last executing test programs: 5m35.623267561s ago: executing program 4 (id=584): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x4e20, 0x6, @mcast2, 0xd}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000200)={0xb, {{0xa, 0x0, 0x76171c1, @mcast2}}, 0x1, 0x2, [{{0xa, 0x4e29, 0x2, @private1={0xfc, 0x1, '\x00', 0xff}, 0x6}}, {{0xa, 0x4e24, 0x8, @private1={0xfc, 0x1, '\x00', 0x2}, 0x7}}]}, 0x190) syz_emit_ethernet(0x46, &(0x7f0000000580)=ANY=[@ANYBLOB="0180c2000000bbbbbbbbbbbb86dd6004c2ad00101100fc010087000000000000000000000001ff020000000000000000000000000001"], 0x0) 5m35.523705001s ago: executing program 4 (id=585): mknod(&(0x7f0000000000)='./file0\x00', 0x10, 0x2) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x4}, 0x18) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./file0\x00', &(0x7f0000000580)='gfs2\x00', 0x3010003, 0x0) 5m35.198247763s ago: executing program 4 (id=587): bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00', {}, 0x8a1}) readv(0xffffffffffffffff, &(0x7f00000017c0), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x0}) sendto$packet(r2, &(0x7f0000000740)=' ', 0x1, 0x20008801, &(0x7f0000000200)={0x11, 0x8100, r3, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x40, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$kcm(0x11, 0xa, 0x300) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, &(0x7f0000000300)={0x48, 0x1, r6, 0x0, 0x6, 0x9}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, &(0x7f0000000540)={0x48, 0x1, r6, 0x0, 0x2, 0x6dd}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r6, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$tipc(r7, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0) r8 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) 5m34.114893911s ago: executing program 4 (id=589): mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r2, &(0x7f0000001600)=""/4103, 0x1007, 0x9b) pipe2$9p(&(0x7f0000000240), 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x0) sendmsg$inet6(r3, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007120000000000"], 0x30}, 0x0) r4 = memfd_create(0x0, 0x7) r5 = dup(r4) r6 = fanotify_init(0x2, 0x40000) r7 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000000)=0x1) ppoll(&(0x7f0000000180)=[{r7, 0x1}], 0x1, 0x0, 0x0, 0x0) close(0x3) unshare(0x2a020480) fanotify_mark(r6, 0x1, 0x32, r5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, 0x0, 0x4) 5m33.015692323s ago: executing program 4 (id=593): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x40}, {0x6}]}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @parameter_prob={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, @private, @local}}}}}}, 0x0) 5m32.718127943s ago: executing program 4 (id=598): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c00000002060108000034e400000000000000020500010006000000050004000000fe000900020073797a3100000000050005000200000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="54000000090601080000000000000000050000000900020073797a310000000005000100070000002c000780060004404e21000005000700e30000000c00018008000140850101010c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 5m16.559627932s ago: executing program 32 (id=598): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c00000002060108000034e400000000000000020500010006000000050004000000fe000900020073797a3100000000050005000200000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="54000000090601080000000000000000050000000900020073797a310000000005000100070000002c000780060004404e21000005000700e30000000c00018008000140850101010c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 2m17.488579738s ago: executing program 0 (id=1479): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000000)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x1, 0x2, 0x2, 0x1, {0x1, 0x1, "94"}}, 0x6) 2m16.962831579s ago: executing program 0 (id=1485): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x20080, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x48000) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe4000/0x18000)=nil, &(0x7f0000000600)=[@text32={0x20, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000000000008504"]) 2m16.325189126s ago: executing program 0 (id=1487): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001e80)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf, 0x9}, {}, {0xb, 0xe}}, [@filter_kind_options=@f_route={{0xa}, {0x10, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x14}, @TCA_ROUTE4_ACT={0x4}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) 2m14.890643428s ago: executing program 0 (id=1494): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xa, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000480)='kfree\x00', r1, 0x0, 0x7}, 0x18) r2 = open(&(0x7f0000000080)='./file1\x00', 0x64842, 0x86) preadv2(r2, 0x0, 0x0, 0x1002, 0x1, 0xb) 2m13.779139662s ago: executing program 0 (id=1496): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615, 0x429}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}}, 0x4000) 2m11.783942757s ago: executing program 0 (id=1501): mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000001100)={0x3}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r2, &(0x7f0000001600)=""/4103, 0x1007, 0x9b) pipe2$9p(&(0x7f0000000240), 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x0) sendmsg$inet6(r3, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007120000000000"], 0x30}, 0x0) r4 = memfd_create(0x0, 0x7) r5 = dup(r4) r6 = fanotify_init(0x2, 0x40000) r7 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000000)=0x1) ppoll(&(0x7f0000000180)=[{r7, 0x1}], 0x1, 0x0, 0x0, 0x0) close(0x3) unshare(0x2a020480) fanotify_mark(r6, 0x1, 0x32, r5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, 0x0, 0x4) 1m56.483864752s ago: executing program 33 (id=1501): mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000001100)={0x3}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r2, &(0x7f0000001600)=""/4103, 0x1007, 0x9b) pipe2$9p(&(0x7f0000000240), 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x0) sendmsg$inet6(r3, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007120000000000"], 0x30}, 0x0) r4 = memfd_create(0x0, 0x7) r5 = dup(r4) r6 = fanotify_init(0x2, 0x40000) r7 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000000)=0x1) ppoll(&(0x7f0000000180)=[{r7, 0x1}], 0x1, 0x0, 0x0, 0x0) close(0x3) unshare(0x2a020480) fanotify_mark(r6, 0x1, 0x32, r5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, 0x0, 0x4) 22.713853672s ago: executing program 6 (id=1994): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x10, 0x400000002, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000b00)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0xffe0, 0xa}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x4000) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x10, 0xf}, {}, {0x7, 0x9}}}, 0x24}}, 0x20084084) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) 22.424215617s ago: executing program 6 (id=1995): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000380)={r4, r1, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000a80)=ANY=[], 0x0) 22.289345727s ago: executing program 6 (id=1996): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000380)={0x1d, r2, 0x0, {0x2, 0xf0, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) setsockopt$SO_J1939_ERRQUEUE(r1, 0x6b, 0x4, &(0x7f0000000080)=0x1, 0x4) sendmsg$can_j1939(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)="5f7327a543a8f33e22", 0x9}, 0x1, 0x0, 0x0, 0x2000c004}, 0x8051) sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4048001) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd27, 0x0, {0x0, 0x0, 0x74, r2, {0xfffd, 0xffff}, {0x1}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x850) 21.123244452s ago: executing program 6 (id=2007): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x101091, 0x0) umount2(&(0x7f0000000080)='./file0/../file0\x00', 0x0) 20.946313156s ago: executing program 6 (id=2009): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000093c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x2066012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba523440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) getdents64(r3, 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0)="7b1713b4c6f02da7493fb6859f0143c68a58166f472c5078104b859bc37f9a49a8f85c9101df3b2736ff9bebcb1a3c2f570b28279b8ff7afdef7451b3d10b4578c2e81784b6e4f410800d997f0689546cee0852e9e9c64c1f95df7b136243cf7aee1b8e7a4e1d6e6fc01337370f0dfc098d975e9a6f90a08f5b845054d1e1fc81adadbf2836ff758bade0484377855b05b3556a91827599638458ad30baea03240b302638b88423ecaba6da1e40f6f1b24d60dde1652f2d5f818af43d49dd55c4eadea945e9b6aa744dca07ec2e00320bef5b045414836941469129670c4cdb953ed61efeeae2ced1b7cb3e7fa4c93cce5623a9e33c69d068b801fd1369aba759e2829c67c705853262fef6669aab956f0f733619dd361be5e1414c7e7ff6218e330156d609fa9f3244a0a4fb678a58e70b86f6dabc3331f755b786c42b4198149941a7a58c83f1f2811209025269c5ffcbe0c34ac98cc091cec2c993bca0aa8400ff9e39cc9fba8dda886f95357957bbad8bb850ab92f7aa9bebcdb0ef188749a1742e5597d199f3ccdc2d807bf757da45acc93e3e9645a1036cb041b3c38dafef367b8dae802bbbc03bacb905d40e1da78591687b416ee380103a670aa8f722c76e13f7f0e3effbb37f15a821b8315fe541e3ffc09289d96db1dfa8861e5da41c812b54ee20ca8b3180f2f46db56954791465cb572de0cce16d789d6fff216ca46977ed724dc0cc8cef7b295ebb2998a5c4662e32ae1001e59f3bfefcd72543bfe1aa6688d65c547089ec0fe1f1d9610095a5a4008b14f46775c368417376ee143856031947db71c455dc40eeeda210fbf258452781ce46e51f6df683a7918770f73d324d9401648d271cb9a7e919401567e400fec420cf363444a78eea03e73176abd6546e1657945aa88f64a21e07fc23edd74512cf89781e8ffe9bb1601ab25d31801332a6c5be9cebb6cb08207bb832106553ea9fc19b4b4f1f0cd55efc2925ffef75e9b12f06b5a7496506a274ca25f88398a1734b7013c3f78a2e49ef0d946a1aff362e37c9b5f5473de11401097722adda87944ee3eeb1bdde60e97484af4d2e5f8b0a9c63bb8bb99461b16edd824add1caf9d5247811cc4f6b48004774f1a4fe4dd125ddbfd8b69ff3ee314aeb445bee9f217a2f5a9e0e84ccd8718471f949086df6cdcbf95e568317e31dd01be1b826cf9a09373b16935fc864794a3886a2f4aacc42135db85f8921916a10aa7111a686979e2a5c9959cafc9774c416c4dfe0b9e06657feb2fbc31e7c11f6e2841680986557c1f2b1ec3c0fcc6a749a3c97a5b370550ab7110e25851b13c0b75a7fb0cd3c4659878209867659c216b467bdcf51e786a59fad084886490fc77e186ab827d844d0ac4682651fc4043f8e87b905532a53017ada44feee1f89f9bc6d2a8b144e721a479f7b90acb91033774f4c12df633548a9097c791ec7e80fa2607c86fce6e9abcae1296528b8488ccf18a4bb0fc9b50c15d294e8d380465465b4eeae26eb6800faba611785cd2ff95ca1923dfa47d5923f89e4eadb612002caceaebbe779c4e3a3833455752eae63689ab8dc03db63d82feeab7f1162eed5909b69ccd5abeb9c071da82cfc76cc692a51d99e0c4bdfa6c81c9878e893a77e1e7105e7910827ddb3353612fa8d5e547b43b5abfe50829c1eb7bfda1731db2a9a1e8f0fc298dfa7009679489f9d9323338b7e59f1e48419ca531d88170a5a1995f576aa125edae9e9ea26f6e9c4bc26323b7db0998c528a7b343ccd87ff44c77e6cfc0a324cc1d4ea79c30015f0caaeccd46e5db580aa5ce8030c2b13b37494557da58abbdc7ce9fc9afa49ce0e8a7a6fa058db210ed654203e7879cf5004ebec57522ed34481b749554b36cd7171209b0763e110096704604f2d3f28c5ddc66c877e3ab63f36137d5a67cbf872aa6af79cb3a66c9040009b5e1c7b718c1b8788156b82d6d800dbe9fc3d16c812a963c73599b79efb89aa74bdbd9b1a2dc0b8ad853f79c0867a3a45d7a1645059171877687a72dd5ed4213c0ab84ef6185e7935346a84450887bdb2b216883e907b13b03c133adc04ab3c5f60209bd90aad3d94443105f08f0ee1b2231e1a1f8cce71de74d5308b78b5d99ce4ad4573faba9fab48bc1615f14d453c67714b99f274de041512b07b885679e6f89f481c28b082084b853c9afcda31def2898284d6ca28fb124df67142821c9705e28093ded60992d9587fb466df839aa2a4973dd48f9372a55da6592646fc918e533955566a2d8dc59277308223aea4dbe0daf839f95516b8995e9eec87df1df9d38693e0824dca7423b08d553b0ae1c5c44533b918eaa02dd17b4c8ce515ae7de410970f670e17b5e3c0a207fb8464d5d442694a271d593fc23ac19619bac32ac17cc6705ce2e6262361eba24277a471602e7ca57cc614ee116e60a9e0b6ac5e3228ea2c650baf1a09e9e5c7a1b25a078d1d11a673d88f6ee33e50d036d7fe4b9c06adc70aede2e35c6738b255690ed3f7a8d2d14e36e360f3bb66978d6cfcfc41887c751c0efc9325d4485a2f561060413fe6af4ce40d87a476201f15a584fc7ba18ddfef5f1d729d5f544c2c6b06befccb444f0408451089f20b06f05ab7d6702b97819b0eff6fb090f21afb3076558e692920053702fc2348f8dade0cb2b007f38d6dcd4ed3bb42553b1bd684791743a1941e5bf2ed234f44be64a95b485a3e949538a40542f25ca4bfce44e291037ab282082f02157a96f4ca0a0c5cd39215fd07461093a4d87a7979f7aa97142bf5b9ef71db537f9acc90f22ca2ded5c1ecd1ba972d05db7f71e8466085c9b3e975fa3a948f2c4049d1a8e46f71157017a3a74ad25e215dcfe7a4c5cb0a7baea0b0ec60c5df82555c553ac60dd39174c721edc0304b836a4de539c3ee55401e13848018f889cc4a0fcd01d9f4978eb730fb1b4a94ede0283f8c95062f01c8c8a3169b2d5c50cdd4f3a248d80a26c950b4036fc6ffefaf5101269fe3594c2cc128220a1d0b5f9f23121f2b184894e129159eaa92d9a30e878839be44d20cbdff3c338cc95795c86121b2b498bd376e895c98d67f6a27eecb46a203aa9de744feedf27b6825cc17aaa098b5ca05cad6bdbe320908ed36bdc8a8f2c777eeb9b037b36c0e36019c264b3e36196501d6cc90e7b1899a72bea5c8a24a5ae62e3684a39a06208bd382cd32acfabd742c76334797fa0c09a2a2a7e1240974afe0f3d6eb44590cf171efb7602009a93bde85cea6701c765dbca7c6a879be41dd08847802d4f59e933df65f727cbb45e3a4a5019f503b6fad7e0338e653f8b2c87aa7f196444e0dc1be6d7c4f0c7ddd663d06ff1365a9c362384a33b0315adbfb2d73359c485cd5410d36d21044bd8d3771c5492803b19f7f3a1a5c3248e66786479fa4416a55855adebeb09528ff5add597790b97bddc16bb9b7b33a1f800701c4293e2c8428dc2684726cfe5539ae0a9bf89e1b6f1989fd0433cc865b308bd0c636402b4b285c290e2439b9ecf0eba156fb6b613ea7f97b04506fe28e9471343c854fdfd48945a7f564acc817e609be8f8a7fdee12e9b592fd8c5c08f51ba8cb95be12cfa497d1539a4b8217818d47ebb3cc669014261530205948fdb9983a0e5759afa9b290ce838102661750ab06d7fe65a39efa6af36c042d2dee36402a6686d58eb144b76033cab4482b8fbdd213a90170939ec98df1fdfca4b37b143a971b9b59fc351098942bba090056c20e8cfbfe8fcbe361d068c98a020f67e807b8db2e45cad83c9970907646c0049c05c1ed657d53d859f1a47bfe6f022be0689de224034d0160b1dbc878ba6dd685911288d7af22ff5eedc1634c36e25f51d0757c7b9c73d7937955da356dea68749d464a75f56c9f6ba36cc1ca8c2f3aa34beae14fba894ca705111cdb19094432c2f6caa0eac78ab09b0cee330f36b1b91a6a5d4896cd15d96c12547826559441cbf578f189f5f04526a4cf76d60144090c2386b747ad50f7962ef2950d2c6f4ff8477ad0681ab24c47ea7ded8c9accff0dfa30489f43f0f3182b88e757fd9a1d82e1c9bb4efe5215518a6e48c688b2dabbd15107c5c6245de0acfd740ea54e0ec212f405f25bc3aafc63009631a4e4749296d47c2bcf25cc95afceb0a1ddb3c6124208f5134981c30489b42eeb864b3123b03106c9b234a465d87c30ef36e00244390de36a5dd93794467ef37bd01b86387855d2ac24e05370212e845082bb22c8fcda0f0bc78ddf971b0b9d69fc50e0d907408e9c9ac4e5099f47db2d0c14d888e363ece768555362a08c408d0119c45f158aad695d455d28e223be2862c19262c9f43eff8855b5a9af4f2cede95e415e2f597bb64c8bb2d608f86b15950ffe2e6bea3cdb221cf8b7eb35e0bdf6638283b09c68cda0bf1ccb9e353a7f0afb58d806923e36b22db68615a7e4e04d0932d928afdc8af3963378ebd5e05058160ac67fadb7a7d9ec498e00f63671b84d880d196c93afb4fc823e7d6576ad824ffb4c90fc780b163a292899ccfcaed81dee2c992787a66800e206df3dfc4a6b441d54ccb1a19a587402a663d510e45a5b1aa96fc467efaf7e71cbbff087f3d2922a133466d5ae9f86b0bc39bb3093b87ac2db941b1fd9e40427402781425d6e8856a2c66cbdd274f4c689758db6dd58ec7d766b177739e8c9173f2b1946be5396aad6d7ed29d058ac231e8c2e6a9077b4a217df4580a2d72bcf0b73e4bd07465deb8798a55ee855b82f1fa7d3748a40485bd90fab94b617d92219c4b65efa022936895e51873058615a19b9d1347120c405c3254f290b4c8b99c8ea9dde3a749ec538421a29d27b48ccd83852abe1a461123e4d36e56508d1827880960362d10835df77f9d4be51f1447cac5ae2017a814de58cd99bcc0c194254b17114ea48f5a0cfe6547686088d527c65180474fd460ffea5d48767ceb65c6fa3d7d3c632591d2d9d65c6c3a35a6ae4dc56322cd84734b0e7a092a4c46c1c607afa6d0e477e8d04e4993e595ba708a0f4466cd8a89fbc06d3cd366007296a9f05b66cfdcd5b30b6745e71d513205d5dbe1e8516d9e9cf133caa994ec0ac2c543d107efd4b9a7d9ee1ee415830a6c2ea17114ea9683726f2c82741f9ad4ac1be6772f0809f18c13f4cfc82fd1b7b3bd29615336003c6784c03fbcae475a58a3c4d68099732c326dfb7643eb150f2354918077bb798b5ecf491cdd0765e3e1ed5d0a37840f1a28f7e188a021781f1896dae7153f9d6639bf66be0c7857d7eccd2a1e6c9fd0cc3594477bb005df9b29f680c966161e37bcec97fc2ef7a2c3bf64e4df5785c9b080c7f9c6d7c515408445d55da499c03ba66369a31157bb03588e84a5303c46cd393c5bd6fbbb8deed94b62d67a9351c259b263c6c4fa65a4dbdd7eee080d82cc5e478c885678edbc9cfce74169ab748d7f4a08aec3e114394fc1d5e361267b8f3fcf38a024928d58158560f7da427680e7611a9f1b8255c67e6ea6b597ebd31bed9fd6f85f9b6ee63d4374c1e50597d1c9f3c56b4266bc632ba66ebecc396f6bead40392dcc138098b4166ab7f8714bd4db0615480705dd200da92dc51ec215844d7599e0a6262e8d5dc6a9452db8994d8b8f19ad4029e0b41b5e13fd6b56230cecea57f3111fe6c78876b3e657fab112968e83a0b64ce9837b89f5dad0d5f0b8b410e3a9a56ab2e9143e90fe371a944989ee206eef777cf4a235333c647e45aab910af492bc7c2213246374251e23accf5818aa2f24823bcba12efe3658e1e2cb49a5d4ffd26453829739647eccd106605921641afe16bbe79c8739062eabeeda4d4a42cb70d84e1e1d3506c7bfba5f5135aaae85b03dc6518eb30d832175cedc5bdca95e600e04902d9eda90c1da4bdd3138ac889398c239068857103ad70b5d1d9fac27c8ccfbcfcf126d9a5441bc963bce4669047ac901a14ca7c7e76f94c77159cdbda5360e04bb539a9d5ccd16a8cc88bacaa5b952c86b163575d7f1cab58f0d612d796b570f3c5debd7d9abde7e24de2c252173f1edc93817192699bddad45eeb41ff398c1bee4d2194f38bf4d2b4ed3a8895476bc441f464753139e204ff5dee7f45ce639d7541c0d396141aeff30cbbfa7157a61993eec98a4356df98665546a1d1e8429fb0c78684000862aac50f7d9a1413e89958f4defd3f087769cafc32bcd6016e496b41b7754cfbe42b352346fd585fb19a80f4af9a19811311b5fc6ea8eb5519a3cf7dbc1a06eed41668e332224c1daa01776e0886044f5a95e5dffc8d9ccce7840eeae97e8cc916db95bdc33fb420e28030c6edb011d5281db1dbeac9bfcaf938a757e3939b025d339e69b9692c8c7352787d399f342e96096e37ca208609e5f93629e36ee442db9fb822ea236683f79875e7dc73ec97f98fe0795f9d83f473cc80a589043a7edd953473684ea4e80f698683a0fc1d8863adc44fc13c27a08921a681ca1ad76207b1a97f8fff7db247ea09b3a6407ea83d82d82d171fc80a8f5fb9f19cd7e94fe121a6a0ef9c4cff7a8689c0abf750dadcc7442c2ca5ed437af5e88e89b0a783a1164cd1eb2a33a64c919d9f08fe5aa7a775352ab6027a7b73d6fef51acebec5516c2a5f2b932b2621bbd2cdb415fce9ba1dbc3de205869fa0423adcedd5570ab0b4b64afafaa458b3840b48f018297aa46426d7893418033f00b5378eac6a70275ec860609b07851b88ecb5da05086adfb80f47c71a77301ca0f1520dfb7a800bc8421abf5eb94942ec818e3a1d45f09ff93e6549b3ef6152c6abe38231b4a82e355e27e363184df51418286d7073cf464eee02310e84b3eccabd2120fcca333130357e1967f67a69f437dcf6a20ca21797230aad086bd4c28348f58b80ec5d27626004533993b9f85897d00bc271a62ab67f92e2eed6d900000000549e8344ad90b47fb5c1ed5908bce94d03bbe98a87a1733b5031f89644c2d35d729e1375969a82f0252859219407c5c87f5d249d5eb8c17001fc7c6dc5d1825851b41e5e937f2c39d7f7196f38f83619da2cddce747bb0e906d0fc13a11fc6c2be3d140ea6da886cd5e194ca9dbff565d2a82e7e82dc5a36084bf02029ea05a9cfe1f3dc80489b426a14372232940ffad8124bd515f0a73fa85c2aa0cd51d76a0cc6e75ccc35b702a4fed4d2e2828d98939406ddc6df1048f0a22611859d6bfcbb0873d102e4b8a86b5d9af8056447f6c1552a603d9f67009fa070db73a01e1b4adbe4e841d0b9a92d148b626c386b25687817e5ec07dbbfa1d62d078578fe21d546414e3c5e29e8e086d7e542a2eb74a67127e7f171e076bbdd62767aae3db467db1df13b3121023bcee33f814d767a9ef14651f76ec89910ed33e9804df8619f69ad06bf0559b00d4efbf6f44e922d50a18ffa25d8ac58dec53a93642186c0ca81b07fe5c14c9c13397649a53ebfcec118e5bb84db053e6e505d07a09bb50f33906e7febac3c85ca337111dbfcb7b9becccaaefa3d857d48f0b3d8646d70fdcf2f1dfb89cc3ba1394cb5de24d999c88235418bc0f20d4036bd0113d298b91c44fe042d3b8e4070e3f828499972524601c4725389122c7fc3e38eb799f7b755f23bd5362880b9275e58eab2c8f42e583890cb84e17f35025d1d76dd28171bee561d21451b4b2ebf23b923221c9ea06b924815889d2b605af66539c3b0ffc30c7170a5581727f0faddb257cb6ab28b3456737d3588fa3bce0ba6a2a5c3c94301fa8a4e6db358731bd3a4a62b42181e04241010d7bc3e973b9fe428175ec8f8e6cbd4e53c8bd957621acb1e42504e6f8a7bb30c382058fc9dcd0cd0ba0b789c316cd58d7b5606cc2a66c872f10e6663346d572ecc37ad1c3d8146a137e35e54096ddc2a5e2d26765d75615fecd09b864b29adfe92763ab54272365f56feeb9b57059744e765485ee322cb879fd3c8fd8bc4727d860995c548bcd41852349f1b2227f5a1f39b24549693fb05c04ba8f190673d11eb27d0bf628489f9b8049f5f3a1e1fed97ba9881da0031ef5960b6b0af825cfae8252b931f6151cba9bf889a5c74051a176c56d3cbb8915d3f28f8f684629bd1e3f87f27909b4e8eca6b88cdd60f3b5bbe0641a469e396080fdd2feeac7a11703b758f1815f100ab2ca4403af34a655f4c35e62778c276c96bb94a3d9f58f3bbd7ae6c4f133f7c4199f18d02d66598a54769415b376bb04b520881f23b22b32685ea1ea0dc179ab2f33f07c7039d1a5eedd1905d2a8c7d3c9686758ba5aafdd74f36da7f5522aff5c40e565b50cdd92ce353c3d6c97ce87f0495bdb95d70ea52c8c26b87cd337fd2283b88d7301c32f26833451b8f7c2ee5f44eec58d9eef2a39b3021a29c8747d36a2dbca6c0c085399bb720000000000000009d67e17060abad89c7d8b8970244c2f11ad2f4ae878a3676659b77178a9b651b12cf9c21e658a32999d596af4648f636df4de8c037d1fa63b1a685e8850156bf99e00666dbc03d3e3b44018659743127f91d44c99b578b86a44f3bcf1523c8cb45accc3c5fedfd7796411eddfc3a7a6b7c57ae10fd4bd3fe9f662dc59747ac4b7cc2584ae3ce2e42a41066dd0d560f1b4c83edc57121dade5e397380bec5f40b5d0beb14aef21b2c68ccfd0eb4959b5e7f5b5779903963298e3c9a2141f145137de1d604d9124c3c4f60a4d54da38a7c32ef2632fe66a8ce8e95ee95a570e18e9fbd44884afe291550839dd61e65c952a3f5c6b61850d1c2a77e18fde734a305b407cf6dbf17afd66da6e42f0e8f66092df46c79b44711f6e8aafa831fa1188beea696672b0e94cc3cae584b30dccf053634f792c2d9f4c87e306991b407949f2870b525d123f9ca23142a0ee13d05f51ed4ff2653727ad5bf16453276b2d5e7d7a8a0a1c4847cb61ac4b08d9abee25165a120d156775a534a62f9af3a3b62726101b94ae1e14352262f017c5361b3341952d194a6a2d470e60df3fde61d343e0af8fdff36ad976af6732b732ceb69344550555174fa280153e08f74d81f4ee69c1eb44a3468e8cf78bf7c1663dae3d31553466faa207b8e9887cb54209fac0b6f6d12d9588351c76e6bad884799afe856a25b5fe737d0ba737a0f1a12b4eb3ede48a0c38e6787ab42fca1c7f2ab42fa6104d5a99aa36b73ac3622ccae122524c28a6557cb7d0a7c7eb5de795647dca0621fc2c9599441dae7cc2a8631252abb5e0f22e9355e0a156a1ab7b1641e345045e8303b5f6dda5c3c1cc2637700cea25c004460d101fc42ad78ae477739a4efbacc57272cfafae15292dc3b2800d9f42002c2062af9a1f329e11140f8317242c04ac1f11cdb45f5f9ab18877daa214c151fb9ac54e3e010b5e7944d7217442d5c4fc29956c1333cb932424096f5b6afe1128db53f7171be4372be8bae538bcb3e4a2eb29608678735a667135e0f2660956e9e2a3ed862209efe65d9ab2fbbf88e5d3384fb3362af00e1ec6b4d3ca40df442b70951026438877189c4b0ae136a9a35c131fdf19115e8dc1ee2b938bfbfdb3808aebbe7dfbbd3510c7070388f5813e8bc63be744b99116c4b84ea37d57c5da7a80cc883aa915d84a249ebfa78ceb124c63b3a0720b19483189ee50824e8581556f0520e434803204cd0f3dd09fc97c979f9a7e3f8e5eca8fccde98fc4939551338235c0c6378faade0d18f7050f29189485e01ec120239373c5478cd19ab27570921415a6680924baf9c5829f3f2115460d1fceb8a026fa1a0a0047fe1cd6fcf1861dd3784e006abfddfe79461c5001e4e32d99c5bc203c21f8c711c5ecccf8941093d95a8db73722bb7511443fb2670244cc1249492e92fc4bf7e06ec6f08c5c6931929d58232b551957b771ea5e4a932b037904b81916e662e3fe95af894e80f699e5c00ab664f381bd9c0bd41322a8b3cf367577429fa52c0f1c44ffc626c215e7103cba05bff4931d9a202c1eb9068f44983d1e0c6d9fb5fed738561651e854a3c1b362ae354a0b4a270386ed2dbef093bd82f07f25edfae31901cb86fd214576b25f769bcb215214c63026b2581a8d17779aae03ba310f3243b3631f4b01c9e3eb342c3bdb44d8e47cdc1683e3b1cfffef72e385cc8831f99425fc406575170e1c106618d5429144a436b9e92d241d8118b5cbe0dca5e8ddd86e671e13080eddcf8dee9e317d192a3a5386378de9b1ecd8cf5439cfbe9f65965e5a5f6c145627ac23fe30c2e06e623b0eca15b225b32b65ce568b656cec0e0d6752fdebffd39c7538472ad7a195b56fcad3fab80016ff006df6b01d785191e4fca143b14ce68b32571476a779515ccb14d35cf9aabd4849c03c9bf12a42cfc2a7146ed6c25892a9d1c48f95314f641142d38cd882e54534d69b3fcc18044309e6debef6dc79d7737956418b955d33737115b44360e0bac14b71e2e64f0c8aea428dce5b65e210c108f832a6041c0aab116488e5863cd1039dc8af537908be3541352bdad303de43387503d19d7c0f0390bdc5b95f1dfb0701fd0e14a22c210837cc0a1cb059de474f4476bfe9bddfe3e7977fb299e82d9eefb18111f7c4a5fbd406fca720fec69340d978f4c9832204d67f6fa5793325e04d4af84acde0b56158e4c606394286a4b3cfc04a426a665529b753e1ce2d6c613159844bd069a67b5b96cb8ec993f05a8e252ed3d8ed63d524af0845f519f9d47b85a773f37031cb91055fb963db50e6a1e368f10a82fa40ac055e0201c6d29661eadb76f8154ef9c1cc210ccf1ccb063e8c00324ed6a14fdefa0167a9abb04debbbf5e7b8a57a7772373c765947f0f67b5130d77a6ca6ab166147d4eba97b4ddf1465d25b02f4430227b5713a29fd84664bfdfa5fc450e48f5263eaca67c16033b79bf1cb819511cf16bae6ffd5d05a7d9cc93067b6f2512fea2424a9c7d178f653ffa7ce1c00924707e3817c7cd461cb2a8cc5eadc40821258eaad7720ee3976c5a60025c317480016e5e5bd884f3646651f3bdc1185ec1a4112eb24ba5b3b6f94ac66322042d4bc48cb5befabfcf950cf8a0165fba3fa019324b53fb56bbfaec7f4ec733e84c22f841c1c9c1dc51dd3ac4887e155ac4095a6b8846c8f401f3c2d48d4de18906193a9f05ed59e3b0add8bc27c0bad8418ccbb842123ce1d39fdeeaa7984dfba9ef121ab4d4d35de076262636f3815708e4bcf31e634a290b13317425b1a4a2e4ebf8537092c7e524c126faa9622bf1337168e003857805dd420a51816fea3cd37c34e483f64a2da3ab67442314ffff40727835a1bc7b9971ccb5f83183cf1a135defd468907b988d97028f904c4d9c712f7d0ed6abe4d80712a7b7e06efcbe6a5b83e32beb1556326af7a97437c35c6a706c6cf4403b98f5134547ac167fd1abcb9245ec3450202ab80e553952412032a6c3cfa64441d4aecabd1e182c50bf67801fd3b44b40648ac9926bbbd7095425a429f2a9550c2fd1267cbf6156897b705255cadf1c7f233f4effd788b3f446dba19e68bbf8b42ff6caf984a4eb51328ab5e2bc28366e8b4df4df967a166470a00", 0x2000, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001040)={0x1f, 0x0, 0x0, [{{0x200000000000, 0x0, 0xfffffffffffffffd, 0x2, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xc000, 0xffffffff, 0x0, r2, 0x2000, 0x10000000}}, {0x0, 0x0, 0x1, 0x0, '\x00'}}]}, 0x0, 0x0, 0x0}) 20.558618976s ago: executing program 6 (id=2012): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x1064, 0x80, 0x4, 0x1ab}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_SYMLINKAT={0x26, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x0, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r2, 0x47f8, 0x0, 0x0, 0x0, 0x0) 20.165509784s ago: executing program 34 (id=2012): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x1064, 0x80, 0x4, 0x1ab}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_SYMLINKAT={0x26, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x0, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r2, 0x47f8, 0x0, 0x0, 0x0, 0x0) 15.451584666s ago: executing program 5 (id=2044): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000000000000000000000ffff", @ANYBLOB], 0x50) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r0 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r0, 0x40106183, &(0x7f0000000000)) 10.30922682s ago: executing program 3 (id=2066): syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40440) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "fa02c8098000"}) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000200)=0x1000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x2b, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x6, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x1, 0x47, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x6, 0x0, 0xac8, 0xbf, 0x2, 0x3, 0x800, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x807ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x4, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 10.014617832s ago: executing program 3 (id=2068): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f00000000c0), 0xf00) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) 7.265571127s ago: executing program 3 (id=2073): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x1, 0x1, 0x86, 0x10, 0x20f4, 0xe05a, 0x6c6d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x69, 0x2, 0x2, 0xff, 0x5a, 0xa3, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}]}}]}}]}}, 0x0) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x3}) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000400)={0x40, 0x16, 0x4a}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x40, 0xf, 0xe, "c0d023ead9eb25f5000200000000"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x7c}, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x0, 0x8, 0x4, 0x3, 0x0, 0x70, 0x7, 0xc56, 0x6, 0x7, 0x7ff, 0x8}}, 0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000ab4000/0x3000)=nil, 0x3000, 0x4) 6.314284965s ago: executing program 5 (id=2077): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = socket$unix(0x1, 0x5, 0x0) r2 = dup2(r1, r0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TCFLSH(r4, 0x400455c8, 0x1000000001) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000380)=0xff) close_range(r2, 0xffffffffffffffff, 0x0) 4.3420084s ago: executing program 1 (id=2087): bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e23, 0x0, @private2}, 0x1c) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) 4.273948317s ago: executing program 3 (id=2088): connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0x7, 0x4, 0x3c8, 0x1f8, 0x0, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast1, @local, 0x8}}}, {{@arp={@remote, @multicast2, 0xffffff00, 0xff, 0x9, 0x9, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x7, 0xe, 0x40, 0xfffd, 0x0, 0x5, 'syz_tun\x00', 'gre0\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x78, 0x8, 0x3}}}, {{@arp={@empty, @dev={0xac, 0x14, 0x14, 0x1a}, 0xffffff00, 0x0, 0x2, 0x0, {@empty, {[0xff, 0x0, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@random="290c176c978f", {[0x7f, 0xff, 0xff, 0x0, 0x0, 0xff]}}, 0xb7, 0x5, 0x0, 0xa7fb, 0x7, 0x800, 'veth1_to_batadv\x00', 'dvmrp1\x00', {}, {0xff}, 0x0, 0x2f2c2646b822bef8}, 0xc0, 0xe8}, @unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)={0x78, r1, 0x1, 0x70bd2a, 0x4, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x5a, 0x33, @beacon={{{}, {0xdde}, @broadcast}, 0x0, @default, 0x4001, @val={0x0, 0x3, @random="73b29f"}, @void, @val={0x3, 0x1, 0xe}, @void, @void, @val={0x5, 0x3, {0x0, 0x5e, 0x2}}, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @val={0x3c, 0x4, {0x1, 0x80, 0xa9, 0x1c}}, @val={0x2d, 0x1a, {0x40, 0x0, 0x3, 0x0, {0x2, 0x1ffa, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3}, 0x7, 0x3, 0x4}}, @void, @void, @void}}]}, 0x78}, 0x1, 0x0, 0x0, 0x880}, 0x0) 4.260931214s ago: executing program 2 (id=2089): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xa}, @flat=@handle={0x73682a85, 0x100, 0x3}, @fda={0x66646185, 0x5, 0x1, 0x18}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 4.085526048s ago: executing program 2 (id=2090): mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) close(r0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4, 0x0, @mcast1={0xff, 0x7}, 0x8a4}}, {{0xa, 0x4e20, 0x100, @remote}}}, 0x108) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000440)={'syz_tun\x00', 0x101}) 3.522466505s ago: executing program 3 (id=2091): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="f00000001000130726bd70000000000002ac14141b0000000000000000000000004e23"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="12000000120001000200000000000000100000000c00001700000000000000000f10"], 0x30}], 0x1, 0x0, 0x0, 0x20004000}, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.284923122s ago: executing program 2 (id=2092): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) mkdir(0x0, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a310000000008000440000000000900010073797a30000000000800034000"], 0x64}}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 3.242777455s ago: executing program 1 (id=2093): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xf, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r1, r2, 0x6, 0x0, @val=@tracing}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@map=r2, 0x6, 0x1, 0x0, &(0x7f0000000100)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) 2.49856414s ago: executing program 5 (id=2094): r0 = landlock_create_ruleset(&(0x7f0000000000)={0x1080, 0x1}, 0x18, 0x0) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = getpgrp(0x0) fcntl$setownex(r3, 0xf, &(0x7f0000000100)={0x2, r4}) sendmsg$unix(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="b5", 0x1}], 0x1}, 0x240408c1) 2.408510628s ago: executing program 3 (id=2095): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0xba01}, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000180)=0x80000001, 0x4) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f0000000140)=0x6, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000480)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@timestamp={0x44, 0x4, 0x5e}]}}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x12, 0x0, &(0x7f0000000200)=0xb) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x237, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6, 0xd0, 0x1, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x2, 0x8, {0x9, 0x21, 0xc3, 0x1, 0x1, {0x22, 0x6c3}}, {{{0x9, 0x5, 0x81, 0x3, 0x410, 0x71, 0xa5, 0x4}}}}}]}}]}}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) 2.360877193s ago: executing program 1 (id=2096): r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000040), 0xc) r1 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) r2 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x3516, 0x300, 0x0, 0x0, 0x0) 2.227020083s ago: executing program 2 (id=2097): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r0 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r0, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) chdir(&(0x7f0000000140)='./bus\x00') linkat(r0, &(0x7f0000000040)='./file1\x00', r0, &(0x7f0000000180)='./bus\x00', 0x0) link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 2.155551786s ago: executing program 5 (id=2098): openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x100, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0x75fa, 0xe475, 0x0, 0x0, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) write$uinput_user_dev(r3, &(0x7f0000000840)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x10, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xe, 0x80, 0xabf, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8000, 0x0, 0xffffffff, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b], [0xffffffff, 0x1, 0x2000, 0x0, 0x4, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6be5, 0x0, 0x0, 0x80000004, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x0, 0x4, 0x0, 0xffeffffe, 0x0, 0x800005], [0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x6e8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xdb2bb47c, 0x1, 0x0, 0x0, 0x0, 0xe9, 0x20, 0x20], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcc5, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0xfffffffe, 0x0, 0x0, 0x3, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) 1.960044902s ago: executing program 2 (id=2099): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000100)={0x10, 0xffffffda, 0x3}, 0x10) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x5, 0x6, 0x0, 0x0, 0x10003, 0x0, 0x400200cc4, 0xffe, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6a, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.717707577s ago: executing program 1 (id=2100): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) mkdir(&(0x7f0000000300)='./bus\x00', 0x9) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 1.662551098s ago: executing program 2 (id=2101): r0 = fanotify_init(0x200, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(r0, 0x71, 0x40000009, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) sendfile(r2, r3, 0x0, 0xffffffff004) 1.340990335s ago: executing program 5 (id=2102): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40050) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0x0, 0xfffff024}, {0x28, 0x0, 0x0, 0xffeff024}, {0x6, 0x0, 0x83}]}, 0x10) sendmmsg(r1, &(0x7f0000001c00), 0x400000000000159, 0x40840) 1.297235722s ago: executing program 1 (id=2103): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x51}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40880, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000004c0)={0x0, 0x2, 0x10}, 0xc) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$sock_timeval(r1, 0x1, 0x42, &(0x7f0000001600)={0x0, 0xea60}, 0x10) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000100)={0x0, 0xdce, 0x101, 0x7}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={r3}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x8a50adcc399d9d2a, &(0x7f0000000380)=""/150, &(0x7f0000000240)=0x96) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000000)={r4, 0x10}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={r4, 0xe}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$session_to_parent(0x12) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r7) sendmsg$NLBL_MGMT_C_ADD(r7, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a300000000088000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073"], 0xd0}}, 0x20050800) readv(r1, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000000)='\t', 0xf4c, 0x0, 0x0, 0x0) 30.695558ms ago: executing program 5 (id=2104): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x80002, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mount$9p_virtio(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000200000c12000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000000000000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000070601080000001e000000000a0000040500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) 0s ago: executing program 1 (id=2105): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_icmp(0x2, 0x2, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b0000000000000000000000000004", @ANYRES32=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0x10, &(0x7f0000000040)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000140)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) kernel console output (not intermixed with test programs): program syz.3.943 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 358.271276][ T977] net_ratelimit: 4 callbacks suppressed [ 358.271306][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 358.321359][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 358.739739][ T6183] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 359.385300][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 359.771966][ T8931] netlink: 24 bytes leftover after parsing attributes in process `syz.3.959'. [ 359.898696][ T8936] netlink: 8 bytes leftover after parsing attributes in process `syz.2.962'. [ 359.928451][ T8936] netlink: 8 bytes leftover after parsing attributes in process `syz.2.962'. [ 360.907814][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 361.186947][ T8945] tipc: Enabling of bearer rejected, already enabled [ 361.298227][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 361.634433][ T8962] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 361.914328][ T8964] netlink: 84 bytes leftover after parsing attributes in process `syz.5.972'. [ 361.931328][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.527717][ T8979] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 362.567511][ T8979] syzkaller1: linktype set to 780 [ 362.804625][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 363.462580][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 363.477053][ T8989] tty tty25: ldisc open failed (-12), clearing slot 24 [ 363.913520][ T8999] netlink: 23 bytes leftover after parsing attributes in process `syz.1.981'. [ 364.235549][ T9006] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 364.410989][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 364.523167][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 364.761150][ T9009] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 365.554951][ T9016] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 365.894459][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 367.092016][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 367.461779][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 367.634511][ T9056] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 367.956396][ T9049] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 368.174771][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 368.261100][ T10] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 368.422892][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 368.468452][ T9071] tipc: Enabling of bearer rejected, already enabled [ 368.483743][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 368.491937][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 368.500390][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 368.517156][ T1037] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 368.527394][ T5842] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 368.537683][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 368.538848][ T10] usb 2-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 368.620760][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.669539][ T10] usb 2-1: config 0 descriptor?? [ 369.145885][ T10] isku 0003:1E7D:319C.0022: unknown main item tag 0x0 [ 369.176619][ T10] isku 0003:1E7D:319C.0022: unknown main item tag 0x0 [ 369.202279][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 369.231419][ T10] isku 0003:1E7D:319C.0022: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.1-1/input0 [ 369.569312][ T9] usb 2-1: USB disconnect, device number 18 [ 369.775363][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 369.991585][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 370.011417][ T10] usb 1-1: config 0 has an invalid interface number: 219 but max is 0 [ 370.032748][ T10] usb 1-1: config 0 has no interface number 0 [ 370.038943][ T10] usb 1-1: config 0 interface 219 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 370.073755][ T10] usb 1-1: config 0 interface 219 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 370.205451][ T10] usb 1-1: New USB device found, idVendor=0582, idProduct=ecd6, bcdDevice=6b.1b [ 370.235000][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 370.246388][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 370.281450][ T10] usb 1-1: Product: syz [ 370.289135][ T10] usb 1-1: Manufacturer: syz [ 370.298235][ T10] usb 1-1: SerialNumber: syz [ 370.320664][ T10] usb 1-1: config 0 descriptor?? [ 370.811606][ T9115] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 371.264561][ T10] usb 1-1: USB disconnect, device number 19 [ 371.281009][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 371.302847][ T9116] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 371.402818][ T5846] udevd[5846]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.219/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 371.542945][ T9126] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 371.561441][ T9126] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 372.178632][ T9135] misc userio: No port type given on /dev/userio [ 372.203119][ T9132] misc userio: The device must be registered before sending interrupts [ 373.499956][ T8769] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 373.605903][ T3513] net_ratelimit: 1827 callbacks suppressed [ 373.605927][ T3513] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.620984][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.652545][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.681700][ T8769] usb 4-1: Using ep0 maxpacket: 32 [ 373.697809][ T8769] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 373.723907][ T8769] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.758886][ T8769] usb 4-1: config 0 descriptor?? [ 374.001755][ T8769] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 374.059003][ T8769] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 374.111826][ T8769] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 374.134008][ T8769] usb 4-1: media controller created [ 374.192037][ T9178] syz.2.1030: attempt to access beyond end of device [ 374.192037][ T9178] loop2: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 374.208191][ T9178] hfsplus: unable to find HFS+ superblock [ 374.401708][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.439872][ T9176] input: syz0 as /devices/virtual/input/input11 [ 375.204032][ T8769] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 375.519341][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 375.554208][ T8769] az6027: usb out operation failed. (-71) [ 375.667649][ T8769] az6027: usb out operation failed. (-71) [ 375.686306][ T8769] stb0899_attach: Driver disabled by Kconfig [ 375.715873][ T8769] az6027: no front-end attached [ 375.715873][ T8769] [ 375.900981][ T8769] az6027: usb out operation failed. (-71) [ 375.925238][ T8769] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 375.981121][ T8769] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input12 [ 376.016671][ T9201] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1037'. [ 376.028782][ T8769] dvb-usb: schedule remote query interval to 400 msecs. [ 376.085583][ T8769] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 376.229685][ T8769] usb 4-1: USB disconnect, device number 11 [ 376.245842][ T9201] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1037'. [ 376.355353][ T9207] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.507762][ T8769] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 376.571640][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.663496][ T9215] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 376.720998][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.834445][ T9221] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1044'. [ 377.345288][ T9232] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 377.373449][ T9232] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 377.392111][ T9242] futex_wake_op: syz.1.1050 tries to shift op by 32; fix this program [ 377.438806][ T9232] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 377.503037][ T9232] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 377.527927][ T9232] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 377.585919][ T9232] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 377.602544][ T6271] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 377.621325][ T9232] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 377.623426][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 377.650176][ T9232] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 377.667994][ T9232] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 377.709614][ T9232] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 378.010826][ T9] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 378.240527][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 378.261845][ T9265] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1058'. [ 378.283669][ T9] usb 4-1: no configurations [ 378.299971][ T9] usb 4-1: can't read configurations, error -22 [ 378.642019][ T8769] net_ratelimit: 4 callbacks suppressed [ 378.642037][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 378.731563][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.737991][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.820448][ T9278] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1061'. [ 379.283953][ T5857] Bluetooth: hci1: command 0x0406 tx timeout [ 379.351263][ T977] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 379.374330][ T1037] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.389525][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.399560][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.521317][ T5857] Bluetooth: hci2: command 0x0406 tx timeout [ 379.578030][ T977] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 379.601806][ T5857] Bluetooth: hci3: command 0x0406 tx timeout [ 379.681146][ T5857] Bluetooth: hci5: command 0x0c1a tx timeout [ 379.689869][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.714870][ T977] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 379.855783][ T9291] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 379.878578][ T977] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 379.940412][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.489302][ T977] usb 3-1: GET_CAPABILITIES returned 0 [ 380.516286][ T977] usbtmc 3-1:16.0: can't read capabilities [ 380.723876][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 380.739308][ T10] usb 3-1: USB disconnect, device number 19 [ 381.391194][ T5857] Bluetooth: hci1: command 0x0406 tx timeout [ 381.607458][ T5857] Bluetooth: hci2: command 0x0406 tx timeout [ 381.680830][ T5857] Bluetooth: hci3: command 0x0406 tx timeout [ 381.761107][ T5857] Bluetooth: hci5: command 0x0c1a tx timeout [ 381.787176][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 381.822844][ T9315] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 382.330956][ T980] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 382.380310][ T9337] loop7: detected capacity change from 0 to 7 [ 382.391226][ T9338] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1079'. [ 382.409513][ T9338] geneve1: entered promiscuous mode [ 382.417470][ T5846] Dev loop7: unable to read RDB block 7 [ 382.431053][ T5846] loop7: AHDI p1 p2 [ 382.435473][ T5846] loop7: partition table partially beyond EOD, truncated [ 382.452902][ T5846] loop7: p1 start 1702000233 is beyond EOD, truncated [ 382.480974][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 382.489475][ T9337] Dev loop7: unable to read RDB block 7 [ 382.507017][ T9337] loop7: AHDI p1 p2 [ 382.517123][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 382.528873][ T9337] loop7: partition table partially beyond EOD, truncated [ 382.541678][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 382.553003][ T9337] loop7: p1 start 1702000233 is beyond EOD, truncated [ 382.566542][ T980] usb 2-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 382.576406][ T980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.603117][ T980] usb 2-1: config 0 descriptor?? [ 382.801452][ T8769] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 382.809479][ T9345] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 383.336564][ T6271] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 383.440932][ T5857] Bluetooth: hci1: command 0x0406 tx timeout [ 383.555541][ T980] hid-led 0003:1D34:0004.0023: unknown main item tag 0x0 [ 383.842619][ T5857] Bluetooth: hci5: command 0x0c1a tx timeout [ 384.064969][ T980] hid-led 0003:1D34:0004.0023: hidraw0: USB HID v0.00 Device [HID 1d34:0004] on usb-dummy_hcd.1-1/input0 [ 384.334951][ T980] hid-led 0003:1D34:0004.0023: Dream Cheeky Webmail Notifier initialized [ 384.381123][ T980] usb 2-1: USB disconnect, device number 19 [ 384.444377][ T5913] net_ratelimit: 2 callbacks suppressed [ 384.444396][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.486297][ T9359] tipc: Enabling of bearer rejected, already enabled [ 384.613549][ T9360] fido_id[9360]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 385.135528][ T6052] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.151456][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.174831][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.627949][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 386.012409][ T9388] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 386.647159][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 387.410853][ T10] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 387.532267][ T9406] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 387.862572][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 387.870789][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 387.930805][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 387.939375][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 387.994233][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 388.032134][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 388.064448][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 388.064762][ T9412] tipc: Enabling of bearer rejected, already enabled [ 388.105804][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 388.146802][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.340920][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 388.417916][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 388.442633][ T10] usbtmc 3-1:16.0: can't read capabilities [ 388.645060][ T10] usb 3-1: USB disconnect, device number 20 [ 389.787637][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 389.787656][ T30] audit: type=1326 audit(1752507402.493:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 389.863866][ T1151] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 389.916879][ T30] audit: type=1326 audit(1752507402.543:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 389.950878][ T30] audit: type=1326 audit(1752507402.553:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 389.976440][ T30] audit: type=1326 audit(1752507402.553:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 390.018579][ T30] audit: type=1326 audit(1752507402.553:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 390.041336][ T10] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 390.120487][ T30] audit: type=1326 audit(1752507402.553:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 390.180947][ T30] audit: type=1326 audit(1752507402.553:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 390.222642][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 390.245376][ T10] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 390.363984][ T10] usb 2-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 390.388919][ T30] audit: type=1326 audit(1752507402.553:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 390.430859][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.800895][ T10] usb 2-1: Product: syz [ 390.805151][ T10] usb 2-1: Manufacturer: syz [ 390.858461][ T10] usb 2-1: SerialNumber: syz [ 390.914049][ T30] audit: type=1326 audit(1752507402.553:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fec4678e929 code=0x7ffc0000 [ 390.979841][ T10] usb 2-1: config 0 descriptor?? [ 391.000076][ T30] audit: type=1326 audit(1752507402.553:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9435 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 391.246172][ T10] usb 2-1: USB disconnect, device number 20 [ 392.352160][ T9468] tipc: Enabling of bearer rejected, already enabled [ 392.487195][ T9474] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 395.274260][ T9498] tipc: Enabling of bearer rejected, already enabled [ 396.860093][ T9521] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 397.615462][ T1151] Bluetooth: hci4: Frame reassembly failed (-84) [ 398.413207][ T9541] input: syz1 as /devices/virtual/input/input13 [ 398.804864][ T5850] IPVS: starting estimator thread 0... [ 398.903405][ T9554] IPVS: using max 23 ests per chain, 55200 per kthread [ 398.909692][ T9557] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 399.601343][ T5857] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 399.601827][ T5843] Bluetooth: hci4: command 0xfc11 tx timeout [ 402.691589][ T9600] Trying to write to read-only block-device nullb0 [ 403.777525][ T9618] macvlan1: entered promiscuous mode [ 403.812023][ T9618] ipvlan0: entered promiscuous mode [ 403.849278][ T9618] ipvlan0: left promiscuous mode [ 403.859887][ T9618] macvlan1: left promiscuous mode [ 404.281904][ T980] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 404.560819][ T980] usb 4-1: Using ep0 maxpacket: 32 [ 404.570349][ T980] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 404.753958][ T980] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 404.764415][ T980] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 404.773765][ T980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.785430][ T980] usb 4-1: config 0 descriptor?? [ 406.090927][ T9645] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 406.111426][ T980] savu 0003:1E7D:2D5A.0024: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 406.181834][ T9646] netlink: set zone limit has 4 unknown bytes [ 406.357210][ T980] usb 4-1: USB disconnect, device number 14 [ 406.450130][ T9647] fido_id[9647]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 406.794432][ T8769] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 406.802588][ T5913] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 407.222243][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 407.439582][ T8769] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 407.448061][ T8769] usb 2-1: config 0 has no interface number 0 [ 407.454305][ T5913] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 407.467499][ T5913] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 407.477776][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.487832][ T8769] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 407.500961][ T8769] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.510031][ T8769] usb 2-1: Product: syz [ 407.517330][ T5913] usb 3-1: config 0 descriptor?? [ 407.522537][ T8769] usb 2-1: Manufacturer: syz [ 407.527178][ T8769] usb 2-1: SerialNumber: syz [ 407.613528][ T8769] usb 2-1: config 0 descriptor?? [ 407.892863][ T8769] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 407.921785][ T8769] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 407.946958][ T8769] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 407.979280][ T5913] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 407.986190][ T9670] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 407.990628][ T8769] usb 2-1: media controller created [ 408.041558][ T5913] plantronics 0003:047F:FFFF.0025: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 408.092970][ T8769] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 408.112264][ T9656] usb 2-1: dvb_usb_ec168: I2C read not implemented [ 408.226695][ T8769] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 408.532774][ T10] usb 3-1: USB disconnect, device number 21 [ 410.410008][ T8769] usb 2-1: USB disconnect, device number 21 [ 410.551999][ T9690] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 411.452038][ T980] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 412.291194][ T980] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 412.312557][ T980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.351411][ T980] usb 4-1: config 0 descriptor?? [ 412.368635][ T980] cp210x 4-1:0.0: cp210x converter detected [ 412.398164][ T9712] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 412.858182][ T980] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 413.540786][ T9] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 413.645352][ T980] usb 4-1: cp210x converter now attached to ttyUSB0 [ 413.673759][ T980] usb 4-1: USB disconnect, device number 15 [ 413.687670][ T980] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 413.714282][ T980] cp210x 4-1:0.0: device disconnected [ 413.770026][ T9] usb 1-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 413.808399][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.827342][ T9] usb 1-1: Product: syz [ 413.832063][ T9] usb 1-1: Manufacturer: syz [ 413.836707][ T9] usb 1-1: SerialNumber: syz [ 413.873662][ T9] usb 1-1: config 0 descriptor?? [ 413.909796][ T9] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 414.770787][ T980] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 415.635474][ T9] gspca_sunplus: reg_r err -110 [ 415.660964][ T9] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 415.881273][ T980] usb 4-1: Using ep0 maxpacket: 32 [ 415.965734][ T977] usb 1-1: USB disconnect, device number 20 [ 415.989691][ T980] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 416.082519][ T9745] netlink: 'syz.5.1208': attribute type 39 has an invalid length. [ 416.375407][ T980] usb 4-1: config 0 has no interface number 0 [ 416.427331][ T980] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 416.438696][ T980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.447510][ T980] usb 4-1: Product: syz [ 416.453251][ T980] usb 4-1: Manufacturer: syz [ 416.458084][ T980] usb 4-1: SerialNumber: syz [ 416.480339][ T980] usb 4-1: config 0 descriptor?? [ 416.506422][ T980] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 416.738302][ T980] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 416.775841][ T980] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 417.000109][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 138 [ 417.165254][ T9753] loop8: detected capacity change from 0 to 8 [ 417.190112][ T9753] Dev loop8: unable to read RDB block 8 [ 417.206592][ T9753] loop8: unable to read partition table [ 417.217555][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 417.218318][ T977] usb 4-1: USB disconnect, device number 16 [ 417.246083][ T9753] loop8: partition table beyond EOD, truncated [ 417.264794][ T9753] loop_reread_partitions: partition scan of loop8 (þ被xü^>à– ) failed (rc=-5) [ 417.305541][ T977] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 417.337852][ T977] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 417.363653][ T977] quatech2 4-1:0.51: device disconnected [ 417.872399][ T980] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 418.091292][ T980] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 418.123726][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 418.137794][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 418.232941][ T980] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 418.371417][ T980] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 418.500368][ T980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.638257][ T980] usb 2-1: config 0 descriptor?? [ 418.766996][ T5941] kernel write not supported for file /ppp (pid: 5941 comm: kworker/1:5) [ 418.806834][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 418.806853][ T30] audit: type=1326 audit(1752507431.513:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9786 comm="syz.0.1226" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f432098e929 code=0x0 [ 419.270564][ T980] plantronics 0003:047F:FFFF.0026: ignoring exceeding usage max [ 419.637805][ T980] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 419.750230][ T980] usb 2-1: USB disconnect, device number 22 [ 419.914743][ T9805] fido_id[9805]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 420.063173][ T5941] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 420.203212][ T9817] loop6: detected capacity change from 0 to 2098 [ 420.242108][ T5941] usb 6-1: Using ep0 maxpacket: 32 [ 420.285970][ T5941] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 420.311367][ T5941] usb 6-1: config 0 has no interface number 0 [ 420.329565][ T5941] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 420.362500][ T980] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 420.569406][ T5941] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.580358][ T5941] usb 6-1: Product: syz [ 420.585427][ T5941] usb 6-1: Manufacturer: syz [ 420.590186][ T5941] usb 6-1: SerialNumber: syz [ 420.598827][ T5941] usb 6-1: config 0 descriptor?? [ 420.608059][ T5941] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 420.748195][ T980] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 420.885041][ T980] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 421.229441][ T9830] usb usb8: usbfs: process 9830 (syz.0.1243) did not claim interface 0 before use [ 421.351850][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 138 [ 421.366486][ T5941] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 421.376621][ T980] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 421.404037][ T6271] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 421.406838][ T980] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 421.426460][ T5941] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 421.444568][ T980] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 421.459000][ T980] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 421.468535][ T980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.538222][ T980] usb 3-1: config 0 descriptor?? [ 421.556606][ T9836] netlink: 13 bytes leftover after parsing attributes in process `syz.0.1245'. [ 421.575028][ T9815] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 421.623301][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 421.631538][ T5941] usb 6-1: USB disconnect, device number 4 [ 421.652671][ T5941] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 421.682483][ T5941] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 421.702744][ T5941] quatech2 6-1:0.51: device disconnected [ 421.740962][ T977] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 421.910987][ T977] usb 2-1: Using ep0 maxpacket: 32 [ 421.928983][ T977] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 421.946981][ T977] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 421.964360][ T30] audit: type=1326 audit(1752507434.663:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 421.968556][ T977] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 422.015714][ T30] audit: type=1326 audit(1752507434.693:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.049170][ T980] plantronics 0003:047F:FFFF.0027: reserved main item tag 0xd [ 422.056975][ T977] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 422.067492][ T30] audit: type=1326 audit(1752507434.693:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.097959][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 422.107580][ T977] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 422.121418][ T980] plantronics 0003:047F:FFFF.0027: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 422.124230][ T977] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 422.166604][ T30] audit: type=1326 audit(1752507434.693:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.176656][ T977] usb 2-1: Product: syz [ 422.224646][ T977] usb 2-1: Manufacturer: syz [ 422.239087][ T30] audit: type=1326 audit(1752507434.693:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.270827][ T977] usb 2-1: SerialNumber: syz [ 422.346593][ T977] usb 2-1: config 0 descriptor?? [ 422.350868][ T30] audit: type=1326 audit(1752507434.693:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.368088][ T977] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 422.382734][ T980] usb 3-1: USB disconnect, device number 22 [ 422.459362][ T30] audit: type=1326 audit(1752507434.693:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.485228][ T977] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 422.524719][ T9840] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1247'. [ 422.584496][ T30] audit: type=1326 audit(1752507434.693:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 422.625643][ T9843] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 422.713316][ T30] audit: type=1326 audit(1752507434.693:174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 423.430391][ T9846] ldusb 2-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 423.921683][ T9] usb 2-1: USB disconnect, device number 23 [ 423.921809][ C1] ldusb 2-1:0.0: usb_submit_urb failed (-19) [ 424.000374][ T30] kauditd_printk_skb: 305 callbacks suppressed [ 424.000436][ T30] audit: type=1326 audit(1752507436.703:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.050483][ T9] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 424.117189][ T30] audit: type=1326 audit(1752507436.703:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.184893][ T30] audit: type=1326 audit(1752507436.703:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.237246][ T30] audit: type=1326 audit(1752507436.703:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.369952][ T9855] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 424.765761][ T30] audit: type=1326 audit(1752507436.703:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.793825][ T30] audit: type=1326 audit(1752507436.703:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.818468][ T30] audit: type=1326 audit(1752507436.703:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.843485][ T30] audit: type=1326 audit(1752507436.703:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 424.869490][ T30] audit: type=1326 audit(1752507436.703:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 425.010954][ T30] audit: type=1326 audit(1752507436.713:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.1244" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fec4672ab19 code=0x7ffc0000 [ 426.030840][ T5941] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 426.123539][ T9878] loop8: detected capacity change from 0 to 8 [ 426.160449][ T9878] Dev loop8: unable to read RDB block 8 [ 426.180884][ T9878] loop8: unable to read partition table [ 426.199790][ T9878] loop8: partition table beyond EOD, truncated [ 426.223195][ T5941] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 426.226622][ T9878] loop_reread_partitions: partition scan of loop8 (þ被xü^>à– ) failed (rc=-5) [ 426.264410][ T5941] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 426.291777][ T5941] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 426.305541][ T5941] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 426.330850][ T980] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 426.381044][ T5941] usb 2-1: config 0 descriptor?? [ 426.511432][ T980] usb 4-1: Using ep0 maxpacket: 32 [ 426.549444][ T980] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 426.723003][ T980] usb 4-1: config 0 has no interface number 0 [ 426.756415][ T980] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 426.824904][ T980] usb 4-1: config 0 interface 85 has no altsetting 0 [ 426.888333][ T980] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 427.126641][ T5941] cm6533_jd 0003:0D8C:0022.0028: unknown main item tag 0x0 [ 427.134153][ T980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.148161][ T5941] cm6533_jd 0003:0D8C:0022.0028: unknown main item tag 0x0 [ 427.155743][ T980] usb 4-1: Product: syz [ 427.160397][ T980] usb 4-1: Manufacturer: syz [ 427.181261][ T5941] cm6533_jd 0003:0D8C:0022.0028: unknown main item tag 0x0 [ 427.188578][ T5941] cm6533_jd 0003:0D8C:0022.0028: unknown main item tag 0x0 [ 427.201147][ T980] usb 4-1: SerialNumber: syz [ 427.231930][ T980] usb 4-1: config 0 descriptor?? [ 427.262615][ T5941] cm6533_jd 0003:0D8C:0022.0028: unknown main item tag 0x0 [ 427.271017][ T5850] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 427.293747][ T5941] cm6533_jd 0003:0D8C:0022.0028: hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 427.442409][ T5941] usb 2-1: USB disconnect, device number 24 [ 427.463522][ T5850] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 427.994563][ T5850] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 428.055749][ T5850] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 428.088901][ T5850] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.090626][ T9895] fido_id[9895]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 428.118027][ T5850] usb 6-1: config 0 descriptor?? [ 428.427766][ T980] appletouch 4-1:0.85: Geyser mode initialized. [ 428.443915][ T980] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input16 [ 429.216740][ T5850] kone 0003:1E7D:2CED.0029: unknown main item tag 0x0 [ 429.225136][ T5941] usb 4-1: USB disconnect, device number 17 [ 429.252752][ T5850] kone 0003:1E7D:2CED.0029: unknown main item tag 0x0 [ 429.261709][ T5850] kone 0003:1E7D:2CED.0029: unknown main item tag 0x0 [ 429.288999][ T5850] kone 0003:1E7D:2CED.0029: hidraw0: USB HID v0.00 Device [HID 1e7d:2ced] on usb-dummy_hcd.5-1/input0 [ 429.542806][ T5941] appletouch 4-1:0.85: input: appletouch disconnected [ 429.577988][ T5850] usb 6-1: USB disconnect, device number 5 [ 430.163273][ T9912] fido_id[9912]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 431.155040][ T9923] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 432.945641][ T977] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 433.383159][ T977] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 433.439775][ T977] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 433.502621][ T977] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 433.543413][ T977] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 433.583780][ T9960] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 433.610777][ T977] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 433.648252][ T977] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.672819][ T977] usb 1-1: config 0 descriptor?? [ 434.052251][ T9967] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 434.461075][ T9964] xt_CT: No such helper "snmp" [ 434.493793][ T977] plantronics 0003:047F:FFFF.002A: ignoring exceeding usage max [ 434.532855][ T977] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 434.551282][ T977] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 434.566808][ T977] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 434.575725][ T977] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 434.600046][ T977] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 434.640311][ T977] plantronics 0003:047F:FFFF.002A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 434.818337][ T977] usb 1-1: USB disconnect, device number 21 [ 434.860458][ T9982] fido_id[9982]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 435.687549][ T9999] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 436.620965][T10010] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 436.900318][T10018] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1308'. [ 438.511776][ T43] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 438.732823][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 438.745876][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.775273][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.816054][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 438.850784][ T43] usb 3-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 438.878308][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.964826][T10057] syz.5.1324: attempt to access beyond end of device [ 438.964826][T10057] loop5: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 438.978570][T10057] hfsplus: unable to find HFS+ superblock [ 439.073064][ T43] usb 3-1: config 0 descriptor?? [ 440.035476][T10063] sg_write: process 703 (syz.0.1326) changed security contexts after opening file descriptor, this is not allowed. [ 440.142031][ T43] cougar 0003:060B:500A.002B: unexpected long global item [ 440.164823][T10066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 440.172562][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.523570][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.536317][ T43] cougar 0003:060B:500A.002B: parse failed [ 440.659064][ T43] cougar 0003:060B:500A.002B: probe with driver cougar failed with error -22 [ 440.777555][ T43] usb 3-1: USB disconnect, device number 23 [ 442.133228][T10094] netlink: 'syz.2.1340': attribute type 10 has an invalid length. [ 442.181353][T10094] syz_tun: entered promiscuous mode [ 442.215724][ T5857] Bluetooth: hci2: unknown advertising packet type: 0x82 [ 442.215807][ T5857] Bluetooth: hci2: Dropping invalid advertising data [ 442.230378][ T5857] Bluetooth: hci2: unknown advertising packet type: 0xf2 [ 442.230415][ T5857] Bluetooth: hci2: Malformed LE Event: 0x02 [ 442.346426][T10102] syz.5.1341: attempt to access beyond end of device [ 442.346426][T10102] loop5: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 442.360185][T10102] hfsplus: unable to find HFS+ superblock [ 442.446568][T10094] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 444.641436][ T977] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 444.707995][T10137] syz.0.1353: attempt to access beyond end of device [ 444.707995][T10137] loop0: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 444.721998][T10137] hfsplus: unable to find HFS+ superblock [ 444.993302][ T977] usb 6-1: Using ep0 maxpacket: 8 [ 445.117512][ T977] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 445.251128][ T977] usb 6-1: config 0 has no interface number 0 [ 445.353597][ T977] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 445.483837][ T977] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 445.633599][ T977] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 445.687077][ T977] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 445.731786][ T977] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 445.786962][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.832929][ T977] usb 6-1: config 0 descriptor?? [ 445.874142][ T977] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 445.961599][T10154] syz.1.1357: attempt to access beyond end of device [ 445.961599][T10154] loop1: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 445.975846][T10154] hfsplus: unable to find HFS+ superblock [ 447.798423][ T980] usb 6-1: USB disconnect, device number 6 [ 448.269024][ T980] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 448.517016][T10185] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1368'. [ 448.544223][T10185] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1368'. [ 449.663706][ T5941] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 450.124196][ T5941] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 450.140252][ T5941] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.157093][ T5941] usb 2-1: New USB device found, idVendor=060b, idProduct=700a, bcdDevice= 0.00 [ 450.180391][ T5941] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 450.197871][ T5941] usb 2-1: Manufacturer: syz [ 450.212217][ T5941] usb 2-1: config 0 descriptor?? [ 450.370183][T10207] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 450.391001][ T43] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 450.562698][ T43] usb 1-1: Using ep0 maxpacket: 8 [ 450.587503][T10214] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 34 [ 450.596182][ T43] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 450.611459][ T43] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 450.627454][ T43] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 450.669620][ T43] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 450.701756][ T5941] cougar 0003:060B:700A.002C: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 450.716412][ T43] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 450.747609][ T43] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 450.766568][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.030060][ T977] usb 2-1: USB disconnect, device number 25 [ 451.061316][ T43] usb 1-1: GET_CAPABILITIES returned 0 [ 451.068250][ T43] usbtmc 1-1:16.0: can't read capabilities [ 451.137389][T10218] fido_id[10218]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 451.751672][ T43] usb 1-1: USB disconnect, device number 22 [ 452.438089][T10240] tipc: Started in network mode [ 452.443192][T10240] tipc: Node identity ac14140f, cluster identity 4711 [ 452.451424][T10240] tipc: New replicast peer: 255.255.255.255 [ 452.458875][T10240] tipc: Enabled bearer , priority 10 [ 452.930898][ T977] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 453.044986][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 453.129755][ T977] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 453.186007][ T977] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 453.219738][ T977] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 453.516888][ T977] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.571414][ T10] tipc: Node number set to 2886997007 [ 453.582518][T10242] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 453.631367][ T977] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 454.005507][ T977] usb 2-1: USB disconnect, device number 26 [ 454.200452][T10263] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 454.710864][ T977] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 454.845414][T10275] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 454.871037][ T977] usb 1-1: Using ep0 maxpacket: 32 [ 454.907391][ T977] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 455.091525][ T977] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 455.287879][T10282] tipc: Enabling of bearer rejected, already enabled [ 455.805244][ T977] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 455.816457][ T977] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 455.829713][ T977] usb 1-1: config 0 interface 0 has no altsetting 0 [ 455.839197][ T977] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 455.848543][ T977] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 455.946815][ T977] usb 1-1: Product: syz [ 455.976652][ T977] usb 1-1: Manufacturer: syz [ 455.997365][ T977] usb 1-1: SerialNumber: syz [ 456.037665][ T977] usb 1-1: config 0 descriptor?? [ 456.055857][ T977] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 456.092105][ T977] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 457.049511][T10296] ldusb 1-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 457.057178][ T977] usb 1-1: USB disconnect, device number 23 [ 457.063316][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 457.076290][T10301] TCP: tcp_parse_options: Illegal window scaling value 236 > 14 received [ 457.110252][ T977] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 458.060783][ T43] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 458.211117][ T5941] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 458.376976][ T43] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 458.472404][ T5941] usb 6-1: Using ep0 maxpacket: 8 [ 458.525025][ T43] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 458.584180][ T5941] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 458.739935][ T5941] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 458.753454][ T5941] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 458.765483][ T5941] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 458.776948][ T43] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 458.786680][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.801211][ T5941] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 458.821221][ T43] usb 2-1: Product: syz [ 458.825450][ T43] usb 2-1: Manufacturer: syz [ 458.836394][ T43] usb 2-1: SerialNumber: syz [ 458.860228][ T5941] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 458.870969][ T43] usb 2-1: config 0 descriptor?? [ 458.900940][ T5941] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 458.910302][T10317] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 458.918783][T10317] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 458.926855][ T5941] usb 6-1: Product: syz [ 458.932116][ T5941] usb 6-1: Manufacturer: syz [ 458.937177][ T5941] usb 6-1: SerialNumber: syz [ 458.954628][ T5941] usb 6-1: config 0 descriptor?? [ 459.100838][ T10] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 459.149530][T10317] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 459.185583][ T5941] radio-si470x 6-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 459.199645][T10317] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 459.207006][ T5941] radio-si470x 6-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 459.272623][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 459.287554][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 459.329891][ T10] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 459.346502][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 459.365548][ T10] usb 4-1: config 0 descriptor?? [ 459.388855][ T5941] radio-si470x 6-1:0.0: software version 0, hardware version 0 [ 459.411765][ T5941] radio-si470x 6-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 459.438102][ T5941] radio-si470x 6-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 459.466924][T10349] Bluetooth: hci0: invalid length 0, exp 2 for type 5 [ 459.589743][ T5941] radio-si470x 6-1:0.0: submitting int urb failed (-90) [ 459.670849][ T43] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 459.859380][ T10] mcp2221 0003:04D8:00DD.002D: unknown main item tag 0x0 [ 459.905858][ T10] mcp2221 0003:04D8:00DD.002D: unknown main item tag 0x0 [ 459.942106][ T10] mcp2221 0003:04D8:00DD.002D: unknown main item tag 0x0 [ 459.949231][ T10] mcp2221 0003:04D8:00DD.002D: unknown main item tag 0x0 [ 460.031030][ T5913] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 460.187941][ T10] mcp2221 0003:04D8:00DD.002D: unknown main item tag 0x0 [ 460.200311][ T5941] radio-si470x 6-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 460.201120][ T5941] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -22 [ 460.201820][ T5913] usb 3-1: Using ep0 maxpacket: 32 [ 460.211180][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.259004][ T5941] usb 6-1: USB disconnect, device number 7 [ 460.307519][ T10] mcp2221 0003:04D8:00DD.002D: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 460.307665][ T43] dm9601 2-1:0.0 (unnamed net_device) (uninitialized): Error reading MODE_CTRL [ 460.365569][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 460.387689][ T43] usb 2-1: USB disconnect, device number 27 [ 460.467573][ T5913] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 460.487614][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.525169][ T5913] usb 3-1: config 0 descriptor?? [ 460.535801][ T5913] hub 3-1:0.0: USB hub found [ 460.740261][ T5913] hub 3-1:0.0: 1 port detected [ 461.269719][ T5913] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 461.326823][ T5913] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 461.423342][ T5913] usbhid 3-1:0.0: can't add hid device: -71 [ 461.455929][ T5913] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 461.573613][ T5913] usb 3-1: USB disconnect, device number 24 [ 461.815022][ T10] usb 4-1: USB disconnect, device number 18 [ 461.893811][T10377] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1437'. [ 463.466268][T10400] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 463.491238][ T43] syzkaller1: tun_net_xmit 90 [ 463.508124][T10400] syzkaller1: Linktype set failed because interface is up [ 463.613447][ T43] syzkaller1: tun_net_xmit 90 [ 463.761881][ T12] syzkaller1: tun_net_xmit 86 [ 463.930864][ T43] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 463.951158][ T5941] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 464.105475][ T43] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 464.129781][ T5941] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 464.147016][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.156816][ T5941] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 464.174448][ T43] usb 6-1: config 0 descriptor?? [ 464.218881][ T5941] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 464.273850][ T5941] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.291592][ T5941] usb 3-1: config 0 descriptor?? [ 464.456588][ T43] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 464.499508][ T43] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 464.527437][ T43] [drm] Initialized udl on minor 2 [ 464.668236][ T43] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 464.696181][ T43] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 464.720529][ T5941] keytouch 0003:0926:3333.002E: fixing up Keytouch IEC report descriptor [ 464.806906][ T5941] input: HID 0926:3333 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0926:3333.002E/input/input17 [ 464.908748][ T980] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 464.917312][ T43] usb 6-1: USB disconnect, device number 8 [ 464.959252][ T980] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 465.200281][ T5941] keytouch 0003:0926:3333.002E: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.2-1/input0 [ 465.398102][ T5941] usb 3-1: USB disconnect, device number 25 [ 465.691838][ T43] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 465.904963][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 465.944127][ T43] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 465.999371][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.089018][ T43] pvrusb2: Hardware description: Terratec Grabster AV400 [ 466.160731][ T43] pvrusb2: ********** [ 466.164795][ T43] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 466.221915][T10419] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1455'. [ 466.273283][ T43] pvrusb2: Important functionality might not be entirely working. [ 466.324845][T10419] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1455'. [ 466.346279][ T43] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 466.411740][ T43] pvrusb2: ********** [ 466.434493][ T2343] pvrusb2: Invalid write control endpoint [ 466.590846][ T43] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 466.676538][T10411] pvrusb2: Invalid write control endpoint [ 466.714497][ T980] usb 4-1: USB disconnect, device number 19 [ 466.804486][ T43] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 466.817421][ T2343] pvrusb2: Invalid write control endpoint [ 466.834549][ T2343] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 466.849767][ T43] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 466.872888][ T2343] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 466.888859][ T43] usb 6-1: New USB device found, idVendor=04e7, idProduct=0030, bcdDevice= 0.00 [ 466.914321][ T2343] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 466.930991][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.948598][ T2343] pvrusb2: Device being rendered inoperable [ 466.961742][ T43] usb 6-1: config 0 descriptor?? [ 466.999991][ T2343] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 467.039343][ T2343] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 467.122061][ T2343] pvrusb2: Attached sub-driver cx25840 [ 467.158441][ T2343] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 467.227392][ T2343] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 468.614228][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.330400][ T7971] sched: DL replenish lagged too much [ 469.340268][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.394001][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.460623][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.523087][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.576072][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.619370][ T43] elo 0003:04E7:0030.002F: unknown main item tag 0x0 [ 469.679263][ T43] elo 0003:04E7:0030.002F: hidraw0: USB HID v0.00 Device [HID 04e7:0030] on usb-dummy_hcd.5-1/input0 [ 469.783866][ T43] usb 6-1: USB disconnect, device number 9 [ 470.087202][T10444] fido_id[10444]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 470.941234][T10459] input: syz1 as /devices/virtual/input/input18 [ 471.371456][T10466] netlink: 830 bytes leftover after parsing attributes in process `syz.1.1471'. [ 471.695153][ T43] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 472.510978][ T43] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 473.369506][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 474.346423][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 474.448272][ T43] usb 4-1: string descriptor 0 read error: -71 [ 474.598436][T10473] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 475.079010][ T43] usb 4-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 475.151638][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.166674][ T43] usb 4-1: config 0 descriptor?? [ 475.172997][ T43] usb 4-1: can't set config #0, error -71 [ 475.183726][ T43] usb 4-1: USB disconnect, device number 20 [ 476.188377][T10496] syzkaller1: entered promiscuous mode [ 476.237517][T10496] syzkaller1: entered allmulticast mode [ 476.520865][ T5913] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 476.737796][ T5913] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 476.796970][ T5913] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 476.853870][ T5913] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 476.903521][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.975088][ T5913] usb 4-1: Product: syz [ 476.979316][ T5913] usb 4-1: Manufacturer: syz [ 477.014864][ T5913] usb 4-1: SerialNumber: syz [ 477.295290][ T5913] usb 4-1: 0:2 : does not exist [ 477.369620][ T5913] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 477.560569][ T5913] usb 4-1: USB disconnect, device number 21 [ 477.796772][ T5846] udevd[5846]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 478.923169][T10528] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 479.439245][T10534] syz.2.1493: attempt to access beyond end of device [ 479.439245][T10534] loop2: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 479.489300][T10534] hfsplus: unable to find HFS+ superblock [ 481.016471][T10540] mac80211_hwsim hwsim7 wlan0: entered promiscuous mode [ 481.069954][T10540] mac80211_hwsim hwsim7 wlan0: left promiscuous mode [ 484.148226][ T1037] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 490.431707][T10583] input: syz1 as /devices/virtual/input/input19 [ 498.899380][T10611] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 498.912452][ T5850] IPVS: starting estimator thread 0... [ 499.041194][T10617] IPVS: using max 24 ests per chain, 57600 per kthread [ 500.122546][ T5850] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 500.384239][ T5850] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 500.444120][ T5850] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 500.540781][ T5850] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 500.549897][ T5850] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.564654][ T5842] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 500.690886][ T5850] usb 2-1: config 0 descriptor?? [ 500.798149][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 500.798170][ T30] audit: type=1326 audit(1752507513.493:510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10635 comm="syz.2.1529" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f306718e929 code=0x0 [ 500.826516][ T5842] usb 6-1: Using ep0 maxpacket: 16 [ 500.841809][T10638] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1530'. [ 500.896795][ T5842] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 500.917455][ T5842] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 500.950041][T10640] netlink: 75 bytes leftover after parsing attributes in process `syz.3.1530'. [ 500.973767][ T5842] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 501.000582][ T5843] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 501.011991][ T5843] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 501.023304][ T5843] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 501.033145][ T5843] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 501.042777][ T5843] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 501.088901][ T5842] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 501.104466][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.131535][ T5842] usb 6-1: config 0 descriptor?? [ 501.587633][T10639] wg1 speed is unknown, defaulting to 1000 [ 501.605373][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.612669][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.665792][ T5842] HID 045e:07da: Invalid code 65791 type 1 [ 502.195748][ T5850] uclogic 0003:256C:006D.0030: failed retrieving string descriptor #100: -71 [ 502.226847][ T5842] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0031/input/input20 [ 502.371098][ T5850] uclogic 0003:256C:006D.0030: failed retrieving pen parameters: -71 [ 502.379253][ T5850] uclogic 0003:256C:006D.0030: failed probing pen v1 parameters: -71 [ 502.559206][ T5842] microsoft 0003:045E:07DA.0031: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 502.577703][ T5850] uclogic 0003:256C:006D.0030: failed probing parameters: -71 [ 502.659353][ T5850] uclogic 0003:256C:006D.0030: probe with driver uclogic failed with error -71 [ 502.719762][ T5842] usb 6-1: USB disconnect, device number 10 [ 502.831283][ T5850] usb 2-1: USB disconnect, device number 28 [ 503.055561][T10648] fido_id[10648]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 503.120989][ T5843] Bluetooth: hci2: command tx timeout [ 503.166403][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.249851][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.326171][ T5850] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 503.353693][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.491246][ T5850] usb 2-1: Using ep0 maxpacket: 32 [ 503.541765][ T5850] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 503.558864][T10669] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1538'. [ 503.569587][ T5850] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 503.592978][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.595462][ T5850] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 503.620340][ T5850] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.639556][ T5850] usb 2-1: config 0 descriptor?? [ 503.664055][ T5850] hub 2-1:0.0: USB hub found [ 503.810264][T10639] chnl_net:caif_netlink_parms(): no params data found [ 503.885970][ T5850] hub 2-1:0.0: 1 port detected [ 504.009997][T10680] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 504.465399][ T12] bridge_slave_1: left allmulticast mode [ 504.485283][ T12] bridge_slave_1: left promiscuous mode [ 504.504779][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 504.518221][ T5850] hub 2-1:0.0: activate --> -90 [ 504.527168][ T12] bridge_slave_0: left allmulticast mode [ 504.546069][ T12] bridge_slave_0: left promiscuous mode [ 504.552217][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.935041][ T5842] usb 2-1: USB disconnect, device number 29 [ 504.941462][ T5850] usb 2-1-port1: cannot disable (err = -71) [ 505.084796][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 505.096035][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 505.108846][ T12] bond0 (unregistering): Released all slaves [ 505.194332][ T12] : left promiscuous mode [ 505.205614][ T5843] Bluetooth: hci2: command tx timeout [ 505.231408][T10639] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.240931][T10639] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.248304][T10639] bridge_slave_0: entered allmulticast mode [ 505.263594][T10639] bridge_slave_0: entered promiscuous mode [ 505.288599][T10639] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.307854][T10639] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.341445][T10639] bridge_slave_1: entered allmulticast mode [ 505.349374][T10639] bridge_slave_1: entered promiscuous mode [ 505.394145][ T12] tipc: Disabling bearer [ 505.403837][ T12] tipc: Disabling bearer [ 505.428708][ T12] tipc: Left network mode [ 505.655171][T10639] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 506.313364][T10730] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 506.429422][T10639] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 506.701147][ T977] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 506.820348][T10639] team0: Port device team_slave_0 added [ 506.859320][T10639] team0: Port device team_slave_1 added [ 506.892681][ T977] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 506.923147][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 506.950582][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 506.982378][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.037319][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.056015][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.087516][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.102065][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.155376][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.200834][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.247948][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.280925][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.292768][ T5843] Bluetooth: hci2: command tx timeout [ 507.329767][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.351376][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.360854][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.382906][T10639] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 507.391857][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.410088][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.429373][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.438743][T10639] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 507.470736][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.481881][T10639] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 507.499862][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.531473][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.580742][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.618226][ T977] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 507.639745][ T977] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 507.642468][T10639] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 507.674582][ T977] usb 2-1: config 0 interface 0 has no altsetting 0 [ 507.691063][T10639] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 507.731914][ T977] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 507.746513][T10639] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 507.757932][ T977] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 507.766916][ T977] usb 2-1: Product: syz [ 507.788299][ T977] usb 2-1: Manufacturer: syz [ 507.808855][ T977] usb 2-1: SerialNumber: syz [ 507.826902][ T977] usb 2-1: config 0 descriptor?? [ 507.847117][ T977] yurex 2-1:0.0: USB YUREX device now attached to Yurex #0 [ 507.868092][ T12] hsr_slave_0: left promiscuous mode [ 507.905997][ T5842] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 507.931295][ T12] hsr_slave_1: left promiscuous mode [ 507.937532][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 507.956785][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 507.977525][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 507.987840][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.018317][ T12] veth1_macvtap: left promiscuous mode [ 508.024182][ T12] veth0_macvtap: left promiscuous mode [ 508.029997][ T12] veth1_vlan: left promiscuous mode [ 508.036461][ T12] veth0_vlan: left promiscuous mode [ 508.084301][ T5842] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 508.102314][ T5842] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 508.114790][ C0] usb 2-1: yurex_control_callback - control failed: -71 [ 508.133669][ T977] usb 2-1: USB disconnect, device number 30 [ 508.153013][ T977] yurex 2-1:0.0: USB YUREX #0 now disconnected [ 508.161322][ T5842] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 508.190879][ T5842] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 508.205450][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.241998][ T5842] usb 6-1: config 0 descriptor?? [ 508.703256][ T5842] plantronics 0003:047F:FFFF.0032: reserved main item tag 0xe [ 508.721583][ T5842] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 508.776806][ T5842] plantronics 0003:047F:FFFF.0032: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 508.872448][ T12] team0 (unregistering): Port device team_slave_1 removed [ 508.996329][ T980] usb 6-1: USB disconnect, device number 11 [ 509.083067][ T12] team0 (unregistering): Port device team_slave_0 removed [ 509.361192][ T5843] Bluetooth: hci2: command tx timeout [ 510.006962][T10791] loop2: detected capacity change from 0 to 7 [ 510.020511][ T5846] Dev loop2: unable to read RDB block 7 [ 510.033841][ T5846] loop2: unable to read partition table [ 510.039937][ T5846] loop2: partition table beyond EOD, truncated [ 510.057005][T10791] Dev loop2: unable to read RDB block 7 [ 510.068566][T10791] loop2: unable to read partition table [ 510.081003][T10791] loop2: partition table beyond EOD, truncated [ 510.087420][T10791] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 512.035638][T10639] hsr_slave_0: entered promiscuous mode [ 512.054613][T10639] hsr_slave_1: entered promiscuous mode [ 512.064694][T10639] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 512.077431][T10639] Cannot create hsr debugfs directory [ 512.158039][T10810] overlayfs: failed to decode file handle (len=5, type=251, flags=0, err=-22) [ 513.960153][T10839] tipc: Enabled bearer , priority 0 [ 514.036591][T10834] tipc: Disabling bearer [ 515.030929][T10872] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1588'. [ 515.035409][T10639] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 515.105104][T10639] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 515.229869][T10639] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 515.266282][T10639] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 516.490584][T10639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.513850][T10639] 8021q: adding VLAN 0 to HW filter on device team0 [ 516.527861][ T3028] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.535112][ T3028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 516.612933][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.620268][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 517.501307][T10937] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1606'. [ 517.697862][T10639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 518.658322][T10939] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1607'. [ 519.210257][ T977] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 519.383830][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 519.398448][ T977] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 519.415887][ T977] usb 6-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 519.427197][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.445048][ T977] usb 6-1: config 0 descriptor?? [ 519.512652][T10639] veth0_vlan: entered promiscuous mode [ 519.544939][T10639] veth1_vlan: entered promiscuous mode [ 519.648281][T10639] veth0_macvtap: entered promiscuous mode [ 519.670554][T10639] veth1_macvtap: entered promiscuous mode [ 519.755779][T10639] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 519.799352][T10639] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 519.829780][T10639] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.839413][T10639] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.874212][T10639] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.881189][ T977] usbhid 6-1:0.0: can't add hid device: -71 [ 519.895186][T10639] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.908092][ T977] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 519.950319][ T977] usb 6-1: USB disconnect, device number 12 [ 519.991678][ T1037] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 520.967984][ T977] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 521.195495][ T977] usb 4-1: Using ep0 maxpacket: 8 [ 521.218653][ T977] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.253653][ T1037] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.270817][ T977] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 521.280030][ T977] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 521.309850][ T1037] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.348079][ T977] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 521.383249][ T977] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 521.406344][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 521.427325][T11018] policy can only be matched on NF_INET_PRE_ROUTING [ 521.427347][T11018] unable to load match [ 521.446382][ T3028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.470946][ T977] hub 4-1:1.0: bad descriptor, ignoring hub [ 521.501253][ T977] hub 4-1:1.0: probe with driver hub failed with error -5 [ 521.510351][ T3028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.529763][ T977] cdc_wdm 4-1:1.0: skipping garbage [ 521.565151][ T977] cdc_wdm 4-1:1.0: skipping garbage [ 521.600222][ T977] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 521.609815][T11025] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1629'. [ 521.627906][ T977] cdc_wdm 4-1:1.0: Unknown control protocol [ 522.347084][T10996] usb 4-1: reset high-speed USB device number 22 using dummy_hcd [ 523.068387][T11050] wg1 speed is unknown, defaulting to 1000 [ 523.340916][ T5941] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 524.392099][ T980] usb 4-1: USB disconnect, device number 22 [ 524.410568][T11065] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1639'. [ 524.480804][ T5941] usb 2-1: Using ep0 maxpacket: 16 [ 524.710054][ T5941] usb 2-1: config 0 has no interfaces? [ 524.717325][ T5941] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 524.729124][ T5941] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 524.737437][ T5941] usb 2-1: Manufacturer: syz [ 524.745386][ T5941] usb 2-1: config 0 descriptor?? [ 525.147268][T11088] loop2: detected capacity change from 0 to 1 [ 525.174142][T11088] Dev loop2: unable to read RDB block 1 [ 525.179939][T11088] loop2: unable to read partition table [ 525.189911][T11088] loop2: partition table beyond EOD, truncated [ 525.272084][T11088] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 526.295539][T11095] loop2: detected capacity change from 0 to 7 [ 526.336999][T11095] Dev loop2: unable to read RDB block 7 [ 526.354163][T11095] loop2: AHDI p2 [ 526.370215][T11095] loop2: partition table partially beyond EOD, truncated [ 526.443937][ T5850] usb 2-1: USB disconnect, device number 31 [ 527.022662][T11113] xt_hashlimit: size too large, truncated to 1048576 [ 527.089299][T11114] : renamed from bridge_slave_0 (while UP) [ 527.930849][ T5941] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 528.101067][ T5941] usb 2-1: Using ep0 maxpacket: 16 [ 528.118823][ T5941] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 528.141602][ T5941] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 528.167051][ T5941] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 528.196870][ T5941] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 528.236625][ T5941] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.267948][ T5941] usb 2-1: Product: syz [ 528.282619][ T5941] usb 2-1: Manufacturer: syz [ 528.303957][T11143] serio: Serial port ptm0 [ 528.479599][ T5941] usb 2-1: SerialNumber: syz [ 529.312968][ T5941] usb 2-1: 2:1 : format type 0 is detected, processed as PCM [ 529.930883][ T980] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 530.123540][ T980] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 530.144814][ T980] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 530.177363][ T980] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.220810][ T980] usb 7-1: config 0 descriptor?? [ 530.328216][ T5941] usb 2-1: 2:1: cannot get freq at ep 0x82 [ 530.486514][ T5941] usb 2-1: USB disconnect, device number 32 [ 530.574770][ T6037] udevd[6037]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 530.665898][ T980] keytouch 0003:0926:3333.0033: fixing up Keytouch IEC report descriptor [ 530.709002][ T980] input: HID 0926:3333 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0926:3333.0033/input/input21 [ 530.859696][T11167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.890506][T11167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.921661][ T980] keytouch 0003:0926:3333.0033: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.6-1/input0 [ 532.151726][T11205] infiniband syz!: set active [ 532.177336][T11205] infiniband syz!: added team_slave_0 [ 532.212906][T11205] syz!: rxe_create_cq: returned err = -12 [ 532.219084][T11205] infiniband syz!: Couldn't create ib_mad CQ [ 532.265026][T11205] infiniband syz!: Couldn't open port 1 [ 532.436560][T11232] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1682'. [ 533.139584][T11234] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1683'. [ 533.173041][T11205] RDS/IB: syz!: added [ 533.177830][T11205] smc: adding ib device syz! with port count 1 [ 533.239352][ T5850] usb 7-1: USB disconnect, device number 2 [ 533.261696][T11205] smc: ib device syz! port 1 has pnetid [ 533.643588][ T980] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 533.841875][ T980] usb 2-1: Using ep0 maxpacket: 16 [ 533.868134][ T980] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 533.890753][ T980] usb 2-1: config 1 has no interface number 0 [ 533.919432][ T980] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 533.967343][ T980] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 533.988696][ T980] usb 2-1: config 1 interface 105 has no altsetting 0 [ 534.013517][ T980] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 534.093711][ T980] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.108141][ T980] usb 2-1: Product: syz [ 534.119064][ T980] usb 2-1: Manufacturer: syz [ 534.124130][ T980] usb 2-1: SerialNumber: syz [ 534.297417][T11266] tipc: Enabling of bearer rejected, already enabled [ 534.906948][T11244] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 534.917996][T11244] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 535.368286][T11244] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 535.391492][T11244] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 535.615717][T11283] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 535.816414][ T980] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 535.887733][ T980] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 535.985078][ T980] aqc111 2-1:1.105 eth9: register 'aqc111' at usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 20:fc:94:45:3a:41 [ 536.335224][ T980] usb 2-1: USB disconnect, device number 33 [ 536.357410][ T980] aqc111 2-1:1.105 eth9: unregister 'aqc111' usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 537.123876][ T980] aqc111 2-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 537.154891][ T980] aqc111 2-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 537.198648][ T980] aqc111 2-1:1.105 eth9 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 537.566278][T11322] kvm: emulating exchange as write [ 537.775656][T11332] wg1 speed is unknown, defaulting to 1000 [ 544.308382][T11457] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 545.337300][T11484] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1746'. [ 545.709806][T11491] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 546.880807][T11468] Bluetooth: hci5: command 0x0c1a tx timeout [ 548.066163][T11498] tipc: Enabling of bearer rejected, already enabled [ 548.351005][T11531] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1759'. [ 548.370783][T11531] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 548.378448][T11531] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 548.430181][T11531] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 548.439107][T11537] netlink: 'syz.1.1762': attribute type 6 has an invalid length. [ 548.450848][T11531] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 548.477518][T11537] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1762'. [ 549.350959][ T5920] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 549.552655][ T5920] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 549.587304][ T5920] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 549.625755][ T5920] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 549.669870][ T5920] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 549.705405][ T5920] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 549.731545][ T5920] usb 7-1: config 0 descriptor?? [ 549.957886][T11588] ptrace attach of "./syz-executor exec"[11589] was attempted by "./syz-executor exec"[11588] [ 550.168778][ T5920] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 550.230871][ T5920] plantronics 0003:047F:FFFF.0034: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 550.439073][ T5920] usb 7-1: USB disconnect, device number 3 [ 551.426346][ T1151] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 552.523673][T11609] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 552.743893][T11611] rdma_rxe: rxe_newlink: failed to add ipvlan1 [ 552.995675][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.030934][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.039848][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.052965][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.076255][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.086762][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.099499][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.110079][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.140875][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.167235][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1783'. [ 553.527624][T11642] overlayfs: failed to clone upperpath [ 553.632323][ T5842] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 553.660292][T11646] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 553.843138][ T5842] usb 4-1: Using ep0 maxpacket: 32 [ 554.262650][ T5842] usb 4-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 554.322583][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.370743][ T5842] usb 4-1: Product: syz [ 554.383579][ T5842] usb 4-1: Manufacturer: syz [ 554.410692][ T5842] usb 4-1: SerialNumber: syz [ 554.472161][ T5842] usb 4-1: config 0 descriptor?? [ 554.503616][ T5842] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 555.730000][T11670] overlayfs: failed to clone upperpath [ 556.271398][ T5842] gspca_topro: Sensor cx0342 [ 556.484352][ T5920] usb 4-1: USB disconnect, device number 23 [ 557.734287][T11719] input: syz0 as /devices/virtual/input/input22 [ 559.153533][T11750] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 559.196381][T11752] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 559.489251][T11760] __nla_validate_parse: 42 callbacks suppressed [ 559.489273][T11760] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1822'. [ 560.212695][T11785] tipc: Enabling of bearer rejected, already enabled [ 561.379050][T11799] netlink: 'syz.3.1834': attribute type 1 has an invalid length. [ 561.535894][T11799] 8021q: adding VLAN 0 to HW filter on device bond1 [ 561.864796][T11808] bond1: (slave gretap1): making interface the new active one [ 561.945837][T11808] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 562.023087][T11822] overlayfs: failed to clone upperpath [ 562.289199][T11829] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1841'. [ 562.483191][ T5941] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 562.680711][ T5941] usb 2-1: Using ep0 maxpacket: 8 [ 563.120824][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.127312][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.224005][T11846] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 563.304781][ T5941] usb 2-1: unable to get BOS descriptor or descriptor too short [ 563.354232][ T5941] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 563.380151][ T5941] usb 2-1: can't read configurations, error -71 [ 563.412413][T11848] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1846'. [ 563.606481][T11858] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1850'. [ 563.890797][ T5850] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 563.947403][T11876] netlink: 'syz.2.1859': attribute type 4 has an invalid length. [ 563.962081][T11876] netlink: 'syz.2.1859': attribute type 4 has an invalid length. [ 564.061719][ T5850] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 564.082227][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.096118][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.118660][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.130272][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.140282][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.154988][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.163473][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.174229][T11886] overlayfs: failed to clone upperpath [ 564.176623][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.194097][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.202381][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.215429][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.227823][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.239519][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.263696][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.284946][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.299761][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.319114][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.366177][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.389192][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.415546][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.429723][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.439527][ T5850] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 564.458371][ T5850] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 564.480037][ T5850] usb 7-1: config 0 interface 0 has no altsetting 0 [ 564.497647][ T5850] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 564.508458][ T5850] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 564.535633][ T5850] usb 7-1: Product: syz [ 564.548809][ T5850] usb 7-1: Manufacturer: syz [ 564.571014][ T5850] usb 7-1: SerialNumber: syz [ 564.595414][ T5850] usb 7-1: config 0 descriptor?? [ 564.649736][ T5850] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 564.925571][T11902] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1868'. [ 564.985643][T11910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.029477][T11910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.081799][ C0] usb 7-1: yurex_control_callback - control failed: -71 [ 565.084224][ T5941] usb 7-1: USB disconnect, device number 4 [ 565.122991][ T5941] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 566.127914][T11946] fuse: root generation should be zero [ 567.670760][ T5850] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 567.850929][ T5850] usb 2-1: Using ep0 maxpacket: 32 [ 567.884092][ T5850] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 567.917722][ T5850] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 567.946226][ T5850] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 567.974681][ T5850] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 568.007235][ T5850] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.049918][ T5850] usb 2-1: config 0 descriptor?? [ 568.082040][ T5850] hub 2-1:0.0: USB hub found [ 568.685861][T12001] tipc: Enabling of bearer rejected, already enabled [ 569.130318][ T5850] hub 2-1:0.0: 2 ports detected [ 570.529132][T12031] syz.3.1901: attempt to access beyond end of device [ 570.529132][T12031] loop3: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 570.542360][T12031] hfsplus: unable to find HFS+ superblock [ 570.548428][ T5850] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 570.615746][ T977] hub 2-1:0.0: activate --> -90 [ 570.817631][ T10] usb 2-1: USB disconnect, device number 36 [ 570.823824][ T977] usb 2-1: Failed to suspend device, error -19 [ 570.884634][ T5850] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 571.012784][T12036] tipc: Enabling of bearer rejected, already enabled [ 571.630997][ T5850] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.670973][ T5850] usb 6-1: config 0 descriptor?? [ 571.765001][T12039] netlink: 'syz.2.1903': attribute type 1 has an invalid length. [ 571.832298][T12039] 8021q: adding VLAN 0 to HW filter on device bond1 [ 572.036628][T12045] bond1: (slave veth3): Enslaving as an active interface with a down link [ 572.572847][T12039] bond1: (slave dummy0): making interface the new active one [ 572.688722][T12039] dummy0: entered promiscuous mode [ 572.701314][T12039] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 573.028156][T12065] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1911'. [ 573.715670][T12080] tipc: Started in network mode [ 573.720680][T12080] tipc: Node identity ac14140f, cluster identity 4711 [ 573.727827][T12080] tipc: New replicast peer: 255.255.255.255 [ 573.735893][T12080] tipc: Enabled bearer , priority 10 [ 575.028036][ T5850] usb 6-1: Cannot set autoneg [ 575.033207][ T977] tipc: Node number set to 2886997007 [ 575.041428][ T5850] MOSCHIP usb-ethernet driver 6-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 575.477454][ T5850] usb 6-1: USB disconnect, device number 13 [ 575.793869][T12091] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1919'. [ 575.931617][T12091] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1919'. [ 575.947476][T12098] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1922'. [ 575.990285][T12096] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 576.146176][T12101] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1924'. [ 576.256910][T12106] syz.1.1926: attempt to access beyond end of device [ 576.256910][T12106] loop1: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 576.270732][T12106] hfsplus: unable to find HFS+ superblock [ 577.762381][T12125] tipc: Enabling of bearer rejected, already enabled [ 579.595849][T12152] netlink: 'syz.1.1938': attribute type 1 has an invalid length. [ 579.619534][T12152] netlink: 136 bytes leftover after parsing attributes in process `syz.1.1938'. [ 579.652140][T12152] netlink: 'syz.1.1938': attribute type 2 has an invalid length. [ 579.681727][T12152] netlink: 'syz.1.1938': attribute type 1 has an invalid length. [ 579.721120][ T977] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 579.915801][ T977] usb 4-1: Using ep0 maxpacket: 32 [ 579.937425][ T977] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 579.960822][ T977] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 579.989537][ T977] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 580.004301][ T977] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 580.052636][ T977] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 580.087379][ T977] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 580.115208][ T977] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 580.134677][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.155963][T12163] syz.1.1942: attempt to access beyond end of device [ 580.155963][T12163] loop1: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 580.169292][T12163] hfsplus: unable to find HFS+ superblock [ 580.212595][ T977] usb 4-1: config 0 descriptor?? [ 580.443457][ T977] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 24 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 580.615847][ T977] usb 4-1: USB disconnect, device number 24 [ 580.628372][ T977] usblp0: removed [ 580.831055][T12172] tipc: Enabling of bearer rejected, already enabled [ 582.275629][T12179] overlayfs: upper fs does not support file handles, falling back to index=off. [ 582.330780][ T977] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 582.500848][ T977] usb 4-1: Using ep0 maxpacket: 32 [ 582.526819][T12187] netlink: 'syz.5.1950': attribute type 10 has an invalid length. [ 582.537777][ T977] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 582.555953][ T2990] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 582.566521][ T977] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 582.607926][T12187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 582.620593][ T977] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 582.654525][T12187] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 582.678746][ T977] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 582.715295][ T977] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 582.733606][T12190] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 582.757093][ T977] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 582.771467][T12190] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 582.790474][T12190] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 582.810044][ T977] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 582.836204][T12190] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 582.845143][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.871846][ T977] usb 4-1: config 0 descriptor?? [ 582.903661][ T977] usb 4-1: can't set config #0, error -71 [ 582.935733][ T977] usb 4-1: USB disconnect, device number 25 [ 582.978468][T12190] bond0: (slave batadv0): Releasing backup interface [ 583.079101][T12199] wg1 speed is unknown, defaulting to 1000 [ 584.111228][T12234] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1965'. [ 584.174277][T12236] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1965'. [ 589.093672][ T1151] dummy0: left promiscuous mode [ 589.113905][ C0] Unknown status report in ack skb [ 589.680869][ T5941] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 589.842447][ T5941] usb 6-1: Using ep0 maxpacket: 32 [ 589.851997][ T5941] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 589.866404][ T5941] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 97, changing to 10 [ 589.898363][ T5941] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 24929, setting to 1024 [ 589.928281][ T5941] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 589.954993][ T5941] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 589.987313][ T5941] usb 6-1: config 0 descriptor?? [ 590.002475][ T5941] hub 6-1:0.0: USB hub found [ 590.203489][ T5941] hub 6-1:0.0: 2 ports detected [ 590.291206][ T980] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 590.481287][ T980] usb 4-1: Using ep0 maxpacket: 16 [ 590.492607][ T980] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 590.507141][ T980] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 590.555089][ T980] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 590.565757][ T980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.576898][T12322] netlink: 60 bytes leftover after parsing attributes in process `syz.6.1994'. [ 590.577899][ T980] usb 4-1: Product: syz [ 590.591720][ T980] usb 4-1: Manufacturer: syz [ 590.596606][ T980] usb 4-1: SerialNumber: syz [ 590.639978][ T980] usb 4-1: config 0 descriptor?? [ 590.666483][ T980] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 590.676035][ T980] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 590.935701][T12326] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1996'. [ 591.264073][ T980] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 591.273549][ T980] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 591.382027][T12332] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1999'. [ 591.655130][ T5850] usb 6-1: USB disconnect, device number 14 [ 591.691014][ T30] audit: type=1800 audit(1752507604.393:511): pid=12337 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.2001" name="/" dev="9p" ino=2 res=0 errno=0 [ 591.899611][ T30] audit: type=1326 audit(1752507604.603:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12342 comm="syz.1.2003" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4f7a98e929 code=0x0 [ 591.933007][ T980] em28xx 4-1:0.0: AC97 command still being executed: not handled properly! [ 591.944355][ T980] em28xx 4-1:0.0: Unknown AC97 audio processor detected! [ 592.089500][ T980] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 592.105694][ T980] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 592.121765][ T980] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 592.138821][ T980] em28xx 4-1:0.0: couldn't setup AC97 register 54 [ 592.157410][ T980] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 592.200413][ T980] usb 4-1: USB disconnect, device number 26 [ 592.725759][ T2990] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.884070][ T2990] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.072395][ T2990] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.444563][ T2990] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.804781][T12388] syz.1.2022: attempt to access beyond end of device [ 593.804781][T12388] loop1: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 593.818525][T12388] hfsplus: unable to find HFS+ superblock [ 594.011535][ T5920] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 594.059979][ T2990] bridge_slave_1: left allmulticast mode [ 594.087461][T11468] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 594.098223][T11468] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 594.107321][T11468] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 594.123677][ T2990] bridge_slave_1: left promiscuous mode [ 594.130268][T11468] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 594.138189][T11468] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 594.179806][ T2990] bridge0: port 2(bridge_slave_1) entered disabled state [ 594.194236][ T2990] bridge_slave_0: left allmulticast mode [ 594.199954][ T2990] bridge_slave_0: left promiscuous mode [ 594.206329][ T2990] bridge0: port 1(bridge_slave_0) entered disabled state [ 594.230673][ T5920] usb 4-1: Using ep0 maxpacket: 32 [ 594.256918][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 594.321221][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 594.379487][ T5920] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 594.409267][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.466443][ T5920] usb 4-1: config 0 descriptor?? [ 594.727621][T12403] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2027'. [ 594.997932][T12409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2027'. [ 595.057517][ T5920] savu 0003:1E7D:2D5A.0035: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 595.193495][ T5920] usb 4-1: USB disconnect, device number 27 [ 595.555192][T12413] fido_id[12413]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 595.794869][ T2990] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 595.818546][ T2990] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 595.831464][ T2990] bond0 (unregistering): Released all slaves [ 595.942889][ T2990] tipc: Disabling bearer [ 595.948333][ T2990] tipc: Left network mode [ 595.998422][T12420] syzkaller0: entered promiscuous mode [ 596.008113][T12420] syzkaller0: entered allmulticast mode [ 596.147783][T12393] wg1 speed is unknown, defaulting to 1000 [ 596.240934][ T5857] Bluetooth: hci2: command tx timeout [ 596.490799][T12435] kvm: pic: non byte read [ 596.495762][T12435] kvm: pic: level sensitive irq not supported [ 596.495871][T12435] kvm: pic: non byte read [ 596.541101][T12435] kvm: pic: level sensitive irq not supported [ 596.541176][T12435] kvm: pic: non byte read [ 596.761122][T12435] kvm: pic: level sensitive irq not supported [ 596.761181][T12435] kvm: pic: non byte read [ 597.074827][ T30] audit: type=1326 audit(1752507609.783:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12446 comm="syz.5.2039" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f330018e929 code=0x0 [ 597.295700][T12457] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2041'. [ 597.984689][ T2990] hsr_slave_0: left promiscuous mode [ 597.993194][ T2990] hsr_slave_1: left promiscuous mode [ 598.003280][ T2990] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 598.020338][ T2990] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 598.088176][ T2990] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 598.106865][ T2990] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 598.213735][ T2990] veth1_macvtap: left promiscuous mode [ 598.235806][ T2990] veth0_macvtap: left promiscuous mode [ 598.249691][ T2990] veth1_vlan: left promiscuous mode [ 598.263062][ T2990] veth0_vlan: left promiscuous mode [ 598.320887][ T5857] Bluetooth: hci2: command tx timeout [ 599.493935][T12494] binder: 12493:12494 ioctl c0306201 2000000003c0 returned -14 [ 599.816919][ T2990] team0 (unregistering): Port device team_slave_1 removed [ 600.045252][ T2990] team0 (unregistering): Port device team_slave_0 removed [ 600.310972][T12510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 600.401198][ T5857] Bluetooth: hci2: command tx timeout [ 601.318773][T12470] wg1 speed is unknown, defaulting to 1000 [ 601.548392][T12520] syzkaller0: entered promiscuous mode [ 601.578091][T12520] syzkaller0: entered allmulticast mode [ 601.626668][T12393] chnl_net:caif_netlink_parms(): no params data found [ 602.018379][T12533] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2060'. [ 602.508102][ T5857] Bluetooth: hci2: command tx timeout [ 605.059724][T12393] bridge0: port 1(bridge_slave_0) entered blocking state [ 605.087967][T12393] bridge0: port 1(bridge_slave_0) entered disabled state [ 605.109835][T12393] bridge_slave_0: entered allmulticast mode [ 605.133218][T12393] bridge_slave_0: entered promiscuous mode [ 605.209545][T12393] bridge0: port 2(bridge_slave_1) entered blocking state [ 605.218697][T12393] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.228759][T12393] bridge_slave_1: entered allmulticast mode [ 605.271122][T12393] bridge_slave_1: entered promiscuous mode [ 605.639270][T12393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 605.711706][T12393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 605.913335][T12393] team0: Port device team_slave_0 added [ 605.938047][T12393] team0: Port device team_slave_1 added [ 606.061254][T12393] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 606.068278][T12393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 606.108767][T12393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 606.126704][T12393] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 606.173850][T12393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 606.204849][T12393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 606.227849][ T5941] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 606.362335][T12393] hsr_slave_0: entered promiscuous mode [ 606.381402][T12393] hsr_slave_1: entered promiscuous mode [ 606.387524][T12393] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 606.411364][T12393] Cannot create hsr debugfs directory [ 606.429395][ T5941] usb 4-1: Using ep0 maxpacket: 16 [ 606.436827][ T5941] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 606.445665][ T5941] usb 4-1: config 1 has no interface number 0 [ 606.458673][ T5941] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 606.489327][ T5941] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 606.509147][ T5941] usb 4-1: config 1 interface 105 has no altsetting 0 [ 606.539261][T12609] overlayfs: failed to clone upperpath [ 606.619764][ T5941] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 606.635642][ T5941] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.724571][ T5941] usb 4-1: Product: syz [ 606.728873][ T5941] usb 4-1: Manufacturer: syz [ 606.782751][ T5941] usb 4-1: SerialNumber: syz [ 606.858031][T12595] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 606.881002][T12595] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 607.386492][T12595] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 607.397379][T12595] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 608.020324][T12393] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 608.043484][T12393] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 608.057692][T12393] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 608.089060][T12393] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 608.259824][ T5941] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 608.278102][T12393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 608.296184][ T5941] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 608.333349][ T30] audit: type=1800 audit(1752507621.043:514): pid=12644 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.2083" name="file1" dev="tmpfs" ino=2648 res=0 errno=0 [ 608.336507][T12393] 8021q: adding VLAN 0 to HW filter on device team0 [ 608.395778][ T5941] aqc111 4-1:1.105 eth13: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 0a:8b:f4:3a:ad:39 [ 608.431924][ T2990] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.439262][ T2990] bridge0: port 1(bridge_slave_0) entered forwarding state [ 608.452900][ T5941] usb 4-1: USB disconnect, device number 28 [ 608.461990][ T2990] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.469219][ T2990] bridge0: port 2(bridge_slave_1) entered forwarding state [ 608.503262][ T5941] aqc111 4-1:1.105 eth13: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 608.644529][ T5941] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 608.682479][ T5941] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 608.729696][ T5941] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 609.140707][ T5857] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 609.838555][T12393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 611.045246][T12707] overlayfs: failed to clone upperpath [ 611.160753][ T5850] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 611.317069][T12393] veth0_vlan: entered promiscuous mode [ 611.341887][ T5850] usb 4-1: Using ep0 maxpacket: 8 [ 611.358683][T12393] veth1_vlan: entered promiscuous mode [ 611.371740][ T5850] usb 4-1: unable to get BOS descriptor or descriptor too short [ 611.372838][T12714] input: syz0 as /devices/virtual/input/input24 [ 611.409163][ T5850] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 113, changing to 10 [ 611.462288][ T5850] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 611.522039][ T5850] usb 4-1: config 1 interface 0 has no altsetting 0 [ 611.539212][T12393] veth0_macvtap: entered promiscuous mode [ 611.571895][ T5850] usb 4-1: New USB device found, idVendor=05ac, idProduct=0237, bcdDevice= 0.40 [ 611.591700][ T5850] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.599769][ T5850] usb 4-1: Product: syz [ 611.618563][T12393] veth1_macvtap: entered promiscuous mode [ 611.648743][ T5850] usb 4-1: Manufacturer: syz [ 611.677049][ T5850] usb 4-1: SerialNumber: syz [ 611.700836][T12722] overlayfs: statfs failed on './file0' [ 611.717817][T12703] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 611.732012][T12393] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 611.778246][T12393] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 611.854666][T12393] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 611.899012][T12393] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 611.952878][T12393] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 611.978195][T12393] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.487430][T12736] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2103'. [ 613.046862][ T6052] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 613.114057][ T6052] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 613.274209][ T6052] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 613.313886][ T6052] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 613.580812][ T6183] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 613.763026][ T6183] ------------[ cut here ]------------ [ 613.828825][ T6183] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1223:5 [ 613.968934][ T6183] index 11 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') [ 613.985469][ T6183] CPU: 0 UID: 0 PID: 6183 Comm: kworker/u8:11 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full) [ 613.985496][ T6183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 613.985509][ T6183] Workqueue: events_unbound cfg80211_wiphy_work [ 613.985550][ T6183] Call Trace: [ 613.985561][ T6183] [ 613.985571][ T6183] dump_stack_lvl+0x189/0x250 [ 613.985600][ T6183] ? __pfx_dump_stack_lvl+0x10/0x10 [ 613.985624][ T6183] ? __pfx__printk+0x10/0x10 [ 613.985665][ T6183] ubsan_epilogue+0xa/0x40 [ 613.985692][ T6183] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 613.985721][ T6183] ieee80211_request_ibss_scan+0x600/0x8b0 [ 613.985769][ T6183] ieee80211_ibss_work+0xd85/0x1060 [ 613.985799][ T6183] ? lockdep_hardirqs_on+0x9c/0x150 [ 613.985831][ T6183] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 613.985860][ T6183] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 613.985887][ T6183] ? kcov_remote_stop+0x17e/0x6d0 [ 613.985916][ T6183] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 613.985951][ T6183] ? skb_dequeue+0x10e/0x150 [ 613.985968][ T6183] ? ieee80211_iface_work+0xcd4/0xfe0 [ 613.986003][ T6183] ? ieee80211_iface_work+0xf39/0xfe0 [ 613.986047][ T6183] cfg80211_wiphy_work+0x2df/0x460 [ 613.986079][ T6183] ? process_scheduled_works+0x9ef/0x17b0 [ 613.986104][ T6183] process_scheduled_works+0xade/0x17b0 [ 613.986160][ T6183] ? __pfx_process_scheduled_works+0x10/0x10 [ 613.986203][ T6183] worker_thread+0x8a0/0xda0 [ 613.986257][ T6183] kthread+0x711/0x8a0 [ 613.986289][ T6183] ? __pfx_worker_thread+0x10/0x10 [ 613.986309][ T6183] ? __pfx_kthread+0x10/0x10 [ 613.986337][ T6183] ? _raw_spin_unlock_irq+0x23/0x50 [ 613.986366][ T6183] ? lockdep_hardirqs_on+0x9c/0x150 [ 613.986393][ T6183] ? __pfx_kthread+0x10/0x10 [ 613.986421][ T6183] ret_from_fork+0x3fc/0x770 [ 613.986445][ T6183] ? __pfx_ret_from_fork+0x10/0x10 [ 613.986473][ T6183] ? __switch_to_asm+0x39/0x70 [ 613.986497][ T6183] ? __switch_to_asm+0x33/0x70 [ 613.986520][ T6183] ? __pfx_kthread+0x10/0x10 [ 613.986547][ T6183] ret_from_fork_asm+0x1a/0x30 [ 613.986592][ T6183] [ 613.989744][ T6183] ---[ end trace ]--- [ 614.234577][ T5850] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input25 [ 614.366126][ T5192] bcm5974 4-1:1.0: could not read from device [ 614.424796][ T5850] usb 4-1: USB disconnect, device number 29 [ 614.440477][ T5192] bcm5974 4-1:1.0: could not read from device [ 614.449096][ T5192] bcm5974 4-1:1.0: could not read from device [ 614.619579][ T9696] udevd[9696]: Error opening device "/dev/input/event4": No such file or directory [ 614.659809][ T9696] udevd[9696]: Unable to EVIOCGABS device "/dev/input/event4" [ 614.679833][ T6183] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 614.687105][ T6183] CPU: 0 UID: 0 PID: 6183 Comm: kworker/u8:11 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full) [ 614.697647][ T6183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 614.707760][ T6183] Workqueue: events_unbound cfg80211_wiphy_work [ 614.714068][ T6183] Call Trace: [ 614.717390][ T6183] [ 614.720361][ T6183] dump_stack_lvl+0x99/0x250 [ 614.725005][ T6183] ? __asan_memcpy+0x40/0x70 [ 614.729645][ T6183] ? __pfx_dump_stack_lvl+0x10/0x10 [ 614.734890][ T6183] ? __pfx__printk+0x10/0x10 [ 614.739546][ T6183] panic+0x2db/0x790 [ 614.743495][ T6183] ? __pfx_panic+0x10/0x10 [ 614.747953][ T6183] ? _printk+0xcf/0x120 [ 614.752163][ T6183] ? __pfx__printk+0x10/0x10 [ 614.756808][ T6183] check_panic_on_warn+0x89/0xb0 [ 614.761790][ T6183] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 614.767563][ T6183] ieee80211_request_ibss_scan+0x600/0x8b0 [ 614.773440][ T6183] ieee80211_ibss_work+0xd85/0x1060 [ 614.778690][ T6183] ? lockdep_hardirqs_on+0x9c/0x150 [ 614.783953][ T6183] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 614.789897][ T6183] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 614.796271][ T6183] ? kcov_remote_stop+0x17e/0x6d0 [ 614.801346][ T6183] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 614.807032][ T6183] ? skb_dequeue+0x10e/0x150 [ 614.811661][ T6183] ? ieee80211_iface_work+0xcd4/0xfe0 [ 614.817100][ T6183] ? ieee80211_iface_work+0xf39/0xfe0 [ 614.822540][ T6183] cfg80211_wiphy_work+0x2df/0x460 [ 614.827698][ T6183] ? process_scheduled_works+0x9ef/0x17b0 [ 614.833478][ T6183] process_scheduled_works+0xade/0x17b0 [ 614.839106][ T6183] ? __pfx_process_scheduled_works+0x10/0x10 [ 614.845150][ T6183] worker_thread+0x8a0/0xda0 [ 614.849815][ T6183] kthread+0x711/0x8a0 [ 614.853933][ T6183] ? __pfx_worker_thread+0x10/0x10 [ 614.859091][ T6183] ? __pfx_kthread+0x10/0x10 [ 614.863739][ T6183] ? _raw_spin_unlock_irq+0x23/0x50 [ 614.868999][ T6183] ? lockdep_hardirqs_on+0x9c/0x150 [ 614.874541][ T6183] ? __pfx_kthread+0x10/0x10 [ 614.879175][ T6183] ret_from_fork+0x3fc/0x770 [ 614.883821][ T6183] ? __pfx_ret_from_fork+0x10/0x10 [ 614.888995][ T6183] ? __switch_to_asm+0x39/0x70 [ 614.893804][ T6183] ? __switch_to_asm+0x33/0x70 [ 614.898625][ T6183] ? __pfx_kthread+0x10/0x10 [ 614.903279][ T6183] ret_from_fork_asm+0x1a/0x30 [ 614.908111][ T6183] [ 614.911518][ T6183] Kernel Offset: disabled [ 614.915933][ T6183] Rebooting in 86400 seconds..