last executing test programs: 3.124082966s ago: executing program 3 (id=294): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r2, 0xc0145b0e, &(0x7f0000000040)={0x100000, 0x0, 0x0, 0x0, 0x3}) ioctl$HIDIOCGUSAGE(r1, 0xc0105b08, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 2.424870578s ago: executing program 3 (id=307): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x64a, &(0x7f0000000040)={0x0, 0x8835c, 0xc000, 0x20000a, 0x33c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x400, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xf}, {0xe, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20000010) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) close(0x4) 1.881937727s ago: executing program 4 (id=323): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) r0 = getpid() syz_pidfd_open(r0, 0x0) 1.881762028s ago: executing program 4 (id=324): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) statfs(&(0x7f0000000040)='./file0\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.803983627s ago: executing program 3 (id=325): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) 1.781448737s ago: executing program 3 (id=327): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='raid5', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='4', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='409', 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='1:0', 0x3) write(r4, &(0x7f00000004c0)='1:', 0x2) write(r4, &(0x7f0000000540)='1:3', 0x3) 1.557800665s ago: executing program 0 (id=338): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r1, &(0x7f00000015c0)=""/4059, 0xfdb, 0x17, 0x0, 0x0) writev(r1, &(0x7f0000001540)=[{&(0x7f0000000140)="58ddb007", 0x4}], 0x1) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) close_range(r0, 0xffffffffffffffff, 0x0) 1.380863759s ago: executing program 0 (id=339): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) setsockopt(0xffffffffffffffff, 0x1, 0x10000000000009, &(0x7f0000000040)="0118269db93bda7b297893dbebf7e87c", 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) openat$random(0xffffffffffffff9c, 0x0, 0x8000, 0x0) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 1.380571946s ago: executing program 0 (id=341): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wlan0\x00'}) r0 = syz_open_dev$I2C(&(0x7f0000000480), 0x0, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000180)={&(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x2, &(0x7f0000000880)="d40b"}], 0x2a}) 1.320025316s ago: executing program 0 (id=342): socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x9, 0x4c032, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10, &(0x7f0000000000), 0x1, 0x4ec, &(0x7f0000000640)="$eJzs3c9rG9kdAPDvyHZqJ07ttD2kgSamtCShiWTHTWJ6SFIo7SnQNr27ri0bY9kylpzEJhSHnkuhlLa0l/bUS6F/QKHkTyiFQPewt7Asu4TdJHvYQ3a1SBolXq9kO0Q/svbnA8/z5s1ovt8noZHezFgTwKE1FhE3IqIvIs5HxEjanklLbNVLdb2nT+7NVksSlcqtD5JI0rbGtpJ0eix92GBE/PwnEb9KknrDNqWNzaWZQiG/ls7nysurudLG5sXF5ZmF/EJ+ZXJy4srU1anLU+Nt6+u1H737x9/948fX/nPhzqPp98/9uprvcLpsez/aqf6cXHh7e1t/RKx1IlgPDexjnaQLeQAAsLvqd/yvRcS3I+LZX3qdDQAAANAJlevD8TyJqAAAAAAHVqZ2DWySyabXAgxHJpPN1q/h/UZcj0KxVP7efHF9Za5+rexoDGTmFwv58fRa4dEYSKrzE7X6y/lLO+YnI+JERPxhZKg2n50tFuZ6ffADAAAADonqOH84U69XJx+N1Mf/AAAAwAEz2usEAAAAgI4z/gcAAICD74vj/7H6JOnvfjIAAABAu/305s1qqTTufz13e2N9qXj74ly+tJRdXp/NzhbXVrMLxeJC7Tf7lvfaXqFYXP1+rKzfzZXzpXKutLE5vVxcXylP1+7rPZ3fz32iAQAAgPY6cebBW0lEbP1gqFaqjqTLjNXhYMu82upJp/IAuq+v1wkAPeMCXzi8jPGBvQb2g13KAwAA6Jyz33xx/n8otp3/P/7IsQE46F7x/D9wgDj/D4fXjvP/f+tVHkD3GeMDex0HaHn+/7/tzwUAAOiM4VpJMtl0DDCUth+v3RZgIJlfLOTHI+KrEfH/kYGvVOcnepwzAAAAAAAAAAAAAAAAAAAAAAAAAHzZVCpJVAAAAIADLSLzXhIRSQxGjHxneOfxgSPJxyO1aUTc+eutP92dKZfXJqrtH75oL/85bb/U/BiDe4wDAABAdzXG6Y1xPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC009Mn92YbpZtxH/8wIkabxe+Pwdp0MAYi4uizJPq3PS6JiL42xN+6HxEnm8VPqmnFaJrFzviZiBjqcfxjbYgPh9mD6v7nRrP3XybGatPm77/+tLyux2Ot9n+ZF/u/vhb7v+N7bPtIOj318F+5lvHvR5zqb77/acRPXnP/+8tfbG62Wlb5e8TZpp8/yedi5crLq7nSxubFxeWZhfxCfmVycuLK1NWpy1PjufnFQj792zTG77/170936//RFvFHW/U/qedUqTTf5pkd8588vPvk681WTCIe/zatN3n9T7aKnz73300/B6rLzzbqW/X6dqf/+b/Tu/V/rkX/93r9z7Xa6A7nf/abd+q1gX0+AgDopNLG5tJMoZBfeyMrzyv7XrnamTci57ZVxt6MNFQOZ6XXeyYAAKDdXn7p73UmAAAAAAAAAAAAAAAAAAAAcHg1/v+/8VvOnfg5se3xBhuVJOl6XwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdvNZAAAA///GoNMV") r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000040)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r0, @ANYBLOB="05", @ANYRES16=r0], 0x0) 1.190644086s ago: executing program 2 (id=345): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r1, &(0x7f0000000400)='PASV\r\n', 0x6) r2 = accept4(r0, 0x0, 0x0, 0x0) write(r2, &(0x7f0000000500)='227 Entering Passive Mode (127,0,0,1,1', 0x26) 1.13577526s ago: executing program 1 (id=347): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x2040, 0x0) ioctl$TCSETSF(r0, 0x5457, &(0x7f0000000000)={0x0, 0x629, 0xffffffff, 0x0, 0x7, "7a58bea88a00"}) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000040)={0x0, 0x5180, 0x5, 0x3ff, 0xb, "6c4b4b0986fbfe53e923b45c545ac95ca5085c"}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_open_dev$vbi(&(0x7f00000005c0), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f00000007c0)) r3 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$sock_buf(r3, 0x1, 0x1c, 0x0, &(0x7f00000001c0)) bind$bt_hci(r1, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000380), 0xfe, 0x571, &(0x7f0000001180)="$eJzs3c1rHOUfAPDvbF76kvbXFEr56UECPVip3TSJLxU81KNosaD3uiTTULLplOymNLFge7AXL1IEEQviH+DdY/Ef8K8oaKFoCXrwEpnNbLpNdvO6Nan7+cBunmdmdp95dub75Pvs7LIB9KyR/K4U8VJEfJVEHGtZ1x/FypGV7Zae3JrMb0ksL3/8exJJsay5fVL8HSoq/4+In7+IOFNa325tYXGmUq2mc0V9tD57fbS2sHj26mxlOp1Or41PTJx/c2L8nbff6lpfX7v017cfPXj//Jenlr758dHxe0lciCPFutZ+7MLt1spIjBSvyUBcWLPhWBca20+Svd4BdqSviPOByMeAY9FXRD3w3/d5RCwDPSoR/9CjmnlAc27fpXnwC+PxeysToPX97195byQONuZGh5eSZ2ZG+Xx3uAvt52389Nv9e/ktuvc+BMCmbt+JiHP9/evHv6QY/3bu3Ba2WdvGNse/5W3uEtDiQZ7/vN4u/8mKLQ427tfmP0NtYncnNo//0qMuNNNRnv+92zb/Xb1oNdxX1I42cr6B5MrVapqPbf+LiNMxcCCvb3Q95/zSw47j1NP8b7CRA+btN3PBYj8e9R949jFTlXplN31u9fhOxMtt899kNf9N2hz//PW4tMU2Tqb3X+m0rjX/bd//52v5h4hXi+N/+5k50dMrWsnG1ydHG+fDaPOsWO/Puyd/6dR+5/4ffQ69XS8//ofbnv+r/R9OWq/X1rbfxvcH/047rdv8+Lc//weTTxrlwWLZzUq9PjcWMZh8uH75+NPHNuvN7fP+nz7VPv43Ov8PRcSnW+z/3RN3O2661+d/3v+pbR3/7RcefvDZd53a39rxf6NROl0s2cr4t9Ud3M1rBwAAAAAAAPtNKSKORFIqr5ZLpXJ55fMdJ+JwqZrV6meuZPPXpqLxXdnhGCg1r3QPtXweYqz4PGyzPr6mPhERxyPi675DjXp5MqtO7XXnAQAAAAAAAAAAAAAAAAAAYJ8Y6vD9/9yvfXu9d8Bz5ye/oXdtGv/d+KUnYF/y/x96l/iH3iX+oXeJf+hd4h96l/iH3iX+oXeJfwAAAAAAAAAAAAAAAAAAAAAAAAAAAOiqSxcv5rflpSe3JvP61I2F+ZnsxtmptDZTnp2fLE9mc9fL01k2XU3Lk9nshk+W/BHVLLs+Nh7zN0fraa0+WltYvDybzV+rX746W5lOL6cD/1bHAAAAAAAAAAAAAAAAAAAA4AVSW1icqVSr6ZyCwo4K/ftjNxRWCs3A3vUT7u24BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACt/gkAAP//ys442g==") ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0x8004587d, &(0x7f0000000080)={@desc={0x1, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) socket$nl_netfilter(0x10, 0x3, 0xc) 1.13205095s ago: executing program 3 (id=348): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x8003, 0xbffc, 0x0, 0x5, 0x134, 0x48, 0x2}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0xffff, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x5, 0x26, 0xffffffb9, 0x1a}, 0x9c) 1.099830919s ago: executing program 1 (id=349): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x2000018, &(0x7f0000000540), 0x1, 0x7cc, &(0x7f00000022c0)="$eJzs3ctrW1caAPDvyvJjnGTsgYFJZmUYmDGEyOOMJ5mBLlK6KIUGAu26iZEVk1q2giWH2BjSUArdFNrQRaHdZJ226a7bPrbtv9BuSikJaeuEJnRRXK4esRxLjpzYchP/fnCtc+7D53z3ce6R7kEKYM8aSf9kIg5FxNtJxFB9fhIRvdVUNuJEbb27K8v5dEpidfWln5LqOndWlvPRtE0MDsa+euZgRHzxRsThzMZyy4tLM5PFYmG+nh+rzJ4fKy8uHTk3OzldmC7MHRufmDh6/L/H+7cv1l++Xtp/853n//XxiV9f/9v1t75M4kTsry9rjmO7jMRIbZ9Eb7oL13luuwvbZcluV4BHkl6aPbWrPA7FUDb6Ot82u5MVAwB2zKWIWAUA9pjE/R8A9pjG5wB3Vpbz6bR6aXc/j+i2W89GxEAt/sbzzdqSbP2Z3UD1OejgnWTd844kIoa3ofyRiPjg01c+TKfYoeeQAK28djkizgyPNNr/tfYn2TBmoabzARn/biQ2GRww8kBe+wfd81na//nfWv9v7frL3O//RIv+T3+La/dRjMT6EScbr//MjW0opq20//dM79rYtrtN8dcN99RzB6p9vt7k7LliIW3b/hwRo9Hbn+bHNylj9PZvt9fNaIq4uf/385VXr6Xlp69ra2RuZB9ocqcmK5OPG3fDrcsRf8+2ij+5f/yTNv3fUx2W8cL/33y/3bI0/jTexrQ+/p0fVbZ6NeKf0Tr+hmSz8YnHxqqnw1jjpGjhk+/eG2xXfvPxT6e0/Np7gQPbH2wL6fEf3Dz+4aR5vGZ562V8dXXo83bL2sff0Pr870terqYbl9LFyUplfjyiL3lx4/yja9s28o310/hH/9H6+t/s/E/fE57pMP7szR8/emj8jRkb4q8b6LCwLUrjn9rS8d964vrdmZ525Xd2/CfSRM9ofU4n7d9m9eprWueRdxwAAAAAAAAAAAAAAAAAAAAAAAAAbEEmIvZHksndT2cyuVxUf8P7rzGYKZbKlcNnSwtzU1H9rezh6M00vupyqOn7UMfr34ffyB99IP+fiPhLRLzb/6dqPpcvFad2O3gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqNvX5vf/Uz/0117v7WoNAYAdMfDQNW4XulIRAKBrHn7/j4j+na8HANA9Hd3/AYCnivs/AOw97v8AsPcMRGR3uw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA81U6dPJlOq/dWlvNpfurC4sJM6cKRqUJ5Jje7kM/lS/Pnc9Ol0nSxkMuXZps2/abV/yuWSucnYm7h4lilUK6MlReXTs+WFuYqp8/NTk4XThd6uxYZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHSuvLg0M1ksFubriWuDEevndCnRU69QVwt9IhOrQ7U99Uepz84nvj/y7cHN1rmy4TSWeOzEbrZKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+O3wMAAP//mc0dAw==") syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) socket$netlink(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) syz_io_uring_setup(0x38, &(0x7f0000000140)={0x0, 0x1d2d, 0x40000, 0x0, 0x1f2}, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x29, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x200000, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 999.808452ms ago: executing program 4 (id=350): syz_usb_connect(0x3, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x90, 0xf2, 0xc3, 0x10, 0x13d8, 0x22, 0xebaa, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x7, 0x40, 0x8, "", [{{0x9, 0x4, 0x42, 0x4, 0x0, 0xf5, 0xbe, 0xf4, 0x10}}]}}]}}, 0x0) syz_open_dev$hidraw(0x0, 0x82, 0x460001) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect$lan78xx(0x4, 0x0, 0x0, 0x0) 999.564737ms ago: executing program 1 (id=351): unshare(0x24020400) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r0, &(0x7f0000000340)={0x18, 0x2, {0x2, @rand_addr=0x64010100}}, 0x1e) 992.82913ms ago: executing program 1 (id=352): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x13}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040005}, 0x44050) 977.311414ms ago: executing program 1 (id=353): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000003b00010324bd702a02dcdf25070000"], 0x14}, 0x1, 0x0, 0x0, 0x4018}, 0x40000) 299.973035ms ago: executing program 2 (id=354): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 299.807312ms ago: executing program 2 (id=355): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x4a, {0x2, 0x0, @dev}}) r1 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000000)={{0x2, 0x3, @local}, {0x1, @remote}, 0x4a, {0x2, 0x0, @remote}, 'veth1_to_bridge\x00'}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x0, @local}, 0x4a, {0x2, 0x0, @multicast2}, 'syz_tun\x00'}) 299.652943ms ago: executing program 2 (id=356): socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000040)={0x0, 0xbb88, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x800, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x28e80, 0x2, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626b, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 268.37119ms ago: executing program 3 (id=357): syz_usb_connect(0x5, 0x24, &(0x7f0000000980)={{0x12, 0x1, 0x310, 0xb0, 0x70, 0x5a, 0x40, 0x421, 0x2e3, 0x43b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x7, 0x0, 0x3, "", [{{0x9, 0x4, 0x3b, 0xa7, 0x0, 0x2, 0x2, 0xff, 0x83}}]}}]}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) fsmount(0xffffffffffffffff, 0xa826ea18fdc3f180, 0x0) 264.131184ms ago: executing program 2 (id=358): r0 = syz_io_uring_setup(0x120b, &(0x7f0000000000)={0x0, 0xd2ba, 0x400, 0xfffffffc, 0x21c}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000400)) r1 = socket$rxrpc(0x21, 0x2, 0x2) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r0, 0x1e, &(0x7f0000000180)={r1, 0x1, 0x1, 0xd, 0xd7}, 0x1) 200.083909ms ago: executing program 2 (id=359): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) readv(r3, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0x9a}], 0x1) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011"], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 143.992048ms ago: executing program 4 (id=360): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='md0\x00', 0x4) close(r0) write(0xffffffffffffffff, &(0x7f0000000300)='raid1\x00', 0x5) write(0xffffffffffffffff, &(0x7f0000000500)='2\x00', 0x1) close(0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, 0x0, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/block/md0/md/component_size\x00', 0x1, 0x0) write(r4, &(0x7f0000000d00)='2', 0x1) close(r4) 127.533661ms ago: executing program 0 (id=361): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) unshare(0x2c020400) connect$unix(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) 64.0501ms ago: executing program 1 (id=362): r0 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r0, 0x6) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r3 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x1, 0x70bd35, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 63.896198ms ago: executing program 4 (id=363): syz_emit_ethernet(0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000280)=[{0x6, 0xba, 0x2, 0xffff}]}, 0x10) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000280)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 63.775023ms ago: executing program 0 (id=364): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r0, &(0x7f0000000200)=[{&(0x7f0000000280)="01", 0x1}], 0x1, 0xfff7fc01, 0x3, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) 0s ago: executing program 4 (id=365): r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x2, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) write(r0, &(0x7f0000000000)="01", 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.83' (ED25519) to the list of known hosts. [ 28.181435][ T4701] cgroup: Unknown subsys name 'net' [ 28.331209][ T4701] cgroup: Unknown subsys name 'cpuset' [ 28.333170][ T4701] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.497642][ T4701] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 29.291379][ T4713] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.293367][ T4713] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.295103][ T4713] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.299023][ T4713] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.322823][ T4725] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 29.324756][ T4725] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 29.324913][ T4725] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 29.325126][ T4725] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 29.325373][ T4725] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.325809][ T4727] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 29.325906][ T4727] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 29.326252][ T4727] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 29.326630][ T4727] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 29.326824][ T4727] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 29.326984][ T4727] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 29.327160][ T4727] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 29.328187][ T4726] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 29.328521][ T4726] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 29.329322][ T4726] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 29.329412][ T4726] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 29.331259][ T4727] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 29.332125][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 29.334643][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 29.337297][ T4724] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 29.337529][ T4724] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 29.704844][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.710036][ T4712] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.710115][ T4712] bridge_slave_0: entered allmulticast mode [ 29.710567][ T4712] bridge_slave_0: entered promiscuous mode [ 29.718853][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.718934][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.718986][ T4712] bridge_slave_1: entered allmulticast mode [ 29.719393][ T4712] bridge_slave_1: entered promiscuous mode [ 29.756050][ T4712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.757121][ T4712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.760256][ T4711] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.760321][ T4711] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.760372][ T4711] bridge_slave_0: entered allmulticast mode [ 29.760900][ T4711] bridge_slave_0: entered promiscuous mode [ 29.796457][ T4711] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.796526][ T4711] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.796587][ T4711] bridge_slave_1: entered allmulticast mode [ 29.796982][ T4711] bridge_slave_1: entered promiscuous mode [ 29.826350][ T4714] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.826444][ T4714] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.826500][ T4714] bridge_slave_0: entered allmulticast mode [ 29.826921][ T4714] bridge_slave_0: entered promiscuous mode [ 29.828342][ T4721] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.828367][ T4721] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.828421][ T4721] bridge_slave_0: entered allmulticast mode [ 29.828838][ T4721] bridge_slave_0: entered promiscuous mode [ 29.829861][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.829882][ T4721] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.830255][ T4721] bridge_slave_1: entered allmulticast mode [ 29.830683][ T4721] bridge_slave_1: entered promiscuous mode [ 29.837759][ T4721] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.838721][ T4721] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.847012][ T4712] team0: Port device team_slave_0 added [ 29.847942][ T4712] team0: Port device team_slave_1 added [ 29.848008][ T4714] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.848068][ T4714] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.848157][ T4714] bridge_slave_1: entered allmulticast mode [ 29.848668][ T4714] bridge_slave_1: entered promiscuous mode [ 29.853154][ T4711] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.854087][ T4711] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.859883][ T4721] team0: Port device team_slave_0 added [ 29.861042][ T4721] team0: Port device team_slave_1 added [ 29.877808][ T4711] team0: Port device team_slave_0 added [ 29.885478][ T4714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.886516][ T4714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.889415][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.890673][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.890692][ T4712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.891436][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.891444][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.891456][ T4712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.907502][ T4712] hsr_slave_0: entered promiscuous mode [ 29.907870][ T4712] hsr_slave_1: entered promiscuous mode [ 29.908965][ T4711] team0: Port device team_slave_1 added [ 29.912518][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.912538][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.912550][ T4721] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.913100][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.913107][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.913123][ T4721] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.922422][ T4717] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.922448][ T4717] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.922538][ T4717] bridge_slave_0: entered allmulticast mode [ 29.922964][ T4717] bridge_slave_0: entered promiscuous mode [ 29.924110][ T4717] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.924168][ T4717] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.924267][ T4717] bridge_slave_1: entered allmulticast mode [ 29.924685][ T4717] bridge_slave_1: entered promiscuous mode [ 29.928846][ T4714] team0: Port device team_slave_0 added [ 29.933395][ T4711] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.933404][ T4711] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.933417][ T4711] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.935233][ T4721] hsr_slave_0: entered promiscuous mode [ 29.935539][ T4721] hsr_slave_1: entered promiscuous mode [ 29.935976][ T4721] debugfs: 'hsr0' already exists in 'hsr' [ 29.936004][ T4721] Cannot create hsr debugfs directory [ 29.946701][ T4714] team0: Port device team_slave_1 added [ 29.950472][ T4711] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.950479][ T4711] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.950492][ T4711] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.957583][ T4717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.963689][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.965216][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.969614][ T4714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.974264][ T4717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.980806][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.980828][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.980839][ T4714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.991602][ T4717] team0: Port device team_slave_0 added [ 30.000793][ T4711] hsr_slave_0: entered promiscuous mode [ 30.002318][ T4711] hsr_slave_1: entered promiscuous mode [ 30.002525][ T4711] debugfs: 'hsr0' already exists in 'hsr' [ 30.002540][ T4711] Cannot create hsr debugfs directory [ 30.008121][ T4717] team0: Port device team_slave_1 added [ 30.036595][ T4714] hsr_slave_0: entered promiscuous mode [ 30.036885][ T4714] hsr_slave_1: entered promiscuous mode [ 30.037061][ T4714] debugfs: 'hsr0' already exists in 'hsr' [ 30.037070][ T4714] Cannot create hsr debugfs directory [ 30.037325][ T4717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.037331][ T4717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.037343][ T4717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.037857][ T4717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.037864][ T4717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.037878][ T4717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.049847][ T4717] hsr_slave_0: entered promiscuous mode [ 30.050597][ T4717] hsr_slave_1: entered promiscuous mode [ 30.051170][ T4717] debugfs: 'hsr0' already exists in 'hsr' [ 30.051179][ T4717] Cannot create hsr debugfs directory [ 30.165770][ T4712] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.168830][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.170477][ T4712] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.172467][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.172815][ T4712] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.175298][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.175589][ T4712] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.177353][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.190326][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.190377][ T4712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.190532][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.190569][ T4712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.203689][ T4721] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.207178][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.211657][ T4721] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.214609][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.216633][ T4721] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.218903][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.224792][ T4721] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.226932][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.244451][ T4712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.247479][ T4714] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.249905][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.252605][ T4714] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.254795][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.256506][ T4714] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.258613][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.261715][ T4714] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.263797][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.266700][ T1393] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.268193][ T1393] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.279754][ T4712] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.292778][ T3785] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.292826][ T3785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.304372][ T3785] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.304414][ T3785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.311414][ T4711] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.314335][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.324187][ T4711] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.326893][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.329068][ T4711] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.331696][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.339582][ T4712] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.340653][ T4712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.345386][ T4711] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.347501][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.359728][ T4721] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.373194][ T4717] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.374397][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.377637][ T4721] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.380371][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.380427][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.383751][ T4717] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.385969][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.386505][ T4717] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.389514][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.394316][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.394359][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.397252][ T4717] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.399338][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.413245][ T4714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.417388][ T4714] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.433710][ T808] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.433746][ T808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.447982][ T808] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.448018][ T808] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.461313][ T4711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.465543][ T4711] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.484818][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.484853][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.485404][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.485424][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.529518][ T4717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.535186][ T4711] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.535222][ T4711] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.543745][ T4717] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.547383][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.547423][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.567746][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.567784][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.603064][ T4712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.634573][ T4712] veth0_vlan: entered promiscuous mode [ 30.637523][ T4712] veth1_vlan: entered promiscuous mode [ 30.653128][ T4712] veth0_macvtap: entered promiscuous mode [ 30.661822][ T4712] veth1_macvtap: entered promiscuous mode [ 30.666760][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.689064][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.701032][ T4721] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.743443][ T1203] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.743473][ T1203] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.761929][ T4721] veth0_vlan: entered promiscuous mode [ 30.766568][ T4721] veth1_vlan: entered promiscuous mode [ 30.771026][ T4711] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.779595][ T4714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.779842][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.779851][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.798013][ T4721] veth0_macvtap: entered promiscuous mode [ 30.812601][ T4711] veth0_vlan: entered promiscuous mode [ 30.821877][ T4711] veth1_vlan: entered promiscuous mode [ 30.829353][ T4717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.832670][ T4721] veth1_macvtap: entered promiscuous mode [ 30.837679][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.847325][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.854444][ T4711] veth0_macvtap: entered promiscuous mode [ 30.857822][ T4712] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.864612][ T4711] veth1_macvtap: entered promiscuous mode [ 30.873274][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.873452][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.873476][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.873493][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.873508][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.873523][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.873538][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.887753][ T4711] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.888768][ T4711] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.922021][ T4714] veth0_vlan: entered promiscuous mode [ 30.924778][ T4714] veth1_vlan: entered promiscuous mode [ 30.935508][ T4717] veth0_vlan: entered promiscuous mode [ 30.938435][ T4717] veth1_vlan: entered promiscuous mode [ 30.949302][ T30] audit: type=1326 audit(30.920:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.949345][ T30] audit: type=1326 audit(30.920:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.957726][ T4714] veth0_macvtap: entered promiscuous mode [ 30.958811][ T4714] veth1_macvtap: entered promiscuous mode [ 30.961879][ T30] audit: type=1326 audit(30.940:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=141 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.961929][ T30] audit: type=1326 audit(30.940:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.961952][ T30] audit: type=1326 audit(30.940:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.966024][ T30] audit: type=1326 audit(30.940:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffff7e95c0ec code=0x7ffc0000 [ 30.966661][ T30] audit: type=1326 audit(30.940:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.966679][ T30] audit: type=1326 audit(30.940:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.971574][ T30] audit: type=1326 audit(30.950:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=29 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.971593][ T30] audit: type=1326 audit(30.950:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4895 comm="syz.0.6" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 30.979030][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.984197][ T3785] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.984242][ T3785] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.984276][ T3785] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.984299][ T3785] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.984321][ T3785] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.989241][ T4717] veth0_macvtap: entered promiscuous mode [ 30.999195][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.999206][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.001687][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.012485][ T4717] veth1_macvtap: entered promiscuous mode [ 31.046850][ T4717] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.047791][ T4717] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.054649][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.055112][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.056374][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.057593][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.057751][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.057772][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.057794][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.057815][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.064996][ T1203] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.065006][ T1203] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.076092][ T1393] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.076104][ T1393] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.103920][ T3785] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.331268][ T3785] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.335886][ T808] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.337641][ T808] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.362199][ T3785] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.362237][ T3785] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.370429][ T4713] Bluetooth: hci2: command tx timeout [ 31.370528][ T4713] Bluetooth: hci4: command tx timeout [ 31.370594][ T4713] Bluetooth: hci3: command tx timeout [ 31.370656][ T4713] Bluetooth: hci1: command tx timeout [ 31.370716][ T4713] Bluetooth: hci0: command tx timeout [ 31.379552][ T4902] loop1: detected capacity change from 0 to 256 [ 31.407865][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.408510][ T4902] netlink: 'syz.1.2': attribute type 39 has an invalid length. [ 31.413029][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.451856][ T1393] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.451885][ T1393] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.001044][ T4920] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 33.146552][ T4920] socket: no more sockets [ 33.197849][ T4951] loop4: detected capacity change from 0 to 8 [ 33.203920][ T4951] Filesystem uses "zstd" compression. This is not supported [ 33.213341][ T4952] loop3: detected capacity change from 0 to 512 [ 33.223680][ T4952] EXT4-fs: Ignoring removed nobh option [ 33.236454][ T4952] EXT4-fs (loop3): orphan cleanup on readonly fs [ 33.240899][ T4952] EXT4-fs error (device loop3): ext4_map_blocks:791: inode #11: block 1: comm syz.3.19: lblock 0 mapped to illegal pblock 1 (length 1) [ 33.240950][ T4952] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 33.247349][ T4952] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 33.247502][ T4952] EXT4-fs error (device loop3): ext4_xattr_inode_update_ref:1037: inode #11: comm syz.3.19: EA inode 11 ref wraparound: ref_count=0 ref_change=-1 [ 33.247530][ T4952] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 33.249989][ C1] EXT4-fs (loop3): error count since last fsck: 2 [ 33.250012][ C1] EXT4-fs (loop3): initial error at time 33: ext4_map_blocks:791: inode 11: block 1 [ 33.250054][ C1] EXT4-fs (loop3): last error at time 33: ext4_xattr_inode_update_ref:1037: inode 11 [ 33.261949][ T4952] EXT4-fs warning (device loop3): ext4_xattr_inode_dec_ref_all:1231: inode #11: comm syz.3.19: ea_inode dec ref err=-117 [ 33.262127][ T4952] EXT4-fs (loop3): 1 orphan inode deleted [ 33.262740][ T4952] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 33.270198][ T4838] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 33.301260][ T4711] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.377996][ T4968] loop3: detected capacity change from 0 to 512 [ 33.422258][ T4838] usb 1-1: unable to get BOS descriptor or descriptor too short [ 33.422798][ T4838] usb 1-1: not running at top speed; connect to a high speed hub [ 33.422830][ T4838] usb 1-1: New USB device found, idVendor=045b, idProduct=0212, bcdDevice=fb.ac [ 33.423675][ T4838] usb 1-1: config 254 has an invalid interface number: 216 but max is 0 [ 33.423688][ T4838] usb 1-1: config 254 has no interface number 0 [ 33.423699][ T4838] usb 1-1: config 254 interface 216 has no altsetting 0 [ 33.425941][ T4838] usb 1-1: string descriptor 0 read error: -22 [ 33.425991][ T4838] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.428491][ T4968] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.444922][ T4838] upd78f0730 1-1:254.216: upd78f0730 converter detected [ 33.448564][ T4838] usb 1-1: upd78f0730 converter now attached to ttyUSB0 [ 33.460476][ T4713] Bluetooth: hci1: command tx timeout [ 33.460510][ T4713] Bluetooth: hci3: command tx timeout [ 33.460533][ T4713] Bluetooth: hci4: command tx timeout [ 33.460550][ T4713] Bluetooth: hci2: command tx timeout [ 33.464461][ T4724] Bluetooth: hci0: command tx timeout [ 33.512635][ T4711] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.549761][ T4724] Bluetooth: hci1: connection err: -111 [ 33.585513][ T4993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.585773][ T4993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.585944][ T4994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.586107][ T4994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.659087][ T4999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.662409][ T4999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.666733][ T4925] netlink: 756 bytes leftover after parsing attributes in process `syz.0.11'. [ 33.666777][ T4925] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11'. [ 33.692488][ T4881] usb 1-1: USB disconnect, device number 2 [ 33.695204][ T4881] upd78f0730 ttyUSB0: upd78f0730 converter now disconnected from ttyUSB0 [ 33.695634][ T4881] upd78f0730 1-1:254.216: device disconnected [ 33.761164][ T4724] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 33.761217][ T4724] CPU: 0 UID: 0 PID: 4724 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT [ 33.761234][ T4724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 33.761241][ T4724] Workqueue: hci1 hci_rx_work [ 33.761259][ T4724] Call trace: [ 33.761263][ T4724] show_stack+0x2c/0x3c (C) [ 33.761279][ T4724] __dump_stack+0x30/0x40 [ 33.761291][ T4724] dump_stack_lvl+0xd8/0x12c [ 33.761303][ T4724] dump_stack+0x1c/0x28 [ 33.761315][ T4724] sysfs_warn_dup+0x9c/0xb8 [ 33.761327][ T4724] sysfs_create_dir_ns+0x190/0x1f4 [ 33.761339][ T4724] kobject_add_internal+0x290/0x6f0 [ 33.761352][ T4724] kobject_add_varg+0x9c/0xe8 [ 33.761363][ T4724] kobject_add+0x110/0x1c8 [ 33.761374][ T4724] device_add+0x394/0x9e0 [ 33.761383][ T4724] hci_conn_add_sysfs+0xbc/0x1e8 [ 33.761393][ T4724] le_conn_complete_evt+0xc68/0x10f8 [ 33.761405][ T4724] hci_le_conn_complete_evt+0x114/0x3d8 [ 33.761418][ T4724] hci_le_meta_evt+0x2b0/0x46c [ 33.761426][ T4724] hci_event_packet+0x4c0/0x9c8 [ 33.761435][ T4724] hci_rx_work+0x2f4/0xd78 [ 33.761445][ T4724] process_scheduled_works+0x788/0x10b8 [ 33.761456][ T4724] worker_thread+0x798/0xbd0 [ 33.761466][ T4724] kthread+0x304/0x3d4 [ 33.761475][ T4724] ret_from_fork+0x10/0x20 [ 33.765870][ T4724] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 33.765935][ T4724] Bluetooth: hci1: failed to register connection device [ 33.921717][ T4994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.925755][ T4994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.728522][ T5012] netlink: 'syz.0.41': attribute type 2 has an invalid length. [ 35.250067][ T4806] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 35.293779][ T5026] batman_adv: batadv0: Adding interface: dummy0 [ 35.295220][ T5026] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.301955][ T5026] batman_adv: batadv0: Interface activated: dummy0 [ 35.306889][ T5026] batadv0: mtu less than device minimum [ 35.310072][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.311837][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.313468][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.315103][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.316729][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.318359][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.320010][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.321634][ T5026] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 35.359385][ T5032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.359573][ T5032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.421361][ T4806] usb 1-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 35.423922][ T4806] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 35.423942][ T4806] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 35.423958][ T4806] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.506561][ T5040] netlink: 12 bytes leftover after parsing attributes in process `syz.1.52'. [ 35.540429][ T4715] Bluetooth: hci2: command tx timeout [ 35.540535][ T4715] Bluetooth: hci3: command tx timeout [ 35.540551][ T4715] Bluetooth: hci1: command tx timeout [ 35.540686][ T4724] Bluetooth: hci0: command tx timeout [ 36.171715][ T4724] Bluetooth: hci4: command tx timeout [ 36.644575][ T5086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.647636][ T5086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.823281][ T5082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.823470][ T5082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.894575][ T4806] pegasus 1-1:1.0: can't reset MAC [ 36.894693][ T4806] pegasus 1-1:1.0: probe with driver pegasus failed with error -5 [ 36.947167][ T5100] No source specified [ 37.126785][ T4806] usb 1-1: USB disconnect, device number 3 [ 37.316309][ T5102] loop1: detected capacity change from 0 to 512 [ 37.317841][ T5102] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 37.317877][ T5102] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 37.324950][ T5102] EXT4-fs (loop1): 1 truncate cleaned up [ 37.325432][ T5102] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.344136][ T4721] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.377375][ T5108] netlink: 'syz.1.79': attribute type 6 has an invalid length. [ 37.377434][ T5108] Zero length message leads to an empty skb [ 37.458208][ T5115] Trying to write to read-only block-device nullb0 [ 37.562844][ T5119] Cannot find set identified by id 0 to match [ 37.757601][ T4724] Bluetooth: hci0: command tx timeout [ 37.758122][ T4718] Bluetooth: hci2: command tx timeout [ 37.758153][ T4715] Bluetooth: hci3: command tx timeout [ 37.758176][ T4713] Bluetooth: hci1: command tx timeout [ 37.816097][ T5122] loop0: detected capacity change from 0 to 512 [ 37.828003][ T5122] EXT4-fs error (device loop0): ext4_orphan_get:1399: inode #15: comm syz.0.85: inode has both inline data and extents flags [ 37.832054][ T5122] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 37.835146][ T5122] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.85: couldn't read orphan inode 15 (err -117) [ 37.835452][ T5122] loop0: lost filesystem error report for type 5 error -117 [ 37.835977][ T5124] nvme_fcloop: unknown parameter or missing value 'wwpn=' [ 37.840461][ C1] EXT4-fs (loop0): error count since last fsck: 2 [ 37.840476][ C1] EXT4-fs (loop0): initial error at time 37: ext4_orphan_get:1399: inode 15 [ 37.840496][ C1] EXT4-fs (loop0): last error at time 37: ext4_orphan_get:1404 [ 37.843277][ T5122] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.850925][ T5122] EXT4-fs (loop0): shut down requested (2) [ 37.883959][ T4712] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.380011][ T4838] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 38.530291][ T4838] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 38.532166][ T4838] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 38.532180][ T4838] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.532189][ T4838] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 38.532202][ T4838] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.533217][ T4838] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 38.533232][ T4838] usb 1-1: Product: syz [ 38.533240][ T4838] usb 1-1: Manufacturer: syz [ 38.536199][ T4838] cdc_wdm 1-1:1.0: skipping garbage [ 38.536209][ T4838] cdc_wdm 1-1:1.0: skipping garbage [ 38.538074][ T4838] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 38.538085][ T4838] cdc_wdm 1-1:1.0: Unknown control protocol [ 38.744638][ T4838] usb 1-1: USB disconnect, device number 4 [ 38.798899][ T5160] loop3: detected capacity change from 0 to 256 [ 39.506251][ T5180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.508696][ T5180] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.714800][ T5184] loop2: detected capacity change from 0 to 1024 [ 39.715216][ T5184] EXT4-fs: Ignoring removed bh option [ 39.734125][ T5184] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.739622][ T5184] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 39.752798][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.777133][ T4838] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 39.801466][ T5190] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 39.801721][ T5190] overlayfs: NFS export requires an index dir, falling back to nfs_export=off. [ 39.837529][ T5195] netlink: 'syz.2.111': attribute type 4 has an invalid length. [ 39.873532][ T5200] Bluetooth: MGMT ver 1.23 [ 39.921569][ T4838] usb 1-1: Using ep0 maxpacket: 32 [ 39.922912][ T4838] usb 1-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 39.923158][ T4838] usb 1-1: too many configurations: 17, using maximum allowed: 8 [ 39.926614][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.926646][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.934028][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.934057][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.937778][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.937801][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.943785][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.945383][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.948283][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.949869][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.951717][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.953399][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.955670][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.957972][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.961698][ T4838] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 39.961720][ T4838] usb 1-1: config 0 has no interface number 0 [ 39.966813][ T4838] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.966835][ T4838] usb 1-1: Product: syz [ 39.966863][ T4838] usb 1-1: Manufacturer: syz [ 39.966875][ T4838] usb 1-1: SerialNumber: syz [ 39.976138][ T4838] usb 1-1: config 0 descriptor?? [ 39.978002][ T4838] etas_es58x 1-1:0.2: Starting syz syz (Serial Number syz) [ 40.046141][ T5222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.046343][ T5222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.095033][ T5228] loop3: detected capacity change from 0 to 4096 [ 40.096571][ T5228] EXT4-fs: inline encryption not supported [ 40.099149][ T5228] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 40.100877][ T5228] EXT4-fs (loop3): Test dummy encryption mode enabled [ 40.103124][ T5228] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec118, mo2=0003] [ 40.104808][ T5228] System zones: 0-5 [ 40.107069][ T5228] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.119224][ T4711] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.138367][ T5232] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.141216][ T5232] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.180127][ T4838] etas_es58x 1-1:0.2: could not retrieve the product info string [ 40.234700][ T5239] netlink: 8 bytes leftover after parsing attributes in process `syz.4.121'. [ 40.337204][ T4403] etas_es58x 1-1:0.2 can0: bit-timing not yet defined [ 40.383418][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0161. [ 40.383459][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 40.383467][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 40.584070][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 40.584106][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 40.584123][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 40.584139][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 40.584154][ C0] net_ratelimit: 11 callbacks suppressed [ 40.584162][ C0] etas_es58x 1-1:0.2 can0: es58x_write_bulk_callback: error -EPROTO [ 40.584392][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 40.584477][ T4403] etas_es58x 1-1:0.2 can0: es58x_open: Could not open the network device: -EINVAL [ 40.586061][ T4388] usb 1-1: USB disconnect, device number 5 [ 40.586890][ T4388] etas_es58x 1-1:0.2: Disconnecting syz syz [ 40.631690][ T5267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.631869][ T5267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.708522][ T5279] loop1: detected capacity change from 0 to 512 [ 40.728363][ T5279] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.983092][ T5319] bond1: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 40.986123][ T5319] bond1 (unregistering): Released all slaves [ 41.147817][ T5328] syz_tun: entered promiscuous mode [ 41.149430][ T5328] macvtap1: entered promiscuous mode [ 41.152119][ T5328] macvtap1: entered allmulticast mode [ 41.153242][ T5328] syz_tun: entered allmulticast mode [ 41.186756][ T5334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.191393][ T5334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.199777][ T5336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.202067][ T5336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.360067][ T24] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 41.531124][ T24] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 41.532084][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 41.532096][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 41.533555][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.533565][ T24] usb 1-1: Product: syz [ 41.533572][ T24] usb 1-1: Manufacturer: syz [ 41.533578][ T24] usb 1-1: SerialNumber: syz [ 41.546904][ T4721] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.630511][ T5338] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 41.631711][ T5338] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 41.634551][ T5338] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 41.637132][ T5338] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 41.637184][ T5338] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 41.639700][ T5338] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 41.641466][ T5338] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 41.643138][ T5338] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 41.644351][ T5338] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 41.645865][ T5338] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 41.648490][ T5338] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 41.649597][ T5338] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 41.651178][ T5338] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 41.652715][ T5338] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 41.653841][ T5338] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 41.655631][ T5338] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 41.659694][ T4724] Bluetooth: hci4: Malformed LE Event: 0x02 [ 41.750583][ T4838] usb 1-1: USB disconnect, device number 6 [ 41.817834][ T5351] netlink: 64 bytes leftover after parsing attributes in process `syz.2.146'. [ 41.834420][ T5353] loop2: detected capacity change from 0 to 512 [ 41.834753][ T5353] ======================================================= [ 41.834753][ T5353] WARNING: The mand mount option has been deprecated and [ 41.834753][ T5353] and is ignored by this kernel. Remove the mand [ 41.834753][ T5353] option from the mount to silence this warning. [ 41.834753][ T5353] ======================================================= [ 41.860616][ T5353] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.871173][ T5353] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 41.883510][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.934381][ T5363] IPv6: NLM_F_REPLACE set, but no existing node found! [ 41.946315][ T5365] loop4: detected capacity change from 0 to 1024 [ 41.948252][ T5365] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 41.948315][ T5365] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 41.949661][ T5365] EXT4-fs error (device loop4): ext4_get_journal_inode:5900: inode #32: comm syz.4.152: iget: special inode unallocated [ 41.949682][ T5365] loop4: lost file I/O error report for ino 32 type 5 pos 0x0 len 0x0 error -117 [ 41.949852][ T5365] EXT4-fs (loop4): Remounting filesystem read-only [ 41.949886][ T5365] EXT4-fs (loop4): no journal found [ 41.949892][ T5365] EXT4-fs (loop4): can't get journal size [ 41.949940][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 41.949949][ C1] EXT4-fs (loop4): initial error at time 41: ext4_get_journal_inode:5900: inode 32 [ 41.949965][ C1] EXT4-fs (loop4): last error at time 41: ext4_get_journal_inode:5900: inode 32 [ 41.957286][ T5365] EXT4-fs (loop4): filesystem is read-only [ 41.957728][ T5365] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 41.983947][ T4714] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.014648][ T5372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.014834][ T5372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.032803][ T5374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.035000][ T5374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.272699][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 42.274018][ T30] audit: type=1326 audit(42.250:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.277968][ T30] audit: type=1326 audit(42.250:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.282879][ T30] audit: type=1326 audit(42.250:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.287145][ T30] audit: type=1326 audit(42.250:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.292089][ T30] audit: type=1326 audit(42.250:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=2 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.296780][ T30] audit: type=1326 audit(42.250:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.296802][ T30] audit: type=1326 audit(42.250:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.296818][ T30] audit: type=1326 audit(42.250:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.157" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff7e979228 code=0x7ffc0000 [ 42.305174][ T5379] syzkaller0: entered promiscuous mode [ 42.305288][ T5379] syzkaller0: entered allmulticast mode [ 42.811094][ T5395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.811288][ T5395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.848408][ T5392] loop2: detected capacity change from 0 to 8192 [ 42.856199][ T5392] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 42.906686][ T5403] loop4: detected capacity change from 0 to 128 [ 42.909669][ T5403] EXT4-fs (loop4): Test dummy encryption mode enabled [ 42.915083][ T5403] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 42.932019][ T5403] fscrypt: AES-256-XTS using implementation "xts-aes-ce" [ 42.946912][ T4714] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 42.969693][ T5411] netlink: 'syz.2.168': attribute type 6 has an invalid length. [ 42.974367][ T5402] netlink: 'syz.2.168': attribute type 6 has an invalid length. [ 42.995696][ T5413] Invalid source name [ 43.297900][ T5430] syz_tun: entered allmulticast mode [ 43.690385][ T4724] Bluetooth: hci1: command 0x0406 tx timeout [ 43.700043][ T4724] Bluetooth: hci4: command 0x0c1a tx timeout [ 43.700083][ T4724] Bluetooth: hci3: command 0x0c1a tx timeout [ 43.700103][ T4724] Bluetooth: hci2: command 0x0c1a tx timeout [ 43.700119][ T4724] Bluetooth: hci0: command 0x0c1a tx timeout [ 43.800734][ T5446] loop3: detected capacity change from 0 to 512 [ 43.803718][ T5446] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 43.809143][ T5446] EXT4-fs (loop3): 1 truncate cleaned up [ 43.809634][ T5446] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.817162][ T5446] EXT4-fs error (device loop3): ext4_empty_dir:3101: inode #2: block 13: comm syz.3.185: bad entry in directory: inode out of bounds - offset=12, inode=2048, rec_len=12, size=1024 fake=1 [ 43.817810][ T5446] EXT4-fs warning (device loop3): ext4_empty_dir:3104: inode #2: comm syz.3.185: directory missing '..' [ 43.826929][ T4711] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.844835][ T5449] binder: 5448:5449 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 43.913188][ T5457] capability: warning: `syz.0.190' uses 32-bit capabilities (legacy support in use) [ 44.319649][ T4713] Bluetooth: hci4: unexpected event for opcode 0x1009 [ 44.374153][ T5481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.375357][ T5481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.411907][ T5487] loop0: detected capacity change from 0 to 256 [ 44.413729][ T5487] FAT-fs (loop0): bogus sectors per cluster 223 [ 44.413935][ T5487] FAT-fs (loop0): Can't find a valid FAT filesystem [ 44.475730][ T5493] loop2: detected capacity change from 0 to 2048 [ 44.493680][ T5493] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.751875][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.767367][ T5501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.775726][ T4838] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 44.776216][ T5501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.930824][ T4838] usb 1-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 44.933183][ T4838] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.933331][ T4838] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 44.933352][ T4838] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.943624][ T4838] idmouse 1-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 44.979000][ T5501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.979201][ T5501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.008739][ T5522] loop3: detected capacity change from 0 to 1024 [ 45.015742][ T5522] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 45.037341][ T4711] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.486322][ T5544] loop1: detected capacity change from 0 to 512 [ 45.491922][ T5544] EXT4-fs error (device loop1): ext4_read_inode_bitmap:141: comm syz.1.224: Invalid inode bitmap blk 4 in block_group 0 [ 45.491954][ T5544] loop1: lost filesystem error report for type 5 error -117 [ 45.494190][ T5544] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.515220][ T4721] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.647934][ T5562] netlink: 12 bytes leftover after parsing attributes in process `syz.3.231'. [ 45.779901][ T4713] Bluetooth: hci0: command 0x0c1a tx timeout [ 45.779937][ T4713] Bluetooth: hci2: command 0x0c1a tx timeout [ 45.779964][ T4713] Bluetooth: hci3: command 0x0c1a tx timeout [ 45.779983][ T4713] Bluetooth: hci1: command 0x0406 tx timeout [ 45.938976][ T5591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.939217][ T5591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.962211][ T5594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.965022][ T5594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.616549][ T5618] loop4: detected capacity change from 0 to 512 [ 46.631256][ T5618] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a842c01c, mo2=0002] [ 46.632995][ T5618] System zones: 0-2, 18-18, 34-35 [ 46.634914][ T5618] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.636097][ T5618] ext4 filesystem being mounted at /45/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.652546][ T4714] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.733456][ T4388] usb 1-1: USB disconnect, device number 7 [ 46.736311][ T4388] idmouse 1-1:1.0: disconnected [ 46.963417][ T5627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.963609][ T5627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.964866][ T5627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.965012][ T5627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.419942][ T5650] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 47.526135][ T5656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.526515][ T5656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.531079][ T4388] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 47.555561][ T5660] bonding: bond0 is being created... [ 47.557646][ T5660] bonding: bond0 already exists [ 47.563666][ T5660] bond0: (slave veth0): Enslaving as an active interface with an up link [ 47.639575][ T5670] loop4: detected capacity change from 0 to 128 [ 47.645161][ T5670] EXT4-fs (loop4): Test dummy encryption mode enabled [ 47.656045][ T5670] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 47.656212][ T5670] ext4 filesystem being mounted at /48/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 47.669763][ T4388] usb 1-1: device descriptor read/64, error -71 [ 47.750151][ T5678] xt_hashlimit: Unknown mode mask 60005, kernel too old? [ 47.849821][ T4713] Bluetooth: hci1: command 0x0406 tx timeout [ 47.849857][ T4713] Bluetooth: hci3: command 0x0c1a tx timeout [ 47.849872][ T4713] Bluetooth: hci2: command 0x0c1a tx timeout [ 47.849886][ T4713] Bluetooth: hci0: command 0x0c1a tx timeout [ 47.909694][ T4388] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 48.044489][ T4388] usb 1-1: device descriptor read/64, error -71 [ 48.149847][ T4388] usb usb1-port1: attempt power cycle [ 48.166370][ T4714] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 48.183830][ T5692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.184024][ T5692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.490299][ T4388] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 48.510018][ T4388] usb 1-1: device descriptor read/8, error -71 [ 48.587076][ T5694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.588514][ T5694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.731135][ T5705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.731328][ T5705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.751005][ T4388] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 48.771586][ T4388] usb 1-1: device descriptor read/8, error -71 [ 48.859510][ T5712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.860823][ T5712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.880925][ T4388] usb usb1-port1: unable to enumerate USB device [ 48.927029][ T5718] loop2: detected capacity change from 0 to 128 [ 48.960861][ T5718] netlink: 8 bytes leftover after parsing attributes in process `syz.2.297'. [ 49.034364][ T4724] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 49.627206][ T5742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.632833][ T5742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.637294][ T5743] loop0: detected capacity change from 0 to 3904 [ 49.697369][ T5738] syz.2.304 (5738): drop_caches: 2 [ 49.785491][ T5743] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 49.785521][ T5743] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 49.786704][ T5743] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 49.786743][ T5743] loop0: [ 49.834254][ T5748] bond0: option slaves: interface +dumm{0}4`g_{ZX does not exist! [ 49.929620][ T4724] Bluetooth: hci1: command 0x0406 tx timeout [ 49.972653][ T5760] loop4: detected capacity change from 0 to 512 [ 49.975308][ T5760] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 49.980922][ T5762] binder: 5761:5762 tried to acquire reference to desc 0, got 1 instead [ 49.983674][ T5762] binder: 5761:5762 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 49.983709][ T5762] binder: 5762 RLIMIT_NICE not set [ 49.984479][ T24] binder: undelivered TRANSACTION_COMPLETE [ 50.002741][ T5760] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.316: bg 0: block 64: padding at end of block bitmap is not set [ 50.002772][ T5760] loop4: lost filesystem error report for type 5 error -117 [ 50.005580][ T5760] Quota error (device loop4): write_blk: dquota write failed [ 50.006128][ T5760] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 50.006332][ T5760] EXT4-fs error (device loop4): ext4_acquire_dquot:7041: comm syz.4.316: Failed to acquire dquot type 0 [ 50.006504][ T5760] loop4: lost filesystem error report for type 5 error -117 [ 50.009701][ T5760] EXT4-fs (loop4): 1 truncate cleaned up [ 50.010697][ T5760] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.034380][ T4714] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.037123][ T5768] netlink: 4 bytes leftover after parsing attributes in process `syz.2.319'. [ 50.037183][ T5768] bridge_slave_1: left allmulticast mode [ 50.037455][ T5768] bridge_slave_1: left promiscuous mode [ 50.037774][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.043343][ T5768] bridge_slave_0: left allmulticast mode [ 50.043417][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.242935][ T5788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.243126][ T5788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.306781][ T5790] netlink: 'syz.0.328': attribute type 17 has an invalid length. [ 50.306813][ T5790] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 50.307249][ T5790] bond0: option all_slaves_active: invalid value (49) [ 50.308155][ T5792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.308350][ T5792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.332000][ T5795] bond0: no command found in slaves file - use +ifname or -ifname [ 50.363385][ T5799] netlink: 64 bytes leftover after parsing attributes in process `syz.0.332'. [ 50.438127][ T4724] Bluetooth: hci2: unexpected event for opcode 0x0c1c [ 50.671305][ T5820] loop0: detected capacity change from 0 to 512 [ 50.687058][ T5820] EXT4-fs warning (device loop0): read_mmp_block:110: Error -117 while reading MMP block 0 [ 50.846887][ T5829] loop1: detected capacity change from 0 to 256 [ 50.848486][ T5829] vfat: Unknown parameter 'sysRM"I_immutable' [ 50.850802][ T5829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.346'. [ 50.875936][ T5831] loop1: detected capacity change from 0 to 1024 [ 50.895915][ T5831] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 50.907018][ T5831] EXT4-fs warning (device loop1): ext4_rmdir:3192: inode #11: comm syz.1.347: empty directory 'file1' has too many links (111) [ 50.918734][ T4721] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.941769][ T5839] loop1: detected capacity change from 0 to 2048 [ 50.949553][ T4388] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 50.952571][ T5839] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 50.964142][ T5839] Bluetooth: hci0: invalid length 0, exp 2 for type 19 [ 50.984931][ T5844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.986823][ T5844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.997459][ T4721] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.109883][ T4388] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 51.110596][ T4388] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.110608][ T4388] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 51.111306][ T4388] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 51.111394][ T4388] usb 1-1: SerialNumber: syz [ 51.370853][ T4388] usb 1-1: USB disconnect, device number 12 [ 51.760937][ T5861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.763238][ T5861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.914842][ T5869] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 51.974601][ T5871] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.044221][ T5871] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.080781][ T5878] ------------[ cut here ]------------ [ 52.080806][ T5878] skb_assert_len [ 52.082859][ T5878] WARNING: ./include/linux/skbuff.h:2753 at __dev_queue_xmit+0x18ec/0x2bc0, CPU#1: syz.4.365/5878 [ 52.084711][ T5878] Modules linked in: [ 52.085393][ T5878] CPU: 1 UID: 0 PID: 5878 Comm: syz.4.365 Not tainted syzkaller #0 PREEMPT [ 52.086840][ T5878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 52.088576][ T5878] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 52.089907][ T5878] pc : __dev_queue_xmit+0x18ec/0x2bc0 [ 52.090832][ T5878] lr : __dev_queue_xmit+0x18ec/0x2bc0 [ 52.091771][ T5878] sp : ffff800092ab7300 [ 52.092487][ T5878] x29: ffff800092ab7550 x28: 1fffe0001a2aba36 x27: dfff800000000000 [ 52.093936][ T5878] x26: ffff700012556e78 x25: 1fffe0001a2aba42 x24: ffff0000d155d1b0 [ 52.095311][ T5878] x23: ffff0000d468e000 x22: 1fffe0001a2aba2a x21: ffff80008a19d000 [ 52.096665][ T5878] x20: ffff0000d155d140 x19: ffff0000d155d150 x18: 1fffe00034bbbe28 [ 52.098046][ T5878] x17: 0000000000000003 x16: ffff800088b37000 x15: ffff800088bed220 [ 52.099368][ T5878] x14: ffff0001a5ddf14c x13: 0000000000000001 x12: 0000000000000000 [ 52.100708][ T5878] x11: ffff80008a5d5e28 x10: 0000000000000003 x9 : 821a23822a50bb00 [ 52.102058][ T5878] x8 : 821a23822a50bb00 x7 : 0000000000000000 x6 : 0000000000000000 [ 52.103421][ T5878] x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800080156118 [ 52.104804][ T5878] x2 : 0000000000000006 x1 : ffff0000ccf78000 x0 : 0000000000000001 [ 52.106157][ T5878] Call trace: [ 52.106693][ T5878] __dev_queue_xmit+0x18ec/0x2bc0 (P) [ 52.107583][ T5878] packet_xmit+0x6c/0x314 [ 52.108312][ T5878] packet_sendmsg+0x1858/0x3df0 [ 52.109126][ T5878] __sock_sendmsg+0xc8/0x17c [ 52.109935][ T5878] sock_write_iter+0x220/0x310 [ 52.110699][ T5878] vfs_write+0x51c/0xa0c [ 52.111365][ T5878] ksys_write+0x12c/0x228 [ 52.112059][ T5878] __arm64_sys_write+0x84/0x98 [ 52.112831][ T5878] invoke_syscall+0x98/0x244 [ 52.113591][ T5878] el0_svc_common+0xec/0x23c [ 52.114388][ T5878] do_el0_svc+0x4c/0x5c [ 52.115098][ T5878] el0_svc+0x64/0x260 [ 52.115760][ T5878] el0t_64_sync_handler+0x44/0x104 [ 52.116602][ T5878] el0t_64_sync+0x198/0x19c [ 52.117355][ T5878] irq event stamp: 288 [ 52.118008][ T5878] hardirqs last enabled at (287): [] finish_task_switch+0x234/0x858 [ 52.119623][ T5878] hardirqs last disabled at (288): [] el1_brk64+0x20/0x54 [ 52.121055][ T5878] softirqs last enabled at (272): [] __alloc_skb+0x1c0/0x610 [ 52.122521][ T5878] softirqs last disabled at (270): [] __alloc_skb+0x1a8/0x610 [ 52.123992][ T5878] ---[ end trace 0000000000000000 ]--- [ 52.125785][ T5878] skb len=0 data_len=0 headroom=160 headlen=0 tailroom=224 [ 52.125785][ T5878] end-tail=224 mac=(160,0) mac_len=0 net=(160,-1) trans=-1 [ 52.125785][ T5878] shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) [ 52.125785][ T5878] csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) [ 52.125785][ T5878] hash(0x0 sw=0 l4=0) proto=0x0003 pkttype=0 iif=0 [ 52.125785][ T5878] priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 [ 52.125785][ T5878] encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) [ 52.128840][ T5878] dev name=tunl0 feat=0x0000000e401d4869 [ 52.128856][ T5878] sk family=17 type=2 proto=0 [ 52.143029][ T5871] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.209509][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 52.214671][ T5871] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.320588][ T808] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.329523][ T808] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.339560][ T40] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.343778][ T40] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.359853][ T9] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 52.360571][ T9] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 52.360583][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 52.360593][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 52.360655][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.361752][ T9] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 52.361761][ T9] usb 1-1: Product: syz [ 52.361768][ T9] usb 1-1: Manufacturer: syz [ 52.365442][ T9] cdc_wdm 1-1:1.0: skipping garbage [ 52.365451][ T9] cdc_wdm 1-1:1.0: skipping garbage [ 52.367654][ T9] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 52.367665][ T9] cdc_wdm 1-1:1.0: Unknown control protocol [ 53.049824][ T4724] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 53.050960][ T4724] Bluetooth: hci3: Injecting HCI hardware error event [ 53.051508][ T4724] Bluetooth: hci3: hardware error 0x00 [ 54.960341][ T4799] usb 1-1: USB disconnect, device number 13 [ 55.129322][ T4724] Bluetooth: hci3: Opcode 0x0c03 failed: -110