last executing test programs: 3m39.990333751s ago: executing program 2 (id=319): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101180) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000000c0)={0x80, 0x4, 0x1, 'queue0\x00', 0x5}) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x274100) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x1}, 0x1c) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x600000) ioctl$SIOCAX25CTLCON(r4, 0x89e8, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x5, 0x5, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet(0x2, 0x3, 0x4) r6 = socket(0x10, 0x3, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r7, 0x0, 0xcf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x40}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}]}, 0x5c}}, 0x0) 2m58.736746139s ago: executing program 2 (id=319): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101180) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000000c0)={0x80, 0x4, 0x1, 'queue0\x00', 0x5}) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x274100) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x1}, 0x1c) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x600000) ioctl$SIOCAX25CTLCON(r4, 0x89e8, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x5, 0x5, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet(0x2, 0x3, 0x4) r6 = socket(0x10, 0x3, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r7, 0x0, 0xcf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x40}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}]}, 0x5c}}, 0x0) 2m10.041655507s ago: executing program 2 (id=319): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101180) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000000c0)={0x80, 0x4, 0x1, 'queue0\x00', 0x5}) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x274100) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x1}, 0x1c) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x600000) ioctl$SIOCAX25CTLCON(r4, 0x89e8, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x5, 0x5, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet(0x2, 0x3, 0x4) r6 = socket(0x10, 0x3, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r7, 0x0, 0xcf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x40}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}]}, 0x5c}}, 0x0) 1m36.35998779s ago: executing program 2 (id=319): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101180) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000000c0)={0x80, 0x4, 0x1, 'queue0\x00', 0x5}) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x274100) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x1}, 0x1c) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x600000) ioctl$SIOCAX25CTLCON(r4, 0x89e8, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x5, 0x5, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet(0x2, 0x3, 0x4) r6 = socket(0x10, 0x3, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r7, 0x0, 0xcf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x40}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}]}, 0x5c}}, 0x0) 1m0.957398782s ago: executing program 2 (id=319): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101180) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000000c0)={0x80, 0x4, 0x1, 'queue0\x00', 0x5}) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x274100) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x1}, 0x1c) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x600000) ioctl$SIOCAX25CTLCON(r4, 0x89e8, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x5, 0x5, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet(0x2, 0x3, 0x4) r6 = socket(0x10, 0x3, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r7, 0x0, 0xcf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x40}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}]}, 0x5c}}, 0x0) 19.659387031s ago: executing program 2 (id=319): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101180) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000000c0)={0x80, 0x4, 0x1, 'queue0\x00', 0x5}) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x274100) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x1}, 0x1c) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x600000) ioctl$SIOCAX25CTLCON(r4, 0x89e8, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x5, 0x5, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet(0x2, 0x3, 0x4) r6 = socket(0x10, 0x3, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r7, 0x0, 0xcf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x40}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}]}, 0x5c}}, 0x0) 7.795116301s ago: executing program 1 (id=845): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x3}, 0x10) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1, 0x0, 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) bind$tipc(r0, 0x0, 0x0) sendmsg$tipc(r0, &(0x7f0000000240)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x18, 0x0, 0x4}}, 0x10, 0x0}, 0x0) 6.7264327s ago: executing program 1 (id=848): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x40, 0x81, 0x9, 0x6, {{0xc, 0x4, 0x1, 0x3, 0x30, 0x67, 0x0, 0x2, 0x4, 0x0, @multicast2, @broadcast, {[@generic={0x44, 0x8, "d562b60a9539"}, @timestamp_prespec={0x44, 0x14, 0x55, 0x3, 0x6, [{@local, 0x401}, {@local, 0x5}]}]}}}}}) r3 = fcntl$dupfd(r0, 0x406, r0) bind$xdp(r1, &(0x7f0000000200)={0x2c, 0xf, r2, 0xa, r3}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r4 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_proto_private(r4, 0x89e1, &(0x7f0000001080)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r6, 0x1, 0x28, &(0x7f0000000080)=0x9, 0x4) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) syz_emit_ethernet(0x1de, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a601a80000fc020000000000000000000000000000fe8000000000000000000000000000aa22340502c9a431", @ANYRESOCT=r6, @ANYRES32=r5], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x2, 0x30}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}]}, 0x48}}, 0x0) 6.427629365s ago: executing program 4 (id=850): close(0xffffffffffffffff) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) setrlimit(0x5, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r4 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r4, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) bind$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs={0x1}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000380)=@ethtool_drvinfo={0x3, "a4c3eabfbc4a051fc8f66eedf1c6676b4e9ac471123ee41b102a78284f881840", "c493c69907ac61ee57f3ff6656218f8c880cab0b7f5f977f29b54144914986b5", "7795433781033bb967429b7c68c2566066943f3a566d7fd05557583a535a3b9e", "cba936683f411a1265d9ffb369dbe16de72fd8ee91c60f531196c136add25f43", "3fda464b4ffcb83f5c89e20fe8814b4e26bb81519905d65c5a0ae43be09d9f7b", "9900255a099270427859ce54", 0x43dd5e67, 0x9, 0x4, 0x5, 0xfffffffe}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r3, 0x0) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) ioctl$KVM_SET_PIT2(r6, 0x4070aea0, &(0x7f0000000300)={[{0x0, 0x8003, 0xe0, 0x3, 0x0, 0x1, 0x4, 0x1, 0xc4, 0x7, 0x3, 0x5, 0x7c}, {0x0, 0x0, 0xff, 0xff, 0x4, 0xfe, 0x5, 0x0, 0x3, 0x2, 0x0, 0xb}, {0x1, 0x0, 0x0, 0x11, 0x5, 0x9, 0xf8, 0x2, 0xd7, 0x89, 0x0, 0x0, 0xe0f1}], 0x7}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, 0x0, 0x0) 6.30979934s ago: executing program 1 (id=851): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69703000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) r2 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, &(0x7f0000000080)={0x0}) syz_open_dev$usbfs(0x0, 0x205, 0x44680) 4.863897554s ago: executing program 4 (id=856): r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000340), 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000000000000000080009000100000005000200fc000000050007000400"], 0x44}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f00000002c0), 0x501c00) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x7fe}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000005e0001"], 0x20}}, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x6d}, 0x2c) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) 4.816172221s ago: executing program 1 (id=857): syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x26, &(0x7f0000000040)=0x4, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x80080) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = openat$smackfs_change_rule(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$smackfs_change_rule(r4, &(0x7f0000000140)=ANY=[@ANYBLOB='] +@\':'], 0xd) fchdir(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x40, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x20, 0x33, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0xc091}, 0xc010) 4.417250786s ago: executing program 3 (id=858): socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000680), &(0x7f0000000780), 0x6}, 0x38) bpf$MAP_CREATE(0x2000000080010000, &(0x7f0000000140)=@base={0x6, 0x4, 0x1ff, 0x5c, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 4.382022955s ago: executing program 4 (id=859): r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x6299, 0x2, 0x1, 0x334}, &(0x7f00000002c0), &(0x7f0000000080)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000005f0000da70a54c4cc66f6444be87c4379b98ad63a9b91ba48bc6cfeb0b317df17c54e926c9c028f247fd8e319c23491faa8c48213a"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='ext4_lazy_itable_init\x00', r3}, 0x18) r5 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r5, r4, 0x0, 0x14, &(0x7f00000001c0)='\x00'}, 0x11) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000040)=0x80000001, 0x4) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r6, 0x107, 0x18, 0x0, &(0x7f0000000180)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0xf, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x3}]}}}, @IFLA_TXQLEN={0x8, 0xd, 0x1}]}, 0x44}, 0x1, 0x8}, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201050037057b082d0800014b702c02030109021200070100a0000904"], 0x0) r9 = accept4(r8, 0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000000), 0x40, 0x0) sendmmsg$alg(r9, &(0x7f0000005dc0)=[{0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000001d40)="d8750288189987d0fabb09b23867772c615b8004f5071a7715f73be32aea3bb1ecc3e0814fb9b752a6d48b1d4d68a4282f76c2c6535ec3ec0fe9843311", 0x3d}], 0x1}], 0x1, 0x40) recvmmsg(r9, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/96, 0x7}, {&(0x7f0000000940)=""/53, 0x35}], 0x2}, 0x7fff}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000840)=""/116, 0x74}], 0x1}, 0x9}], 0x2, 0x10000, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="05000000e6ef1f00060000007f00000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000580)={r10, &(0x7f0000001600), 0x0}, 0x20) 4.060718523s ago: executing program 3 (id=860): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2608064c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r1}, 0x18) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 3.834688174s ago: executing program 0 (id=861): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x40, 0x81, 0x9, 0x6, {{0xc, 0x4, 0x1, 0x3, 0x30, 0x67, 0x0, 0x2, 0x4, 0x0, @multicast2, @broadcast, {[@generic={0x44, 0x8, "d562b60a9539"}, @timestamp_prespec={0x44, 0x14, 0x55, 0x3, 0x6, [{@local, 0x401}, {@local, 0x5}]}]}}}}}) r3 = fcntl$dupfd(r0, 0x406, r0) bind$xdp(r1, &(0x7f0000000200)={0x2c, 0xf, r2, 0xa, r3}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r4 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_proto_private(r4, 0x89e1, &(0x7f0000001080)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r6, 0x1, 0x28, &(0x7f0000000080)=0x9, 0x4) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) syz_emit_ethernet(0x1de, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a601a80000fc020000000000000000000000000000fe8000000000000000000000000000aa22340502c9a431", @ANYRESOCT=r6, @ANYRES32=r5], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x2, 0x30}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}]}, 0x48}}, 0x0) 3.380336159s ago: executing program 1 (id=862): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r0}, 0x10) wait4(0x0, 0x0, 0x40000000, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) userfaultfd(0x80001) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f00000006c0)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_route(0x10, 0x3, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) dup(r3) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[], &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', r4, 0x0, 0xfff7fffffffffff5}, 0x18) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000200)="d6b47fce454b60f121e014f73a", 0x2}, 0x38) r6 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$kcm(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0}, 0x24000000) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 3.244574042s ago: executing program 0 (id=863): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400)) timer_create(0xfffffffd, 0x0, &(0x7f0000000000)=0x0) timer_settime(r1, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r0) r2 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000300)={0x0, 0xfffffffffffffe7a, r3, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000600)={r4, 0xb23, 0x0, 0x0, 0x3, [], [0x800000], [0x0, 0x1001000, 0x3], [0x39b7, 0xfffffffffffffffd, 0xe8a6, 0x3]}) timer_create(0x2, &(0x7f0000000180)={0x0, 0x1b, 0x4, @thr={&(0x7f00000003c0)="dd3b0668efe983457707e3417a73daa3c6be7fbf59fadd7d5edc4ba2756af56776fc2396bf9729494bb4e2ceaf988b688225a0c06f0fe8ee847e7e7fb397364852c9c5c8338d9bbb1f04ce8d0f7c50b22b0b589c0cfdced5c4a9f6e7cea3b86f8c95cc9907615ad1d2e408685e16eb90e9256721b87f9bf551c19400bf8e", &(0x7f00000000c0)="e9c43ec3696356bd22b764f77b56af4bdf17637fd3d3c411947e275512e38d7010ce8911be9323f960906e60f67f9b71aee260d5fa5d"}}, &(0x7f0000000240)) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r5, 0xc0145401, &(0x7f0000000100)={0x1, 0x0, 0x5, 0x3}) 2.249999985s ago: executing program 1 (id=864): syz_usb_connect(0x3, 0x8c, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004ec1be40b40b1b0acea10000000109027a00010000c00009047803014db6f9000905071040008180ff072501830094005823d3996c3d2b0fccdf435a45d8646f77b085fe454e65f39c6eb9732826bf6727af3f615e3077d6710ce2449609122d4ff332063c52e615a663cd4284f83a3e001c4765c330e0c5a21b7d9d1f00"/140], 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae01, 0x1f) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) socket$inet6(0xa, 0x6, 0xffffcc87) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRES8=r2, @ANYBLOB="000329bd7000fbdbdf25050000000e0001006e65746465"], 0x88}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f00000003c0)=0x6, 0x4) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x10f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x6cae6a631b9c6543, 0x80, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x3, 0x1, 0x3, 0x7, {0x9, 0x21, 0x3, 0x1, 0x1, {0x22, 0x348}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x5, 0x2}}}}}]}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x200, 0xa, 0x3, 0xfc, 0xff, 0x4}, 0x23, &(0x7f0000000400)={0x5, 0xf, 0x23, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x7, "095e9f2fd1cbdf554a06717214b62be3"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x7, 0x4, 0xf, 0x75}]}, 0x7, [{0xda, &(0x7f0000000440)=@string={0xda, 0x3, "5f066c422a58a75767f028836ad72c0cf6154cd99db83783b4f6b24c103af6b12dc1e72b2966a04494019e6e5ec922f7e96e8a950ef6393bacffb2558da921322beef3c615e20be3884458b96227299014edda4e4372f119809903a221e5816c0ac1668f46444c215bbb4cd80c53652ef9c82e47d4473145d5f8b980653ae584ab4d59577187d6b7f2266e85f0a217baf1eb78a95efccfa5d5b2fe186437ba85e3f1de5de9811df9c879226fdac1b767fcb05e03e485d14f4c4138354bcde83dae5042d9d31fe59db4f4f940be99f60219cbf7897194eca2"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x426}}, {0x4, &(0x7f0000000580)=@string={0x4, 0x3, "ccd1"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x400a}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x4ff}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x4c0a}}]}) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) r3 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000140), 0x40300, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, &(0x7f0000000200)={0xffffffff, 0x2, {}, {r4}, 0x81}) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x1) 2.249505278s ago: executing program 3 (id=865): fchmodat(0xffffffffffffff9c, 0x0, 0xfffffffb) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x5, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}, [@map_idx_val={0x18, 0xb, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x30, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x2, 0xfffffffe, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x3, 0xffe0}, {0x0, 0x7}, {0x14, 0xfff3}}}, 0x24}}, 0x40004) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r0, 0xf50f, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{r2}, &(0x7f00000000c0), &(0x7f0000000100)='%ps \x00'}, 0x20) accept$inet6(r2, 0x0, 0x0) write$cgroup_netprio_ifpriomap(r2, &(0x7f0000000080)={'virt_wifi0', 0x32, 0x32}, 0xd) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x4000000) 2.186019748s ago: executing program 0 (id=866): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="18029000fffd3fff0000000000000000850000004100000085000000d000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 2.061761692s ago: executing program 3 (id=867): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69703000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) r2 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, &(0x7f0000000080)={0x0}) syz_open_dev$usbfs(0x0, 0x205, 0x44680) 1.961860284s ago: executing program 0 (id=868): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r0, 0x4038ae7a, &(0x7f0000000340)={0x80, 0x40000094, 0x0, 0x0}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000040)=0x3, 0x4) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000003c0)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000600"/13], 0x1c}}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.640298558s ago: executing program 4 (id=869): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f91324fc60", 0x8c0}], 0x1}, 0x0) 1.314833636s ago: executing program 4 (id=870): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xfffffffffffffffe}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xfffffffffffffff5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000bc0)={{{@in=@loopback, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0xa, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x2, 0x0, 0x8, 0x8, 0x4}, {0x4}}, {{@in=@dev={0xac, 0x14, 0x14, 0x3f}, 0x80, 0x32}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x8}}, 0xe8) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r6, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 317.567057ms ago: executing program 3 (id=871): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000002540)={0x2d8, r2, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TX_RATES={0x1d8, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x3c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd9, 0x3, 0x8, 0x100, 0x7, 0x6, 0xfff3, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x81, 0x401, 0x2, 0x7, 0x4, 0x9, 0x40, 0x4]}}]}, @NL80211_BAND_2GHZ={0xa0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x400, 0x6e, 0x5194, 0x0, 0xe, 0x9, 0x3ff, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x800, 0x4, 0x8, 0x6, 0x5, 0x8, 0x7fff, 0x6]}}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x48, 0xb, 0x24, 0x12, 0x9, 0x6c, 0x60, 0x60, 0x36, 0x60, 0x30, 0x1, 0xd, 0x30, 0x6c, 0x24, 0xb, 0x2, 0x48, 0x30, 0x24, 0x36]}, @NL80211_TXRATE_HT={0x1f, 0x2, [{0x0, 0x1}, {0x1, 0x8}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x4}, {0x3, 0x3}, {0x1}, {0x2, 0x6}, {0x3, 0x2}, {0x6, 0x1}, {0x0, 0x2}, {0x4, 0xa}, {0x7}, {0x1, 0x2}, {0x5, 0x9}, {0x6}, {0x1, 0x4}, {0x0, 0x8}, {0x1, 0x8}, {0x5, 0x3}, {0x7, 0x7}, {0x3, 0x5}, {0x3, 0x5}, {0x2, 0x8}, {0x7, 0x5}, {0x2, 0x9}, {0x1, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x6c, 0x24, 0xb, 0x30, 0x24, 0x4, 0x5, 0x12, 0xb, 0x9, 0x1b, 0x1, 0x0, 0x48, 0x5, 0x60, 0x16, 0x16, 0x60, 0x6c, 0x3, 0x12, 0x16, 0x2, 0x5, 0x12]}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x6a, 0x2, 0x2, 0x1, 0x54, 0x8, 0x1]}}]}, @NL80211_BAND_5GHZ={0x44, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x3, 0x6, 0x0, 0x2, 0x78, 0x6f05, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x1, 0x9}, {0x7, 0x2}, {0x1, 0x6}, {0x7, 0x1}, {0x4, 0x4}, {}, {0x7, 0x5}, {0x7, 0x3}, {0x3, 0x6}, {0x6}, {0x1, 0x9}, {0x4}, {0x2, 0x3}, {0x1}, {0x6, 0x6}, {0x6}, {0x1}, {0x0, 0x8}, {0x6, 0x5}, {0x3, 0x1}, {0x3, 0x2}, {0x4, 0x4}, {0x6, 0x7}, {0x1, 0x9}, {0x4, 0x8}, {0x3, 0x3}, {0x1, 0x2}, {0x3, 0x8}, {0x1, 0x8}]}]}, @NL80211_BAND_6GHZ={0x3c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x5, 0x8, 0x5, 0xfeff, 0xfff, 0x7, 0x15]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x101, 0x9aad, 0x4, 0x6, 0x0, 0x7ff, 0x2, 0x4]}}]}, @NL80211_BAND_60GHZ={0x60, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x7, 0x200, 0x7, 0x7, 0x401, 0x2, 0xb]}}, @NL80211_TXRATE_HT={0x33, 0x2, [{0x0, 0x8}, {0x1, 0x7}, {0x0, 0x9}, {0x1, 0x2}, {0x0, 0x6}, {0x7, 0x5}, {0x0, 0x9}, {0x0, 0x6}, {0x6, 0x4}, {0x7, 0x3}, {0x3, 0x3}, {0x7, 0x8}, {0x3, 0x1}, {0x3, 0x5}, {0x0, 0x4}, {0x7}, {}, {0x0, 0x6}, {0x3, 0x6}, {0x4, 0x1}, {0x4, 0x3}, {0x7, 0x8}, {0x7, 0xa}, {0x1, 0xa}, {0x0, 0x2}, {0x0, 0x7}, {0x1, 0x6}, {0x5, 0x5}, {0x4, 0x9}, {0x0, 0x2}, {0x4, 0x6}, {0x1}, {0x2, 0x1}, {0x5, 0xa}, {0x0, 0x9}, {0x4, 0x5}, {0x7, 0x6}, {0x6, 0xa}, {0x3}, {0x0, 0x4}, {0x3, 0x5}, {0x4, 0xa}, {0x1, 0x1}, {0x3, 0x8}, {0x3, 0x7}, {0x2, 0x2}, {0x2, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x7ff, 0x4, 0x9, 0x4, 0x1ff, 0x81, 0x9]}}]}]}, @NL80211_ATTR_TX_RATES={0xe4, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x3e, 0x2, [{0x0, 0x1}, {0x0, 0x4}, {0x0, 0x7}, {0x1, 0x4}, {0x3}, {0x5, 0x1}, {0x4, 0x3}, {0x0, 0x3}, {0x1, 0x2}, {0x7, 0x6}, {0x3, 0x1}, {0x2, 0x8}, {0x4, 0xa}, {0x7, 0x8}, {0x2, 0xa}, {0x5, 0x7}, {0x2, 0x7}, {0x7, 0x2}, {0x0, 0x1}, {0x6, 0x6}, {}, {0x1, 0x5}, {0x1}, {0x5, 0x1}, {0x2, 0x3}, {0x3, 0x1}, {0x5, 0x2}, {0x1, 0x1}, {0x2, 0x9}, {0x4, 0x3}, {0x2, 0x7}, {0x0, 0xa}, {0x5, 0x3}, {0x1}, {0x6, 0xa}, {0x1, 0x8}, {0x7, 0x7}, {0x6, 0x1}, {0x3, 0x4}, {0x1, 0xa}, {0x1, 0x5}, {0x1, 0x5}, {0x7, 0x7}, {0x3}, {0x6, 0x8}, {0x5, 0x3}, {0x6, 0x3}, {0x6, 0x3}, {0x2, 0x3}, {0x2, 0x2}, {0x4, 0xa}, {0x3, 0x7}, {0x1, 0x3}, {0x4, 0x6}, {0x0, 0x7}, {0x2}, {0x6, 0x3}, {0x5, 0x8}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7a5c, 0x5, 0x1, 0x5, 0x9, 0x9, 0xad, 0x4]}}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xfff, 0x40, 0x4259, 0x61, 0x1, 0x3, 0x7, 0x81]}}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x44, 0x2, [{0x0, 0x8}, {0x1, 0x6}, {0x6, 0x3}, {0x2, 0x3}, {0x3, 0x5}, {0x7, 0x6}, {0x4, 0x9}, {0x4, 0x1}, {0x3, 0x2}, {0x1, 0x9}, {0x7}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x1, 0x4}, {0x2, 0x8}, {0x6, 0x7}, {0x5, 0x1}, {0x4, 0x9}, {0x4, 0x3}, {0x1, 0x8}, {0x1, 0x2}, {0x3, 0x6}, {0x7, 0x8}, {0x7, 0x6}, {0x7, 0x6}, {0x5}, {0x7}, {0x7, 0x4}, {0x0, 0x8}, {0x0, 0x5}, {0x6, 0x16}, {0x1, 0x2}, {0x7, 0x5}, {0x7, 0x3}, {0x1, 0x1}, {0x2, 0x5}, {0x7, 0x9}, {0x0, 0x9}, {0x5, 0x1}, {0x1}, {0x1, 0x9}, {0x5, 0x9}, {0x1, 0x3}, {0x1}, {0x1, 0x5}, {0x0, 0xa}, {0x2, 0x5}, {0x1, 0x3}, {0x0, 0x7}, {0x5, 0x7}, {0x2, 0x2}, {0x2, 0x1}, {0x7, 0x6}, {0x7, 0x9}, {0x1, 0xa}, {0x1, 0x7}, {0x0, 0x6}, {0x4, 0x1}, {0x7, 0xa}, {0x4, 0x7}, {0x2, 0x5}, {0x5, 0x6}, {0x7, 0x7}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}]}]}, 0x2d8}, 0x1, 0x0, 0x0, 0x4}, 0x4000) 285.431707ms ago: executing program 0 (id=872): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x20, 0x33, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0xc091}, 0xc010) 96.886432ms ago: executing program 3 (id=873): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x948}, [@call={0x85, 0x0, 0x0, 0x3d}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000, @void, @value}, 0x94) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x82881, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x4, 0x8, 0xb, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map=r5, r4, 0x7, 0x0, 0x0, @void, @value}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) (async) connect$inet(r6, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) write$binfmt_elf32(r6, &(0x7f00000014c0)=ANY=[], 0x46b) sendmmsg$inet(r6, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000006c0)="ed", 0x1}, {&(0x7f0000000200)="b5", 0x1}, {&(0x7f0000000340)='.', 0x1}, {&(0x7f0000000140)='U', 0x1}, {&(0x7f0000000180)="f3", 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000580)="f1", 0x1}, {&(0x7f0000000c80)='a', 0x1}, {&(0x7f0000000b40)='M', 0x1}, {&(0x7f0000000d80)='o', 0x1}, {&(0x7f0000000e80)='\b', 0x1}], 0xa6}, 0x70040000}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="bb", 0x1}, {&(0x7f00000007c0)="a1", 0x1}, {&(0x7f0000000800)='s', 0x1}, {&(0x7f00000009c0)='\\', 0x1}], 0x4}}, {{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000440)="88", 0x1}, {&(0x7f0000000840)="e5", 0x1}, {&(0x7f0000001040)="96", 0x1}], 0x3}}], 0x4, 0x4048841) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x1200}}, 0x0) ioctl$TCSETSW2(r1, 0x5434, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="ddd5be65914ca2fd9a767ed10a74", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r7, 0x84, 0x75, &(0x7f0000000000)={r8, 0x8}, &(0x7f0000000040)=0x8) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x45, 0x2, 0x2}, {0x64}, {0x40}, {0x6}]}) syz_open_dev$vcsa(&(0x7f0000000100), 0x81, 0x501340) 89.736603ms ago: executing program 4 (id=874): r0 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) r1 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="933c547ecfa7"}, 0x14) syz_emit_ethernet(0x6a, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x2, 0x1, 0x11, 0x0, @empty=0xe0, @private=0xa010100}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x1, "a483f184f0334b90f7455389810a695fc32c36677d0b0816", "89a1a2e06cb164e9140c6f4df2c09fa2b0d4fac08c4d603fb6907c2a6aabe251"}}}}}}, 0x0) 0s ago: executing program 0 (id=875): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x3, 0xfffffffd, @loopback}, 0x1c) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000180)='illinois\x00', 0x9) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x0, 0x7fffffff}}}}]}, 0x4c}}, 0x0) shutdown(r4, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) getsockopt$sock_buf(r8, 0x1, 0x1a, 0x0, &(0x7f0000000100)) r9 = syz_open_dev$loop(&(0x7f00000005c0), 0x10000, 0x4040) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0x0, 0x2]}}) sendmsg$inet6(r3, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) r10 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, &(0x7f00000000c0)={@mcast2, 0x800, 0x0, 0x74909c28a5ac223, 0x1, 0x0, 0x10}, 0x20) kernel console output (not intermixed with test programs): 00 [ 241.094517][ T7423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.094528][ T7423] R13: 0000000000000000 R14: 00007f9da5bb6080 R15: 00007ffd476f2c38 [ 241.094562][ T7423] [ 241.094632][ T7423] ERROR: Out of memory at tomoyo_realpath_from_path. [ 241.843904][ T7167] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 241.982546][ T24] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 242.012136][ T24] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 242.019817][ T7167] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 242.048450][ T24] quatech2 5-1:0.51: device disconnected [ 242.086973][ T7167] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 242.135950][ T7431] netlink: 44 bytes leftover after parsing attributes in process `syz.3.380'. [ 242.229042][ T7167] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 242.399125][ T7439] netlink: 168 bytes leftover after parsing attributes in process `syz.1.382'. [ 243.465749][ T7167] 8021q: adding VLAN 0 to HW filter on device bond0 [ 243.567981][ T7167] 8021q: adding VLAN 0 to HW filter on device team0 [ 243.592819][ T6888] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.599947][ T6888] bridge0: port 1(bridge_slave_0) entered forwarding state [ 243.621793][ T10] kernel write not supported for file /snd/seq (pid: 10 comm: kworker/0:1) [ 243.662709][ T6888] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.669930][ T6888] bridge0: port 2(bridge_slave_1) entered forwarding state [ 243.981334][ T10] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 244.190655][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.233946][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 244.412666][ T10] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 244.432128][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.453787][ T10] usb 2-1: config 0 descriptor?? [ 244.510810][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 244.517525][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 244.649746][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 244.679255][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 244.690754][ T10] usb 2-1: media controller created [ 244.709029][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 244.733958][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 244.749989][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 244.766718][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input12 [ 244.819032][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 244.866418][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 245.021216][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 245.030034][ T7167] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 245.040229][ T10] dvb-usb: error while querying for an remote control event. [ 245.210381][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 245.247299][ T10] dvb-usb: error while querying for an remote control event. [ 245.249497][ T7479] input: syz0 as /devices/virtual/input/input13 [ 245.273883][ T7167] veth0_vlan: entered promiscuous mode [ 245.328170][ T7167] veth1_vlan: entered promiscuous mode [ 245.431011][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 245.431037][ T10] dvb-usb: error while querying for an remote control event. [ 245.476057][ T7167] veth0_macvtap: entered promiscuous mode [ 245.504491][ T7167] veth1_macvtap: entered promiscuous mode [ 245.587160][ T7167] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 245.591294][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 245.591328][ T10] dvb-usb: error while querying for an remote control event. [ 245.650175][ T7167] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 245.664160][ T7167] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.664222][ T7167] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.664247][ T7167] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.664271][ T7167] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.770678][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 245.773480][ T10] dvb-usb: error while querying for an remote control event. [ 245.941845][ T5968] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 245.941870][ T5968] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 245.950332][ T6011] dvb-usb: bulk message failed: -22 (1/0) [ 245.950368][ T6011] dvb-usb: error while querying for an remote control event. [ 246.029433][ T2984] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.029458][ T2984] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.112579][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 246.112616][ T10] dvb-usb: error while querying for an remote control event. [ 246.222300][ T7498] netlink: 48 bytes leftover after parsing attributes in process `syz.0.392'. [ 246.270922][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 246.276743][ T10] dvb-usb: error while querying for an remote control event. [ 246.323757][ T5877] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 246.481093][ T977] dvb-usb: bulk message failed: -22 (1/0) [ 246.504748][ T977] dvb-usb: error while querying for an remote control event. [ 246.505083][ T5156] usb 2-1: USB disconnect, device number 9 [ 246.527398][ T5877] usb 4-1: device descriptor read/64, error -71 [ 246.705476][ T5156] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 246.793401][ T5877] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 246.940879][ T5877] usb 4-1: device descriptor read/64, error -71 [ 247.050599][ T5877] usb usb4-port1: attempt power cycle [ 247.092408][ T7515] netlink: 8 bytes leftover after parsing attributes in process `syz.4.396'. [ 247.138855][ T5156] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 247.177398][ T2984] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.344616][ T5156] usb 2-1: too many configurations: 65, using maximum allowed: 8 [ 247.435842][ T5877] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 247.445524][ T5156] usb 2-1: New USB device found, idVendor=046d, idProduct=08c1, bcdDevice=ee.8d [ 247.482737][ T5156] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.506224][ T5877] usb 4-1: device descriptor read/8, error -71 [ 247.521187][ T2984] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.575963][ T5156] usb 2-1: Found UVC 0.00 device (046d:08c1) [ 247.616517][ T5156] usb 2-1: No valid video chain found. [ 247.790372][ T5877] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 247.810143][ T7507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.833662][ T5877] usb 4-1: device descriptor read/8, error -71 [ 247.841058][ T7507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.903481][ T2984] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.946061][ T5877] usb usb4-port1: unable to enumerate USB device [ 248.144845][ T2984] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.627041][ T2984] bridge_slave_1: left allmulticast mode [ 249.712873][ T7542] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 249.818885][ T2984] bridge_slave_1: left promiscuous mode [ 249.887314][ T2984] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.462080][ T2984] bridge_slave_0: left allmulticast mode [ 251.474326][ T2984] bridge_slave_0: left promiscuous mode [ 251.480223][ T2984] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.493770][ T5877] usb 2-1: USB disconnect, device number 10 [ 251.634371][ T7550] Illegal XDP return value 4291436544 on prog (id 111) dev N/A, expect packet loss! [ 251.793772][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 251.842700][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 251.864178][ T5830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 251.887932][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 251.910824][ T5830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 252.288684][ T7565] loop6: detected capacity change from 0 to 524287999 [ 252.837025][ T7570] netlink: 44 bytes leftover after parsing attributes in process `syz.1.403'. [ 252.864200][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 252.912308][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 252.935036][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 252.955988][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 252.976063][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 252.986143][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 252.997215][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 253.009023][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 253.022796][ T7503] ldm_validate_partition_table(): Disk read failed. [ 253.030940][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 253.040641][ T7503] Buffer I/O error on dev loop6, logical block 0, async page read [ 253.051329][ T7503] Dev loop6: unable to read RDB block 0 [ 253.061939][ T7503] loop6: unable to read partition table [ 253.511299][ T7583] RDS: rds_bind could not find a transport for ::ffff:172.30.0.4, load rds_tcp or rds_rdma? [ 253.623028][ T7585] netlink: 'syz.3.407': attribute type 10 has an invalid length. [ 253.689284][ T2984] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 253.710121][ T2984] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 253.728098][ T2984] bond0 (unregistering): Released all slaves [ 253.802964][ T7585] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 254.060506][ T5830] Bluetooth: hci1: command tx timeout [ 255.343352][ T7610] netlink: 184 bytes leftover after parsing attributes in process `syz.0.412'. [ 255.401157][ T5156] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 255.438233][ T7610] bond0: entered allmulticast mode [ 255.470499][ T7610] bond_slave_0: entered allmulticast mode [ 255.482395][ T7610] bond_slave_1: entered allmulticast mode [ 255.755792][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.764549][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.765718][ T5156] usb 4-1: device descriptor read/64, error -71 [ 255.802522][ T2984] hsr_slave_0: left promiscuous mode [ 255.839894][ T2984] hsr_slave_1: left promiscuous mode [ 255.908122][ T2984] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 255.921972][ T2984] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 256.019078][ T2984] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 256.100528][ T5156] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 256.114698][ T2984] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 256.151756][ T5830] Bluetooth: hci1: command tx timeout [ 256.176976][ T2984] veth1_macvtap: left promiscuous mode [ 256.185868][ T2984] veth0_macvtap: left promiscuous mode [ 256.192013][ T2984] veth1_vlan: left promiscuous mode [ 256.198611][ T2984] veth0_vlan: left promiscuous mode [ 256.240361][ T5156] usb 4-1: device descriptor read/64, error -71 [ 256.351420][ T5156] usb usb4-port1: attempt power cycle [ 256.720369][ T5156] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 256.741980][ T5156] usb 4-1: device descriptor read/8, error -71 [ 256.909858][ T2984] team0 (unregistering): Port device team_slave_1 removed [ 256.974871][ T2984] team0 (unregistering): Port device team_slave_0 removed [ 256.982672][ T5156] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 257.011620][ T5156] usb 4-1: device descriptor read/8, error -71 [ 257.129638][ T5156] usb usb4-port1: unable to enumerate USB device [ 257.369139][ T7646] netlink: 260 bytes leftover after parsing attributes in process `syz.3.414'. [ 257.393675][ T7646] i2c i2c-0: Invalid block write size 35 [ 257.495198][ T7648] loop8: detected capacity change from 0 to 79 [ 257.552545][ T7648] loop8: detected capacity change from 79 to 78 [ 257.746481][ T7650] warning: `syz.3.416' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 257.853768][ T7656] Invalid logical block size (4608) [ 258.289532][ T5830] Bluetooth: hci1: command tx timeout [ 258.309238][ T7556] chnl_net:caif_netlink_parms(): no params data found [ 258.404324][ T7667] FAULT_INJECTION: forcing a failure. [ 258.404324][ T7667] name fail_futex, interval 1, probability 0, space 0, times 1 [ 258.417949][ T7667] CPU: 1 UID: 0 PID: 7667 Comm: syz.3.419 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 258.417978][ T7667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 258.417990][ T7667] Call Trace: [ 258.417999][ T7667] [ 258.418007][ T7667] dump_stack_lvl+0x189/0x250 [ 258.418042][ T7667] ? __pfx____ratelimit+0x10/0x10 [ 258.418073][ T7667] ? __pfx_dump_stack_lvl+0x10/0x10 [ 258.418103][ T7667] ? __pfx__printk+0x10/0x10 [ 258.418132][ T7667] ? rcu_is_watching+0x15/0xb0 [ 258.418168][ T7667] should_fail_ex+0x414/0x560 [ 258.418199][ T7667] get_futex_key+0x82b/0x16c0 [ 258.418244][ T7667] ? __pfx_get_futex_key+0x10/0x10 [ 258.418282][ T7667] ? __asan_memset+0x22/0x50 [ 258.418308][ T7667] futex_requeue+0x21b/0x19a0 [ 258.418332][ T7667] ? finish_task_switch+0x26b/0x950 [ 258.418377][ T7667] ? __pfx_futex_requeue+0x10/0x10 [ 258.418399][ T7667] ? trace_irq_disable+0x37/0x110 [ 258.418424][ T7667] ? preempt_schedule_irq+0xde/0x150 [ 258.418453][ T7667] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 258.418491][ T7667] ? lockdep_hardirqs_on+0x9c/0x150 [ 258.418532][ T7667] ? do_futex+0x2a8/0x420 [ 258.418561][ T7667] do_futex+0x362/0x420 [ 258.418581][ T7667] ? rcu_is_watching+0x15/0xb0 [ 258.418622][ T7667] ? __pfx_do_futex+0x10/0x10 [ 258.418640][ T7667] ? preempt_schedule_irq+0xde/0x150 [ 258.418679][ T7667] __se_sys_futex+0x36f/0x400 [ 258.418709][ T7667] ? __pfx___se_sys_futex+0x10/0x10 [ 258.418737][ T7667] ? __x64_sys_futex+0x31/0xf0 [ 258.418766][ T7667] do_syscall_64+0xfa/0x3b0 [ 258.418785][ T7667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.418808][ T7667] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 258.418828][ T7667] ? clear_bhb_loop+0x60/0xb0 [ 258.418853][ T7667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.418872][ T7667] RIP: 0033:0x7f2bf3d8e929 [ 258.418890][ T7667] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 258.418906][ T7667] RSP: 002b:00007f2bf4bb3038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 258.418927][ T7667] RAX: ffffffffffffffda RBX: 00007f2bf3fb6160 RCX: 00007f2bf3d8e929 [ 258.418941][ T7667] RDX: 0000000000000001 RSI: 000000000000000c RDI: 0000000000000000 [ 258.418952][ T7667] RBP: 00007f2bf4bb3090 R08: 0000200000048000 R09: 0000000000000000 [ 258.418965][ T7667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 258.418976][ T7667] R13: 0000000000000001 R14: 00007f2bf3fb6160 R15: 00007ffe82b29b98 [ 258.419008][ T7667] [ 258.999547][ T7673] bridge_slave_0: left allmulticast mode [ 259.058582][ T7673] bridge_slave_0: left promiscuous mode [ 259.082565][ T7673] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.156680][ T7673] bridge_slave_1: left allmulticast mode [ 259.167662][ T7673] bridge_slave_1: left promiscuous mode [ 259.188036][ T7673] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.383286][ T7688] netlink: 44 bytes leftover after parsing attributes in process `syz.3.423'. [ 259.460856][ T7673] bond0: (slave bond_slave_0): Releasing backup interface [ 259.499439][ T30] audit: type=1326 audit(1750511267.193:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7679 comm="syz.0.421" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da598e929 code=0x7ffc0000 [ 259.545922][ T7673] bond0: (slave bond_slave_1): Releasing backup interface [ 259.565296][ T30] audit: type=1326 audit(1750511267.193:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7679 comm="syz.0.421" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da598e929 code=0x7ffc0000 [ 259.595958][ T30] audit: type=1326 audit(1750511267.193:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7679 comm="syz.0.421" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9da598d290 code=0x7ffc0000 [ 259.633617][ T30] audit: type=1326 audit(1750511267.193:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7679 comm="syz.0.421" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da598e929 code=0x7ffc0000 [ 259.658614][ T30] audit: type=1326 audit(1750511267.193:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7679 comm="syz.0.421" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da598e929 code=0x7ffc0000 [ 259.692999][ T7673] team0: Port device team_slave_0 removed [ 259.719455][ T7673] team0: Port device team_slave_1 removed [ 259.745505][ T7673] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 259.759432][ T7673] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 259.807186][ T7673] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 259.827571][ T7673] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 259.990485][ T6011] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 260.252705][ T6011] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 260.273323][ T6011] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 260.300415][ T5830] Bluetooth: hci1: command tx timeout [ 260.313181][ T6011] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 260.325050][ T6011] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 260.344976][ T6011] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 260.372700][ T7703] ======================================================= [ 260.372700][ T7703] WARNING: The mand mount option has been deprecated and [ 260.372700][ T7703] and is ignored by this kernel. Remove the mand [ 260.372700][ T7703] option from the mount to silence this warning. [ 260.372700][ T7703] ======================================================= [ 260.435004][ T7703] debugfs: Invalid uid '0x00000000ffffffff' [ 260.435118][ T6011] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 260.451575][ T6011] usb 2-1: Manufacturer: syz [ 260.462583][ T6011] usb 2-1: config 0 descriptor?? [ 260.561128][ T7706] fuse: Bad value for 'fd' [ 260.576321][ T7706] Invalid source name [ 260.580499][ T7706] UBIFS error (pid: 7706): cannot open "./file0", error -22 [ 260.816379][ T7707] netlink: 4 bytes leftover after parsing attributes in process `syz.0.425'. [ 261.218361][ T7707] team0: Port device team_slave_1 removed [ 261.662648][ T7556] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.751493][ T7556] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.795268][ T7556] bridge_slave_0: entered allmulticast mode [ 261.922988][ T7556] bridge_slave_0: entered promiscuous mode [ 261.946820][ T7556] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.979041][ T7556] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.979055][ T7713] netlink: 4 bytes leftover after parsing attributes in process `syz.3.429'. [ 262.007504][ T7556] bridge_slave_1: entered allmulticast mode [ 262.016602][ T7556] bridge_slave_1: entered promiscuous mode [ 262.030402][ T6011] rc_core: IR keymap rc-hauppauge not found [ 262.036462][ T6011] Registered IR keymap rc-empty [ 262.045150][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.070435][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.108047][ T6011] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 262.153297][ T7713] veth3: entered promiscuous mode [ 262.164438][ T6011] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input14 [ 262.207597][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.260109][ T7556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 262.290453][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.313309][ T7556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 262.340509][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.347973][ T7694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.390440][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.398601][ T7694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.415348][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.431766][ T7694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.450674][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 262.454749][ T7694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.870504][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 263.360914][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 263.390690][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 263.410533][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 263.430374][ T6011] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 263.484296][ T7556] team0: Port device team_slave_0 added [ 263.504110][ T6011] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 263.522953][ T7741] sch_tbf: burst 21990 is lower than device lo mtu (65550) ! [ 263.597998][ T6011] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 263.608498][ T7556] team0: Port device team_slave_1 added [ 263.671789][ T6011] usb 2-1: USB disconnect, device number 11 [ 263.807132][ T7556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 263.826053][ T7556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.893406][ T7556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 263.924394][ T7556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 263.933560][ T7556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.964744][ T7556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 264.074783][ T7556] hsr_slave_0: entered promiscuous mode [ 264.090709][ T7556] hsr_slave_1: entered promiscuous mode [ 264.105765][ T7556] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 264.113805][ T7556] Cannot create hsr debugfs directory [ 266.086410][ T7763] netlink: 8 bytes leftover after parsing attributes in process `syz.1.439'. [ 266.389199][ T7769] netlink: 20 bytes leftover after parsing attributes in process `syz.3.440'. [ 266.895130][ T6011] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 266.967722][ T7776] devtmpfs: Unknown parameter 'nr_Inode' [ 267.347758][ T6011] usb 4-1: Using ep0 maxpacket: 16 [ 267.378167][ T6011] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 267.392905][ T6011] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 268.093183][ T6011] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 268.266716][ T6011] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 268.327474][ T6011] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 268.378842][ T6011] usb 4-1: SerialNumber: syz [ 268.403700][ T7769] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 270.683900][ T6011] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 270.784561][ T6011] usb 4-1: USB disconnect, device number 25 [ 271.458883][ T7820] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 272.299962][ T7824] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 272.299962][ T7824] The task syz.0.454 (7824) triggered the difference, watch for misbehavior. [ 273.403163][ T7556] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 273.423843][ T7833] netlink: 4 bytes leftover after parsing attributes in process `syz.4.456'. [ 273.601332][ T7833] team1: entered promiscuous mode [ 273.631385][ T7833] team1: entered allmulticast mode [ 273.662745][ T7556] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 273.764721][ T7556] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 274.916459][ T7556] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 275.086987][ T24] libceph: connect (1)[c::]:6789 error -101 [ 275.102489][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 275.362848][ T5878] libceph: connect (1)[c::]:6789 error -101 [ 275.374010][ T5878] libceph: mon0 (1)[c::]:6789 connect error [ 275.398927][ T7872] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 275.427435][ T7556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.493237][ T7556] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.510102][ T6888] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.517388][ T6888] bridge0: port 1(bridge_slave_0) entered forwarding state [ 275.550531][ T6011] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 275.582359][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.589610][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 275.599249][ T7851] ceph: No mds server is up or the cluster is laggy [ 275.951696][ T6011] usb 2-1: config 0 has an invalid interface number: 168 but max is 0 [ 276.650406][ T6011] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 276.698905][ T6011] usb 2-1: config 0 has no interface number 0 [ 276.725072][ T6011] usb 2-1: config 0 interface 168 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 276.759065][ T6011] usb 2-1: config 0 interface 168 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 16 [ 276.846817][ T7556] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 276.857301][ T7556] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 276.979377][ T6011] usb 2-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 276.988882][ T6011] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.051082][ T6011] usb 2-1: config 0 descriptor?? [ 277.180449][ T5826] Bluetooth: hci1: command 0x0405 tx timeout [ 277.237785][ T6011] HFC-S_USB 2-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 277.272294][ T5877] IPVS: starting estimator thread 0... [ 277.399582][ T7892] IPVS: using max 28 ests per chain, 67200 per kthread [ 277.418393][ T7889] netlink: 32 bytes leftover after parsing attributes in process `syz.4.465'. [ 277.427649][ T7889] sch_tbf: peakrate 4 is lower than or equals to rate 5 ! [ 281.530973][ T10] usb 2-1: USB disconnect, device number 12 [ 281.960075][ T7923] loop9: detected capacity change from 0 to 8 [ 281.977709][ T7923] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 281.983322][ T7923] loop9: partition table partially beyond EOD, truncated [ 281.992219][ T7923] loop9: p1 size 81768186 extends beyond EOD, truncated [ 282.838031][ T7913] udevd[7913]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 283.097117][ T7556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 284.472640][ T7556] veth0_vlan: entered promiscuous mode [ 284.796118][ T7556] veth1_vlan: entered promiscuous mode [ 285.089904][ T7556] veth0_macvtap: entered promiscuous mode [ 285.136197][ T7556] veth1_macvtap: entered promiscuous mode [ 285.254101][ T7556] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 285.357943][ T7556] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 285.419551][ T7556] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.473209][ T7556] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.496502][ T7556] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.519784][ T7556] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.809198][ T1112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 285.845238][ T1112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 285.962247][ T7968] syz.1.476: attempt to access beyond end of device [ 285.962247][ T7968] loop1: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 285.975800][ T7968] hfsplus: unable to find HFS+ superblock [ 286.883332][ T6939] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 286.891488][ T6939] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 287.560722][ T5878] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 288.191551][ T5878] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 288.235633][ T5878] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 288.279432][ T5878] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 288.311608][ T5878] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.353962][ T7980] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 289.864827][ T36] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 289.882044][ T5878] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 290.339440][ T36] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.233090][ T8014] netlink: 8 bytes leftover after parsing attributes in process `syz.1.486'. [ 291.607382][ T8017] netlink: 4 bytes leftover after parsing attributes in process `syz.1.486'. [ 291.663795][ T10] usb 5-1: USB disconnect, device number 17 [ 291.685938][ T36] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.850970][ T8027] binder: BINDER_SET_CONTEXT_MGR already set [ 292.857258][ T8027] binder: 8021:8027 ioctl 4018620d 200000000040 returned -16 [ 292.918522][ T8027] binder: 8021:8027 unknown command 0 [ 292.924852][ T8027] binder: 8021:8027 ioctl c0306201 2000000003c0 returned -22 [ 293.282884][ T8031] netlink: 4 bytes leftover after parsing attributes in process `syz.3.485'. [ 293.475097][ T8017] hsr_slave_1 (unregistering): left promiscuous mode [ 293.475492][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 293.495352][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 293.504536][ T5830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 293.516234][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 293.524129][ T5830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 293.636581][ T36] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.081338][ T8050] vlan2: entered promiscuous mode [ 294.094283][ T8050] bridge0: entered promiscuous mode [ 294.105002][ T8050] vlan2: entered allmulticast mode [ 294.121108][ T8050] bridge0: entered allmulticast mode [ 294.221690][ T36] bridge_slave_1: left allmulticast mode [ 294.227454][ T36] bridge_slave_1: left promiscuous mode [ 294.235353][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 294.249611][ T36] bridge_slave_0: left allmulticast mode [ 294.255735][ T36] bridge_slave_0: left promiscuous mode [ 294.262032][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.581529][ T5830] Bluetooth: hci1: command tx timeout [ 296.274159][ T5877] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 297.371035][ T5877] usb 4-1: Using ep0 maxpacket: 32 [ 297.407245][ T5877] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 297.429635][ T5877] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 297.446547][ T5877] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 297.462812][ T5877] usb 4-1: Product: syz [ 297.467740][ T5877] usb 4-1: Manufacturer: syz [ 297.472707][ T5877] usb 4-1: SerialNumber: syz [ 297.489202][ T5877] usb 4-1: config 0 descriptor?? [ 297.509152][ T8076] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 297.661139][ T5830] Bluetooth: hci1: command tx timeout [ 297.678737][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 297.720993][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 297.747629][ T36] bond0 (unregistering): Released all slaves [ 297.840631][ T977] usb 4-1: USB disconnect, device number 26 [ 298.839968][ T8091] netlink: 44 bytes leftover after parsing attributes in process `syz.0.504'. [ 298.865333][ T8076] netlink: 8 bytes leftover after parsing attributes in process `syz.3.499'. [ 300.420702][ T5830] Bluetooth: hci1: command tx timeout [ 302.461640][ T5826] Bluetooth: hci1: command tx timeout [ 302.474836][ T8130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.512'. [ 303.864027][ T36] hsr_slave_0: left promiscuous mode [ 303.905453][ T36] hsr_slave_1: left promiscuous mode [ 303.924388][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 303.944855][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 303.987004][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 303.999939][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 304.057080][ T36] veth1_macvtap: left promiscuous mode [ 304.076244][ T36] veth0_macvtap: left promiscuous mode [ 304.088624][ T36] veth1_vlan: left promiscuous mode [ 304.104333][ T36] veth0_vlan: left promiscuous mode [ 305.053963][ T36] team0 (unregistering): Port device team_slave_1 removed [ 305.093752][ T36] team0 (unregistering): Port device team_slave_0 removed [ 306.949667][ T8035] chnl_net:caif_netlink_parms(): no params data found [ 306.960628][ T8183] netlink: 4 bytes leftover after parsing attributes in process `syz.1.524'. [ 307.055497][ T8171] syz.3.520 (8171): drop_caches: 2 [ 311.658602][ T8035] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.669381][ T8035] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.687608][ T8035] bridge_slave_0: entered allmulticast mode [ 311.729020][ T8035] bridge_slave_0: entered promiscuous mode [ 311.755828][ T8035] bridge0: port 2(bridge_slave_1) entered blocking state [ 312.614850][ T8035] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.654607][ T8035] bridge_slave_1: entered allmulticast mode [ 312.683730][ T8035] bridge_slave_1: entered promiscuous mode [ 313.377016][ T8247] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 313.566235][ T8251] netlink: 8 bytes leftover after parsing attributes in process `syz.3.536'. [ 313.634040][ T8035] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 313.725689][ T8035] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 314.553356][ T8035] team0: Port device team_slave_0 added [ 314.569719][ T8035] team0: Port device team_slave_1 added [ 314.620936][ T5826] Bluetooth: hci1: command 0x0405 tx timeout [ 314.692303][ T8035] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 314.716651][ T8035] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 315.045336][ T8035] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 315.104048][ T8035] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 315.930479][ T8035] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 316.177283][ T8035] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 317.195106][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.218773][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.685567][ T8035] hsr_slave_0: entered promiscuous mode [ 318.771001][ T8326] [U] vÔ3¸Âfù¾"SçÁ/Éê4:ÃXTz“W¡t‘’lWµ«= [ 318.777101][ T8035] hsr_slave_1: entered promiscuous mode [ 318.785659][ T8326] [U] J"—e:ÀÆ" [ 319.088487][ T8035] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 319.268303][ T8035] Cannot create hsr debugfs directory [ 322.780449][ T5826] Bluetooth: hci0: command 0x0c1a tx timeout [ 322.788369][ T8346] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 322.852596][ T8035] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 322.868204][ T8035] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 322.875537][ T8346] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 322.895591][ T8346] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 322.896493][ T8035] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 322.924974][ T8346] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 322.926874][ T8035] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 322.944381][ T8346] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 322.958324][ T8346] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 322.975875][ T8346] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 323.270337][ T8028] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 323.287183][ T8035] 8021q: adding VLAN 0 to HW filter on device bond0 [ 323.383061][ T8035] 8021q: adding VLAN 0 to HW filter on device team0 [ 323.427929][ T5968] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.435263][ T5968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 323.461401][ T8028] usb 5-1: Using ep0 maxpacket: 32 [ 323.493482][ T8028] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 323.568130][ T8028] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 323.693882][ T8028] usb 5-1: config 0 has no interface number 0 [ 323.758115][ T8028] usb 5-1: config 0 interface 67 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 324.242871][ T3023] bridge0: port 2(bridge_slave_1) entered blocking state [ 324.250099][ T3023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 324.561584][ T8035] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 324.572505][ T8035] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 324.634217][ T8028] usb 5-1: string descriptor 0 read error: -71 [ 324.640668][ T8028] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 324.812377][ T8028] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.858886][ T8028] usb 5-1: config 0 descriptor?? [ 324.864484][ T5830] Bluetooth: hci2: command 0x0c1a tx timeout [ 324.871978][ T8028] usb 5-1: can't set config #0, error -71 [ 324.907649][ T8028] usb 5-1: USB disconnect, device number 18 [ 324.968686][ T5826] Bluetooth: hci3: command 0x0c1a tx timeout [ 324.974968][ T5830] Bluetooth: hci4: command 0x0c1a tx timeout [ 325.570741][ T5830] Bluetooth: hci1: command 0x0405 tx timeout [ 326.442598][ T8415] loop6: detected capacity change from 0 to 7 [ 326.493438][ T8415] Dev loop6: unable to read RDB block 7 [ 326.499096][ T8415] loop6: unable to read partition table [ 326.541602][ T8415] loop6: partition table beyond EOD, truncated [ 326.563559][ T8415] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 326.688948][ T8422] sp0: Synchronizing with TNC [ 326.766323][ T8418] [U] è` [ 326.889212][ T8035] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 327.620366][ T5830] Bluetooth: hci1: command 0x0405 tx timeout [ 328.006949][ T8035] veth0_vlan: entered promiscuous mode [ 328.109600][ T8035] veth1_vlan: entered promiscuous mode [ 328.282634][ T8441] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 330.129172][ T5830] Bluetooth: hci1: command 0x0405 tx timeout [ 330.907293][ T8035] veth0_macvtap: entered promiscuous mode [ 330.972041][ T8035] veth1_macvtap: entered promiscuous mode [ 331.034185][ T8035] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 331.122850][ T8035] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 331.232699][ T8035] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.280496][ T8035] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.504683][ T8035] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.513830][ T8035] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.355145][ T8476] loop9: detected capacity change from 0 to 8 [ 332.521818][ T8476] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 332.527852][ T8476] loop9: partition table partially beyond EOD, truncated [ 332.535196][ T8476] loop9: p1 size 81768186 extends beyond EOD, truncated [ 333.857579][ T7913] udevd[7913]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 334.868674][ T6939] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 334.890794][ T6939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 335.005383][ T8029] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.056806][ T8029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.340889][ T8028] kernel write not supported for file /snd/seq (pid: 8028 comm: kworker/1:8) [ 336.726893][ T8513] netlink: 24 bytes leftover after parsing attributes in process `syz.3.580'. [ 336.740332][ T24] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 337.563834][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.575298][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 337.610465][ T24] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 337.644649][ T24] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 337.667776][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.705197][ T24] usb 5-1: config 0 descriptor?? [ 337.729158][ T24] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 337.762086][ T24] dvb-usb: bulk message failed: -22 (3/0) [ 337.811752][ T24] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 337.884222][ T24] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 337.898002][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 337.903198][ T24] usb 5-1: media controller created [ 337.949001][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 338.043710][ T24] dvb-usb: bulk message failed: -22 (6/0) [ 338.065026][ T24] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 338.095418][ T24] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input16 [ 338.142784][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 338.145474][ T24] dvb-usb: schedule remote query interval to 150 msecs. [ 338.197006][ T24] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 338.265227][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 338.350739][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 338.356573][ T24] dvb-usb: error while querying for an remote control event. [ 338.547059][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 338.562889][ T24] dvb-usb: error while querying for an remote control event. [ 338.591464][ T13] bridge_slave_1: left allmulticast mode [ 338.602514][ T13] bridge_slave_1: left promiscuous mode [ 338.625195][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.741302][ T8535] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 338.800398][ T13] bridge_slave_0: left allmulticast mode [ 338.950357][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 338.967988][ T24] dvb-usb: error while querying for an remote control event. [ 339.190528][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 339.263534][ T24] dvb-usb: error while querying for an remote control event. [ 339.450431][ T13] bridge_slave_0: left promiscuous mode [ 339.456339][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.593640][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 339.599559][ T24] dvb-usb: error while querying for an remote control event. [ 339.618886][ T5877] usb 5-1: USB disconnect, device number 19 [ 339.759024][ T5877] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 340.109117][ T8555] loop9: detected capacity change from 0 to 8 [ 340.694757][ T8555] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 340.700306][ T8555] loop9: partition table partially beyond EOD, truncated [ 340.707539][ T8555] loop9: p1 size 81768186 extends beyond EOD, truncated [ 340.834558][ T7913] udevd[7913]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 341.009189][ T5826] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 341.035450][ T5826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 341.112954][ T5826] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 341.221947][ T5826] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 341.244937][ T5826] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 342.201569][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 342.214580][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 342.224801][ T13] bond0 (unregistering): Released all slaves [ 342.276715][ T8028] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 342.517924][ T8028] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 342.718292][ T8028] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 342.988997][ T8028] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 343.467771][ T5826] Bluetooth: hci1: command tx timeout [ 343.620939][ T8028] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 343.630059][ T8028] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.670568][ T8028] usb 4-1: Product: syz [ 343.674902][ T8028] usb 4-1: Manufacturer: syz [ 343.687743][ T8028] usb 4-1: SerialNumber: syz [ 344.311338][ T8028] usb 4-1: config 0 descriptor?? [ 344.317385][ T8566] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 344.336419][ T8566] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 344.346428][ T8028] usb 4-1: ucan: probing device on interface #0 [ 344.883818][ T8028] usb 4-1: ucan: failed to retrieve device info [ 344.919628][ T8028] usb 4-1: ucan: probe failed; try to update the device firmware [ 344.961750][ T8028] usb 4-1: USB disconnect, device number 27 [ 344.978548][ T8596] loop6: detected capacity change from 0 to 524287999 [ 345.500838][ T5830] Bluetooth: hci1: command tx timeout [ 346.130279][ T13] hsr_slave_0: left promiscuous mode [ 346.143524][ T13] hsr_slave_1: left promiscuous mode [ 346.196502][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 346.363938][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 346.953945][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 347.010643][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 347.063080][ T13] veth1_macvtap: left promiscuous mode [ 347.069573][ T13] veth0_macvtap: left promiscuous mode [ 347.075858][ T13] veth1_vlan: left promiscuous mode [ 347.081389][ T13] veth0_vlan: left promiscuous mode [ 348.010927][ T8628] loop9: detected capacity change from 0 to 8 [ 348.019018][ T5830] Bluetooth: hci1: command tx timeout [ 348.058479][ T8628] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 348.070361][ T8628] loop9: partition table partially beyond EOD, truncated [ 348.100488][ T8628] loop9: p1 size 81768186 extends beyond EOD, truncated [ 348.458529][ T7913] udevd[7913]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 348.698278][ T8028] kernel write not supported for file /snd/seq (pid: 8028 comm: kworker/1:8) [ 349.024656][ T5923] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 349.174238][ T13] team0 (unregistering): Port device team_slave_1 removed [ 349.199169][ T5923] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 349.211049][ T5923] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 349.222296][ T5923] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 349.231591][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.233970][ T13] team0 (unregistering): Port device team_slave_0 removed [ 349.251834][ T5923] usb 4-1: config 0 descriptor?? [ 349.275904][ T5923] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 349.283287][ T5923] dvb-usb: bulk message failed: -22 (3/0) [ 349.302972][ T5923] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 349.315348][ T5923] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 349.325301][ T5923] usb 4-1: media controller created [ 349.333044][ T5923] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 349.357402][ T5923] dvb-usb: bulk message failed: -22 (6/0) [ 349.365660][ T5923] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 349.391338][ T5923] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input17 [ 349.410784][ T5923] dvb-usb: schedule remote query interval to 150 msecs. [ 349.417796][ T5923] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 349.575981][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 349.581990][ T5923] dvb-usb: error while querying for an remote control event. [ 349.742790][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 349.748604][ T5923] dvb-usb: error while querying for an remote control event. [ 349.819557][ T30] audit: type=1800 audit(1750511357.513:107): pid=8576 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.589" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 349.920686][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 349.926504][ T5923] dvb-usb: error while querying for an remote control event. [ 349.930672][ T8576] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 349.991474][ T8576] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 350.008258][ T8576] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 350.110462][ T5910] dvb-usb: bulk message failed: -22 (1/0) [ 350.116283][ T5910] dvb-usb: error while querying for an remote control event. [ 350.213886][ T8556] chnl_net:caif_netlink_parms(): no params data found [ 350.320874][ T5910] dvb-usb: bulk message failed: -22 (1/0) [ 350.330297][ T5910] dvb-usb: error while querying for an remote control event. [ 350.386460][ T5830] Bluetooth: hci1: command tx timeout [ 350.521392][ T5910] dvb-usb: bulk message failed: -22 (1/0) [ 350.527216][ T5910] dvb-usb: error while querying for an remote control event. [ 351.094393][ T5910] dvb-usb: bulk message failed: -22 (1/0) [ 351.388110][ T5910] dvb-usb: error while querying for an remote control event. [ 351.617194][ T5910] dvb-usb: bulk message failed: -22 (1/0) [ 352.272028][ T5910] dvb-usb: error while querying for an remote control event. [ 352.311056][ T5923] usb 4-1: USB disconnect, device number 28 [ 352.434003][ T8556] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.480354][ T8556] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.522309][ T8556] bridge_slave_0: entered allmulticast mode [ 352.771207][ T5923] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 352.805682][ T8556] bridge_slave_0: entered promiscuous mode [ 352.875677][ T8556] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.902177][ T8556] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.926466][ T8556] bridge_slave_1: entered allmulticast mode [ 353.045880][ T8556] bridge_slave_1: entered promiscuous mode [ 353.482813][ T8556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 353.536619][ T8556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 353.550457][ T977] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 353.829213][ T8694] loop9: detected capacity change from 0 to 8 [ 353.873182][ T8694] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 353.878888][ T8694] loop9: partition table partially beyond EOD, truncated [ 353.893863][ T8694] loop9: p1 size 81768186 extends beyond EOD, truncated [ 354.468157][ T977] usb 4-1: device descriptor read/64, error -71 [ 354.535725][ T7913] udevd[7913]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 354.840885][ T977] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 355.497352][ T8556] team0: Port device team_slave_0 added [ 355.506411][ T8556] team0: Port device team_slave_1 added [ 355.610298][ T977] usb 4-1: device descriptor read/64, error -71 [ 355.674056][ T8702] input: syz1 as /devices/virtual/input/input18 [ 355.701189][ T8556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 355.708199][ T8556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 355.785282][ T8556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 355.824095][ T8556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 355.864339][ T8556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 355.935285][ T977] usb usb4-port1: attempt power cycle [ 355.983097][ T8556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 356.250642][ T8708] x_tables: duplicate underflow at hook 2 [ 356.330458][ T977] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 356.734152][ T977] usb 4-1: device descriptor read/8, error -71 [ 356.783829][ T8706] trusted_key: encrypted_key: master key parameter 'ñžà' is invalid [ 357.321960][ T8556] hsr_slave_0: entered promiscuous mode [ 358.203653][ T8556] hsr_slave_1: entered promiscuous mode [ 358.238576][ T8556] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 358.255813][ T8556] Cannot create hsr debugfs directory [ 358.408306][ T5877] kernel write not supported for file /snd/seq (pid: 5877 comm: kworker/1:4) [ 358.479882][ T8734] netlink: 8 bytes leftover after parsing attributes in process `syz.1.617'. [ 358.730548][ T5877] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 358.940849][ T5830] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 359.138962][ T5877] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.200068][ T5877] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 359.290428][ T5877] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 359.329670][ T5877] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.352907][ T5877] usb 5-1: config 0 descriptor?? [ 359.401906][ T5877] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 359.570320][ T5877] dvb-usb: bulk message failed: -22 (3/0) [ 359.601309][ T5877] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 359.618412][ T5877] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 359.766127][ T8752] loop9: detected capacity change from 0 to 8 [ 360.594753][ T8752] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 360.600405][ T8752] loop9: partition table partially beyond EOD, truncated [ 360.608661][ T8752] loop9: p1 size 81768186 extends beyond EOD, truncated [ 360.633315][ T8749] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 360.687942][ T5877] usb 5-1: media controller created [ 360.704716][ T5877] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 360.778109][ T8001] udevd[8001]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 360.821887][ T5877] dvb-usb: bulk message failed: -22 (6/0) [ 360.859894][ T5877] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 360.905713][ T5877] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input19 [ 360.955367][ T5877] dvb-usb: schedule remote query interval to 150 msecs. [ 360.989936][ T5877] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 361.140930][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 361.150832][ T5877] dvb-usb: error while querying for an remote control event. [ 361.331568][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 361.337614][ T5877] dvb-usb: error while querying for an remote control event. [ 361.510691][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 361.519488][ T5877] dvb-usb: error while querying for an remote control event. [ 361.864083][ T5942] dvb-usb: bulk message failed: -22 (1/0) [ 361.937861][ T5942] dvb-usb: error while querying for an remote control event. [ 362.289280][ T5942] dvb-usb: bulk message failed: -22 (1/0) [ 362.374213][ T5942] dvb-usb: error while querying for an remote control event. [ 362.400664][ T24] usb 5-1: USB disconnect, device number 20 [ 363.318261][ T24] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 364.137637][ T8789] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 364.179322][ T8789] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 364.454877][ T8778] syz.1.621 (8778) used greatest stack depth: 17992 bytes left [ 366.590696][ T5877] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 366.741226][ T5877] usb 2-1: device descriptor read/64, error -71 [ 366.962820][ T8556] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 366.978754][ T8556] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 367.001836][ T8556] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 367.009964][ T8814] syz.0.630: attempt to access beyond end of device [ 367.009964][ T8814] nbd0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 367.010540][ T977] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 367.032101][ T8814] syz.0.630: attempt to access beyond end of device [ 367.032101][ T8814] nbd0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 367.049635][ T8556] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 367.057404][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 367.079615][ T8814] syz.0.630: attempt to access beyond end of device [ 367.079615][ T8814] nbd0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 367.090481][ T5877] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 367.107402][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 367.139394][ T8814] syz.0.630: attempt to access beyond end of device [ 367.139394][ T8814] nbd0: rw=0, sector=64, nr_sectors = 2 limit=0 [ 367.175584][ T8814] syz.0.630: attempt to access beyond end of device [ 367.175584][ T8814] nbd0: rw=0, sector=512, nr_sectors = 2 limit=0 [ 367.198189][ T977] usb 4-1: Using ep0 maxpacket: 16 [ 367.217631][ T977] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 367.231003][ T5877] usb 2-1: device descriptor read/64, error -71 [ 367.254057][ T977] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 367.270302][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 367.291327][ T8814] syz.0.630: attempt to access beyond end of device [ 367.291327][ T8814] nbd0: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 367.320045][ T977] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 367.346374][ T5877] usb usb2-port1: attempt power cycle [ 367.358969][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 367.371181][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.389981][ T8556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 367.402423][ T8814] syz.0.630: attempt to access beyond end of device [ 367.402423][ T8814] nbd0: rw=0, sector=64, nr_sectors = 4 limit=0 [ 367.415250][ T977] usb 4-1: Product: syz [ 367.415273][ T977] usb 4-1: Manufacturer: syz [ 367.415289][ T977] usb 4-1: SerialNumber: syz [ 367.459147][ T8556] 8021q: adding VLAN 0 to HW filter on device team0 [ 367.467207][ T8814] syz.0.630: attempt to access beyond end of device [ 367.467207][ T8814] nbd0: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 367.495859][ T5968] bridge0: port 1(bridge_slave_0) entered blocking state [ 367.503089][ T5968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 367.517997][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 367.534610][ T8814] syz.0.630: attempt to access beyond end of device [ 367.534610][ T8814] nbd0: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 367.566487][ T5968] bridge0: port 2(bridge_slave_1) entered blocking state [ 367.573755][ T5968] bridge0: port 2(bridge_slave_1) entered forwarding state [ 367.587906][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 367.635511][ T8814] syz.0.630: attempt to access beyond end of device [ 367.635511][ T8814] nbd0: rw=0, sector=64, nr_sectors = 8 limit=0 [ 367.665517][ T8808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.694964][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 367.705458][ T8808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.720935][ T5877] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 367.754360][ T5877] usb 2-1: device descriptor read/8, error -71 [ 367.761261][ T8814] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 367.784714][ T8808] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 367.796060][ T8814] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 367.838705][ T977] usb 4-1: cannot find UAC_HEADER [ 367.935160][ T977] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 367.975104][ T977] usb 4-1: USB disconnect, device number 33 [ 368.011388][ T5877] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 368.043789][ T7913] udevd[7913]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 368.061313][ T5877] usb 2-1: device descriptor read/8, error -71 [ 368.191287][ T5877] usb usb2-port1: unable to enumerate USB device [ 368.312407][ T8556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 368.404283][ T8556] veth0_vlan: entered promiscuous mode [ 368.417114][ T8556] veth1_vlan: entered promiscuous mode [ 368.534269][ T8556] veth0_macvtap: entered promiscuous mode [ 368.579909][ T8556] veth1_macvtap: entered promiscuous mode [ 368.663924][ T8556] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 368.789288][ T8556] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.838947][ T8556] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.861749][ T8556] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.874109][ T8556] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.894482][ T8556] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.063739][ T6939] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.102261][ T6939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.252568][ T6939] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.289107][ T6939] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.268629][ T59] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.547876][ T59] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.645556][ T59] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.762993][ T59] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.955938][ T59] bridge_slave_1: left allmulticast mode [ 371.962351][ T59] bridge_slave_1: left promiscuous mode [ 371.968096][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.978199][ T59] bridge_slave_0: left allmulticast mode [ 371.984761][ T59] bridge_slave_0: left promiscuous mode [ 371.990575][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.197984][ T8894] capability: warning: `syz.4.645' uses deprecated v2 capabilities in a way that may be insecure [ 372.261580][ T8899] overlayfs: failed to resolve './file0': -2 [ 372.850698][ T5910] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 373.398046][ T8901] netlink: 32 bytes leftover after parsing attributes in process `syz.0.642'. [ 373.620894][ T5910] usb 2-1: config index 0 descriptor too short (expected 31, got 27) [ 374.262443][ T5910] usb 2-1: config 1 interface 0 altsetting 253 endpoint 0x1 has invalid wMaxPacketSize 0 [ 374.273936][ T5910] usb 2-1: config 1 interface 0 has no altsetting 0 [ 374.283612][ T5910] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= b.72 [ 374.420876][ T5910] usb 2-1: New USB device strings: Mfr=28, Product=37, SerialNumber=3 [ 374.460323][ T5910] usb 2-1: Product: syz [ 374.470816][ T5910] usb 2-1: Manufacturer: syz [ 374.486008][ T5910] usb 2-1: SerialNumber: syz [ 374.738624][ T5826] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 374.749472][ T5826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 374.759647][ T5826] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 374.777949][ T5826] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 374.799149][ T5826] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 374.987565][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 375.062066][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 375.073352][ T59] bond0 (unregistering): Released all slaves [ 375.121291][ T977] IPVS: starting estimator thread 0... [ 375.191415][ T5910] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 17 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 375.211052][ T8924] IPVS: using max 26 ests per chain, 62400 per kthread [ 375.229477][ T5910] usb 2-1: USB disconnect, device number 17 [ 375.452648][ T5910] usblp0: removed [ 376.220869][ T24] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 376.490781][ T59] hsr_slave_0: left promiscuous mode [ 377.101323][ T5826] Bluetooth: hci1: command tx timeout [ 377.112656][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 377.125183][ T59] hsr_slave_1: left promiscuous mode [ 377.260087][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 377.281125][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 377.288546][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 377.342815][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=0721, bcdDevice=9c.25 [ 377.376861][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 377.388477][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.436639][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 377.664175][ T59] veth1_macvtap: left promiscuous mode [ 377.714358][ T59] veth0_macvtap: left promiscuous mode [ 377.814675][ T59] veth1_vlan: left promiscuous mode [ 377.865314][ T59] veth0_vlan: left promiscuous mode [ 378.256373][ T24] usb 4-1: Product: syz [ 378.266555][ T24] usb 4-1: Manufacturer: syz [ 378.276973][ T24] usb 4-1: SerialNumber: syz [ 378.301214][ T24] usb 4-1: config 0 descriptor?? [ 378.308546][ T24] hub 4-1:0.0: bad descriptor, ignoring hub [ 378.314720][ T24] hub 4-1:0.0: probe with driver hub failed with error -5 [ 378.640798][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.647165][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.180553][ T5826] Bluetooth: hci1: command tx timeout [ 380.710431][ T8971] 9pnet_fd: Insufficient options for proto=fd [ 381.260321][ T5826] Bluetooth: hci1: command tx timeout [ 381.542347][ T8028] usb 4-1: USB disconnect, device number 34 [ 382.515096][ T8981] netlink: 48 bytes leftover after parsing attributes in process `syz.0.657'. [ 382.686781][ T59] team0 (unregistering): Port device team_slave_1 removed [ 383.002687][ T59] team0 (unregistering): Port device team_slave_0 removed [ 383.340638][ T5826] Bluetooth: hci1: command tx timeout [ 383.876238][ T8028] IPVS: starting estimator thread 0... [ 384.003046][ T8991] IPVS: using max 24 ests per chain, 57600 per kthread [ 384.129975][ T8919] chnl_net:caif_netlink_parms(): no params data found [ 385.332629][ T8919] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.340125][ T8919] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.359637][ T8919] bridge_slave_0: entered allmulticast mode [ 385.380927][ T8919] bridge_slave_0: entered promiscuous mode [ 385.399693][ T9016] netlink: 830 bytes leftover after parsing attributes in process `syz.1.661'. [ 385.409586][ T9016] bond_slave_0: entered promiscuous mode [ 385.415762][ T9016] bond_slave_1: entered promiscuous mode [ 385.434138][ T9009] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 385.460970][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.476350][ T8919] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.497627][ T8919] bridge_slave_1: entered allmulticast mode [ 385.509797][ T8919] bridge_slave_1: entered promiscuous mode [ 385.735894][ T8919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 385.827570][ T8919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 386.177029][ T9034] 9pnet_fd: Insufficient options for proto=fd [ 387.020755][ T5826] Bluetooth: hci0: command 0x0c1a tx timeout [ 387.205201][ T8919] team0: Port device team_slave_0 added [ 387.389147][ T8919] team0: Port device team_slave_1 added [ 387.490992][ T977] IPVS: starting estimator thread 0... [ 387.590603][ T9048] IPVS: using max 26 ests per chain, 62400 per kthread [ 387.800514][ T977] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 388.010253][ T977] usb 4-1: Using ep0 maxpacket: 8 [ 388.026765][ T8919] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 388.062156][ T977] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 388.154852][ T8919] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 388.217445][ T977] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 388.403127][ T977] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 388.597190][ T977] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 388.617571][ T8919] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 388.763905][ T8919] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 388.771153][ T8919] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 388.798153][ T8919] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 388.847731][ T977] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 388.925964][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.468330][ T977] usb 4-1: GET_CAPABILITIES returned 0 [ 389.490481][ T977] usbtmc 4-1:16.0: can't read capabilities [ 389.607416][ T30] audit: type=1804 audit(1750511397.283:108): pid=9050 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.663" name="file0" dev="ramfs" ino=23672 res=1 errno=0 [ 390.391985][ T8919] hsr_slave_0: entered promiscuous mode [ 390.411814][ T8919] hsr_slave_1: entered promiscuous mode [ 390.428651][ T8919] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 390.448927][ T8919] Cannot create hsr debugfs directory [ 390.530657][ T5910] usb 4-1: USB disconnect, device number 35 [ 391.368437][ T9080] 9pnet_fd: Insufficient options for proto=fd [ 391.775491][ T5923] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 391.805609][ T9096] 9pnet_fd: Insufficient options for proto=fd [ 392.097807][ T5923] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 392.228072][ T5923] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 392.359603][ T5923] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 392.399687][ T5923] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.475336][ T5923] usb 5-1: config 0 descriptor?? [ 392.553678][ T5923] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 392.599442][ T5923] dvb-usb: bulk message failed: -22 (3/0) [ 392.628360][ T5923] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 392.854907][ T5923] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 393.752508][ T5923] usb 5-1: media controller created [ 393.930857][ T5923] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 394.061078][ T5923] dvb-usb: bulk message failed: -22 (6/0) [ 394.070451][ T5923] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 394.133097][ T5923] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input20 [ 396.190863][ T5923] dvb-usb: schedule remote query interval to 150 msecs. [ 396.243067][ T5923] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 396.401662][ T977] dvb-usb: bulk message failed: -22 (1/0) [ 396.435057][ T977] dvb-usb: error while querying for an remote control event. [ 396.482350][ T5923] usb 5-1: USB disconnect, device number 21 [ 396.660622][ T5923] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 396.879487][ T9123] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 397.020810][ T9123] netlink: 'syz.3.686': attribute type 10 has an invalid length. [ 397.136051][ T9123] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 397.398463][ T8919] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 397.555538][ T8919] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 398.225647][ T8919] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 398.327331][ T8919] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 398.592375][ T9144] netlink: 32 bytes leftover after parsing attributes in process `syz.3.691'. [ 398.867341][ T8919] 8021q: adding VLAN 0 to HW filter on device bond0 [ 398.987353][ T8919] 8021q: adding VLAN 0 to HW filter on device team0 [ 399.659769][ T8029] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.667026][ T8029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 399.696999][ T8029] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.704268][ T8029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 399.735569][ T8919] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 399.748105][ T8919] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 399.845753][ T9167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.904403][ T9167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 400.010727][ T9171] netlink: 'syz.1.695': attribute type 5 has an invalid length. [ 400.380764][ T9181] 9pnet_fd: Insufficient options for proto=fd [ 400.619591][ T8919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 400.761721][ T5877] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 400.879789][ T8919] veth0_vlan: entered promiscuous mode [ 400.935650][ T5877] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 400.959524][ T5877] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 401.042284][ T5877] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 401.117960][ T8919] veth1_vlan: entered promiscuous mode [ 401.176436][ T5877] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.243393][ T5877] usb 4-1: config 0 descriptor?? [ 401.266428][ T5877] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 401.300768][ T5877] dvb-usb: bulk message failed: -22 (3/0) [ 401.325907][ T5877] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 401.346740][ T8919] veth0_macvtap: entered promiscuous mode [ 401.356020][ T5877] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 401.377597][ T8919] veth1_macvtap: entered promiscuous mode [ 401.386457][ T5877] usb 4-1: media controller created [ 401.398033][ T5877] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 401.447438][ T8919] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.460027][ T5877] dvb-usb: bulk message failed: -22 (6/0) [ 401.475771][ T5877] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 401.489946][ T5877] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input21 [ 401.520728][ T8919] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.552151][ T5877] dvb-usb: schedule remote query interval to 150 msecs. [ 401.564614][ T8919] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.584471][ T5877] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 401.595356][ T8919] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.625845][ T8919] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.644822][ T8919] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.809538][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 401.816625][ T5877] dvb-usb: error while querying for an remote control event. [ 402.264783][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 402.285911][ T5877] dvb-usb: error while querying for an remote control event. [ 402.471755][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 402.504166][ T5877] dvb-usb: error while querying for an remote control event. [ 402.516779][ T1102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.591987][ T1102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.606127][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.619598][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.667333][ T9213] netlink: 'syz.4.703': attribute type 11 has an invalid length. [ 402.732892][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 402.759996][ T5877] dvb-usb: error while querying for an remote control event. [ 402.952623][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 403.016663][ T24] dvb-usb: error while querying for an remote control event. [ 403.272135][ T8028] dvb-usb: bulk message failed: -22 (1/0) [ 403.326416][ T8028] dvb-usb: error while querying for an remote control event. [ 403.948206][ T5835] dvb-usb: bulk message failed: -22 (1/0) [ 404.041814][ T5835] dvb-usb: error while querying for an remote control event. [ 404.300484][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 404.370389][ T5877] dvb-usb: error while querying for an remote control event. [ 404.477637][ T5877] usb 4-1: USB disconnect, device number 36 [ 404.895771][ T9237] netlink: 'syz.4.706': attribute type 1 has an invalid length. [ 405.474970][ T5877] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 405.695884][ T30] audit: type=1326 audit(1750511413.383:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9226 comm="syz.0.705" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9da598e929 code=0x0 [ 405.717827][ T9237] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 405.860772][ T9227] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 405.925169][ T9227] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 405.941340][ T9227] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 405.976832][ T9227] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 407.243835][ T59] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.418165][ T59] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.449454][ T5923] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 407.557786][ T59] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.621502][ T5923] usb 4-1: Using ep0 maxpacket: 16 [ 407.630832][ T59] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.647251][ T5923] usb 4-1: config index 0 descriptor too short (expected 46642, got 72) [ 407.665927][ T5923] usb 4-1: config 173 has too many interfaces: 131, using maximum allowed: 32 [ 407.676963][ T5923] usb 4-1: config 173 contains an unexpected descriptor of type 0x1, skipping [ 407.697677][ T5923] usb 4-1: config 173 has an invalid descriptor of length 0, skipping remainder of the config [ 407.731494][ T5923] usb 4-1: config 173 has 0 interfaces, different from the descriptor's value: 131 [ 407.765118][ T5923] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 407.794720][ T5923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.810702][ T5923] usb 4-1: Product: syz [ 407.815016][ T5923] usb 4-1: Manufacturer: syz [ 407.819645][ T5923] usb 4-1: SerialNumber: syz [ 407.865946][ T59] bridge_slave_1: left allmulticast mode [ 407.876433][ T59] bridge_slave_1: left promiscuous mode [ 407.884083][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.898379][ T59] bridge_slave_0: left allmulticast mode [ 407.904199][ T5826] Bluetooth: hci0: command 0x0c1a tx timeout [ 407.911511][ T59] bridge_slave_0: left promiscuous mode [ 407.917416][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.980851][ T5826] Bluetooth: hci3: command 0x0c1a tx timeout [ 407.981330][ T9240] Bluetooth: hci2: command 0x0c1a tx timeout [ 408.061209][ T9240] Bluetooth: hci4: command 0x0c1a tx timeout [ 409.377846][ T5923] usb 4-1: USB disconnect, device number 37 [ 409.388442][ T5826] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 409.404432][ T5826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 409.426912][ T5826] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 409.441804][ T5826] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 409.452558][ T5826] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 409.516466][ T9307] 9pnet_fd: Insufficient options for proto=fd [ 409.881540][ T5835] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 410.084547][ T5835] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 410.130596][ T5835] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 410.170418][ T5835] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 410.207361][ T9325] netlink: 8 bytes leftover after parsing attributes in process `syz.3.719'. [ 410.207768][ T5835] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.277839][ T5835] usb 5-1: config 0 descriptor?? [ 410.296006][ T5835] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 410.310740][ T5835] dvb-usb: bulk message failed: -22 (3/0) [ 410.348790][ T5835] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 410.379779][ T5835] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 410.400624][ T5835] usb 5-1: media controller created [ 410.413661][ T5835] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 410.458494][ T5835] dvb-usb: bulk message failed: -22 (6/0) [ 410.474295][ T5835] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 410.499794][ T5835] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input22 [ 410.579365][ T9331] Cannot find add_set index 0 as target [ 410.587122][ T9331] netlink: 'syz.3.720': attribute type 9 has an invalid length. [ 410.605354][ T9331] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 411.330522][ T5835] dvb-usb: schedule remote query interval to 150 msecs. [ 411.337546][ T5835] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 411.399230][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 411.490771][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 411.498550][ T5877] dvb-usb: error while querying for an remote control event. [ 411.512482][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 411.572766][ T59] bond0 (unregistering): Released all slaves [ 411.583179][ T9240] Bluetooth: hci1: command tx timeout [ 411.690414][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 411.696227][ T5877] dvb-usb: error while querying for an remote control event. [ 411.925713][ T9341] openvswitch: netlink: Duplicate or invalid key (type 0). [ 411.940528][ T5877] dvb-usb: bulk message failed: -22 (1/0) [ 411.956637][ T5877] dvb-usb: error while querying for an remote control event. [ 411.972470][ T9341] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 412.141370][ T5835] dvb-usb: bulk message failed: -22 (1/0) [ 412.151372][ T5835] dvb-usb: error while querying for an remote control event. [ 412.215866][ T9347] netlink: 56 bytes leftover after parsing attributes in process `syz.0.725'. [ 412.321181][ T5835] dvb-usb: bulk message failed: -22 (1/0) [ 412.359610][ T5835] dvb-usb: error while querying for an remote control event. [ 412.427981][ T59] hsr_slave_0: left promiscuous mode [ 412.482837][ T59] hsr_slave_1: left promiscuous mode [ 412.497562][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 412.515605][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 412.527242][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 412.547631][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 412.591091][ T59] veth1_macvtap: left promiscuous mode [ 412.597465][ T59] veth0_macvtap: left promiscuous mode [ 412.610137][ T59] veth1_vlan: left promiscuous mode [ 412.616897][ T59] veth0_vlan: left promiscuous mode [ 412.651147][ T5835] dvb-usb: bulk message failed: -22 (1/0) [ 412.657675][ T5835] dvb-usb: error while querying for an remote control event. [ 413.411856][ T5835] usb 5-1: USB disconnect, device number 22 [ 413.555494][ T9365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.728'. [ 413.660499][ T9240] Bluetooth: hci1: command tx timeout [ 413.839307][ T5835] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 414.960136][ T59] team0 (unregistering): Port device team_slave_1 removed [ 415.004363][ T59] team0 (unregistering): Port device team_slave_0 removed [ 415.399311][ T9301] chnl_net:caif_netlink_parms(): no params data found [ 415.683561][ T9394] netlink: 8 bytes leftover after parsing attributes in process `syz.3.731'. [ 415.740503][ T9240] Bluetooth: hci1: command tx timeout [ 416.094211][ T9403] FAULT_INJECTION: forcing a failure. [ 416.094211][ T9403] name failslab, interval 1, probability 0, space 0, times 0 [ 416.118815][ T9409] netlink: 48 bytes leftover after parsing attributes in process `syz.0.735'. [ 416.170940][ T9409] FAULT_INJECTION: forcing a failure. [ 416.170940][ T9409] name failslab, interval 1, probability 0, space 0, times 0 [ 416.234944][ T9409] CPU: 1 UID: 0 PID: 9409 Comm: syz.0.735 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 416.234975][ T9409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 416.234995][ T9409] Call Trace: [ 416.235009][ T9409] [ 416.235018][ T9409] dump_stack_lvl+0x189/0x250 [ 416.235049][ T9409] ? irqentry_exit+0x74/0x90 [ 416.235080][ T9409] ? __pfx_dump_stack_lvl+0x10/0x10 [ 416.235128][ T9409] should_fail_ex+0x414/0x560 [ 416.235160][ T9409] should_failslab+0xa8/0x100 [ 416.235188][ T9409] kmem_cache_alloc_noprof+0x73/0x3c0 [ 416.235211][ T9409] ? skb_clone+0x212/0x3a0 [ 416.235244][ T9409] skb_clone+0x212/0x3a0 [ 416.235275][ T9409] __netlink_deliver_tap+0x404/0x850 [ 416.235314][ T9409] ? netlink_deliver_tap+0x2e/0x1b0 [ 416.235339][ T9409] netlink_deliver_tap+0x19c/0x1b0 [ 416.235363][ T9409] netlink_sendskb+0x68/0x140 [ 416.235387][ T9409] netlink_rcv_skb+0x28c/0x470 [ 416.235411][ T9409] ? __pfx_genl_rcv_msg+0x10/0x10 [ 416.235450][ T9409] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 416.235492][ T9409] ? down_read+0x1ad/0x2e0 [ 416.235516][ T9409] genl_rcv+0x28/0x40 [ 416.235545][ T9409] netlink_unicast+0x758/0x8d0 [ 416.235579][ T9409] netlink_sendmsg+0x805/0xb30 [ 416.235614][ T9409] ? __pfx_netlink_sendmsg+0x10/0x10 [ 416.235648][ T9409] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 416.235673][ T9409] ? __pfx_netlink_sendmsg+0x10/0x10 [ 416.235699][ T9409] __sock_sendmsg+0x219/0x270 [ 416.235734][ T9409] ____sys_sendmsg+0x505/0x830 [ 416.235767][ T9409] ? __pfx_____sys_sendmsg+0x10/0x10 [ 416.235804][ T9409] ? import_iovec+0x74/0xa0 [ 416.235828][ T9409] ___sys_sendmsg+0x21f/0x2a0 [ 416.235857][ T9409] ? __pfx____sys_sendmsg+0x10/0x10 [ 416.235925][ T9409] ? __fget_files+0x2a/0x420 [ 416.235952][ T9409] ? __fget_files+0x3a0/0x420 [ 416.235992][ T9409] __x64_sys_sendmsg+0x19b/0x260 [ 416.236020][ T9409] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 416.236058][ T9409] ? __pfx_ksys_write+0x10/0x10 [ 416.236079][ T9409] ? rcu_is_watching+0x15/0xb0 [ 416.236114][ T9409] ? do_syscall_64+0xbe/0x3b0 [ 416.236137][ T9409] do_syscall_64+0xfa/0x3b0 [ 416.236154][ T9409] ? lockdep_hardirqs_on+0x9c/0x150 [ 416.236182][ T9409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.236203][ T9409] ? clear_bhb_loop+0x60/0xb0 [ 416.236229][ T9409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.236249][ T9409] RIP: 0033:0x7f9da598e929 [ 416.236268][ T9409] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 416.236286][ T9409] RSP: 002b:00007f9da6759038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 416.236307][ T9409] RAX: ffffffffffffffda RBX: 00007f9da5bb5fa0 RCX: 00007f9da598e929 [ 416.236322][ T9409] RDX: 00000000000008d0 RSI: 0000200000000200 RDI: 0000000000000003 [ 416.236335][ T9409] RBP: 00007f9da6759090 R08: 0000000000000000 R09: 0000000000000000 [ 416.236348][ T9409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.236360][ T9409] R13: 0000000000000000 R14: 00007f9da5bb5fa0 R15: 00007ffd476f2c38 [ 416.236393][ T9409] [ 416.541308][ T9403] CPU: 1 UID: 0 PID: 9403 Comm: syz.4.734 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 416.541354][ T9403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 416.541367][ T9403] Call Trace: [ 416.541375][ T9403] [ 416.541384][ T9403] dump_stack_lvl+0x189/0x250 [ 416.541417][ T9403] ? __pfx____ratelimit+0x10/0x10 [ 416.541448][ T9403] ? __pfx_dump_stack_lvl+0x10/0x10 [ 416.541477][ T9403] ? __pfx__printk+0x10/0x10 [ 416.541514][ T9403] should_fail_ex+0x414/0x560 [ 416.541546][ T9403] should_failslab+0xa8/0x100 [ 416.541575][ T9403] kmem_cache_alloc_noprof+0x73/0x3c0 [ 416.541598][ T9403] ? skb_clone+0x212/0x3a0 [ 416.541629][ T9403] skb_clone+0x212/0x3a0 [ 416.541657][ T9403] __netlink_deliver_tap+0x404/0x850 [ 416.541699][ T9403] ? netlink_deliver_tap+0x2e/0x1b0 [ 416.541722][ T9403] netlink_deliver_tap+0x19c/0x1b0 [ 416.541747][ T9403] netlink_sendskb+0x68/0x140 [ 416.541768][ T9403] netlink_rcv_skb+0x28c/0x470 [ 416.541791][ T9403] ? __pfx_genl_rcv_msg+0x10/0x10 [ 416.541821][ T9403] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 416.541863][ T9403] ? down_read+0x1ad/0x2e0 [ 416.541886][ T9403] genl_rcv+0x28/0x40 [ 416.541911][ T9403] netlink_unicast+0x758/0x8d0 [ 416.541943][ T9403] netlink_sendmsg+0x805/0xb30 [ 416.541977][ T9403] ? __pfx_netlink_sendmsg+0x10/0x10 [ 416.542010][ T9403] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 416.542033][ T9403] ? __pfx_netlink_sendmsg+0x10/0x10 [ 416.542057][ T9403] __sock_sendmsg+0x219/0x270 [ 416.542090][ T9403] ____sys_sendmsg+0x505/0x830 [ 416.542121][ T9403] ? __pfx_____sys_sendmsg+0x10/0x10 [ 416.542157][ T9403] ? import_iovec+0x74/0xa0 [ 416.542181][ T9403] ___sys_sendmsg+0x21f/0x2a0 [ 416.542208][ T9403] ? __pfx____sys_sendmsg+0x10/0x10 [ 416.542273][ T9403] ? __fget_files+0x2a/0x420 [ 416.542299][ T9403] ? __fget_files+0x3a0/0x420 [ 416.542336][ T9403] __x64_sys_sendmsg+0x19b/0x260 [ 416.542364][ T9403] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 416.542400][ T9403] ? __pfx_ksys_write+0x10/0x10 [ 416.542420][ T9403] ? rcu_is_watching+0x15/0xb0 [ 416.542454][ T9403] ? do_syscall_64+0xbe/0x3b0 [ 416.542476][ T9403] do_syscall_64+0xfa/0x3b0 [ 416.542496][ T9403] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.542515][ T9403] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 416.542534][ T9403] ? clear_bhb_loop+0x60/0xb0 [ 416.542558][ T9403] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.542578][ T9403] RIP: 0033:0x7f7d9498e929 [ 416.542596][ T9403] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 416.542612][ T9403] RSP: 002b:00007f7d957d6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 416.542633][ T9403] RAX: ffffffffffffffda RBX: 00007f7d94bb5fa0 RCX: 00007f7d9498e929 [ 416.542647][ T9403] RDX: 0000000000040080 RSI: 0000200000000140 RDI: 0000000000000003 [ 416.542660][ T9403] RBP: 00007f7d957d6090 R08: 0000000000000000 R09: 0000000000000000 [ 416.542678][ T9403] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.542690][ T9403] R13: 0000000000000000 R14: 00007f7d94bb5fa0 R15: 00007ffe7a4ee5a8 [ 416.542722][ T9403] [ 418.434077][ T9240] Bluetooth: hci1: command tx timeout [ 418.584113][ T9301] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.740319][ T9301] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.857203][ T9301] bridge_slave_0: entered allmulticast mode [ 418.982044][ T9301] bridge_slave_0: entered promiscuous mode [ 418.991615][ T9301] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.998779][ T9301] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.006357][ T9301] bridge_slave_1: entered allmulticast mode [ 419.014650][ T9301] bridge_slave_1: entered promiscuous mode [ 420.846623][ T9301] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 420.995940][ T9301] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.459476][ T5942] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 421.841444][ T5942] usb 5-1: Using ep0 maxpacket: 32 [ 421.894004][ T9301] team0: Port device team_slave_0 added [ 421.932677][ T5942] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 422.073921][ T5942] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 422.114030][ T5942] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 422.227657][ T5942] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 422.389080][ T5942] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 422.421904][ T9301] team0: Port device team_slave_1 added [ 422.494372][ T5942] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 422.540463][ T5942] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 422.607084][ T5942] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.647006][ T5942] usb 5-1: config 0 descriptor?? [ 423.331669][ T9301] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 423.338682][ T9301] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 423.352864][ T5942] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 23 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 423.483320][ T9301] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 423.498392][ T9301] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 423.505566][ T9301] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 423.540262][ T9301] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 423.583207][ T5942] usb 5-1: USB disconnect, device number 23 [ 423.645904][ T5942] usblp0: removed [ 423.958481][ T9499] loop9: detected capacity change from 0 to 8 [ 423.965647][ T9499] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 423.973427][ T9499] loop9: partition table partially beyond EOD, truncated [ 423.980914][ T9499] loop9: p1 size 81768186 extends beyond EOD, truncated [ 424.309003][ T9301] hsr_slave_0: entered promiscuous mode [ 424.318245][ T9301] hsr_slave_1: entered promiscuous mode [ 424.324996][ T9301] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 424.340291][ T9301] Cannot create hsr debugfs directory [ 424.808126][ T8985] udevd[8985]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 425.670689][ T5835] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 425.840429][ T5835] usb 2-1: Using ep0 maxpacket: 32 [ 426.081665][ T5835] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 426.120925][ T5835] usb 2-1: config 0 has no interface number 0 [ 426.141542][ T5835] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 426.194794][ T5835] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.253934][ T5835] usb 2-1: Product: syz [ 426.278308][ T9521] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 426.287861][ T5835] usb 2-1: Manufacturer: syz [ 426.301533][ T5835] usb 2-1: SerialNumber: syz [ 426.318792][ T5835] usb 2-1: config 0 descriptor?? [ 428.131965][ T5835] smsc95xx v2.0.0 [ 428.606192][ T9538] 9pnet_fd: Insufficient options for proto=fd [ 429.264876][ T5835] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 429.290265][ T5835] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 429.571820][ T5835] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 429.712939][ T5835] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61 [ 430.784325][ T977] usb 2-1: USB disconnect, device number 18 [ 432.565991][ T9580] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 432.583440][ T5910] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 432.795248][ T5910] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 432.830456][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.846351][ T5910] usb 2-1: Product: syz [ 432.852458][ T5910] usb 2-1: Manufacturer: syz [ 432.857399][ T5910] usb 2-1: SerialNumber: syz [ 432.889301][ T5910] usb 2-1: config 0 descriptor?? [ 433.441016][ T5910] usb 2-1: Firmware version (0.0) predates our first public release. [ 433.512738][ T5910] usb 2-1: Please update to version 0.2 or newer [ 433.532906][ T9301] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 433.564340][ T5910] usb 2-1: Firmware: build lb [ 433.619209][ T9301] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 433.708492][ T9301] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 433.770044][ T9301] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 434.964846][ T9573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.991082][ T9573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.036079][ T9616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.061835][ T9616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.417572][ T9301] 8021q: adding VLAN 0 to HW filter on device bond0 [ 436.469686][ T9301] 8021q: adding VLAN 0 to HW filter on device team0 [ 436.503952][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 436.511242][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 436.573376][ T1102] bridge0: port 2(bridge_slave_1) entered blocking state [ 436.580794][ T1102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 436.797101][ T5942] usb 2-1: USB disconnect, device number 19 [ 437.020552][ T9640] netlink: 32 bytes leftover after parsing attributes in process `syz.3.784'. [ 437.973414][ T5835] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 438.050783][ T5942] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 438.112353][ T9659] netlink: 'syz.3.788': attribute type 1 has an invalid length. [ 438.191002][ T5835] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 438.296180][ T5942] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.345735][ T5835] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 438.404694][ T5942] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.425659][ T5835] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 438.501513][ T5942] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 438.525339][ T5835] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 438.581690][ T5942] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.611458][ T5835] usb 5-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 438.652796][ T5942] usb 2-1: config 0 descriptor?? [ 438.670540][ T5835] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.721084][ T5835] usb 5-1: config 0 descriptor?? [ 438.833486][ T9301] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 438.932701][ T5835] hdpvr 5-1:0.0: firmware version 0x0 dated [ 438.961520][ T5835] hdpvr 5-1:0.0: untested firmware, the driver might not work. [ 439.158221][ T5942] cm6533_jd 0003:0D8C:0022.0003: unknown main item tag 0x0 [ 439.181350][ T5942] cm6533_jd 0003:0D8C:0022.0003: unknown main item tag 0x0 [ 439.372186][ T9652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.407746][ T9652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.463983][ T5942] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.0003/input/input23 [ 439.588856][ T5942] cm6533_jd 0003:0D8C:0022.0003: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 440.088970][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.100326][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.304424][ T5910] usb 2-1: USB disconnect, device number 20 [ 440.425514][ T9682] overlayfs: missing 'lowerdir' [ 441.267979][ T9677] fido_id[9677]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 441.329079][ T9663] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.336604][ T9663] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.060327][ T5877] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 443.118062][ T9663] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 443.149675][ T9663] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 443.220516][ T5877] usb 4-1: Using ep0 maxpacket: 16 [ 443.235768][ T5877] usb 4-1: unable to get BOS descriptor or descriptor too short [ 443.248381][ T5877] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 443.264730][ T5877] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 443.275706][ T5877] usb 4-1: config 1 has no interface number 1 [ 443.286513][ T5877] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 443.308856][ T5877] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 443.318710][ T5877] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.334240][ T5877] usb 4-1: Product: syz [ 443.338549][ T5877] usb 4-1: Manufacturer: syz [ 443.347662][ T5877] usb 4-1: SerialNumber: syz [ 443.571200][ T9724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.584600][ T9724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.615748][ T5877] usb 4-1: 2:1 : no UAC_FORMAT_TYPE desc [ 443.671903][ T5877] usb 4-1: USB disconnect, device number 38 [ 443.682029][ T9663] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.693449][ T9663] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.713440][ T9663] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.725140][ T9663] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.775061][ T8985] udevd[8985]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 444.081333][ T9301] veth0_vlan: entered promiscuous mode [ 444.117613][ T5835] hdpvr 5-1:0.0: Could not setup controls [ 444.137705][ T5835] hdpvr 5-1:0.0: registering videodev failed [ 444.367673][ T9301] veth1_vlan: entered promiscuous mode [ 444.386559][ T5835] hdpvr 5-1:0.0: probe with driver hdpvr failed with error -71 [ 444.420776][ T5835] usb 5-1: USB disconnect, device number 24 [ 444.431782][ T9301] veth0_macvtap: entered promiscuous mode [ 444.444903][ T9301] veth1_macvtap: entered promiscuous mode [ 444.467821][ T9301] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.545022][ T9301] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.618233][ T9301] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.660866][ T9301] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.700162][ T9301] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.734376][ T9301] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.227253][ T3539] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.255492][ T3539] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.339431][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.354389][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.501098][ T59] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.977462][ T59] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.303859][ T9773] overlayfs: missing 'workdir' [ 448.443811][ T9777] netlink: 28 bytes leftover after parsing attributes in process `syz.3.813'. [ 449.534236][ T59] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.571805][ T9784] netlink: 8 bytes leftover after parsing attributes in process `syz.0.814'. [ 449.581900][ T9792] syz_tun: entered allmulticast mode [ 449.778782][ T59] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.871276][ T5953] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 450.031508][ T9240] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 450.045418][ T9240] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 450.054135][ T9240] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 450.068001][ T5953] usb 4-1: Using ep0 maxpacket: 8 [ 450.079893][ T9240] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 450.094960][ T5953] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 450.105230][ T9240] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 450.118850][ T5953] usb 4-1: config 0 has no interface number 0 [ 450.136944][ T5953] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 450.157104][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.175629][ T5953] usb 4-1: Product: syz [ 450.180399][ T5953] usb 4-1: Manufacturer: syz [ 450.196369][ T5953] usb 4-1: SerialNumber: syz [ 450.209475][ T5953] usb 4-1: config 0 descriptor?? [ 450.564349][ T5953] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 450.590333][ T5953] usb 4-1: No streaming interface found for terminal 6. [ 450.591600][ T59] bridge_slave_1: left allmulticast mode [ 450.626751][ T5953] usb 4-1: USB disconnect, device number 39 [ 450.672159][ T59] bridge_slave_1: left promiscuous mode [ 450.720390][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.764888][ T59] bridge_slave_0: left allmulticast mode [ 450.781921][ T59] bridge_slave_0: left promiscuous mode [ 450.801532][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.416291][ T9828] netlink: 'syz.3.827': attribute type 23 has an invalid length. [ 452.150535][ T9240] Bluetooth: hci1: command tx timeout [ 452.538372][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 452.605603][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 452.618274][ T59] bond0 (unregistering): Released all slaves [ 453.630043][ T9855] netlink: 4 bytes leftover after parsing attributes in process `syz.4.831'. [ 454.220627][ T9240] Bluetooth: hci1: command 0x041b tx timeout [ 455.565582][ T9883] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 455.679177][ T9805] chnl_net:caif_netlink_parms(): no params data found [ 455.686347][ T5910] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 455.882761][ T5910] usb 5-1: config 0 has an invalid interface number: 76 but max is 0 [ 455.927513][ T5910] usb 5-1: config 0 has no interface number 0 [ 455.964907][ T5910] usb 5-1: too many endpoints for config 0 interface 76 altsetting 133: 31, using maximum allowed: 30 [ 456.019484][ T5910] usb 5-1: config 0 interface 76 altsetting 133 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 456.032619][ T59] hsr_slave_0: left promiscuous mode [ 456.070034][ T59] hsr_slave_1: left promiscuous mode [ 456.079513][ T5910] usb 5-1: config 0 interface 76 altsetting 133 has 1 endpoint descriptor, different from the interface descriptor's value: 31 [ 456.094048][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 456.124308][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 456.163702][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 456.171418][ T5910] usb 5-1: config 0 interface 76 has no altsetting 0 [ 456.190000][ T5910] usb 5-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.00 [ 456.192282][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 456.207630][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=244, SerialNumber=0 [ 456.233535][ T5910] usb 5-1: Product: syz [ 456.258892][ T5910] usb 5-1: config 0 descriptor?? [ 456.300456][ T5826] Bluetooth: hci1: command 0x041b tx timeout [ 456.347838][ T59] veth1_macvtap: left promiscuous mode [ 456.381650][ T59] veth0_macvtap: left promiscuous mode [ 456.391840][ T59] veth1_vlan: left promiscuous mode [ 456.397245][ T59] veth0_vlan: left promiscuous mode [ 456.494710][ T9877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.532630][ T9877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.570992][ T24] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 456.758541][ T24] usb 4-1: config 48 has an invalid descriptor of length 0, skipping remainder of the config [ 456.825638][ T24] usb 4-1: config 48 interface 0 altsetting 98 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 456.869676][ T24] usb 4-1: config 48 interface 0 altsetting 98 endpoint 0x4 has invalid wMaxPacketSize 0 [ 456.913021][ T24] usb 4-1: config 48 interface 0 altsetting 98 endpoint 0x8 has invalid wMaxPacketSize 0 [ 456.930352][ T24] usb 4-1: config 48 interface 0 altsetting 98 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 456.974527][ T24] usb 4-1: config 48 interface 0 has no altsetting 0 [ 457.002586][ T24] usb 4-1: New USB device found, idVendor=1784, idProduct=0006, bcdDevice=bb.2f [ 457.022444][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.053116][ T24] usb 4-1: Product: syz [ 457.057444][ T24] usb 4-1: Manufacturer: syz [ 457.083923][ T24] usb 4-1: SerialNumber: syz [ 457.206189][ T5910] usbtouchscreen 5-1:0.76: probe with driver usbtouchscreen failed with error -71 [ 457.263353][ T5910] usb 5-1: USB disconnect, device number 25 [ 457.459469][ T9915] netlink: 8 bytes leftover after parsing attributes in process `syz.3.840'. [ 457.711218][ T5910] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 457.865651][ T5910] usb 5-1: device descriptor read/64, error -71 [ 457.951446][ T59] team0 (unregistering): Port device team_slave_1 removed [ 458.338457][ T59] team0 (unregistering): Port device team_slave_0 removed [ 458.394786][ T5826] Bluetooth: hci1: command 0x041b tx timeout [ 458.477991][ T5910] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 458.645076][ T5910] usb 5-1: device descriptor read/64, error -71 [ 458.777075][ T5910] usb usb5-port1: attempt power cycle [ 459.120882][ T9901] mkiss: ax0: crc mode is auto. [ 459.180465][ T5910] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 459.234324][ T5910] usb 5-1: device descriptor read/8, error -71 [ 459.331873][ T24] usb 4-1: USB disconnect, device number 40 [ 459.707828][ T5910] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 459.932183][ T5910] usb 5-1: device descriptor read/8, error -71 [ 459.953476][ T9805] bridge0: port 1(bridge_slave_0) entered blocking state [ 459.969471][ T9805] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.989790][ T9805] bridge_slave_0: entered allmulticast mode [ 460.017498][ T9805] bridge_slave_0: entered promiscuous mode [ 460.040591][ T5910] usb usb5-port1: unable to enumerate USB device [ 460.042738][ T9805] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.080452][ T9805] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.098070][ T9805] bridge_slave_1: entered allmulticast mode [ 460.132378][ T9805] bridge_slave_1: entered promiscuous mode [ 460.340539][ T9937] FAULT_INJECTION: forcing a failure. [ 460.340539][ T9937] name failslab, interval 1, probability 0, space 0, times 0 [ 460.413305][ T9937] CPU: 1 UID: 0 PID: 9937 Comm: syz.0.847 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 460.413335][ T9937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 460.413349][ T9937] Call Trace: [ 460.413358][ T9937] [ 460.413367][ T9937] dump_stack_lvl+0x189/0x250 [ 460.413404][ T9937] ? __pfx____ratelimit+0x10/0x10 [ 460.413435][ T9937] ? __pfx_dump_stack_lvl+0x10/0x10 [ 460.413465][ T9937] ? __pfx__printk+0x10/0x10 [ 460.413493][ T9937] ? __pfx___might_resched+0x10/0x10 [ 460.413528][ T9937] should_fail_ex+0x414/0x560 [ 460.413557][ T9937] ? alloc_netdev_mqs+0x8e5/0x11e0 [ 460.413583][ T9937] should_failslab+0xa8/0x100 [ 460.413611][ T9937] __kvmalloc_node_noprof+0x161/0x5f0 [ 460.413637][ T9937] ? alloc_netdev_mqs+0x8e5/0x11e0 [ 460.413669][ T9937] alloc_netdev_mqs+0x8e5/0x11e0 [ 460.413704][ T9937] ppp_ioctl+0x634/0x19a0 [ 460.413731][ T9937] ? __pfx_smack_file_ioctl+0x10/0x10 [ 460.413759][ T9937] ? __pfx_ppp_ioctl+0x10/0x10 [ 460.413788][ T9937] ? __fget_files+0x2a/0x420 [ 460.413813][ T9937] ? __fget_files+0x3a0/0x420 [ 460.413838][ T9937] ? __fget_files+0x2a/0x420 [ 460.413868][ T9937] ? bpf_lsm_file_ioctl+0x9/0x20 [ 460.413895][ T9937] ? __pfx_ppp_ioctl+0x10/0x10 [ 460.413920][ T9937] __se_sys_ioctl+0xfc/0x170 [ 460.413945][ T9937] do_syscall_64+0xfa/0x3b0 [ 460.413962][ T9937] ? lockdep_hardirqs_on+0x9c/0x150 [ 460.413991][ T9937] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.414009][ T9937] ? clear_bhb_loop+0x60/0xb0 [ 460.414034][ T9937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.414054][ T9937] RIP: 0033:0x7f9da598e929 [ 460.414071][ T9937] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 460.414097][ T9937] RSP: 002b:00007f9da6759038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 460.414119][ T9937] RAX: ffffffffffffffda RBX: 00007f9da5bb5fa0 RCX: 00007f9da598e929 [ 460.414133][ T9937] RDX: 0000200000000140 RSI: 00000000c004743e RDI: 0000000000000005 [ 460.414145][ T9937] RBP: 00007f9da6759090 R08: 0000000000000000 R09: 0000000000000000 [ 460.414157][ T9937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 460.414168][ T9937] R13: 0000000000000000 R14: 00007f9da5bb5fa0 R15: 00007ffd476f2c38 [ 460.414201][ T9937] [ 460.480586][ T5826] Bluetooth: hci1: command 0x041b tx timeout [ 460.612931][ T9945] FAULT_INJECTION: forcing a failure. [ 460.612931][ T9945] name failslab, interval 1, probability 0, space 0, times 0 [ 460.683030][ T9805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.792878][ T9945] CPU: 1 UID: 0 PID: 9945 Comm: syz.3.849 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 460.792909][ T9945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 460.792922][ T9945] Call Trace: [ 460.792930][ T9945] [ 460.792939][ T9945] dump_stack_lvl+0x189/0x250 [ 460.792974][ T9945] ? __pfx____ratelimit+0x10/0x10 [ 460.793013][ T9945] ? __pfx_dump_stack_lvl+0x10/0x10 [ 460.793041][ T9945] ? __pfx__printk+0x10/0x10 [ 460.793064][ T9945] ? __pfx___might_resched+0x10/0x10 [ 460.793093][ T9945] ? fs_reclaim_acquire+0x7d/0x100 [ 460.793127][ T9945] should_fail_ex+0x414/0x560 [ 460.793157][ T9945] should_failslab+0xa8/0x100 [ 460.793185][ T9945] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 460.793237][ T9945] ? __alloc_skb+0x112/0x2d0 [ 460.793264][ T9945] __alloc_skb+0x112/0x2d0 [ 460.793291][ T9945] alloc_skb_with_frags+0xca/0x890 [ 460.793314][ T9945] ? __might_fault+0xb0/0x130 [ 460.793354][ T9945] sock_alloc_send_pskb+0x857/0x990 [ 460.793404][ T9945] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 460.793444][ T9945] ? iov_iter_advance+0x8b/0x1c0 [ 460.793478][ T9945] tun_get_user+0x9c3/0x3ce0 [ 460.793527][ T9945] ? __might_fault+0xb0/0x130 [ 460.793554][ T9945] ? __pfx_tun_get_user+0x10/0x10 [ 460.793593][ T9945] ? __lock_acquire+0xab9/0xd20 [ 460.793626][ T9945] ? ref_tracker_alloc+0x318/0x460 [ 460.793651][ T9945] ? __lock_acquire+0xab9/0xd20 [ 460.793679][ T9945] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 460.793712][ T9945] ? tun_get+0x1c/0x2f0 [ 460.793747][ T9945] ? tun_get+0x1c/0x2f0 [ 460.793776][ T9945] ? tun_get+0x1c/0x2f0 [ 460.793810][ T9945] tun_chr_write_iter+0x113/0x200 [ 460.793844][ T9945] vfs_write+0x548/0xa90 [ 460.793872][ T9945] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 460.793903][ T9945] ? __pfx_vfs_write+0x10/0x10 [ 460.793943][ T9945] ? __fget_files+0x2a/0x420 [ 460.793989][ T9945] ksys_write+0x145/0x250 [ 460.794015][ T9945] ? __pfx_ksys_write+0x10/0x10 [ 460.794036][ T9945] ? rcu_is_watching+0x15/0xb0 [ 460.794072][ T9945] ? do_syscall_64+0xbe/0x3b0 [ 460.794095][ T9945] do_syscall_64+0xfa/0x3b0 [ 460.794112][ T9945] ? lockdep_hardirqs_on+0x9c/0x150 [ 460.794142][ T9945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.794163][ T9945] ? clear_bhb_loop+0x60/0xb0 [ 460.794189][ T9945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.794208][ T9945] RIP: 0033:0x7f2bf3d8e929 [ 460.794227][ T9945] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 460.794244][ T9945] RSP: 002b:00007f2bf4bd4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 460.794266][ T9945] RAX: ffffffffffffffda RBX: 00007f2bf3fb6080 RCX: 00007f2bf3d8e929 [ 460.794282][ T9945] RDX: 000000000000fdef RSI: 00002000000000c0 RDI: 0000000000000004 [ 460.794295][ T9945] RBP: 00007f2bf4bd4090 R08: 0000000000000000 R09: 0000000000000000 [ 460.794307][ T9945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 460.794319][ T9945] R13: 0000000000000000 R14: 00007f2bf3fb6080 R15: 00007ffe82b29b98 [ 460.794352][ T9945] [ 461.101383][ T9943] syzkaller1: entered promiscuous mode [ 461.106962][ T9943] syzkaller1: entered allmulticast mode [ 461.827762][ T9805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 462.535006][ T9805] team0: Port device team_slave_0 added [ 462.549774][ T9805] team0: Port device team_slave_1 added [ 462.701985][ T9805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 462.732847][ T9980] netlink: 'syz.1.857': attribute type 1 has an invalid length. [ 463.010658][ T9805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 463.336557][ T9805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 463.429418][ T9805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 463.436933][ T9805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 463.553262][ T9805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.780301][ T9719] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 463.829837][ T9805] hsr_slave_0: entered promiscuous mode [ 463.839189][ T9805] hsr_slave_1: entered promiscuous mode [ 463.847810][ T9805] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 463.878117][ T9805] Cannot create hsr debugfs directory [ 463.940312][ T9719] usb 5-1: Using ep0 maxpacket: 8 [ 463.993101][ T9719] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 464.092708][ T9719] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 464.171213][ T9719] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 464.219761][ T9719] usb 5-1: Product: syz [ 464.242960][ T9719] usb 5-1: Manufacturer: syz [ 464.263517][ T9719] usb 5-1: SerialNumber: syz [ 464.590416][ T9719] usb 5-1: palm_os_3_probe - error -71 getting connection information [ 464.671551][ T9719] visor 5-1:1.0: probe with driver visor failed with error -71 [ 464.748121][ T9719] usb 5-1: USB disconnect, device number 30 [ 464.754927][T10004] openvswitch: netlink: Tunnel attr 16371 out of range max 16 [ 464.950518][ T9] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 465.134237][ T9] usb 2-1: config 0 has an invalid interface number: 120 but max is 0 [ 465.151922][ T9] usb 2-1: config 0 has no interface number 0 [ 465.161779][ T9] usb 2-1: config 0 interface 120 has no altsetting 0 [ 465.195715][ T9] usb 2-1: New USB device found, idVendor=0bb4, idProduct=0a1b, bcdDevice=a1.ce [ 465.224890][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.266287][ T9] usb 2-1: config 0 descriptor?? [ 466.754946][T10035] netlink: 'syz.0.872': attribute type 1 has an invalid length. [ 466.960042][T10036] TCP: out of memory -- consider tuning tcp_mem [ 466.983774][T10036] ------------[ cut here ]------------ [ 466.989665][T10036] WARNING: CPU: 1 PID: 10036 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x623/0x730 [ 466.999635][T10036] Modules linked in: [ 467.003855][T10036] CPU: 1 UID: 0 PID: 10036 Comm: syz.3.873 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 467.016559][T10036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 467.027419][T10036] RIP: 0010:inet_sock_destruct+0x623/0x730 [ 467.033553][T10036] Code: 0f 0b 90 e9 62 fe ff ff e8 1a ad d8 f7 90 0f 0b 90 e9 95 fe ff ff e8 0c ad d8 f7 90 0f 0b 90 e9 bb fe ff ff e8 fe ac d8 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc [ 467.053369][T10036] RSP: 0018:ffffc90003a2fc58 EFLAGS: 00010293 [ 467.059493][T10036] RAX: ffffffff89e7ae52 RBX: dffffc0000000000 RCX: ffff888025685a00 [ 467.068148][T10036] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 467.076402][T10036] RBP: 0000000080000000 R08: ffff88807f0be89f R09: 1ffff1100fe17d13 [ 467.084861][T10036] R10: dffffc0000000000 R11: ffffed100fe17d14 R12: ffff88807f0be600 [ 467.093320][T10036] R13: dffffc0000000000 R14: ffff88807f0be884 R15: 1ffff1100fe17cc2 [ 467.102022][T10036] FS: 000055557b8a0500(0000) GS:ffff888125d83000(0000) knlGS:0000000000000000 [ 467.111224][T10036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 467.117870][T10036] CR2: 00007fff082d60c8 CR3: 0000000034e26000 CR4: 00000000003526f0 [ 467.125948][T10036] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 467.134027][T10036] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 467.142728][T10036] Call Trace: [ 467.146050][T10036] [ 467.149015][T10036] ? netlink_has_listeners+0x339/0x3f0 [ 467.154726][T10036] ? __pfx_inet_sock_destruct+0x10/0x10 [ 467.160410][T10036] __sk_destruct+0x86/0x660 [ 467.164989][T10036] inet_release+0x184/0x210 [ 467.169548][T10036] sock_close+0xc0/0x240 [ 467.173989][T10036] ? __pfx_sock_close+0x10/0x10 [ 467.178888][T10036] __fput+0x44c/0xa70 [ 467.183986][T10036] task_work_run+0x1d1/0x260 [ 467.188639][T10036] ? __pfx_task_work_run+0x10/0x10 [ 467.194292][T10036] ? exit_to_user_mode_loop+0x40/0x110 [ 467.199812][T10036] exit_to_user_mode_loop+0xec/0x110 [ 467.205369][T10036] do_syscall_64+0x2bd/0x3b0 [ 467.210006][T10036] ? lockdep_hardirqs_on+0x9c/0x150 [ 467.215331][T10036] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.221508][T10036] ? clear_bhb_loop+0x60/0xb0 [ 467.226263][T10036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.232806][T10036] RIP: 0033:0x7f2bf3d8e929 [ 467.237276][T10036] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.257159][T10036] RSP: 002b:00007ffe82b29cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 467.265693][T10036] RAX: 0000000000000000 RBX: 0000000000071fb0 RCX: 00007f2bf3d8e929 [ 467.273785][T10036] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 467.276548][ T9805] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 467.282413][T10036] RBP: 00007f2bf3fb7ba0 R08: 0000000000000001 R09: 0000001b82b29fef [ 467.298040][T10036] R10: 00007f2bf3c00000 R11: 0000000000000246 R12: 00007f2bf3fb5fac [ 467.306128][T10036] R13: 00007f2bf3fb5fa0 R14: ffffffffffffffff R15: 00007ffe82b29e10 [ 467.314281][T10036] [ 467.317354][T10036] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 467.324650][T10036] CPU: 1 UID: 0 PID: 10036 Comm: syz.3.873 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 467.336637][T10036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 467.346699][T10036] Call Trace: [ 467.349991][T10036] [ 467.352941][T10036] dump_stack_lvl+0x99/0x250 [ 467.357556][T10036] ? __asan_memcpy+0x40/0x70 [ 467.362155][T10036] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.367376][T10036] ? __pfx__printk+0x10/0x10 [ 467.371993][T10036] panic+0x2db/0x790 [ 467.375906][T10036] ? __pfx_panic+0x10/0x10 [ 467.380357][T10036] __warn+0x31b/0x4b0 [ 467.384356][T10036] ? inet_sock_destruct+0x623/0x730 [ 467.389570][T10036] ? inet_sock_destruct+0x623/0x730 [ 467.394790][T10036] report_bug+0x2be/0x4f0 [ 467.399140][T10036] ? inet_sock_destruct+0x623/0x730 [ 467.404363][T10036] ? inet_sock_destruct+0x623/0x730 [ 467.409582][T10036] ? inet_sock_destruct+0x625/0x730 [ 467.414798][T10036] handle_bug+0x84/0x160 [ 467.419050][T10036] exc_invalid_op+0x1a/0x50 [ 467.423567][T10036] asm_exc_invalid_op+0x1a/0x20 [ 467.428423][T10036] RIP: 0010:inet_sock_destruct+0x623/0x730 [ 467.434251][T10036] Code: 0f 0b 90 e9 62 fe ff ff e8 1a ad d8 f7 90 0f 0b 90 e9 95 fe ff ff e8 0c ad d8 f7 90 0f 0b 90 e9 bb fe ff ff e8 fe ac d8 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc [ 467.453880][T10036] RSP: 0018:ffffc90003a2fc58 EFLAGS: 00010293 [ 467.459972][T10036] RAX: ffffffff89e7ae52 RBX: dffffc0000000000 RCX: ffff888025685a00 [ 467.467963][T10036] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 467.475953][T10036] RBP: 0000000080000000 R08: ffff88807f0be89f R09: 1ffff1100fe17d13 [ 467.483940][T10036] R10: dffffc0000000000 R11: ffffed100fe17d14 R12: ffff88807f0be600 [ 467.491925][T10036] R13: dffffc0000000000 R14: ffff88807f0be884 R15: 1ffff1100fe17cc2 [ 467.499917][T10036] ? inet_sock_destruct+0x622/0x730 [ 467.505143][T10036] ? inet_sock_destruct+0x622/0x730 [ 467.510428][T10036] ? netlink_has_listeners+0x339/0x3f0 [ 467.515914][T10036] ? __pfx_inet_sock_destruct+0x10/0x10 [ 467.521491][T10036] __sk_destruct+0x86/0x660 [ 467.526029][T10036] inet_release+0x184/0x210 [ 467.530570][T10036] sock_close+0xc0/0x240 [ 467.534840][T10036] ? __pfx_sock_close+0x10/0x10 [ 467.539720][T10036] __fput+0x44c/0xa70 [ 467.543743][T10036] task_work_run+0x1d1/0x260 [ 467.548360][T10036] ? __pfx_task_work_run+0x10/0x10 [ 467.553497][T10036] ? exit_to_user_mode_loop+0x40/0x110 [ 467.559009][T10036] exit_to_user_mode_loop+0xec/0x110 [ 467.564339][T10036] do_syscall_64+0x2bd/0x3b0 [ 467.568965][T10036] ? lockdep_hardirqs_on+0x9c/0x150 [ 467.574219][T10036] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.580313][T10036] ? clear_bhb_loop+0x60/0xb0 [ 467.585014][T10036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.590928][T10036] RIP: 0033:0x7f2bf3d8e929 [ 467.595362][T10036] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.615003][T10036] RSP: 002b:00007ffe82b29cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 467.623440][T10036] RAX: 0000000000000000 RBX: 0000000000071fb0 RCX: 00007f2bf3d8e929 [ 467.631436][T10036] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 467.639419][T10036] RBP: 00007f2bf3fb7ba0 R08: 0000000000000001 R09: 0000001b82b29fef [ 467.647403][T10036] R10: 00007f2bf3c00000 R11: 0000000000000246 R12: 00007f2bf3fb5fac [ 467.655389][T10036] R13: 00007f2bf3fb5fa0 R14: ffffffffffffffff R15: 00007ffe82b29e10 [ 467.663388][T10036] [ 467.666766][T10036] Kernel Offset: disabled [ 467.671211][T10036] Rebooting in 86400 seconds..