0000000340)='./mnt\x00', &(0x7f0000000380), 0x800, &(0x7f0000000500)={[{@dyn}, {@flock_write}, {@flock_openafs}, {@flock_local}, {@flock_write}], [{@subj_type={'subj_type', 0x3d, '/dev/vga_arbiter\x00'}}, {@fowner_eq}, {@uid_gt}]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000fea000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0}, 0x68) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x2}}, './mnt/test2\x00'}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x17bb, &(0x7f0000000240)={0x0, 0xc8a1, 0x4000, 0x2, 0xc3}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r2, r1, 0x0, 0x20000) 11m20.900853574s ago: executing program 4 (id=66): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) unshare(0x2c020400) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) 11m6.033346426s ago: executing program 32 (id=64): ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000440)=""/102400, 0x19000) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(0xffffffffffffffff, 0x4142, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x240048d0}, 0x40) 11m5.803543763s ago: executing program 33 (id=66): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) unshare(0x2c020400) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) 9m19.962813383s ago: executing program 0 (id=202): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000400)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x0, 0x0) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0xffff, 0x0, 0x0, 0x7}]}, 0x10) read(r4, &(0x7f00000002c0)=""/10, 0x5b) 9m18.842438628s ago: executing program 0 (id=203): ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x41000, 0x3, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}, {0x30000, 0x60000, 0xb, 0x0, 0x0, 0x17, 0xf9, 0x6, 0x6, 0x0, 0x4, 0x6}, {0xeeef0000, 0x6000, 0x13, 0x5, 0x0, 0x0, 0x99, 0x0, 0x4, 0xe, 0x1, 0x6}, {0x30000, 0x0, 0x4, 0x5, 0x0, 0x0, 0x0, 0x20, 0x4, 0x4}, {0x3004, 0x70000, 0x3, 0x0, 0x0, 0x80, 0x8, 0x20, 0x0, 0x6d, 0x1a}, {0xe000, 0x9000, 0x10, 0x0, 0x0, 0x9, 0x0, 0xfe, 0x0, 0x0, 0x84}, {0x4, 0x5000, 0xd, 0x4, 0x70, 0x0, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x100000, 0x0, 0xfb, 0x0, 0x2, 0x0, 0x2, 0x0, 0xa}, {0x70000, 0xffff}, {0x0, 0x7}, 0x3771459b4651a1c4, 0x0, 0x7000, 0x0, 0x0, 0x1, 0x900, [0xfffffffffffffffc, 0x0, 0x0, 0x40]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRESDEC], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setns(0xc9, 0x0) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r4, 0x89ee, &(0x7f0000000000)=0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000680)={'ip6gre0\x00', &(0x7f0000000600)={'syztnl1\x00', 0x0, 0x29, 0x7, 0xe, 0x8b, 0x18, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x7807, 0x8, 0x5}}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='freezer.state\x00', 0x275a, 0x0) fcntl$lock(r6, 0x26, &(0x7f0000000000)) fcntl$lock(r6, 0x5, &(0x7f00000001c0)={0x1, 0x1, 0x5, 0xb5c}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@map=0x1, r5, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) 9m15.846110306s ago: executing program 1 (id=204): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0x8, &(0x7f0000001f80)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000500)=""/85, 0x500, 0x4000000, 0xd8, 0x0, &(0x7f0000000400)="5af2ba690dc031c78b4b34cdc9bab3f4bfee0efad920a9b1316e6795a8ace70c12260f5a0a76e7a3301437f780e5b979eedcf5d71b4b0b68394172ae2f7752ea2bda4bbe67024a89fb4b1f16b42332f57d5c70a0c0207fc90352a2735996af79fa0161c12b38317781f1c398968974d7198d55e95565ba4a6ac341d0c4bfadbe4614f6d9722744c5f7f8cc69db840197963100390a0f655325650c945aae4463c11cad428b2a2c62701252900367fec7a20b9accc95d688403251fa374f8383aaeaf800031bbc7d6a1617f214cbf97d9e2985788b49d4498", &(0x7f0000000000), 0x0, 0x0, 0x20000000}, 0x50) socket$inet6(0xa, 0xa, 0x6) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000070a0101"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 9m15.289696662s ago: executing program 0 (id=205): ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x41000, 0x3, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}, {0x30000, 0x60000, 0xb, 0x0, 0x0, 0x17, 0xf9, 0x6, 0x6, 0x0, 0x4, 0x6}, {0xeeef0000, 0x6000, 0x13, 0x5, 0x0, 0x0, 0x99, 0x0, 0x4, 0xe, 0x1, 0x6}, {0x30000, 0x0, 0x4, 0x5, 0x0, 0x0, 0x0, 0x20, 0x4, 0x4}, {0x3004, 0x70000, 0x3, 0x0, 0x0, 0x80, 0x8, 0x20, 0x0, 0x6d, 0x1a}, {0xe000, 0x9000, 0x10, 0x0, 0x0, 0x9, 0x0, 0xfe, 0x0, 0x0, 0x84}, {0x4, 0x5000, 0xd, 0x4, 0x70, 0x0, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x100000, 0x0, 0xfb, 0x0, 0x2, 0x0, 0x2, 0x0, 0xa}, {0x70000, 0xffff}, {0x0, 0x7}, 0x3771459b4651a1c4, 0x0, 0x7000, 0x0, 0x0, 0x1, 0x900, [0xfffffffffffffffc, 0x0, 0x0, 0x40]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRESDEC], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setns(0xc9, 0x0) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r4, 0x89ee, &(0x7f0000000000)=0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000680)={'ip6gre0\x00', &(0x7f0000000600)={'syztnl1\x00', 0x0, 0x29, 0x7, 0xe, 0x8b, 0x18, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x7807, 0x8, 0x5}}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='freezer.state\x00', 0x275a, 0x0) fcntl$lock(r7, 0x26, &(0x7f0000000000)) fcntl$lock(r7, 0x5, &(0x7f00000001c0)={0x1, 0x1, 0x5, 0xb5c}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x10, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x8}, [@map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @jmp={0x5, 0x1, 0x6, 0x6, 0x2, 0x1e, 0xffffffffffffffef}, @map_val={0x18, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x6}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x8}, @generic={0x7, 0x0, 0x9, 0x6, 0x7}]}, &(0x7f0000000400)='GPL\x00', 0x5ee, 0x0, &(0x7f0000000440), 0x41000, 0x0, '\x00', r6, 0x0, r7, 0x8, &(0x7f00000006c0)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000700)={0x4, 0x8, 0xfffffff9, 0x10000}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000740)=[r2], &(0x7f0000000780)=[{0x5, 0x2, 0x6, 0x1}, {0x4, 0x2, 0x3, 0xc}, {0x3, 0x1, 0x0, 0x6}, {0x0, 0x2, 0x0, 0xa}, {0x0, 0x1, 0x5}, {0x4, 0x3, 0x9, 0x7}], 0x10, 0xbd71}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@map=0x1, r5, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@fallback, 0xffffffffffffffff, 0x7}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) 9m13.654315438s ago: executing program 1 (id=207): ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x41000, 0x3, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}, {0x30000, 0x60000, 0xb, 0x0, 0x0, 0x17, 0xf9, 0x6, 0x6, 0x0, 0x4, 0x6}, {0xeeef0000, 0x6000, 0x13, 0x5, 0x0, 0x0, 0x99, 0x0, 0x4, 0xe, 0x1, 0x6}, {0x30000, 0x0, 0x4, 0x5, 0x0, 0x0, 0x0, 0x20, 0x4, 0x4}, {0x3004, 0x70000, 0x3, 0x0, 0x0, 0x80, 0x8, 0x20, 0x0, 0x6d, 0x1a}, {0xe000, 0x9000, 0x10, 0x0, 0x0, 0x9, 0x0, 0xfe, 0x0, 0x0, 0x84}, {0x4, 0x5000, 0xd, 0x4, 0x70, 0x0, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x100000, 0x0, 0xfb, 0x0, 0x2, 0x0, 0x2, 0x0, 0xa}, {0x70000, 0xffff}, {0x0, 0x7}, 0x3771459b4651a1c4, 0x0, 0x7000, 0x0, 0x0, 0x1, 0x900, [0xfffffffffffffffc, 0x0, 0x0, 0x40]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRESDEC], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r4, 0x89ee, &(0x7f0000000000)=0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r5, 0x26, &(0x7f0000000000)) fcntl$lock(r5, 0x5, &(0x7f00000001c0)={0x1, 0x1, 0x5, 0xb5c}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x10, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x8}, [@map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @jmp={0x5, 0x1, 0x6, 0x6, 0x2, 0x1e, 0xffffffffffffffef}, @map_val={0x18, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x6}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x8}, @generic={0x7, 0x0, 0x9, 0x6, 0x7}]}, 0x0, 0x5ee, 0x0, &(0x7f0000000440), 0x41000, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000006c0)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000700)={0x4, 0x8, 0xfffffff9, 0x10000}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000740)=[r2], &(0x7f0000000780)=[{0x5, 0x2, 0x6, 0x1}, {0x4, 0x2, 0x3, 0xc}, {0x3, 0x1, 0x0, 0x6}, {0x0, 0x2, 0x0, 0xa}, {0x0, 0x1, 0x5}], 0x10, 0xbd71}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@fallback, 0xffffffffffffffff, 0x7}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) 9m12.05004438s ago: executing program 1 (id=208): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$afs(&(0x7f00000001c0), &(0x7f0000000340)='./mnt\x00', 0x0, 0x800, &(0x7f0000000500)) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0x20000) 9m11.59622994s ago: executing program 1 (id=210): syz_open_procfs(0x0, &(0x7f0000000140)='maps\x00') write(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x400452c9, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="f31fbd0d660f2a630066b8000000000f23d80f21f86635000000000f23f8b80d008ed82e667c75f364b646660fc735b800008ee866b9ff03000066ba000000000f3066b9bb0800000f32", 0x4a}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000005700)=@vmx={0x100, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xfffffffffffffffe}, {'\x00', "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe2d1f2b6255614c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0xffffffffffffffc3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9m9.822362852s ago: executing program 1 (id=211): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$afs(0x0, &(0x7f0000000340)='./mnt\x00', &(0x7f0000000380), 0x800, &(0x7f0000000500)={[{@dyn}, {@flock_write}, {@flock_openafs}, {@flock_local}, {@flock_write}], [{@subj_type={'subj_type', 0x3d, '/dev/vga_arbiter\x00'}}, {@fowner_eq}, {@uid_gt}]}) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x2}}, './mnt/test2\x00'}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x17bb, &(0x7f0000000240)={0x0, 0xc8a1, 0x4000, 0x2, 0xc3}) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0xc00) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r3, r2, 0x0, 0x20000) 9m9.283418009s ago: executing program 0 (id=212): mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000004) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, 0x0, 0x0) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6002, &(0x7f0000000000)=0x3, 0xf, 0x0) set_mempolicy_home_node(&(0x7f0000ffc000/0x4000)=nil, 0x403f, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000700)='1\n', 0x2) write(r0, &(0x7f0000000900)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r1, &(0x7f0000000b00)='1\n', 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000000)={0xffffffffffffffff, 0x4, 0x2c, 0x8, @vifc_lcl_addr=@local, @private=0xa010101}, 0x10) socket$tipc(0x1e, 0x5, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) 9m8.261392457s ago: executing program 1 (id=213): ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x41000, 0x3, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}, {0x30000, 0x60000, 0xb, 0x0, 0x0, 0x17, 0xf9, 0x6, 0x6, 0x0, 0x4, 0x6}, {0xeeef0000, 0x6000, 0x13, 0x5, 0x0, 0x0, 0x99, 0x0, 0x4, 0xe, 0x1, 0x6}, {0x30000, 0x0, 0x4, 0x5, 0x0, 0x0, 0x0, 0x20, 0x4, 0x4}, {0x3004, 0x70000, 0x3, 0x0, 0x0, 0x80, 0x8, 0x20, 0x0, 0x6d, 0x1a}, {0xe000, 0x9000, 0x10, 0x0, 0x0, 0x9, 0x0, 0xfe, 0x0, 0x0, 0x84}, {0x4, 0x5000, 0xd, 0x4, 0x70, 0x0, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x100000, 0x0, 0xfb, 0x0, 0x2, 0x0, 0x2, 0x0, 0xa}, {0x70000, 0xffff}, {0x0, 0x7}, 0x3771459b4651a1c4, 0x0, 0x7000, 0x0, 0x0, 0x1, 0x900, [0xfffffffffffffffc, 0x0, 0x0, 0x40]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRESDEC], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setns(0xc9, 0x0) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r4, 0x89ee, &(0x7f0000000000)=0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000680)={'ip6gre0\x00', &(0x7f0000000600)={'syztnl1\x00', 0x0, 0x29, 0x7, 0xe, 0x8b, 0x18, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x7807, 0x8, 0x5}}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='freezer.state\x00', 0x275a, 0x0) fcntl$lock(r6, 0x26, &(0x7f0000000000)) fcntl$lock(r6, 0x5, &(0x7f00000001c0)={0x1, 0x1, 0x5, 0xb5c}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@map=0x1, r5, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) 9m6.238621684s ago: executing program 0 (id=215): r0 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000100)={0xf030000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f910, 0x8000, '\x00', @string=0x0}}) 9m3.328509212s ago: executing program 0 (id=216): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./file0\x00', 0x200403, 0x144) close(0x3) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20004000) syz_usb_control_io(r1, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="200f1100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, 0x0, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000006c0)=@o_path={0x0}, 0x18) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000200)={'batadv_slave_1\x00', {0x2, 0x0, @remote}}) ioctl$sock_inet_SIOCSIFADDR(r2, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e23, @private=0xfffffffc}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_CAP_X2APIC_API(r5, 0x4068aea3, &(0x7f0000002a80)={0x81, 0x0, 0x3}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x102) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, 0x0) ioctl$BTRFS_IOC_ENCODED_READ(r2, 0x80809440, &(0x7f00000001c0)={&(0x7f0000000280)=[{&(0x7f0000000000)="42a4ca64d1cde38b6347755b2fb04d76611656874e8d33fab7d07db0dc12cb3354206182e86414fdfb0825b5865e10252a1de8b2d2dbd071069528222a46b13f", 0x40}, {&(0x7f0000000080)="57decdc6dd11f5f1964a097ce893c3dc303c7b07d5d6f47bdec8dc5df2edc73ae25cbbe91e79ff4b69cfad889dc58274b2e03588899a40e5fc259ff2c5f38874fa7aeb8fc692e8f54e8fd13eab1f6594cb78d692108b71dd9ccb0bcf5c4e35a217b7680bf7a667c8b7b7b4d309c377bb5e00a3c4b9007d1c50afbea1fb17b3edab3e4a2a9655679def4dbd3dd929ccf4f50e1695c1a2e542a1c2d06b97d94c0623af7346f9690f0cb316ab9f005510f09f09deb5e6bab901f2a2b8d409cc46cdb9ec1cb0ab286c1ee7d682ab2886b839f3e6", 0xd2}, {&(0x7f0000000240)}], 0x3, 0x2, 0x0, 0x7, 0x7, 0xff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r7 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r7, 0xc0405665, &(0x7f0000000580)={0x0, 0x5, 0x39}) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r3, 0x0, 0x4000000) 8m52.110303812s ago: executing program 34 (id=213): ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x41000, 0x3, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}, {0x30000, 0x60000, 0xb, 0x0, 0x0, 0x17, 0xf9, 0x6, 0x6, 0x0, 0x4, 0x6}, {0xeeef0000, 0x6000, 0x13, 0x5, 0x0, 0x0, 0x99, 0x0, 0x4, 0xe, 0x1, 0x6}, {0x30000, 0x0, 0x4, 0x5, 0x0, 0x0, 0x0, 0x20, 0x4, 0x4}, {0x3004, 0x70000, 0x3, 0x0, 0x0, 0x80, 0x8, 0x20, 0x0, 0x6d, 0x1a}, {0xe000, 0x9000, 0x10, 0x0, 0x0, 0x9, 0x0, 0xfe, 0x0, 0x0, 0x84}, {0x4, 0x5000, 0xd, 0x4, 0x70, 0x0, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x100000, 0x0, 0xfb, 0x0, 0x2, 0x0, 0x2, 0x0, 0xa}, {0x70000, 0xffff}, {0x0, 0x7}, 0x3771459b4651a1c4, 0x0, 0x7000, 0x0, 0x0, 0x1, 0x900, [0xfffffffffffffffc, 0x0, 0x0, 0x40]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRESDEC], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setns(0xc9, 0x0) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r4, 0x89ee, &(0x7f0000000000)=0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000680)={'ip6gre0\x00', &(0x7f0000000600)={'syztnl1\x00', 0x0, 0x29, 0x7, 0xe, 0x8b, 0x18, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x7807, 0x8, 0x5}}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='freezer.state\x00', 0x275a, 0x0) fcntl$lock(r6, 0x26, &(0x7f0000000000)) fcntl$lock(r6, 0x5, &(0x7f00000001c0)={0x1, 0x1, 0x5, 0xb5c}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@map=0x1, r5, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) 8m46.842959448s ago: executing program 35 (id=216): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./file0\x00', 0x200403, 0x144) close(0x3) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20004000) syz_usb_control_io(r1, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="200f1100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, 0x0, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000006c0)=@o_path={0x0}, 0x18) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000200)={'batadv_slave_1\x00', {0x2, 0x0, @remote}}) ioctl$sock_inet_SIOCSIFADDR(r2, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e23, @private=0xfffffffc}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_CAP_X2APIC_API(r5, 0x4068aea3, &(0x7f0000002a80)={0x81, 0x0, 0x3}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x102) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, 0x0) ioctl$BTRFS_IOC_ENCODED_READ(r2, 0x80809440, &(0x7f00000001c0)={&(0x7f0000000280)=[{&(0x7f0000000000)="42a4ca64d1cde38b6347755b2fb04d76611656874e8d33fab7d07db0dc12cb3354206182e86414fdfb0825b5865e10252a1de8b2d2dbd071069528222a46b13f", 0x40}, {&(0x7f0000000080)="57decdc6dd11f5f1964a097ce893c3dc303c7b07d5d6f47bdec8dc5df2edc73ae25cbbe91e79ff4b69cfad889dc58274b2e03588899a40e5fc259ff2c5f38874fa7aeb8fc692e8f54e8fd13eab1f6594cb78d692108b71dd9ccb0bcf5c4e35a217b7680bf7a667c8b7b7b4d309c377bb5e00a3c4b9007d1c50afbea1fb17b3edab3e4a2a9655679def4dbd3dd929ccf4f50e1695c1a2e542a1c2d06b97d94c0623af7346f9690f0cb316ab9f005510f09f09deb5e6bab901f2a2b8d409cc46cdb9ec1cb0ab286c1ee7d682ab2886b839f3e6", 0xd2}, {&(0x7f0000000240)}], 0x3, 0x2, 0x0, 0x7, 0x7, 0xff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r7 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r7, 0xc0405665, &(0x7f0000000580)={0x0, 0x5, 0x39}) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r3, 0x0, 0x4000000) 1m45.270659766s ago: executing program 8 (id=995): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008840) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)={0x34, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x18, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}]}]}, 0x34}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c0005"], 0x30}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1m44.315861737s ago: executing program 8 (id=997): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) 1m43.73751804s ago: executing program 8 (id=999): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0xf, 0x0, 0x39, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x8000) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x3, 0xff, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 1m42.803541423s ago: executing program 8 (id=1005): socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./trace\x00', 0x1ff) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0xee8c0000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x4c8a1, 0xc000, 0x1, 0xc0, 0x0, r0}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x20) 1m42.109170827s ago: executing program 8 (id=1008): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x88, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x4c, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @val={0x72, 0x6}, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x88}}, 0x20000014) 1m36.505460678s ago: executing program 8 (id=1036): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000400)=@gcm_256={{0x304}, "bd3477bcd0fc636b", "0aad493bc513a8768e6917ea79c5de042217979390b1b9e729d17743f2dede96", "fdc4e7fa", "5a9ffb9342587272"}, 0x38) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x11a, 0x4, 0x0, 0x0) 1m35.887709367s ago: executing program 36 (id=1036): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000400)=@gcm_256={{0x304}, "bd3477bcd0fc636b", "0aad493bc513a8768e6917ea79c5de042217979390b1b9e729d17743f2dede96", "fdc4e7fa", "5a9ffb9342587272"}, 0x38) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x11a, 0x4, 0x0, 0x0) 1m25.004741981s ago: executing program 6 (id=1088): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000a000000000400000200000002") ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001") 1m24.027299092s ago: executing program 6 (id=1092): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234', 0xd, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000140)="9e6f6e", 0x3, 0x100224) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1m22.946269995s ago: executing program 6 (id=1093): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}, {@userxattr}]}) 1m22.551670313s ago: executing program 6 (id=1097): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='attr/prev\x00') socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1m21.149286372s ago: executing program 6 (id=1104): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008840) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c0005"], 0x30}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1m18.006927659s ago: executing program 6 (id=1116): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0xeff9, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg(r2, 0x0, 0x40000120) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000706010800000000000000000a0000040500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) 1m2.639636609s ago: executing program 37 (id=1116): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0xeff9, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg(r2, 0x0, 0x40000120) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000706010800000000000000000a0000040500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) 6.969283884s ago: executing program 5 (id=1418): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x4000880) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x4, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DISCONNECT(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000005880)={0x24, r1, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x39}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x8004) 5.935676215s ago: executing program 2 (id=1425): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x80, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x4c, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @val={0x72, 0x6}, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x80}}, 0x20000014) 5.795996198s ago: executing program 5 (id=1426): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @rand_addr=0x64010100}]}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000280)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="cf0400000000000000001300000008000300", @ANYRES32=r4, @ANYBLOB="040013000a0006000802110000010000060010008005000006001200000000000500c2"], 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 5.617422034s ago: executing program 3 (id=1427): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xffff}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}}, 0x0) write$tun(r0, &(0x7f0000001240)=ANY=[@ANYBLOB="00008847"], 0xfce) 5.572256557s ago: executing program 2 (id=1428): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0) ioctl(r0, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000a000000000400000200000002") ioctl(r0, 0x40480923, 0x0) 5.446157653s ago: executing program 5 (id=1430): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000a000000000400000200000002") ioctl(r1, 0x80480911, &(0x7f0000000400)) 5.213401689s ago: executing program 2 (id=1431): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0x1000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x40090) 4.945224716s ago: executing program 5 (id=1432): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r6, @ANYBLOB="0c009900ff070000700000001400040073797a6b616c6c6572300000000000000800050007"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYBLOB="50000000080211000001080211000000080211000000000000000000000000000100010000060202020202020101822d"], 0x54) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x28, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) 4.463268127s ago: executing program 3 (id=1434): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000000000000000800090001"], 0x44}}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x24008040) r3 = socket(0x11, 0x80a, 0x80) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) 4.195867129s ago: executing program 7 (id=1436): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000a000000000400000200000002") ioctl(r1, 0x40140921, &(0x7f0000000400)="1b00000001") 3.99578656s ago: executing program 3 (id=1437): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x80, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x4c, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @val={0x72, 0x6}, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x80}}, 0x20000014) 3.661904376s ago: executing program 7 (id=1438): r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r0, &(0x7f00000007c0)='ac', 0x2) 3.600254883s ago: executing program 5 (id=1439): setns(0xc9, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c00044000000000000000011400"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) 3.3202163s ago: executing program 7 (id=1440): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0) ioctl(r0, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000a000000000400000200000002") ioctl(r0, 0x40480923, 0x0) 3.184717924s ago: executing program 3 (id=1441): syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000009e40)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32, @ANYBLOB="2e003300d0000000080211000001080211000000505050505050000425", @ANYRES64=r1], 0x4c}}, 0x0) 3.06812982s ago: executing program 7 (id=1442): mkdirat(0xffffffffffffff9c, 0x0, 0x6f7) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x560f, &(0x7f0000000140)) ioctl$VT_DISALLOCATE(r0, 0x5608) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) 2.813638712s ago: executing program 5 (id=1443): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r1 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xe, 0x1, 'hashlimit\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x3c, 0x3, "6c6f000000000000000000000000000020000000102700ff0f0000000000000010000000e8030000e8030000202000"/56}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x120}}, 0x0) 2.069201684s ago: executing program 3 (id=1444): syz_usb_connect(0x1, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230820090400bc6435fb4d00", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) 1.863994847s ago: executing program 2 (id=1445): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="0100"], 0x6f4}}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1.688745299s ago: executing program 9 (id=1037): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x6f}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'ip6_vti0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r1}) 1.056960152s ago: executing program 7 (id=1446): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xffff}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}}, 0x0) write$tun(r0, &(0x7f0000001240)=ANY=[@ANYBLOB="00008847"], 0xfce) 957.695454ms ago: executing program 9 (id=1447): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='10000', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) 670.560141ms ago: executing program 2 (id=1448): syz_open_dev$usbmon(&(0x7f0000000280), 0x0, 0x0) 313.895518ms ago: executing program 2 (id=1449): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_ublk_setup_io_uring(0x155a, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000340)={0x12100080, 0x0, 0x0, 0x0, {0x3a}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_ublk_add_dev(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) 200.012624ms ago: executing program 3 (id=1450): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='md0', 0x3) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)) write(0xffffffffffffffff, &(0x7f00000007c0)='ac', 0x2) 0s ago: executing program 7 (id=1451): r0 = inotify_init() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2002, 0x8) write(r1, &(0x7f0000000180)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0x981) kernel console output (not intermixed with test programs): ate [ 574.466892][ T8404] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.467153][ T8404] bridge_slave_0: entered allmulticast mode [ 574.483384][ T8404] bridge_slave_0: entered promiscuous mode [ 574.668561][ T8404] bridge0: port 2(bridge_slave_1) entered blocking state [ 574.668703][ T8404] bridge0: port 2(bridge_slave_1) entered disabled state [ 574.668936][ T8404] bridge_slave_1: entered allmulticast mode [ 574.671827][ T8404] bridge_slave_1: entered promiscuous mode [ 575.360129][ T10] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 575.455051][ T8404] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.477433][ T8404] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.508651][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 575.509542][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 575.510826][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 575.510869][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 575.510895][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 575.510914][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 575.510935][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 575.511995][ T10] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 575.512016][ T10] usb 3-1: Manufacturer: syz [ 575.517821][ T10] usb 3-1: config 0 descriptor?? [ 575.808705][ T10] rc_core: IR keymap rc-hauppauge not found [ 575.808726][ T10] Registered IR keymap rc-empty [ 575.808888][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 575.829311][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 575.859096][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 575.865478][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input8 [ 575.895303][ T8404] team0: Port device team_slave_0 added [ 575.922919][ T8404] team0: Port device team_slave_1 added [ 575.935143][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 575.948812][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 575.968862][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 575.989059][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.008720][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.028970][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.054077][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.075441][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.089745][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.109063][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 576.175779][ T10] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 576.175808][ T10] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 576.208040][ T8404] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 576.208078][ T8404] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 576.208109][ T8404] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 576.257503][ T10] usb 3-1: USB disconnect, device number 25 [ 576.455914][ T8404] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 576.455933][ T8404] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 576.455964][ T8404] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.456973][ T8439] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.457154][ T8439] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.457338][ T8439] bridge_slave_0: entered allmulticast mode [ 576.530194][ T8439] bridge_slave_0: entered promiscuous mode [ 576.689860][ T8439] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.689957][ T8439] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.690130][ T8439] bridge_slave_1: entered allmulticast mode [ 576.692064][ T8439] bridge_slave_1: entered promiscuous mode [ 576.888285][ T8439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.152863][ T8439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.181628][ T8404] hsr_slave_0: entered promiscuous mode [ 577.182907][ T8404] hsr_slave_1: entered promiscuous mode [ 577.183823][ T8404] debugfs: 'hsr0' already exists in 'hsr' [ 577.183848][ T8404] Cannot create hsr debugfs directory [ 577.373412][ T8439] team0: Port device team_slave_0 added [ 577.441795][ T8439] team0: Port device team_slave_1 added [ 577.678642][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 90 seconds [ 577.678698][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 90 seconds [ 577.678842][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 90 seconds [ 577.678942][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 90 seconds [ 578.156609][ T8543] ip6gre1: left allmulticast mode [ 578.798605][ T7918] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 578.975161][ T7918] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 579.006908][ T7918] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 579.006938][ T7918] usb 3-1: Product: syz [ 579.006953][ T7918] usb 3-1: SerialNumber: syz [ 579.038851][ T7918] usb 3-1: config 0 descriptor?? [ 579.152848][ T8439] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 579.152869][ T8439] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 579.152899][ T8439] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 579.399615][ T8439] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 579.399650][ T8439] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 579.399680][ T8439] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 579.468973][ T36] usb 3-1: USB disconnect, device number 26 [ 580.037592][ T8439] hsr_slave_0: entered promiscuous mode [ 580.049529][ T8439] hsr_slave_1: entered promiscuous mode [ 580.050490][ T8439] debugfs: 'hsr0' already exists in 'hsr' [ 580.050512][ T8439] Cannot create hsr debugfs directory [ 581.573064][ T8560] jffs2: notice: (8560) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 582.315774][ T37] audit: type=1800 audit(1787212776.891:434): pid=8565 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.379" name="control" dev="configfs" ino=21476 res=0 errno=0 [ 582.536083][ T5250] 8021q: adding VLAN 0 to HW filter on device eth19 [ 583.343405][ T55] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 583.343759][ T55] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 583.374388][ T5723] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 583.688922][ T31] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 583.714331][ T31] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 584.355245][ T8593] jffs2: notice: (8593) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 584.685921][ T8598] jffs2: notice: (8598) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 585.184596][ T8609] [U]  [ 585.268856][ T12] bridge_slave_1: left allmulticast mode [ 585.268888][ T12] bridge_slave_1: left promiscuous mode [ 585.269228][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.370193][ T12] bridge_slave_0: left allmulticast mode [ 585.370220][ T12] bridge_slave_0: left promiscuous mode [ 585.370443][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.428748][ T7918] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 585.579874][ T7918] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 585.584033][ T7918] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 585.584076][ T7918] usb 3-1: Product: syz [ 585.584088][ T7918] usb 3-1: SerialNumber: syz [ 585.590611][ T7918] usb 3-1: config 0 descriptor?? [ 585.629495][ T12] bridge_slave_1: left allmulticast mode [ 585.629542][ T12] bridge_slave_1: left promiscuous mode [ 585.631019][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.760475][ T12] bridge_slave_0: left allmulticast mode [ 585.760515][ T12] bridge_slave_0: left promiscuous mode [ 585.760841][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.827413][ T7918] hso 3-1:0.0: Failed to find INT IN ep [ 585.998775][ T12] bridge_slave_1: left allmulticast mode [ 585.998807][ T12] bridge_slave_1: left promiscuous mode [ 585.999008][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.100340][ T12] bridge_slave_0: left allmulticast mode [ 586.100371][ T12] bridge_slave_0: left promiscuous mode [ 586.100578][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.989817][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 587.070033][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 587.132326][ T12] bond0 (unregistering): Released all slaves [ 587.681269][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 587.698643][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 587.759366][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 587.821239][ T12] bond0 (unregistering): Released all slaves [ 588.359396][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 588.440842][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 588.520648][ T12] bond0 (unregistering): Released all slaves [ 588.698017][ T8346] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 588.790394][ T8346] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 589.047650][ T8346] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 589.107665][ T7918] usb 3-1: USB disconnect, device number 27 [ 589.111098][ T8346] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 589.114350][ T8346] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 589.197915][ T8346] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 589.222228][ T8346] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 589.295621][ T8346] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 589.908693][ T12] hsr_slave_0: left promiscuous mode [ 589.956749][ T12] hsr_slave_1: left promiscuous mode [ 589.958114][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 589.999388][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 590.411933][ T8640] No source specified [ 591.743565][ T12] hsr_slave_0: left promiscuous mode [ 591.778606][ T12] hsr_slave_1: left promiscuous mode [ 591.779758][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 591.805476][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 591.898581][ T12] hsr_slave_0: left promiscuous mode [ 591.918644][ T12] hsr_slave_1: left promiscuous mode [ 591.919682][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 591.943971][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 592.450133][ T12] team0 (unregistering): Port device team_slave_1 removed [ 592.499568][ T12] team0 (unregistering): Port device team_slave_0 removed [ 592.941729][ T12] team0 (unregistering): Port device team_slave_1 removed [ 592.991069][ T12] team0 (unregistering): Port device team_slave_0 removed [ 593.414367][ T12] team0 (unregistering): Port device team_slave_1 removed [ 593.450704][ T12] team0 (unregistering): Port device team_slave_0 removed [ 593.622806][ T8644] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 593.622851][ T8644] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 593.622882][ T8644] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 593.635706][ T5250] 8021q: adding VLAN 0 to HW filter on device eth20 [ 594.030055][ T8346] 8021q: adding VLAN 0 to HW filter on device bond0 [ 594.105398][ T8346] 8021q: adding VLAN 0 to HW filter on device team0 [ 594.130157][ T1408] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.130338][ T1408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 595.261116][ T1408] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.262714][ T1408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 596.828813][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 598.680279][ T4955] udevd[4955]: worker [7808] /devices/virtual/block/nbd2 is taking a long time [ 602.118148][ T5597] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 602.147120][ T5597] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 602.184665][ T5597] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 602.201772][ T5597] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 602.206972][ T5597] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 603.866439][ T5589] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 603.914011][ T5589] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 603.916743][ T5589] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 603.972039][ T5589] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 603.985973][ T5589] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 604.340311][ T5589] Bluetooth: hci0: command tx timeout [ 606.190371][ T5589] Bluetooth: hci2: command tx timeout [ 606.418829][ T5589] Bluetooth: hci0: command tx timeout [ 607.740162][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 120 seconds [ 607.740213][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 120 seconds [ 607.740258][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 120 seconds [ 607.740403][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 120 seconds [ 608.953008][ T5589] Bluetooth: hci2: command tx timeout [ 608.953044][ T5589] Bluetooth: hci0: command tx timeout [ 609.180970][ T8695] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.181131][ T8695] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.181402][ T8695] bridge_slave_0: entered allmulticast mode [ 609.189531][ T8695] bridge_slave_0: entered promiscuous mode [ 609.277270][ T8695] bridge0: port 2(bridge_slave_1) entered blocking state [ 609.277404][ T8695] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.277604][ T8695] bridge_slave_1: entered allmulticast mode [ 609.308577][ T8695] bridge_slave_1: entered promiscuous mode [ 609.826748][ T8695] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 609.827022][ T8709] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.827248][ T8709] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.827423][ T8709] bridge_slave_0: entered allmulticast mode [ 609.834634][ T8709] bridge_slave_0: entered promiscuous mode [ 610.092200][ T8695] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 610.092466][ T8709] bridge0: port 2(bridge_slave_1) entered blocking state [ 610.092602][ T8709] bridge0: port 2(bridge_slave_1) entered disabled state [ 610.092737][ T8709] bridge_slave_1: entered allmulticast mode [ 610.094623][ T8709] bridge_slave_1: entered promiscuous mode [ 610.526016][ T8404] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 610.563341][ T8404] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 610.585026][ T8695] team0: Port device team_slave_0 added [ 610.611447][ T8709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 610.640338][ T8695] team0: Port device team_slave_1 added [ 610.671168][ T8709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 611.008458][ T5597] Bluetooth: hci0: command tx timeout [ 611.008467][ T5589] Bluetooth: hci2: command tx timeout [ 611.325270][ T5597] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 611.339737][ T5597] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 611.343424][ T5597] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 611.353419][ T5597] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 611.355735][ T5597] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 611.654031][ T8695] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 611.654051][ T8695] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 611.654080][ T8695] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 611.813677][ T8709] team0: Port device team_slave_0 added [ 611.815738][ T8695] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 611.815754][ T8695] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 611.815785][ T8695] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 612.344819][ T8709] team0: Port device team_slave_1 added [ 613.086124][ T5589] Bluetooth: hci2: command tx timeout [ 614.318544][ T8810] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 615.288514][ T5589] Bluetooth: hci5: command tx timeout [ 615.571651][ T8709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 615.571671][ T8709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 615.571718][ T8709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 615.654188][ T8709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 615.654208][ T8709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 615.654239][ T8709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 615.861835][ T8695] hsr_slave_0: entered promiscuous mode [ 615.863216][ T8695] hsr_slave_1: entered promiscuous mode [ 615.864252][ T8695] debugfs: 'hsr0' already exists in 'hsr' [ 615.864278][ T8695] Cannot create hsr debugfs directory [ 616.018925][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 616.139433][ T8709] hsr_slave_0: entered promiscuous mode [ 616.140520][ T8709] hsr_slave_1: entered promiscuous mode [ 616.142886][ T8709] debugfs: 'hsr0' already exists in 'hsr' [ 616.142905][ T8709] Cannot create hsr debugfs directory [ 616.222562][ T8439] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 616.268115][ T8439] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 616.390528][ T8439] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 616.436210][ T8439] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 617.308733][ T5589] Bluetooth: hci5: command tx timeout [ 617.696833][ T5597] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 617.733675][ T5597] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 617.746620][ T5597] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 617.798162][ T5597] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 617.812031][ T5597] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 618.698753][ T12] bridge_slave_1: left allmulticast mode [ 618.698782][ T12] bridge_slave_1: left promiscuous mode [ 618.698980][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 618.851856][ T12] bridge_slave_0: left allmulticast mode [ 618.851892][ T12] bridge_slave_0: left promiscuous mode [ 618.852182][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.064494][ T8833] [U]  [ 619.378664][ T5589] Bluetooth: hci5: command tx timeout [ 619.378664][ T5701] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 619.529468][ T5701] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 619.532589][ T5701] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 619.532615][ T5701] usb 3-1: Product: syz [ 619.532630][ T5701] usb 3-1: SerialNumber: syz [ 619.552444][ T5701] usb 3-1: config 0 descriptor?? [ 619.781567][ T5701] hso 3-1:0.0: Failed to find INT IN ep [ 619.849438][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 619.867385][ T5589] Bluetooth: hci1: command tx timeout [ 619.940853][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 619.961219][ T12] bond0 (unregistering): Released all slaves [ 620.441899][ T9] usb 3-1: USB disconnect, device number 28 [ 620.751027][ T12] hsr_slave_0: left promiscuous mode [ 620.789012][ T12] hsr_slave_1: left promiscuous mode [ 620.789953][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 620.820022][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 621.458776][ T5589] Bluetooth: hci5: command tx timeout [ 621.579441][ T12] team0 (unregistering): Port device team_slave_1 removed [ 621.640913][ T12] team0 (unregistering): Port device team_slave_0 removed [ 621.938599][ T5589] Bluetooth: hci1: command tx timeout [ 622.590650][ T8795] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.590816][ T8795] bridge0: port 1(bridge_slave_0) entered disabled state [ 622.591018][ T8795] bridge_slave_0: entered allmulticast mode [ 622.593211][ T8795] bridge_slave_0: entered promiscuous mode [ 622.667901][ T8795] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.667998][ T8795] bridge0: port 2(bridge_slave_1) entered disabled state [ 622.668203][ T8795] bridge_slave_1: entered allmulticast mode [ 622.710343][ T8795] bridge_slave_1: entered promiscuous mode [ 622.807455][ T8795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 622.884402][ T8795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 623.191879][ T8795] team0: Port device team_slave_0 added [ 623.219508][ T8795] team0: Port device team_slave_1 added [ 623.418563][ T8795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 623.418581][ T8795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.418607][ T8795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 623.503758][ T8795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 623.503775][ T8795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.503798][ T8795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 623.698912][ T8820] bridge0: port 1(bridge_slave_0) entered blocking state [ 623.699129][ T8820] bridge0: port 1(bridge_slave_0) entered disabled state [ 623.699682][ T8820] bridge_slave_0: entered allmulticast mode [ 623.701925][ T8820] bridge_slave_0: entered promiscuous mode [ 623.774516][ T8820] bridge0: port 2(bridge_slave_1) entered blocking state [ 623.774655][ T8820] bridge0: port 2(bridge_slave_1) entered disabled state [ 623.774790][ T8820] bridge_slave_1: entered allmulticast mode [ 623.776703][ T8820] bridge_slave_1: entered promiscuous mode [ 623.944820][ T8795] hsr_slave_0: entered promiscuous mode [ 623.946147][ T8795] hsr_slave_1: entered promiscuous mode [ 624.018649][ T5589] Bluetooth: hci1: command tx timeout [ 624.193640][ T8820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 624.357668][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.357744][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.108702][ T5589] Bluetooth: hci1: command tx timeout [ 627.325761][ T8820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 628.014722][ T8820] team0: Port device team_slave_0 added [ 628.130006][ T8820] team0: Port device team_slave_1 added [ 629.023032][ T8820] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 629.023052][ T8820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 629.023081][ T8820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 629.110080][ T8866] Bluetooth: MGMT ver 1.23 [ 632.258824][ T8820] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 632.258839][ T8820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 632.258860][ T8820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 632.764185][ T8820] hsr_slave_0: entered promiscuous mode [ 632.765419][ T8820] hsr_slave_1: entered promiscuous mode [ 632.766226][ T8820] debugfs: 'hsr0' already exists in 'hsr' [ 632.766247][ T8820] Cannot create hsr debugfs directory [ 632.928278][ T8695] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 633.000919][ T8695] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 633.103925][ T8695] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 633.144741][ T8695] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 633.235398][ T8695] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 633.285134][ T8695] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 633.408095][ T8695] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 633.436584][ T8695] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 634.057013][ T8887] Invalid logical block size (8192) [ 637.081475][ T8709] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 637.124796][ T8709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 637.146210][ T8709] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 637.163734][ T8709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 637.228999][ T8709] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 637.275112][ T8709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 637.284322][ T8709] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 637.362031][ T8709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 637.397855][ T8895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.413'. [ 637.819817][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 150 seconds [ 637.819856][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 150 seconds [ 637.819879][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 150 seconds [ 637.819901][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 150 seconds [ 638.064834][ T8695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 638.162964][ T8709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 638.185252][ T8695] 8021q: adding VLAN 0 to HW filter on device team0 [ 638.220937][ T3368] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.221620][ T3368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 638.270955][ T8709] 8021q: adding VLAN 0 to HW filter on device team0 [ 638.290959][ T1408] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.292919][ T1408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 638.335109][ T1408] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.335248][ T1408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 638.432835][ T3368] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.432972][ T3368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 639.398885][ T12] bridge_slave_1: left allmulticast mode [ 639.398927][ T12] bridge_slave_1: left promiscuous mode [ 639.399230][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.581664][ T12] bridge_slave_0: left allmulticast mode [ 639.581703][ T12] bridge_slave_0: left promiscuous mode [ 639.581945][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 639.623156][ T37] audit: type=1800 audit(1787212834.201:435): pid=8933 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.422" name="subclass" dev="configfs" ino=25901 res=0 errno=0 [ 639.816812][ T8935] netlink: 'syz.2.423': attribute type 10 has an invalid length. [ 639.848726][ T12] bridge_slave_1: left allmulticast mode [ 639.848756][ T12] bridge_slave_1: left promiscuous mode [ 639.848993][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.873039][ T8936] netlink: 'syz.2.423': attribute type 10 has an invalid length. [ 639.969873][ T12] bridge_slave_0: left allmulticast mode [ 639.969902][ T12] bridge_slave_0: left promiscuous mode [ 639.970128][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.188871][ T12] bridge_slave_1: left allmulticast mode [ 640.188903][ T12] bridge_slave_1: left promiscuous mode [ 640.189143][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.290023][ T12] bridge_slave_0: left allmulticast mode [ 640.290077][ T12] bridge_slave_0: left promiscuous mode [ 640.290398][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.741919][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 640.859547][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 640.940754][ T12] bond0 (unregistering): Released all slaves [ 641.220266][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 641.299743][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 641.360367][ T12] bond0 (unregistering): Released all slaves [ 641.629468][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 641.710991][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 641.771435][ T12] bond0 (unregistering): Released all slaves [ 641.801732][ T5250] 8021q: adding VLAN 0 to HW filter on device eth17 [ 641.852839][ T8935] 8021q: adding VLAN 0 to HW filter on device bond0 [ 641.857576][ T8935] team0: Port device bond0 added [ 641.919329][ T8936] syz_tun: entered promiscuous mode [ 641.938132][ T8936] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 643.410227][ T12] hsr_slave_0: left promiscuous mode [ 643.443674][ T12] hsr_slave_1: left promiscuous mode [ 643.444903][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.493403][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 643.699794][ T12] hsr_slave_0: left promiscuous mode [ 643.738723][ T12] hsr_slave_1: left promiscuous mode [ 643.739753][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.789448][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 643.989019][ T12] hsr_slave_0: left promiscuous mode [ 644.008902][ T12] hsr_slave_1: left promiscuous mode [ 644.010520][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 644.060140][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 644.509239][ T12] team0 (unregistering): Port device team_slave_1 removed [ 644.570718][ T12] team0 (unregistering): Port device team_slave_0 removed [ 645.149846][ T12] team0 (unregistering): Port device team_slave_1 removed [ 645.199370][ T12] team0 (unregistering): Port device team_slave_0 removed [ 645.690389][ T12] team0 (unregistering): Port device team_slave_1 removed [ 645.739278][ T12] team0 (unregistering): Port device team_slave_0 removed [ 645.954358][ T8948] lo speed is unknown, defaulting to 1000 [ 645.954858][ T8952] lo speed is unknown, defaulting to 1000 [ 645.982167][ T5250] 8021q: adding VLAN 0 to HW filter on device eth18 [ 646.017819][ T8952] lo speed is unknown, defaulting to 1000 [ 646.122909][ T8948] lo speed is unknown, defaulting to 1000 [ 646.125918][ T8952] lo speed is unknown, defaulting to 1000 [ 646.173829][ T8952] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 646.173863][ T8952] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 646.173912][ T8952] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 646.176391][ T8948] lo speed is unknown, defaulting to 1000 [ 646.503252][ T8952] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 646.524669][ T8952] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 647.482116][ T8709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 647.556757][ T8695] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 647.963502][ T8952] lo speed is unknown, defaulting to 1000 [ 647.986688][ T8952] lo speed is unknown, defaulting to 1000 [ 648.051612][ T8952] lo speed is unknown, defaulting to 1000 [ 648.054477][ T8952] lo speed is unknown, defaulting to 1000 [ 648.057360][ T8952] lo speed is unknown, defaulting to 1000 [ 649.004626][ T5250] 8021q: adding VLAN 0 to HW filter on device eth19 [ 649.109621][ T8948] infiniband sz1: set active [ 649.109645][ T8948] infiniband sz1: added lo [ 649.147639][ T8948] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 649.177281][ T5577] lo speed is unknown, defaulting to 1000 [ 649.196842][ T8948] infiniband sz1: Couldn't open port 1 [ 649.210081][ T8948] smbdirect: ib_dev[sz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 649.210124][ T8948] smbdirect: ib_dev[sz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 649.210171][ T8948] smbdirect: ib_dev[sz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 649.343435][ T8948] RDS/IB: sz1: added [ 649.368559][ T8948] smc: adding ib device sz1 with port count 1 [ 649.408069][ T8948] smc: ib device sz1 port 1 has no pnetid [ 649.752927][ T5577] lo speed is unknown, defaulting to 1000 [ 649.829949][ T8695] veth0_vlan: entered promiscuous mode [ 649.850756][ T8948] lo speed is unknown, defaulting to 1000 [ 649.913855][ T8695] veth1_vlan: entered promiscuous mode [ 650.721707][ T8709] veth0_vlan: entered promiscuous mode [ 650.747887][ T8948] lo speed is unknown, defaulting to 1000 [ 650.776117][ T8695] veth0_macvtap: entered promiscuous mode [ 650.816191][ T8695] veth1_macvtap: entered promiscuous mode [ 650.833999][ T8709] veth1_vlan: entered promiscuous mode [ 650.981527][ T8695] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 651.136519][ T8695] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 651.304746][ T8709] veth0_macvtap: entered promiscuous mode [ 651.462046][ T8709] veth1_macvtap: entered promiscuous mode [ 651.488579][ T1283] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.648592][ T8709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 652.721562][ T8709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 652.765801][ T8948] lo speed is unknown, defaulting to 1000 [ 653.109845][ T1370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 653.109867][ T1370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 653.138872][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 653.964326][ T8795] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 654.281227][ T8795] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 654.540130][ T8795] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 654.572227][ T8795] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 654.573111][ T8948] lo speed is unknown, defaulting to 1000 [ 654.653965][ T8795] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 654.656004][ T422] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.656024][ T422] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.733758][ T8795] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 655.000767][ T8795] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 655.051870][ T8795] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 655.230357][ T422] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.230381][ T422] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.333243][ T8948] lo speed is unknown, defaulting to 1000 [ 655.363534][ T9060] tmpfs: Bad value for 'mpol' [ 655.398236][ T9060] block2mtd: error: cannot open device /dev/loop0 [ 655.586940][ T8820] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 655.669184][ T8820] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 655.686484][ T8820] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 655.743528][ T8820] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 655.756396][ T3368] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.756417][ T3368] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 656.234917][ T9064] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.261312][ T9064] bridge0: port 1(bridge_slave_0) entered disabled state [ 656.802871][ T9064] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 656.833401][ T9064] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 657.986320][ T8820] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 658.027039][ T8820] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 658.041377][ T8820] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 658.087970][ T8820] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 658.416410][ T8795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 658.534359][ T8795] 8021q: adding VLAN 0 to HW filter on device team0 [ 658.549009][ T1365] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.549067][ T1365] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.549106][ T1365] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.549153][ T1365] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.549192][ T1365] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.556417][ T1408] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.556527][ T1408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 658.928054][ T1365] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.939438][ T1365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 660.187099][ T9076] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 661.162759][ T8795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 661.220369][ T8820] 8021q: adding VLAN 0 to HW filter on device bond0 [ 661.281471][ T9125] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 661.471975][ T8820] 8021q: adding VLAN 0 to HW filter on device team0 [ 661.509207][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.511154][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 661.716391][ T9140] vlan2: entered promiscuous mode [ 661.716415][ T9140] hsr0: entered promiscuous mode [ 661.732397][ T9140] vlan2: entered allmulticast mode [ 661.732420][ T9140] hsr0: entered allmulticast mode [ 661.732434][ T9140] hsr_slave_0: entered allmulticast mode [ 661.732461][ T9140] hsr_slave_1: entered allmulticast mode [ 661.807634][ T9140] netlink: 4 bytes leftover after parsing attributes in process `syz.6.445'. [ 661.887743][ T1283] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.897447][ T1283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 661.939638][ T9140] hsr_slave_0: left promiscuous mode [ 661.978693][ T9140] hsr_slave_1: left promiscuous mode [ 662.258558][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 662.498501][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 662.504475][ T9] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 662.507024][ T9] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 662.507053][ T9] usb 6-1: config 179 has no interface number 0 [ 662.507101][ T9] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 662.507130][ T9] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 662.507161][ T9] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 662.507189][ T9] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 662.507209][ T9] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 662.507241][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.588744][ T9155] bond0: (slave syz_tun): Releasing backup interface [ 662.627630][ T9152] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 663.186915][ T5701] usb 6-1: USB disconnect, device number 2 [ 663.186915][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 663.188567][ C0] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 663.283903][ T8795] veth0_vlan: entered promiscuous mode [ 663.325039][ T8795] veth1_vlan: entered promiscuous mode [ 663.473901][ T9160] netlink: 104 bytes leftover after parsing attributes in process `syz.6.451'. [ 663.512904][ T8795] veth0_macvtap: entered promiscuous mode [ 663.551078][ T8795] veth1_macvtap: entered promiscuous mode [ 663.560350][ T9162] netlink: 104 bytes leftover after parsing attributes in process `syz.6.451'. [ 663.625949][ T8795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 663.670501][ T8795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 664.675192][ T3289] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.675214][ T3289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.768861][ T1283] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.832302][ T9175] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 664.966203][ T9180] faux_driver vgem: [drm] Unknown color mode 265; guessing buffer size. [ 665.027806][ T9175] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.455'. [ 665.091314][ T1370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 665.091336][ T1370] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 665.102397][ T422] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.287174][ T12] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.528849][ T5577] usb 7-1: new low-speed USB device number 2 using dummy_hcd [ 665.692669][ T5577] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 665.694239][ T5577] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 665.694279][ T5577] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.694319][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.694348][ T5577] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.694635][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.694669][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.694698][ T5577] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.694740][ T5577] usb 7-1: config 168 interface 0 has no altsetting 0 [ 665.823961][ T5577] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 665.824005][ T5577] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.824094][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.824123][ T5577] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.824151][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.824178][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.824205][ T5577] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.824234][ T5577] usb 7-1: config 168 interface 0 has no altsetting 0 [ 665.825687][ T5577] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 665.825719][ T5577] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.825763][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.825786][ T5577] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.825807][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.825829][ T5577] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.825852][ T5577] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.825875][ T5577] usb 7-1: config 168 interface 0 has no altsetting 0 [ 666.009169][ T3368] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 666.143171][ T5577] usb 7-1: string descriptor 0 read error: -22 [ 666.143337][ T5577] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.281210][ T8820] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 666.337849][ T5577] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 666.739806][ T5723] usb 7-1: USB disconnect, device number 2 [ 667.912592][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 180 seconds [ 667.912645][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 180 seconds [ 667.912677][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 180 seconds [ 667.912709][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 180 seconds [ 668.020317][ T9189] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.860131][ T9223] netlink: 104 bytes leftover after parsing attributes in process `syz.5.468'. [ 669.075661][ T9189] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.258504][ T5723] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 669.409140][ T5723] usb 6-1: Using ep0 maxpacket: 8 [ 669.411112][ T5723] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 669.412794][ T5723] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 669.412821][ T5723] usb 6-1: config 0 has no interface number 0 [ 669.412868][ T5723] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 669.412894][ T5723] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 669.412921][ T5723] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 669.412951][ T5723] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 669.412996][ T5723] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.537817][ T5723] usb 6-1: config 0 descriptor?? [ 669.569763][ T5723] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 669.666465][ T9236] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 670.032400][ T9240] siw: device registration error -23 [ 670.111634][ T5701] usb 6-1: USB disconnect, device number 3 [ 670.139504][ T5701] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 670.252088][ T9189] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.546345][ T8820] veth0_vlan: entered promiscuous mode [ 670.884117][ T9189] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.943913][ T9251] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 671.327499][ T8820] veth1_vlan: entered promiscuous mode [ 671.554677][ T8820] veth0_macvtap: entered promiscuous mode [ 671.639461][ T8820] veth1_macvtap: entered promiscuous mode [ 671.819699][ T8820] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 671.894416][ T8820] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 672.077984][ T3289] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.173233][ T3289] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.174165][ T3289] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.571513][ T1408] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 673.226147][ T9294] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 673.226815][ T9294] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 673.454499][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 673.454523][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 673.977507][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 673.977531][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 674.598131][ T9319] jffs2: notice: (9319) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 675.806733][ T9353] Bluetooth: ISO socket layer initialized [ 675.958273][ T9358] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 676.089785][ T9364] netlink: 104 bytes leftover after parsing attributes in process `syz.6.520'. [ 676.763774][ T9] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 676.919769][ T9] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 676.938881][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.938911][ T9] usb 9-1: Product: syz [ 676.938928][ T9] usb 9-1: Manufacturer: syz [ 676.938945][ T9] usb 9-1: SerialNumber: syz [ 677.516179][ T9382] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 677.543228][ T5577] usb 9-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 678.052762][ T9374] batman_adv: batadv0: Adding interface: veth0 [ 678.052783][ T9374] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 678.052912][ T9374] batman_adv: batadv0: Interface activated: veth0 [ 678.191272][ T9374] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 678.191303][ T9374] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 678.744989][ T5577] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 678.785966][ T9374] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 678.786283][ T9374] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 678.849881][ T9374] batman_adv: batadv0: Interface deactivated: veth0 [ 678.849910][ T9374] batman_adv: batadv0: Removing interface: veth0 [ 678.895913][ T5577] ath9k_htc: Failed to initialize the device [ 679.166180][ T9392] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 679.166267][ T9392] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 679.462326][ T5577] usb 9-1: ath9k_htc: USB layer deinitialized [ 679.527863][ T9398] netlink: 104 bytes leftover after parsing attributes in process `syz.2.536'. [ 680.507685][ T9] usb 9-1: USB disconnect, device number 2 [ 680.956515][ T9409] netlink: 16402 bytes leftover after parsing attributes in process `syz.8.539'. [ 681.761858][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.761892][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.761936][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.761960][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.761987][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.762012][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.762039][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.762066][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.762092][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.762119][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 681.953481][ T9429] netlink: 36 bytes leftover after parsing attributes in process `syz.2.547'. [ 681.953507][ T9429] netlink: 16 bytes leftover after parsing attributes in process `syz.2.547'. [ 681.953526][ T9429] netlink: 36 bytes leftover after parsing attributes in process `syz.2.547'. [ 682.066795][ T9] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [þk] on syz1 [ 682.237541][ T9432] netlink: 104 bytes leftover after parsing attributes in process `syz.7.550'. [ 682.244274][ T9431] fido_id[9431]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 682.726605][ T9445] netlink: 'syz.8.555': attribute type 10 has an invalid length. [ 682.759174][ T9445] syz_tun: entered promiscuous mode [ 682.777672][ T9445] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 685.216376][ T9507] netlink: 4 bytes leftover after parsing attributes in process `syz.8.577'. [ 685.671472][ T9503] vlan2: entered promiscuous mode [ 685.671498][ T9503] hsr0: entered promiscuous mode [ 685.671854][ T9503] vlan2: entered allmulticast mode [ 685.671870][ T9503] hsr0: entered allmulticast mode [ 685.671884][ T9503] hsr_slave_0: entered allmulticast mode [ 685.671909][ T9503] hsr_slave_1: entered allmulticast mode [ 685.795719][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.795797][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.583690][ T9545] Character devices: [ 687.583690][ T9545] 1 mem [ 687.583690][ T9545] 2 pty [ 687.583690][ T9545] 3 ttyp [ 687.583690][ T9545] 4 /dev/vc/0 [ 687.583690][ T9545] 4 tty [ 687.583690][ T9545] 4 ttyS [ 687.583690][ T9545] 5 /dev/tty [ 687.583690][ T9545] 5 /dev/console [ 687.583690][ T9545] 5 /dev/ptmx [ 687.583690][ T9545] 5 ttyprintk [ 687.583690][ T9545] 7 vcs [ 687.583690][ T9545] 9 st [ 687.583690][ T9545] 10 misc [ 687.583690][ T9545] 13 input [ 687.583690][ T9545] 14 sound [ 687.583690][ T9545] 21 sg [ 687.583690][ T9545] 29 fb [ 687.583690][ T9545] 81 video4linux [ 687.583690][ T9545] 89 i2c [ 687.583690][ T9545] 90 mtd [ 687.583690][ T9545] 98 comedi [ 687.583690][ T9545] 108 ppp [ 687.583690][ T9545] 116 alsa [ 687.583690][ T9545] 128 ptm [ 687.583690][ T9545] 136 pts [ 687.583690][ T9545] 152 aoechr [ 687.583690][ T9545] 166 ttyACM [ 687.583690][ T9545] 180 usb [ 687.583690][ T9545] 188 ttyUSB [ 687.583690][ T9545] 189 usb_device [ 687.583690][ T9545] 202 cpu/msr [ 687.583690][ T9545] 203 cpu/cpuid [ 687.583690][ T9545] 212 DVB [ 687.583690][ T9545] 216 rfcomm [ 687.583690][ T9545] 226 drm [ 687.583690][ T9545] 231 infiniband_mad [ 687.583690][ T9545] 231 infiniband_verbs [ 687.583690][ T9545] 234 mei [ 687.583690][ T9545] 235 ublk-char [ 687.583690][ T9545] 236 ttynull [ 687.583690][ T9545] 237 noz [ 687.583690][ T9545] 238 gsmtty [ 687.583690][ T9545] 239 bsg [ 687.583690][ T9545] 240 pvfs2-req [ 687.583690][ T9545] 241 counter [ 687.583690][ T9545] 242 tee [ 687.583690][ T9545] 243 iio [ 687.583690][ T9545] 244 ptp [ 687.583690][ T9545] 245 pps [ 687.583690][ T9545] 246 cec [ 687.583690][ T9545] 247 media [ 687.583690][ T9545] 248 rtc [ 687.583690][ T9545] 249 dma_heap [ 687.583690][ T9545] 250 dax [ 687.583690][ T9545] 251 dimmctl [ 687.583690][ T9545] 252 ndctl [ 687.583690][ T9545] 253 tpm [ 687.583690][ T9545] 254 gpiochip [ 687.583690][ T9545] 493 hidg [ 687.583690][ T9545] 494 gnss [ 687.599396][ T9545] batadv_slave_0: entered promiscuous mode [ 687.606675][ T9542] batadv_slave_0: left promiscuous mode [ 688.071600][ T9551] netlink: 4 bytes leftover after parsing attributes in process `syz.8.601'. [ 690.117271][ T9597] netlink: 4 bytes leftover after parsing attributes in process `syz.5.616'. [ 690.200338][ T9593] vlan2: entered promiscuous mode [ 690.200363][ T9593] hsr0: entered promiscuous mode [ 690.200637][ T9593] vlan2: entered allmulticast mode [ 690.200654][ T9593] hsr0: entered allmulticast mode [ 690.200667][ T9593] hsr_slave_0: entered allmulticast mode [ 690.200693][ T9593] hsr_slave_1: entered allmulticast mode [ 690.466297][ T5723] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 690.631044][ T5723] usb 8-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 690.632899][ T5723] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 690.686312][ T5723] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 690.686341][ T5723] usb 8-1: Product: syz [ 690.686358][ T5723] usb 8-1: Manufacturer: syz [ 690.686374][ T5723] usb 8-1: SerialNumber: syz [ 690.857258][ T9597] hsr_slave_0: left promiscuous mode [ 690.962013][ T5723] usbhid 8-1:1.0: couldn't find an input interrupt endpoint [ 690.996305][ T9597] hsr_slave_1: left promiscuous mode [ 691.162381][ T5723] usb 8-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 691.840678][ T5723] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 691.905617][ T5723] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 691.905836][ T5723] usb 8-1: media controller created [ 692.504233][ T5723] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 693.244714][ T5723] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 693.299191][ T9636] netlink: 4 bytes leftover after parsing attributes in process `syz.8.636'. [ 693.358574][ T9636] hsr_slave_0: left promiscuous mode [ 693.412141][ T9636] hsr_slave_1: left promiscuous mode [ 694.307330][ T5723] usb 8-1: USB disconnect, device number 2 [ 694.991221][ T9664] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 696.026424][ T9681] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 696.118504][ T9681] md: array md0 already initialised! [ 696.181937][ T9686] md: md0: array is limited to 27 devices [ 696.589434][ T9692] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 696.840419][ T9699] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 696.840514][ T9699] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 697.076961][ T9704] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 697.147039][ T9704] md: array md0 already initialised! [ 697.576706][ T9714] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 697.978505][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 210 seconds [ 697.978557][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 210 seconds [ 697.978590][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 210 seconds [ 697.978622][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 210 seconds [ 698.395364][ T9734] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 698.437190][ T9740] [U] ¹é [ 698.457137][ T9738] netlink: 'syz.6.683': attribute type 10 has an invalid length. [ 698.468914][ T9734] md: array md0 already initialised! [ 698.489233][ T9738] syz_tun: entered promiscuous mode [ 698.686028][ T9749] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.688'. [ 698.928514][ T7918] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 699.105859][ T7918] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 699.118772][ T7918] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 699.118802][ T7918] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 699.118859][ T7918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.175176][ T7918] usb 3-1: config 0 descriptor?? [ 699.199093][ T7918] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 699.199665][ T7918] dvb-usb: bulk message failed: -22 (3/0) [ 699.255061][ T7918] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 699.256339][ T7918] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 699.256398][ T7918] usb 3-1: media controller created [ 699.286916][ T7918] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 699.391505][ T7918] dvb-usb: bulk message failed: -22 (6/0) [ 699.391663][ T7918] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 699.428120][ T7918] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input9 [ 699.528292][ T7918] dvb-usb: schedule remote query interval to 150 msecs. [ 699.528317][ T7918] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 699.546854][ T7918] usb 3-1: USB disconnect, device number 29 [ 699.788550][ T7918] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 700.114065][ T9785] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 700.525375][ T9766] netlink: 'syz.7.695': attribute type 61 has an invalid length. [ 701.554730][ T9823] netlink: 4 bytes leftover after parsing attributes in process `syz.7.717'. [ 701.654955][ T9818] md: array md0 already initialised! [ 701.754249][ T9821] vlan2: entered promiscuous mode [ 701.754269][ T9821] hsr0: entered promiscuous mode [ 701.754555][ T9821] vlan2: entered allmulticast mode [ 701.754571][ T9821] hsr0: entered allmulticast mode [ 701.754584][ T9821] hsr_slave_0: entered allmulticast mode [ 701.754608][ T9821] hsr_slave_1: entered allmulticast mode [ 702.040619][ T9823] hsr_slave_0: left promiscuous mode [ 702.084154][ T9823] hsr_slave_1: left promiscuous mode [ 702.194330][ T9836] netlink: 104 bytes leftover after parsing attributes in process `syz.6.723'. [ 702.731394][ T9852] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 702.755353][ T9854] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 702.755440][ T9854] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 702.788597][ T9852] md: array md0 already initialised! [ 703.046551][ T9863] netlink: 4 bytes leftover after parsing attributes in process `syz.6.735'. [ 703.298037][ T9871] netlink: 104 bytes leftover after parsing attributes in process `syz.5.737'. [ 703.555932][ T9860] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 703.907563][ T9892] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 703.907649][ T9892] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 704.116690][ T9883] netlink: 16402 bytes leftover after parsing attributes in process `syz.8.739'. [ 704.420496][ T9904] netlink: 104 bytes leftover after parsing attributes in process `syz.7.751'. [ 704.833184][ T9915] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 704.833285][ T9915] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 705.060414][ T9928] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 705.060502][ T9928] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 705.440524][ T9943] netlink: 16402 bytes leftover after parsing attributes in process `syz.7.765'. [ 705.552937][ T9945] netlink: 104 bytes leftover after parsing attributes in process `syz.6.767'. [ 705.994573][ T9957] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 706.051688][ T9959] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 706.051782][ T9959] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 706.530218][ T9971] netlink: 104 bytes leftover after parsing attributes in process `syz.8.778'. [ 706.761567][ T9977] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 706.778977][ T5701] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 706.854151][ T9977] md: md0: array is limited to 27 devices [ 706.941461][ T5701] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 706.949630][ T5701] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.135534][ T9981] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 707.633140][ T9994] md: array md0 already initialised! [ 708.097540][ T5701] usb 6-1: ATUSB: AT86RF231 version 180 [ 708.157431][T10004] netlink: 104 bytes leftover after parsing attributes in process `syz.2.791'. [ 708.300066][ T5701] usb 6-1: Firmware version (0.0) predates our first public release. [ 708.300094][ T5701] usb 6-1: Please update to version 0.2 or newer [ 708.303877][ T5701] usb 6-1: Firmware: build [ 709.595347][ T5701] usb 6-1: USB disconnect, device number 4 [ 710.384281][T10063] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 710.648708][ T7918] usb 8-1: new low-speed USB device number 3 using dummy_hcd [ 710.861722][ T7918] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 710.863277][ T7918] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 710.863318][ T7918] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 710.863485][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 710.863518][ T7918] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 710.863546][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 710.863575][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 710.863605][ T7918] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 710.863635][ T7918] usb 8-1: config 168 interface 0 has no altsetting 0 [ 710.865099][ T7918] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 710.865139][ T7918] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 710.865183][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 710.865214][ T7918] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 710.865241][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 710.865269][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 710.865297][ T7918] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 710.865326][ T7918] usb 8-1: config 168 interface 0 has no altsetting 0 [ 710.866764][ T7918] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 710.866803][ T7918] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 710.866875][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 710.866904][ T7918] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 710.866932][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 710.866961][ T7918] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 710.866990][ T7918] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 710.867020][ T7918] usb 8-1: config 168 interface 0 has no altsetting 0 [ 711.037458][ T7918] usb 8-1: string descriptor 0 read error: -22 [ 711.037853][ T7918] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.323211][ T7918] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 712.235366][T10081] dummy_hcd dummy_hcd.0: remove, state 4 [ 712.235831][T10081] usb usb1: USB disconnect, device number 1 [ 713.111365][T10081] dummy_hcd dummy_hcd.0: stopped [ 713.111398][T10081] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 714.116454][ T8573] usb 8-1: USB disconnect, device number 3 [ 714.930678][T10138] netlink: 4 bytes leftover after parsing attributes in process `syz.6.844'. [ 716.188662][T10111] syz.5.833 (10111): drop_caches: 2 [ 716.506577][T10158] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 716.969092][T10170] md: array md0 already initialised! [ 717.011279][T10170] md: md0: array is limited to 27 devices [ 717.243274][T10178] futex_wake_op: syz.2.860 tries to shift op by 144; fix this program [ 718.251986][T10207] md: array md0 already initialised! [ 718.314020][T10207] md: md0: array is limited to 27 devices [ 719.451713][T10242] binder: 10241:10242 ioctl c0306201 0 returned -14 [ 719.452738][T10242] binder: 10241:10242 ioctl c0306201 0 returned -14 [ 721.283018][T10291] md: array md0 already initialised! [ 721.337653][T10291] md: md0: array is limited to 27 devices [ 722.535675][T10323] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 722.535784][T10323] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 722.706309][T10328] netlink: 104 bytes leftover after parsing attributes in process `syz.6.921'. [ 723.231331][T10335] md: array md0 already initialised! [ 723.232794][T10338] md: md0: array is limited to 27 devices [ 723.782590][ T5589] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 723.782907][ T5589] Bluetooth: hci2: Injecting HCI hardware error event [ 723.787571][ T5597] Bluetooth: hci2: hardware error 0x00 [ 724.342077][T10359] netlink: 104 bytes leftover after parsing attributes in process `syz.6.933'. [ 724.481124][T10363] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 724.481223][T10363] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 725.150333][T10376] netlink: 4 bytes leftover after parsing attributes in process `syz.8.939'. [ 725.224445][T10378] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 725.454920][T10388] netlink: 104 bytes leftover after parsing attributes in process `syz.6.943'. [ 726.461135][T10398] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 726.461230][T10398] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 726.508779][ T5597] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 726.738738][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 726.968837][T10408] netlink: 104 bytes leftover after parsing attributes in process `syz.7.954'. [ 727.159508][T10413] overlay: filesystem on ./file0 not supported as upperdir [ 727.977661][T10428] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.960'. [ 728.059959][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 240 seconds [ 728.060014][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 240 seconds [ 728.060049][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 240 seconds [ 728.060083][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 240 seconds [ 728.737666][T10431] netlink: 4 bytes leftover after parsing attributes in process `syz.5.961'. [ 728.823121][ T5597] Bluetooth: hci0: command 0x0406 tx timeout [ 729.018799][T10441] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 729.018892][T10441] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 730.574703][ T37] audit: type=1326 audit(1787212925.151:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10465 comm="syz.8.974" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f02538ae0d9 code=0x0 [ 731.123612][T10481] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 731.123719][T10481] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 731.663082][ T36] usb 7-1: new low-speed USB device number 3 using dummy_hcd [ 731.841470][ T36] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 731.843504][ T36] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 731.843552][ T36] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 731.843597][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 731.843628][ T36] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 731.843656][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 731.843686][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 731.843715][ T36] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 731.843744][ T36] usb 7-1: config 168 interface 0 has no altsetting 0 [ 732.011707][ T36] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 732.011759][ T36] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 732.011800][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 732.011828][ T36] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 732.011855][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 732.011882][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 732.011909][ T36] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 732.011958][ T36] usb 7-1: config 168 interface 0 has no altsetting 0 [ 732.118625][ T36] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 732.118747][ T36] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 732.118891][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 732.118982][ T36] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 732.119055][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 732.119128][ T36] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 732.119202][ T36] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 732.119275][ T36] usb 7-1: config 168 interface 0 has no altsetting 0 [ 732.177576][ T36] usb 7-1: string descriptor 0 read error: -22 [ 732.177971][ T36] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.380339][T10498] netlink: 4 bytes leftover after parsing attributes in process `syz.2.986'. [ 732.489902][T10495] vlan2: entered promiscuous mode [ 732.489925][T10495] hsr0: entered promiscuous mode [ 732.490257][T10495] vlan2: entered allmulticast mode [ 732.492663][T10495] hsr0: entered allmulticast mode [ 732.492682][T10495] hsr_slave_0: entered allmulticast mode [ 732.492709][T10495] hsr_slave_1: entered allmulticast mode [ 732.694470][T10498] hsr_slave_0: left promiscuous mode [ 732.813239][T10498] hsr_slave_1: left promiscuous mode [ 732.856498][ T36] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 733.027748][ T36] usb 7-1: USB disconnect, device number 3 [ 734.018475][ T5589] Bluetooth: hci5: command 0x0406 tx timeout [ 734.577771][T10515] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 734.577814][T10515] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 734.577860][T10515] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 734.777097][T10519] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 734.777188][T10519] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 734.945326][T10515] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 735.599213][T10528] netlink: 12 bytes leftover after parsing attributes in process `syz.5.998'. [ 735.606385][T10528] netlink: 104 bytes leftover after parsing attributes in process `syz.5.998'. [ 736.882002][ T5701] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.858791][ T5701] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.974374][T10557] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1011'. [ 737.999983][T10557] netlink: 104 bytes leftover after parsing attributes in process `syz.7.1011'. [ 738.099009][ T5577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.265524][ T66] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.271198][ T5577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.331228][ T7918] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.617302][ T1222] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.617706][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.898865][ T5701] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.939497][ T5701] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.238982][T10582] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1023'. [ 740.275493][T10582] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1023'. [ 741.019514][T10588] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 741.083960][T10503] bond0: (slave syz_tun): Releasing backup interface [ 741.093896][T10588] md: array md0 already initialised! [ 742.028940][ T5701] net_ratelimit: 4 callbacks suppressed [ 742.028963][ T5701] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.078221][T10602] md: array md0 already initialised! [ 742.079863][T10605] md: md0: array is limited to 27 devices [ 742.713445][T10614] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1034'. [ 742.757664][T10614] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1034'. [ 743.059897][ T5323] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.353327][ T66] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 743.378795][ T8573] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.809503][ T5597] Bluetooth: hci0: unexpected event for opcode 0x2023 [ 744.028096][ T1222] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.042839][ T7918] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.044809][ T7918] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.098896][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.602102][ T5589] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 744.666106][ T5589] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 744.677011][ T5589] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 744.699665][ T5589] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 744.706479][ T5589] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 744.991441][ T66] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.141451][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.327478][T10643] md: array md0 already initialised! [ 745.353195][T10645] md: md0: array is limited to 27 devices [ 745.622705][T10648] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1048'. [ 745.625244][T10648] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1048'. [ 746.129142][ T66] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.179199][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.419070][ T7918] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.891688][ T8573] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 746.904476][ T5589] Bluetooth: hci1: command tx timeout [ 747.007885][ T66] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 747.070067][ T8573] usb 8-1: Using ep0 maxpacket: 8 [ 747.070974][ T8573] usb 8-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 747.072653][ T8573] usb 8-1: config 179 has an invalid interface number: 65 but max is 0 [ 747.072681][ T8573] usb 8-1: config 179 has no interface number 0 [ 747.072731][ T8573] usb 8-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 747.072760][ T8573] usb 8-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 747.072791][ T8573] usb 8-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 747.072820][ T8573] usb 8-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 1040, setting to 1024 [ 747.072850][ T8573] usb 8-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 747.072880][ T8573] usb 8-1: config 179 interface 65 has no altsetting 0 [ 747.072916][ T8573] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.190028][T10674] md: array md0 already initialised! [ 747.230902][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.230976][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.321773][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.346049][T10666] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 747.422468][T10675] md: md0: array is limited to 27 devices [ 747.500832][ T8573] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:179.65/input/input10 [ 747.810440][ T4940] input input10: unable to receive magic message: -110 [ 748.007718][T10631] lo speed is unknown, defaulting to 1000 [ 748.082123][ C0] xpad 8-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 748.128289][ T4940] input input10: unable to receive magic message: -32 [ 748.346549][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.529995][T10631] lo speed is unknown, defaulting to 1000 [ 748.672755][ T9654] input input10: unable to receive magic message: -32 [ 748.758083][ C0] xpad 8-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 748.857432][ T4940] input input10: unable to receive magic message: -32 [ 748.981270][ T5589] Bluetooth: hci1: command tx timeout [ 749.379185][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.462438][ T8573] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.556938][ T4940] input input10: unable to receive magic message: -32 [ 749.630243][ C0] xpad 8-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 749.759295][ T4940] input input10: unable to receive magic message: -32 [ 749.957217][ T5701] usb 8-1: USB disconnect, device number 4 [ 749.957292][ C0] xpad 8-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 750.085451][T10690] bridge0: port 2(bridge_slave_1) entered disabled state [ 750.137720][T10690] bridge0: port 1(bridge_slave_0) entered disabled state [ 750.418847][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.058549][ T5589] Bluetooth: hci1: command tx timeout [ 751.469909][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.749290][T10690] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 751.777010][T10690] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 752.498777][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.498904][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.138689][ T5589] Bluetooth: hci1: command tx timeout [ 753.332097][ T7918] lo speed is unknown, defaulting to 1000 [ 753.332155][ T7918] sz1: Port: 1 Link DOWN [ 753.390053][ T7918] lo speed is unknown, defaulting to 1000 [ 753.539169][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.620531][ T5577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.696722][T10733] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 753.743490][T10737] syz.6.1081 uses obsolete (PF_INET,SOCK_PACKET) [ 753.829499][T10733] md: array md0 already initialised! [ 753.831228][T10738] md: array md0 already initialised! [ 754.587156][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.728651][T10759] md: array md0 already initialised! [ 754.869071][T10759] md: md0: array is limited to 27 devices [ 754.894534][T10762] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 755.069365][T10762] md: array md0 already initialised! [ 755.619955][ T5577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.173500][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.157208][T10784] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1095'. [ 757.233924][T10785] futex_wake_op: syz.6.1097 tries to shift op by 144; fix this program [ 757.268757][ T5701] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.753543][T10793] md: array md0 already has disks! [ 757.758826][T10796] md: could not open device unknown-block(1,0). [ 757.758884][T10796] md: error, md_import_device() returned -16 [ 757.854332][ T66] bridge_slave_1: left allmulticast mode [ 757.854372][ T66] bridge_slave_1: left promiscuous mode [ 757.854653][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.042052][ T66] bridge_slave_0: left allmulticast mode [ 758.042090][ T66] bridge_slave_0: left promiscuous mode [ 758.042348][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 758.138618][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 270 seconds [ 758.138671][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 270 seconds [ 758.138705][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 270 seconds [ 758.138737][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 270 seconds [ 760.275545][T10837] md: array md0 already has disks! [ 760.276092][T10840] md: could not open device unknown-block(1,0). [ 760.276158][T10840] md: error, md_import_device() returned -16 [ 760.817820][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 760.905262][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 761.016548][ T66] bond0 (unregistering): Released all slaves [ 762.258703][T10872] syzkaller0: entered promiscuous mode [ 762.461324][T10868] syzkaller0: entered allmulticast mode [ 762.802082][T10878] netlink: 'syz.5.1120': attribute type 10 has an invalid length. [ 763.057668][T10882] md: array md0 already has disks! [ 763.183688][T10883] md: could not open device unknown-block(1,0). [ 763.183765][T10883] md: error, md_import_device() returned -16 [ 763.770267][T10885] siw: device registration error -23 [ 764.048493][T10878] syz_tun: entered promiscuous mode [ 764.166343][T10878] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 766.174372][T10631] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.174743][T10631] bridge0: port 1(bridge_slave_0) entered disabled state [ 766.174985][T10631] bridge_slave_0: entered allmulticast mode [ 766.212674][T10631] bridge_slave_0: entered promiscuous mode [ 766.432566][T10920] md: array md0 already has disks! [ 766.432745][T10921] md: could not open device unknown-block(1,0). [ 766.432805][T10921] md: error, md_import_device() returned -16 [ 766.655492][T10631] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.655626][T10631] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.655974][T10631] bridge_slave_1: entered allmulticast mode [ 766.689232][T10631] bridge_slave_1: entered promiscuous mode [ 767.244548][T10631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 767.327638][T10631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 767.754456][T10936] netlink: 'syz.5.1134': attribute type 10 has an invalid length. [ 768.298251][ T8573] logitech-hidpp-device 0003:046D:C082.0004: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 768.598902][ T5250] 8021q: adding VLAN 0 to HW filter on device eth17 [ 768.766844][T10938] fido_id[10938]: Failed to read report descriptor at '/sys/devices/virtual/misc/uhid/0003:046D:C082.0004/report_descriptor': No such device [ 769.132884][T10631] team0: Port device team_slave_0 added [ 769.232987][T10631] team0: Port device team_slave_1 added [ 770.352289][ T66] veth1_macvtap: left promiscuous mode [ 770.421778][ T66] veth0_macvtap: left promiscuous mode [ 770.422060][ T66] veth1_vlan: left promiscuous mode [ 770.422256][ T66] veth0_vlan: left promiscuous mode [ 771.064080][T10957] md: array md0 already has disks! [ 771.181287][T10958] md: could not open device unknown-block(1,0). [ 771.181373][T10958] md: error, md_import_device() returned -16 [ 773.670879][ T66] team0 (unregistering): Port device team_slave_1 removed [ 773.750663][ T66] team0 (unregistering): Port device team_slave_0 removed [ 774.945777][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 774.998572][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.004856][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.005480][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.005657][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.005823][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.005987][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.006159][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.023091][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.023399][T10970] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 775.282528][T10631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 775.282547][T10631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 775.282576][T10631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 775.365136][T10631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 775.365150][T10631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 775.365172][T10631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 775.732009][T10631] hsr_slave_0: entered promiscuous mode [ 775.738023][T10631] hsr_slave_1: entered promiscuous mode [ 775.959881][ T5250] 8021q: adding VLAN 0 to HW filter on device eth18 [ 777.847656][ T5597] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 777.915350][ T5597] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 777.950596][ T5597] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 777.959181][ T5597] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 777.984517][ T5597] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 779.049448][T10631] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 779.164808][T10631] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 779.198003][T10631] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 779.304028][T10631] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 779.339125][T11034] netlink: 'syz.7.1158': attribute type 10 has an invalid length. [ 779.486236][T10631] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 779.610208][T10631] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 779.624313][T10631] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 779.734578][T10631] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 779.737637][ T5250] 8021q: adding VLAN 0 to HW filter on device eth19 [ 780.178821][ T5589] Bluetooth: hci4: command tx timeout [ 780.529363][T10631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 780.706915][T10631] 8021q: adding VLAN 0 to HW filter on device team0 [ 780.805209][ T1222] bridge0: port 1(bridge_slave_0) entered blocking state [ 780.806961][ T1222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 781.433640][T11012] lo speed is unknown, defaulting to 1000 [ 781.451343][ T1222] bridge0: port 2(bridge_slave_1) entered blocking state [ 781.453191][ T1222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 781.522168][T11012] lo speed is unknown, defaulting to 1000 [ 782.258498][ T5589] Bluetooth: hci4: command tx timeout [ 782.679042][T11111] netlink: 'syz.5.1175': attribute type 10 has an invalid length. [ 783.865319][ T1370] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.209432][ T5250] 8021q: adding VLAN 0 to HW filter on device eth20 [ 784.342802][ T5589] Bluetooth: hci4: command tx timeout [ 784.970512][ T1370] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 785.701962][T11147] futex_wake_op: syz.7.1185 tries to shift op by 144; fix this program [ 785.783401][ T1370] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 786.293219][T11153] netlink: 'syz.5.1186': attribute type 10 has an invalid length. [ 786.418460][ T5589] Bluetooth: hci4: command tx timeout [ 786.842926][ T1370] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 788.190852][T11188] futex_wake_op: syz.2.1195 tries to shift op by 144; fix this program [ 788.197111][T11189] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1196'. [ 788.219134][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 300 seconds [ 788.219184][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 300 seconds [ 788.219217][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 300 seconds [ 788.219250][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 300 seconds [ 788.295318][T11190] netlink: 'syz.7.1196': attribute type 10 has an invalid length. [ 789.045366][T10631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 790.491864][T11012] bridge0: port 1(bridge_slave_0) entered blocking state [ 790.491955][T11012] bridge0: port 1(bridge_slave_0) entered disabled state [ 790.492167][T11012] bridge_slave_0: entered allmulticast mode [ 790.506596][T11012] bridge_slave_0: entered promiscuous mode [ 790.839148][T11012] bridge0: port 2(bridge_slave_1) entered blocking state [ 790.839333][T11012] bridge0: port 2(bridge_slave_1) entered disabled state [ 790.839541][T11012] bridge_slave_1: entered allmulticast mode [ 790.851325][T11012] bridge_slave_1: entered promiscuous mode [ 790.891987][T11224] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1206'. [ 790.987704][T11228] netlink: 'syz.7.1206': attribute type 10 has an invalid length. [ 791.507414][T11012] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 791.558467][T11012] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 791.794790][ T1370] bridge_slave_1: left allmulticast mode [ 791.794827][ T1370] bridge_slave_1: left promiscuous mode [ 791.795123][ T1370] bridge0: port 2(bridge_slave_1) entered disabled state [ 791.985799][ T1370] bridge_slave_0: left allmulticast mode [ 791.985838][ T1370] bridge_slave_0: left promiscuous mode [ 791.986095][ T1370] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.966831][ T1370] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 794.061196][ T1370] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 794.161686][ T1370] bond0 (unregistering): Released all slaves [ 794.531448][T11012] team0: Port device team_slave_0 added [ 794.539318][T11012] team0: Port device team_slave_1 added [ 795.008944][T11253] md: array md0 already has disks! [ 795.117038][T11256] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1217'. [ 795.176004][T11258] netlink: 'syz.7.1217': attribute type 10 has an invalid length. [ 795.260488][T11012] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 795.260510][T11012] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.260545][T11012] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 795.337214][T11012] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 795.337236][T11012] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.337270][T11012] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 796.382514][T11012] hsr_slave_0: entered promiscuous mode [ 796.398015][T11012] hsr_slave_1: entered promiscuous mode [ 796.406099][T11012] debugfs: 'hsr0' already exists in 'hsr' [ 796.406129][T11012] Cannot create hsr debugfs directory [ 796.601394][T10631] veth0_vlan: entered promiscuous mode [ 797.165916][T10631] veth1_vlan: entered promiscuous mode [ 797.234319][T11289] md: array md0 already has disks! [ 797.719189][T11299] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1228'. [ 797.818603][T11302] netlink: 'syz.2.1228': attribute type 10 has an invalid length. [ 798.025801][ T5250] 8021q: adding VLAN 0 to HW filter on device eth21 [ 798.464711][ T1370] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 798.464742][ T1370] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 798.503211][ T1370] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 798.503241][ T1370] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 798.613632][ T1370] veth1_macvtap: left promiscuous mode [ 798.613749][ T1370] veth0_macvtap: left promiscuous mode [ 798.614038][ T1370] veth1_vlan: left promiscuous mode [ 798.614235][ T1370] veth0_vlan: left promiscuous mode [ 800.009968][T11325] md: array md0 already has disks! [ 800.553159][T11331] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1236'. [ 800.844035][ T1370] team0 (unregistering): Port device team_slave_1 removed [ 800.942814][ T1370] team0 (unregistering): Port device team_slave_0 removed [ 802.230051][T10631] veth0_macvtap: entered promiscuous mode [ 802.309379][T10631] veth1_macvtap: entered promiscuous mode [ 802.405616][T10631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 802.514147][T10631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 802.814601][T11344] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1240'. [ 802.924146][T11344] netlink: 'syz.7.1240': attribute type 10 has an invalid length. [ 802.956564][T11348] vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 802.956655][T11348] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 803.630240][T11359] md: array md0 already has disks! [ 804.157587][ T5597] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 804.213901][ T5597] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 804.241170][ T5597] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 804.247041][ T5597] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 804.262342][ T5597] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 804.611677][ T1283] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.638631][ T1283] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.638693][ T1283] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.638734][ T1283] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.834671][T11378] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1249'. [ 805.491309][T11390] md: could not open device unknown-block(1,0). [ 805.491401][T11390] md: error, md_import_device() returned -16 [ 805.572115][ T5250] 8021q: adding VLAN 0 to HW filter on device eth22 [ 805.818548][T11394] md: array md0 already has disks! [ 806.106700][T11402] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1255'. [ 806.193264][T11405] netlink: 'syz.2.1255': attribute type 10 has an invalid length. [ 806.498639][ T5597] Bluetooth: hci2: command tx timeout [ 807.046283][T11426] md: could not open device unknown-block(1,0). [ 807.046347][T11426] md: error, md_import_device() returned -16 [ 807.586790][T11368] lo speed is unknown, defaulting to 1000 [ 807.599630][T11368] lo speed is unknown, defaulting to 1000 [ 807.660018][ T5250] 8021q: adding VLAN 0 to HW filter on device eth23 [ 807.840615][T11441] md: array md0 already has disks! [ 808.261429][T11452] overlayfs: missing 'lowerdir' [ 808.579353][ T5597] Bluetooth: hci2: command tx timeout [ 808.661212][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.661286][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.996840][ T66] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 809.463542][T11473] md: could not open device unknown-block(1,0). [ 809.463610][T11473] md: error, md_import_device() returned -16 [ 809.738967][T11483] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 809.744110][ T5250] 8021q: adding VLAN 0 to HW filter on device eth24 [ 809.890527][T11485] md: array md0 already has disks! [ 809.932229][T11485] md: array md0 already has disks! [ 810.060385][T11489] overlayfs: missing 'lowerdir' [ 810.247604][ T66] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.658460][ T5597] Bluetooth: hci2: command tx timeout [ 810.756231][T11503] md: could not open device unknown-block(1,0). [ 810.756277][T11503] md: error, md_import_device() returned -16 [ 811.107171][ T66] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.170330][T11012] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 811.214068][T11012] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 811.314342][T11012] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 811.353909][T11012] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 811.487514][T11530] overlayfs: missing 'lowerdir' [ 811.558058][T11012] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 811.672699][T11012] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 811.977985][ T66] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 812.031093][T11012] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 812.072588][T11012] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 812.430485][T11552] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 812.744840][ T5597] Bluetooth: hci2: command tx timeout [ 812.989268][T11563] bond0: (slave syz_tun): Releasing backup interface [ 813.254950][T11573] overlayfs: missing 'workdir' [ 813.866966][T11012] 8021q: adding VLAN 0 to HW filter on device bond0 [ 814.216777][T11599] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 814.262787][ T66] bridge_slave_1: left allmulticast mode [ 814.262827][ T66] bridge_slave_1: left promiscuous mode [ 814.263121][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 814.450763][ T66] bridge_slave_0: left allmulticast mode [ 814.450801][ T66] bridge_slave_0: left promiscuous mode [ 814.451838][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 814.453780][T11607] overlayfs: missing 'workdir' [ 814.621846][T11613] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1309'. [ 815.609117][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 815.669144][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 815.690933][ T66] bond0 (unregistering): Released all slaves [ 815.731011][T11368] bridge0: port 1(bridge_slave_0) entered blocking state [ 815.731155][T11368] bridge0: port 1(bridge_slave_0) entered disabled state [ 815.731434][T11368] bridge_slave_0: entered allmulticast mode [ 815.733944][T11368] bridge_slave_0: entered promiscuous mode [ 815.857034][T11368] bridge0: port 2(bridge_slave_1) entered blocking state [ 815.857200][T11368] bridge0: port 2(bridge_slave_1) entered disabled state [ 815.857404][T11368] bridge_slave_1: entered allmulticast mode [ 815.935302][T11368] bridge_slave_1: entered promiscuous mode [ 816.100813][T11634] overlayfs: missing 'workdir' [ 816.261509][T11012] 8021q: adding VLAN 0 to HW filter on device team0 [ 816.397136][T11368] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 816.476915][T11368] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 816.572673][ T1408] bridge0: port 1(bridge_slave_0) entered blocking state [ 816.574741][ T1408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 817.249805][T11659] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1323'. [ 817.274296][ T3368] bridge0: port 2(bridge_slave_1) entered blocking state [ 817.274473][ T3368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 817.307412][T11368] team0: Port device team_slave_0 added [ 817.324963][T11660] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1323'. [ 817.342839][T11368] team0: Port device team_slave_1 added [ 817.489222][T11664] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1324'. [ 817.708936][ T66] hsr_slave_0: left promiscuous mode [ 817.750039][ T66] hsr_slave_1: left promiscuous mode [ 817.752860][ T66] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 817.752894][ T66] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 817.812674][ T66] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 817.812706][ T66] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 817.947533][ T66] veth1_macvtap: left promiscuous mode [ 817.947645][ T66] veth0_macvtap: left promiscuous mode [ 817.947938][ T66] veth1_vlan: left promiscuous mode [ 817.948129][ T66] veth0_vlan: left promiscuous mode [ 818.300872][ T32] block nbd2: Possible stuck request ffff8880277d0000: control (read@0,1024B). Runtime 330 seconds [ 818.300927][ T32] block nbd2: Possible stuck request ffff8880277d01c0: control (read@1024,1024B). Runtime 330 seconds [ 818.300964][ T32] block nbd2: Possible stuck request ffff8880277d0380: control (read@2048,1024B). Runtime 330 seconds [ 818.301010][ T32] block nbd2: Possible stuck request ffff8880277d0540: control (read@3072,1024B). Runtime 330 seconds [ 818.528631][ T5723] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 818.689384][ T5723] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 818.690661][ T5723] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 818.690692][ T5723] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 818.690734][ T5723] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 818.755867][ T5723] usb 6-1: config 0 descriptor?? [ 819.009356][ T66] team0 (unregistering): Port device team_slave_1 removed [ 819.069327][ T66] team0 (unregistering): Port device team_slave_0 removed [ 819.218724][ T5723] keytouch 0003:0926:3333.0005: fixing up Keytouch IEC report descriptor [ 819.245564][ T5723] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0005/input/input11 [ 819.522173][T11368] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 819.522190][T11368] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 819.522217][T11368] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 819.597387][T11368] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 819.597405][T11368] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 819.597432][T11368] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 819.843204][T11368] hsr_slave_0: entered promiscuous mode [ 819.856143][T11368] hsr_slave_1: entered promiscuous mode [ 819.957032][T11688] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1333'. [ 820.069664][T11688] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1333'. [ 820.303524][T11694] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1334'. [ 820.613134][ T5723] keytouch 0003:0926:3333.0005: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 822.178855][T11737] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1345'. [ 822.178881][T11737] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1345'. [ 822.245695][T11738] netlink: 'syz.5.1344': attribute type 10 has an invalid length. [ 822.282357][T11739] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1345'. [ 822.282388][T11739] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1345'. [ 822.373575][ T5723] usb 6-1: USB disconnect, device number 5 [ 823.470989][T11763] md: could not open device unknown-block(1,0). [ 823.471053][T11763] md: error, md_import_device() returned -16 [ 823.497813][T11768] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1354'. [ 824.063871][T11012] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 824.083454][T11783] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1358'. [ 824.083483][T11783] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1358'. [ 824.349428][T11791] netlink: 'syz.2.1360': attribute type 10 has an invalid length. [ 824.668912][T11798] md: could not open device unknown-block(1,0). [ 824.668979][T11798] md: error, md_import_device() returned -16 [ 824.785357][T11012] veth0_vlan: entered promiscuous mode [ 824.907827][T11012] veth1_vlan: entered promiscuous mode [ 825.144567][T11012] veth0_macvtap: entered promiscuous mode [ 825.166466][T11012] veth1_macvtap: entered promiscuous mode [ 825.175397][T11810] __nla_validate_parse: 4 callbacks suppressed [ 825.175416][T11810] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1366'. [ 825.360293][T11812] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1367'. [ 825.361292][T11812] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1367'. [ 825.364154][T11012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 825.533857][T11012] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 825.631342][ T3368] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.631386][ T3368] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.631419][ T3368] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.631451][ T3368] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.636314][T11818] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 825.762280][T11815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1369'. [ 825.820128][T11815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1369'. [ 825.999525][T11825] netlink: 'syz.7.1371': attribute type 10 has an invalid length. [ 827.632494][ T3289] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 827.632517][ T3289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 828.173395][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 828.173418][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 828.217552][T11871] netlink: 'syz.7.1383': attribute type 10 has an invalid length. [ 828.260349][T11368] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 828.305292][T11368] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 828.307026][T11368] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 828.457962][T11368] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 828.525498][T11368] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 828.634432][T11368] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 828.637179][T11368] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 828.703848][T11368] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 829.161466][T11897] md: array md0 already has disks! [ 829.161710][T11899] md: could not open device unknown-block(1,0). [ 829.161766][T11899] md: error, md_import_device() returned -16 [ 829.564592][T11368] 8021q: adding VLAN 0 to HW filter on device bond0 [ 829.824678][T11915] netlink: 'syz.7.1393': attribute type 10 has an invalid length. [ 829.874781][T11368] 8021q: adding VLAN 0 to HW filter on device team0 [ 829.927573][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 829.936811][ T422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 830.063004][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 830.063160][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 830.817464][T11943] md: array md0 already has disks! [ 830.817835][T11945] md: could not open device unknown-block(1,0). [ 830.817899][T11945] md: error, md_import_device() returned -16 [ 831.221001][T11953] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1406'. [ 831.253520][T11953] netlink: 'syz.2.1406': attribute type 10 has an invalid length. [ 831.275060][T11954] netlink: 'syz.5.1405': attribute type 1 has an invalid length. [ 831.275084][T11954] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1405'. [ 832.483383][T11368] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 832.525121][T11995] futex_wake_op: syz.7.1417 tries to shift op by 144; fix this program [ 832.895494][T12005] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 833.217698][T12015] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1420'. [ 833.230099][T12015] netlink: 'syz.3.1420': attribute type 10 has an invalid length. [ 833.256417][T12017] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 833.273536][T12015] syz_tun: entered promiscuous mode [ 833.300126][T12017] md: array md0 already has disks! [ 833.315698][T12015] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 833.767010][T12028] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 833.831857][T11368] veth0_vlan: entered promiscuous mode [ 833.914911][T11368] veth1_vlan: entered promiscuous mode [ 834.365169][T12049] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 834.420024][T11368] veth0_macvtap: entered promiscuous mode [ 834.449252][T11368] veth1_macvtap: entered promiscuous mode [ 834.479198][T12049] md: array md0 already has disks! [ 834.768861][T12060] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1432'. [ 834.818218][T12061] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1432'. [ 834.818585][T11200] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 834.878200][T12062] netlink: 'syz.5.1432': attribute type 10 has an invalid length. [ 834.941860][T12063] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 834.958632][T11200] usb 3-1: device descriptor read/64, error -71 [ 835.127986][T12067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1434'. [ 835.181206][T12068] netlink: 'syz.3.1434': attribute type 10 has an invalid length. [ 835.208416][T11200] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 835.298769][T12071] md: could not open device unknown-block(1,0). [ 835.298833][T12071] md: error, md_import_device() returned -16 [ 835.348482][T11200] usb 3-1: device descriptor read/64, error -71 [ 835.351417][T11368] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 835.388103][T11368] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 835.460465][T11200] usb usb3-port1: attempt power cycle [ 835.587308][ T1370] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.631968][T12077] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 835.827154][T11200] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 835.840678][T11200] usb 3-1: device descriptor read/8, error -71 [ 836.100303][T11200] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 836.133428][T11200] usb 3-1: device descriptor read/8, error -71 [ 836.239122][T11200] usb usb3-port1: unable to enumerate USB device [ 836.349495][T12092] md: array md0 already has disks! [ 836.388960][T12092] md: array md0 already has disks! [ 836.408595][ T422] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.412004][ T1283] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.413123][ T1283] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.937692][ T3289] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 836.937714][ T3289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 837.206101][ T1283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 837.206124][ T1283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 837.795877][T12117] futex_wake_op: syz.2.1445 tries to shift op by 144; fix this program [ 837.919593][ T9] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 838.083239][ T9] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 838.085071][ T9] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 838.085114][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 838.085156][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 838.085185][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 838.087689][ T9] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 838.087731][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 838.087774][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 838.087804][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 838.129780][ T9] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 838.130628][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 838.130740][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 838.133665][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 838.245088][ T9] usb 4-1: string descriptor 0 read error: -22 [ 838.245259][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.470835][ T9] adutux 4-1:168.0: interrupt endpoints not found [ 838.734476][T11200] usb 4-1: USB disconnect, device number 2 [ 839.484120][T12134] Could not create tracefs 'set_event_pid' entry [ 839.539747][T12145] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 839.617376][T12134] Could not create tracefs 'set_event_notrace_pid' entry [ 839.742085][T12134] ------------[ cut here ]------------ [ 839.742101][T12134] !list_empty(&ei->children) [ 839.742123][T12134] WARNING: fs/tracefs/event_inode.c:128 at free_ei+0x284/0x340, CPU#0: syz.9.1447/12134 [ 839.742314][T12134] Modules linked in: [ 839.742352][T12134] CPU: 0 UID: 0 PID: 12134 Comm: syz.9.1447 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 839.742379][T12134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 839.742398][T12134] RIP: 0010:free_ei+0x284/0x340 [ 839.742435][T12134] Code: 48 c7 c7 40 80 77 8e 48 89 de 48 c7 c2 90 a0 cf 83 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 32 69 da fd e8 ad 3f f6 fd 90 <0f> 0b 90 e9 c7 fd ff ff e8 9f 3f f6 fd 90 0f 0b 90 48 b8 00 00 00 [ 839.742455][T12134] RSP: 0000:ffffc90003e3fa88 EFLAGS: 00010283 [ 839.742476][T12134] RAX: ffffffff83cfa423 RBX: ffff88803560dd10 RCX: 0000000000080000 [ 839.742495][T12134] RDX: ffffc9001c307000 RSI: 000000000007e3be RDI: 000000000007e3bf [ 839.742510][T12134] RBP: ffff88803560dd00 R08: 00000000ffffffff R09: 1ffffffff1f5fba6 [ 839.742528][T12134] R10: dffffc0000000000 R11: fffffbfff1f5fba7 R12: 0000000000000000 [ 839.742543][T12134] R13: ffff8880407c4800 R14: ffff88803560dd00 R15: 0000000000000003 [ 839.742560][T12134] FS: 00007fbd002b56c0(0000) GS:ffff888125c29000(0000) knlGS:0000000000000000 [ 839.742580][T12134] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 839.742597][T12134] CR2: 00007fffc2676ff8 CR3: 000000003bb34000 CR4: 00000000003526f0 [ 839.742623][T12134] Call Trace: [ 839.742632][T12134] [ 839.742641][T12134] ? new_inode+0x13a/0x170 [ 839.742763][T12134] ? tracefs_get_inode+0x11/0x80 [ 839.742803][T12134] eventfs_create_events_dir+0x7c7/0xa00 [ 839.742849][T12134] create_event_toplevel_files+0x11e/0x1a0 [ 839.742934][T12134] event_trace_add_tracer+0x8a/0x3b0 [ 839.742985][T12134] trace_array_create_dir+0x77/0x160 [ 839.743042][T12134] trace_array_create_systems+0xb3c/0xe60 [ 839.743070][T12134] ? mutex_lock_nested+0x152/0x1d0 [ 839.743219][T12134] instance_mkdir+0xd5/0x140 [ 839.743281][T12134] tracefs_syscall_mkdir+0x11a/0x190 [ 839.743318][T12134] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 839.743351][T12134] ? generic_permission+0x2bf/0x670 [ 839.743418][T12134] ? __pfx_tracefs_permission+0x10/0x10 [ 839.743455][T12134] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 839.743531][T12134] vfs_mkdir+0x408/0x620 [ 839.743576][T12134] filename_mkdirat+0x289/0x520 [ 839.743622][T12134] ? __pfx_filename_mkdirat+0x10/0x10 [ 839.743663][T12134] ? do_getname+0x151/0x250 [ 839.743693][T12134] __se_sys_mkdirat+0x35/0x150 [ 839.743734][T12134] do_syscall_64+0x166/0x520 [ 839.743789][T12134] ? trace_irq_disable+0x3b/0x140 [ 839.743812][T12134] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.743860][T12134] ? clear_bhb_loop+0x70/0xc0 [ 839.743890][T12134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.743914][T12134] RIP: 0033:0x7fbd0207e0d9 [ 839.743937][T12134] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 839.743965][T12134] RSP: 002b:00007fbd002b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 839.743990][T12134] RAX: ffffffffffffffda RBX: 00007fbd02306090 RCX: 00007fbd0207e0d9 [ 839.744007][T12134] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 839.744023][T12134] RBP: 00007fbd02115024 R08: 0000000000000000 R09: 0000000000000000 [ 839.744037][T12134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 839.744051][T12134] R13: 00007fbd02306128 R14: 00007fbd02306090 R15: 00007ffcd0d89fc8 [ 839.744089][T12134] [ 839.744106][T12134] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 839.744124][T12134] CPU: 0 UID: 0 PID: 12134 Comm: syz.9.1447 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 839.744149][T12134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 839.744162][T12134] Call Trace: [ 839.744171][T12134] [ 839.744179][T12134] vpanic+0x56d/0xa60 [ 839.744264][T12134] ? __pfx__printk+0x10/0x10 [ 839.744290][T12134] ? __pfx_vpanic+0x10/0x10 [ 839.744322][T12134] ? is_bpf_text_address+0x292/0x2b0 [ 839.744375][T12134] ? is_bpf_text_address+0x26/0x2b0 [ 839.744416][T12134] panic+0xc5/0xd0 [ 839.744451][T12134] ? __pfx_panic+0x10/0x10 [ 839.744507][T12134] __warn+0x315/0x4c0 [ 839.744527][T12134] ? free_ei+0x284/0x340 [ 839.744564][T12134] ? free_ei+0x284/0x340 [ 839.744597][T12134] __report_bug+0x276/0x570 [ 839.744667][T12134] ? free_ei+0x284/0x340 [ 839.744703][T12134] ? __pfx___report_bug+0x10/0x10 [ 839.744737][T12134] ? kasan_quarantine_put+0xbb/0x1f0 [ 839.744806][T12134] ? lockdep_hardirqs_on+0x7b/0x110 [ 839.744846][T12134] ? free_ei+0x284/0x340 [ 839.744879][T12134] report_bug+0x16b/0x220 [ 839.744903][T12134] ? free_ei+0x284/0x340 [ 839.744933][T12134] ? free_ei+0x286/0x340 [ 839.744976][T12134] handle_bug+0x9c/0x200 [ 839.745001][T12134] exc_invalid_op+0x1a/0x50 [ 839.745026][T12134] asm_exc_invalid_op+0x1a/0x20 [ 839.745047][T12134] RIP: 0010:free_ei+0x284/0x340 [ 839.745080][T12134] Code: 48 c7 c7 40 80 77 8e 48 89 de 48 c7 c2 90 a0 cf 83 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 32 69 da fd e8 ad 3f f6 fd 90 <0f> 0b 90 e9 c7 fd ff ff e8 9f 3f f6 fd 90 0f 0b 90 48 b8 00 00 00 [ 839.745100][T12134] RSP: 0000:ffffc90003e3fa88 EFLAGS: 00010283 [ 839.745120][T12134] RAX: ffffffff83cfa423 RBX: ffff88803560dd10 RCX: 0000000000080000 [ 839.745137][T12134] RDX: ffffc9001c307000 RSI: 000000000007e3be RDI: 000000000007e3bf [ 839.745172][T12134] RBP: ffff88803560dd00 R08: 00000000ffffffff R09: 1ffffffff1f5fba6 [ 839.745190][T12134] R10: dffffc0000000000 R11: fffffbfff1f5fba7 R12: 0000000000000000 [ 839.745206][T12134] R13: ffff8880407c4800 R14: ffff88803560dd00 R15: 0000000000000003 [ 839.745232][T12134] ? free_ei+0x283/0x340 [ 839.745274][T12134] ? free_ei+0x283/0x340 [ 839.745305][T12134] ? new_inode+0x13a/0x170 [ 839.745330][T12134] ? tracefs_get_inode+0x11/0x80 [ 839.745367][T12134] eventfs_create_events_dir+0x7c7/0xa00 [ 839.745412][T12134] create_event_toplevel_files+0x11e/0x1a0 [ 839.745453][T12134] event_trace_add_tracer+0x8a/0x3b0 [ 839.745494][T12134] trace_array_create_dir+0x77/0x160 [ 839.745526][T12134] trace_array_create_systems+0xb3c/0xe60 [ 839.745553][T12134] ? mutex_lock_nested+0x152/0x1d0 [ 839.745586][T12134] instance_mkdir+0xd5/0x140 [ 839.745624][T12134] tracefs_syscall_mkdir+0x11a/0x190 [ 839.745657][T12134] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 839.745688][T12134] ? generic_permission+0x2bf/0x670 [ 839.745720][T12134] ? __pfx_tracefs_permission+0x10/0x10 [ 839.745756][T12134] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 839.745793][T12134] vfs_mkdir+0x408/0x620 [ 839.745839][T12134] filename_mkdirat+0x289/0x520 [ 839.745883][T12134] ? __pfx_filename_mkdirat+0x10/0x10 [ 839.745925][T12134] ? do_getname+0x151/0x250 [ 839.745963][T12134] __se_sys_mkdirat+0x35/0x150 [ 839.746005][T12134] do_syscall_64+0x166/0x520 [ 839.746026][T12134] ? trace_irq_disable+0x3b/0x140 [ 839.746049][T12134] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.746074][T12134] ? clear_bhb_loop+0x70/0xc0 [ 839.746104][T12134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.746128][T12134] RIP: 0033:0x7fbd0207e0d9 [ 839.746149][T12134] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 839.746170][T12134] RSP: 002b:00007fbd002b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 839.746194][T12134] RAX: ffffffffffffffda RBX: 00007fbd02306090 RCX: 00007fbd0207e0d9 [ 839.746212][T12134] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 839.746229][T12134] RBP: 00007fbd02115024 R08: 0000000000000000 R09: 0000000000000000 [ 839.746244][T12134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 839.746258][T12134] R13: 00007fbd02306128 R14: 00007fbd02306090 R15: 00007ffcd0d89fc8 [ 839.746298][T12134] [ 839.746909][T12134] Kernel Offset: disabled