last executing test programs: 6m57.030829871s ago: executing program 4 (id=14): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{&(0x7f0000000100)={0xa, 0x4e24, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x400}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000180)="bf", 0x1}], 0x1}}], 0x1, 0x8090) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x4) syz_init_net_socket$rose(0xb, 0x5, 0x0) 6m55.290164133s ago: executing program 4 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000040)={0x4, 0x0, [{0xc0000000, 0x6, 0x5, 0x40, 0x3ff, 0x0, 0x1}, {0x80000019, 0x8, 0x0, 0x35, 0x3, 0xfff, 0x4}, {0xa, 0x5, 0x2, 0x3, 0x5, 0x3, 0x3d}, {0x4, 0x2, 0x0, 0x5, 0x87, 0xd, 0x3}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) sched_setattr(0x0, 0x0, 0x0) unshare(0x22020600) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000004b000000180100002020702500000000002020207b1af8ff00000000bfa100020000000007010000f8ffffffb702000008000000b7030000faffffff850000002d00000085000000070000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) ioctl(r2, 0x8b21, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000140)={0x16, 0x0, [{0x80000008, 0x2, 0x4, 0x2, 0x10, 0x2, 0x101}, {0xd, 0x8, 0x4, 0x9, 0x2, 0x4, 0xd}, {0x80000008, 0x7, 0x6, 0x401, 0xb5, 0x2, 0x10}]}) 6m55.030360689s ago: executing program 4 (id=19): r0 = syz_open_dev$loop(&(0x7f00000017c0), 0x7fffffffffffffff, 0x1) fallocate(r0, 0x0, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r1 = getpid() r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010009081000418e00000d04fcff", 0x58}], 0x1) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_usb_connect(0x0, 0x5a, &(0x7f0000000100)=ANY=[@ANYRES64=r0], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x200006, 0x8, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) inotify_init() mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0x9aa9b000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$netlink(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x1, 0x0, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) 6m48.200951614s ago: executing program 4 (id=28): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000240), 0x2860) syz_open_dev$I2C(&(0x7f0000000080), 0x7, 0x800) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r7, r6, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r7}, &(0x7f0000000000), &(0x7f0000000080)=r3}, 0x20) recvmsg$unix(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x0) sendmsg$inet(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x0) r8 = syz_io_uring_setup(0x66e, &(0x7f0000000000)={0x0, 0xa9cc, 0x10100, 0x0, 0x21d}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x2}) io_uring_enter(r8, 0x567, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="18000000000000000000000000000000611930000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0c", 0xe) r12 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r13) sendmsg$IEEE802154_SET_MACPARAMS(r13, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x1c, r14, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) 6m42.55561931s ago: executing program 4 (id=36): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_io_uring_setup(0x132a, 0x0, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, 0x0, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xfffffffffffffd90) io_uring_setup(0x15de, 0x0) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) quotactl$Q_QUOTAON(0xffffffff80000201, 0x0, 0xffffffffffffffff, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) r7 = accept$unix(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000080)=0x6e) recvmmsg$unix(r7, &(0x7f0000003740)=[{{&(0x7f0000000280), 0x6e, &(0x7f0000001480)=[{&(0x7f0000000340)=""/167, 0xa7}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/125, 0x7d}], 0x3, &(0x7f00000014c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x78}}, {{&(0x7f0000001540), 0x6e, &(0x7f0000001a80)=[{&(0x7f00000015c0)}, {&(0x7f0000001600)=""/250, 0xfa}, {0x0}, {&(0x7f0000001700)=""/75, 0x4b}, {&(0x7f0000001780)=""/43, 0x2b}, {&(0x7f00000017c0)=""/214, 0xd6}, {&(0x7f00000018c0)=""/166, 0xa6}, {&(0x7f0000001980)}, {&(0x7f00000019c0)=""/20, 0x14}, {&(0x7f0000001a00)=""/108, 0x6c}], 0xa}}, {{&(0x7f0000001b40), 0x6e, &(0x7f0000003080)=[{&(0x7f0000001bc0)=""/146, 0x92}, {&(0x7f0000001c80)=""/120, 0x78}, {&(0x7f0000001d00)=""/114, 0x72}, {&(0x7f0000001d80)=""/186, 0xba}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/80, 0x50}, {&(0x7f0000002ec0)=""/68, 0x44}, {&(0x7f0000002f40)=""/180, 0xb4}, {&(0x7f0000003000)=""/114, 0x72}], 0x9, &(0x7f0000003140)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f00000031c0), 0x6e, &(0x7f00000035c0)=[{&(0x7f0000003240)=""/195, 0xc3}, {&(0x7f0000003340)=""/24, 0x18}, {&(0x7f0000003380)=""/239, 0xef}, {&(0x7f0000003480)=""/93, 0x5d}, {&(0x7f0000003500)=""/174, 0xae}], 0x5, &(0x7f0000003640)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}], 0x4, 0x2000, &(0x7f0000003840)={0x0, 0x3938700}) pread64(0xffffffffffffffff, 0x0, 0x0, 0x10001) syz_usb_control_io$hid(r6, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00222800000096231313db9533ec070c00000028070900be008300"], 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a00000004000000050000000500000002000000", @ANYRESHEX, @ANYBLOB='\x00'/20, @ANYRES64=r3, @ANYBLOB="000000000000136dc1fa000000000000000000ebff00000000"], 0x50) 6m38.323037055s ago: executing program 4 (id=42): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000001040)=ANY=[@ANYBLOB="00000108000021"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000340)={0x10006, 0x0, 0x3, 0x1, 0x1}, 0x8) 6m23.070913096s ago: executing program 32 (id=42): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000001040)=ANY=[@ANYBLOB="00000108000021"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000340)={0x10006, 0x0, 0x3, 0x1, 0x1}, 0x8) 6m1.987989876s ago: executing program 1 (id=94): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176, 0x0, 0x0, 0x60000000}}], 0x400000000000172, 0x4000000) 5m55.154356249s ago: executing program 1 (id=102): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x400) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r2, 0xc06c4124, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}) 5m53.348285228s ago: executing program 1 (id=105): ptrace(0x10, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setxattr$incfs_metadata(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040), 0x0, 0x20000, 0x2) 5m51.446647157s ago: executing program 1 (id=107): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x38}}, 0x0) bind$inet6(r1, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020200600000000000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000d0000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='btrfs\x00', 0x210818, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c4b20710200e01015a7a8cd7030109021b00010000000009040000012e6d0a000905ff276be15627"], 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r5, 0x89f9, &(0x7f0000000080)={'sit0\x00', 0x0}) r6 = socket(0x10, 0x1, 0x0) sendmsg$nl_route(r6, &(0x7f00000004c0)={0xffffffffffffffff, 0x0, &(0x7f0000000480)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000006800010000000000fedbdf2502000000000000000800bdc706a7fff704000b00"], 0x24}}, 0x0) setsockopt$inet6_udp_encap(r6, 0x11, 0x64, &(0x7f0000000040)=0x5, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) 5m43.354635795s ago: executing program 1 (id=114): syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_le_credits={{0x16, 0xf, 0x4}, {0xfff, 0x5}}}}, 0x11) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4, @private=0xa010102}, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, &(0x7f0000000300)={0x5, [[0x0, 0x42212d2b, 0x8, 0x33, 0x5, 0x6e8f, 0x6, 0x7], [0x2, 0x7, 0x5, 0x3, 0x4, 0xb, 0x6, 0x7], [0x0, 0x3, 0x0, 0x8, 0x8f59, 0x401, 0x8, 0x5]], '\x00', [{0x5, 0x2, 0x1, 0x0, 0x1, 0x1}, {0x81, 0x7, 0x1, 0x0, 0x1, 0x1}, {0x499, 0x80000000, 0x1, 0x1, 0x0, 0x1}, {0x45f, 0x8, 0x1, 0x1, 0x0, 0x1}, {0x6, 0x4, 0x1, 0x1, 0x0, 0x1}, {0x9, 0xc, 0x1, 0x1, 0x0, 0x1}, {0xb39, 0x200, 0x1, 0x0, 0x0, 0x1}, {0x5, 0x9, 0x0, 0x1, 0x1, 0x1}, {0xa, 0x2, 0x0, 0x1, 0x1}, {0x9af, 0x10001}, {0xff8b, 0xc, 0x1}, {0x3ff, 0x400, 0x1, 0x0, 0x1}], '\x00', 0x3}) bind$can_raw(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000280)) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) timer_create(0x9, 0x0, &(0x7f0000bbdffc)=0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0xf, 0x0, @tid=r4}) timer_settime(r6, 0x0, &(0x7f0000000000), 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LOG_PREFIX={0x6, 0x2, 0x1, 0x0, ':\x00'}, @NFTA_LOG_FLAGS={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc0}}, 0x0) 5m42.056483296s ago: executing program 1 (id=115): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x50, 0x7fff7ffc}]}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000000)={'pimreg1\x00', 0x8}) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ptrace(0x10, r4) setrlimit(0x6, &(0x7f0000000080)={0x3, 0x9}) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100)=0xfffffffb, 0x4) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x1e) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x402, 0x9, 0xfffffffffffffffd, 0x2, 0x4, 0x0, 0x4002004c0, 0x1004, 0x8080000000000000, 0x100000000c595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x1400000000000, 0x8d], 0xe000, 0x2010d3}) 5m26.826547944s ago: executing program 33 (id=115): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x50, 0x7fff7ffc}]}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000000)={'pimreg1\x00', 0x8}) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ptrace(0x10, r4) setrlimit(0x6, &(0x7f0000000080)={0x3, 0x9}) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100)=0xfffffffb, 0x4) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x1e) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x402, 0x9, 0xfffffffffffffffd, 0x2, 0x4, 0x0, 0x4002004c0, 0x1004, 0x8080000000000000, 0x100000000c595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x1400000000000, 0x8d], 0xe000, 0x2010d3}) 3m27.847683157s ago: executing program 2 (id=272): getpid() r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c000000130001002dbd7000fedbdf2500000000", @ANYRES32, @ANYBLOB="2420000020190000080013"], 0x3c}, 0x1, 0x0, 0x0, 0xc0000c1}, 0x20048000) ppoll(0x0, 0x48, &(0x7f0000000000)={0x77359400}, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000b40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}, @NFT_MSG_NEWSETELEM={0x2f0, 0xc, 0xa, 0x500, 0x0, 0x0, {0x5, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x2b0, 0x3, 0x0, 0x1, [{0x1d8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x1d4, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x20, 0x1, "a44ea3ea21465ea70442c7b0494703b5d9036a9acb202e88040b3908"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x90, 0x1, "0d4818aeac5485f636cac5a0fcbe0aed71d50dfa95042d27cd7b0a8731a27e474f30a8e2960fd7a8bad64a930973c4a53b7e74520b81909e27a7f805b92e71261c683956d3a3e2438d721f53e5e36a7f128cfc54666f7f038346d7d9483d48a8d00e46e3f5bd300293b34c21a28c9c5cbf692197603275370d7b2cc59baa327091638d16c76ea4a17de4959e"}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x86, 0x1, "2a0ce4f8814340fb48981a540b6949267de3ae97ce9d4ab3a71dfbb263de4d949fbca58ddce65b65196de0b30b692d5b948fbc6357fabcec674d397474c4257ab8e6efdf89df14a9d852569c010dba51116a533e7332b37818eb405e2a55330e0c8f9d3771a05abf720fc8b12feefdf98b1ea099c03de21ed6721903c1482c42358f"}]}]}, {0xd4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x4a, 0x6, 0x1, 0x0, "108be967853fb2d6599e763c7372758d40ff9342dd36a299c53b2ed10b86871c1d8af2972448185d598a3dc5fe10961c76604717d7c46025bdc1901d1051023394469a6cb711"}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, [""]}}}, @NFTA_SET_ELEM_EXPRESSIONS={0x64, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tunnel={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}, {0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz2\x00'}, @NFTA_LOOKUP_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x32c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x2}}) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) r3 = socket$inet6(0xa, 0x2, 0x88) r4 = socket$inet(0x2, 0x1, 0x100) setsockopt$sock_int(r4, 0x1, 0x48, &(0x7f0000000040)=0x3, 0x4) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0xd}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) 3m25.444777215s ago: executing program 2 (id=276): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req={0xffffff80, 0xffff, 0x2, 0x86f5}, 0x10) syz_usb_connect(0x5, 0x24, &(0x7f0000004a40)={{0x12, 0x1, 0x110, 0x1, 0xc, 0x9e, 0x40, 0x5c6, 0x9069, 0x3d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0xb, 0x70, 0xa, [{{0x9, 0x4, 0x3e, 0x7, 0x0, 0x2, 0x2, 0x1, 0x4}}]}}]}}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) 3m22.881239856s ago: executing program 2 (id=279): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000008001a80100003800c0005800800000000000000100003803000018005000c000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d80500060000000000130002006272696467655f696c6176655f30000007000200293a00000500060000000000080001000000000018000180140004004d2906d0880fc8acc30fe2020f9849675000018014000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af080001000000000008000100000000006000018005000600000000000500060000000000080001000000000005000600000000000c00020073797a746e6c30000800010000000000130002006272696467655f736c6176655f30000014000500e078d277f38ed3a40a448f3f6b6763e8e0000c80080025000000000005000600000000001400190003dd96197aca85b64424a37dbda7b69414000700eb050e1ca400188004000100000000000800"], 0x270}, 0x1, 0x0, 0x0, 0x40015}, 0x0) connect$can_j1939(r0, &(0x7f0000000180)={0x1d, r2, 0x3, {0x1, 0x0, 0x1}, 0xff}, 0x18) 3m22.671285449s ago: executing program 2 (id=281): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 3m22.520848294s ago: executing program 2 (id=283): openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x40281, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x4d, 0x0, &(0x7f0000000100)) fcntl$setownex(r0, 0xf, &(0x7f0000000140)={0x2}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x5, 0x8, 0x9}, 0x50) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) r6 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, 0x0, 0x0) 3m20.636527028s ago: executing program 2 (id=287): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0x3}, {0xa, 0xffe0}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x12000000}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x9}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3m19.361467798s ago: executing program 34 (id=287): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0x3}, {0xa, 0xffe0}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x12000000}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x9}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 20.734251504s ago: executing program 5 (id=62): r0 = syz_io_uring_setup(0x5c6, 0x0, &(0x7f0000000300), &(0x7f0000000580)) r1 = eventfd2(0x97d, 0x1) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000001c0)=r1, 0x1) 20.543043137s ago: executing program 5 (id=463): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x60442, 0x0) r2 = dup(r1) ioctl$PTP_PIN_GETFUNC2(r2, 0xc0603d0f, &(0x7f0000000080)={'\x00', 0x800, 0x1, 0x92}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040bd28090900000000000109022600cc0000000009040000020300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000000c0)={0x18, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) openat$mice(0xffffffffffffff9c, 0x0, 0x0) sendmsg$NL80211_CMD_TESTMODE(r2, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xec, r3, 0x2, 0x70bd27, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0xd5, 0x45, "abee14e1c04c8be55eb2eb61bce5d6aec976f0b02db502d54d63504e80169fc4f25ccd8d17516765625db910a61b9a6098fc5646885fafce991a165889b407d6d3998d067785d7661e8e8eef57aa645528599d534c895737f4bd886807cf601d3a8f3a47d59815c027cfa1170849e25b8be0fd1c0d37ed89419b8653246641df876498d2ef9f7109a5ff51a53eadb448939366e9f4fcbb446463f6da312839f0992b0094d1377080e35e90214454b354a72ba9d9495d680a34d5ae7320e9fc371024266408316f8a165298d94cb950ccfa"}]}, 0xec}, 0x1, 0x0, 0x0, 0x80}, 0x20004065) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x3b}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="58000000030601080000000000000000010000030900020073797a3200000000"], 0x58}, 0x1, 0x0, 0x0, 0x28000}, 0x4000) r5 = syz_open_dev$vcsu(&(0x7f0000000040), 0x8001, 0x200) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r5, 0x80047210, &(0x7f00000000c0)) 12.958624631s ago: executing program 6 (id=474): openat$ptmx(0xffffffffffffff9c, 0x0, 0xa0402, 0x0) io_pgetevents(0x0, 0x9, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x0}) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x9) sched_setscheduler(r0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0xa5) r4 = socket$netlink(0x10, 0x3, 0x10) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00002ba000/0x2000)=nil, 0x2000}, 0x6}) bind$netlink(r4, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000640)=0x17ff, 0x4) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000002240), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') lsetxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) 12.876527943s ago: executing program 7 (id=475): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000080000000850000002b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000000000000000000000000001802"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) setfsgid(0xee00) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, r3, 0x5, 0x0, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x1}]}, 0x38}}, 0x0) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x100, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000340)={0x2, @win={{0x1, 0x6, 0x5, 0xffff}, 0x4, 0x5, 0x0, 0xbb8e, 0x0}}) mlockall(0x3) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x132, 0xffffffffffffffff, 0x8000000) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ff2000/0x3000)=nil) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000300)={0x68, r7, 0x1, 0xfffffffd, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME={0x4b, 0x33, @action={{{}, {}, @broadcast, @device_a, @random="777347e97c11"}, @sp_mp_confirm={0xf, 0x2, {0x2100, @default, {0x1, 0x3, [{0xc}, {0x2, 0x1}, {0x24, 0x1}]}, @val={0x72, 0x6}, @val={0x2d, 0x1a, {0x20, 0x1, 0x2, 0x0, {0x5, 0x80, 0x0, 0x6, 0x0, 0x0, 0x1, 0x3, 0x1}, 0x1, 0x6, 0x29}}}}}}]}, 0x68}}, 0x20000090) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="c1dfb061cd21d3084d94d35486dd", 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 12.456413832s ago: executing program 3 (id=478): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x88fb}, @void, @eth={@empty, @random="20dabc77d493", @val={@val={0x88a8, 0x0, 0x0, 0x3}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x2000, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x17c1, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x1, 0x100, @void}}}}}}}}, 0x3a) 11.020921055s ago: executing program 0 (id=480): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x50, 0x7fff7ffc}]}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000000)={'pimreg1\x00', 0x8}) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) setrlimit(0x6, &(0x7f0000000080)={0x3, 0x9}) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100)=0xfffffffb, 0x4) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x1e) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x5c, 0x30, 0x1, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9c, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x0) r6 = openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000200)={[0x402, 0x9, 0xfffffffffffffffd, 0x2, 0x4, 0x0, 0x4002004c0, 0x1004, 0x8080000000000000, 0x100000000c595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x1400000000000, 0x8d], 0xe000, 0x2010d3}) ioctl$KVM_RUN(r8, 0xae80, 0x0) 10.755002513s ago: executing program 5 (id=481): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xe9e2, 0x800, 0x1, 0x40000330}, &(0x7f0000000dc0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1, 0x8}) io_uring_enter(r2, 0x2ffb, 0x0, 0x0, 0x0, 0x0) 9.141881104s ago: executing program 7 (id=482): syz_usb_connect$uac1(0x0, 0xa2, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000406b1d0101400001020301090290000301038000090480000001010000042401"], 0x0) open(&(0x7f0000000040)='./file0\x00', 0x800, 0x48) 8.000030831s ago: executing program 3 (id=483): syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x1d, 0x2, 0x6) bind$inet(r0, &(0x7f00000000c0)={0x1d, 0x4e20, @loopback}, 0x10) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2002, 0x0) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000380)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r1, &(0x7f0000000180)="de", 0x1, 0x3e7ffffffc, 0x0, 0x10}]) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000240)={'ip6gre0\x00', &(0x7f00000001c0)={'syztnl2\x00', r3, 0x2f, 0x3, 0x4, 0x3, 0x42, @ipv4={'\x00', '\xff\xff', @loopback}, @private2, 0x10, 0x40, 0xe6d4, 0xffffffff}}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000b00)=ANY=[@ANYBLOB="9feb010018000000000000003c000000000000000000000d"], 0x0, 0x56, 0x0, 0x1, 0xce}, 0x28) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x83, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000340)={0x1, 0x0, [{0x80000008, 0x0, 0x7, 0x3, 0xffff7ffe, 0x4, 0x5}]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) unshare(0x26000400) r7 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r7, 0x28, 0x6, 0x0, 0x0) 7.639005203s ago: executing program 0 (id=484): r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e22, @empty}, {0x2, 0x4e20, @broadcast}, 0xc5, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000180)='veth1_to_bridge\x00', 0x7, 0x2, 0x9}) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x63, 0x1, 0x1, 0xd8}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) (async) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000000)=0x3, 0x4) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="000000000000000044001280"], 0xc3}, 0x1, 0x100000000000000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYBLOB="00008000000000001800348005"], 0x38}, 0x1, 0x300}, 0x0) (async) r2 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000140), 0x4924b68, 0x0) syz_emit_ethernet(0x152, &(0x7f0000000140)={@broadcast, @multicast, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, '\x00', 0x118, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @local}, @local, {[], @time_exceed={0x3, 0x1, 0x0, 0x4, '\x00', {0x8, 0x6, "98c878", 0x9, 0x0, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0={0xfc, 0x0, '\x00', 0x81}, [@routing={0x0, 0x2, 0x2, 0xff, 0x0, [@private2={0xfc, 0x2, '\x00', 0x1}]}], "a1f0354991e4c324420f2bf9f55302b84d61a5980a51ea715ac01b6bb182337de35095f3ed27202c55600545c8459294f896ee68104a253073667206640103b91c9b4950412f1079e684f12ffd9a6863174da997ab75ed1d438f3c01eedd4bd609831e2682fbbd3a9ac8473bf8f4579db846471e688bc72442b2ecde8c60cffc645cac6209b8aef05cafe63075db98106eb7bebde9c2fca23d407e9552e6b17c7d2f3c14d4db8aceb16b8090d6282106697c009d1eaf2ec18a2273c8c5c0e895c7d92149d263a6d275bb18f1e57af440"}}}}}}}, 0x0) 6.503113708s ago: executing program 3 (id=485): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) readv(r0, &(0x7f0000000b00)=[{&(0x7f00000005c0)=""/198, 0xc6}, {&(0x7f0000000480)=""/88, 0x58}, {&(0x7f0000000500)=""/2, 0x2}, {&(0x7f0000000780)=""/13, 0xd}, {&(0x7f0000000a80)=""/122, 0x7a}, {&(0x7f00000007c0)=""/11, 0xb}], 0x6) 6.051366873s ago: executing program 7 (id=486): accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x60) (async) r0 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x60) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)=@ethtool_ts_info}) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)=@ethtool_ts_info}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0xe3}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0xe3}}, './file0\x00'}) sendmsg$NL80211_CMD_GET_REG(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x0, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0xb5}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004010}, 0x0) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000002, 0x2010, 0xffffffffffffffff, 0x80000000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000500)={0x8, 0x0}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x19, 0x16, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ldst={0x2, 0x3, 0x3, 0x6, 0x1, 0x1, 0x4}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x4}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @ldst={0x0, 0x0, 0x3, 0x5, 0xb, 0xffffffffffffffff, 0x8}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000340)='GPL\x00', 0x80, 0xda, &(0x7f0000000380)=""/218, 0x41000, 0x61, '\x00', 0x0, @fallback=0x23, r1, 0x8, &(0x7f0000000480)={0x1, 0x4}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xc, 0x2000, 0x9}, 0x10, r2, 0xffffffffffffffff, 0x7, &(0x7f0000000540)=[r1], &(0x7f0000000580)=[{0x5, 0x3, 0x4, 0x4}, {0x5, 0x5, 0x6, 0xc}, {0x1, 0x2, 0x0, 0x9}, {0x1, 0x1, 0x8, 0x9}, {0x1, 0x1, 0x8, 0x1}, {0x0, 0x1, 0x2, 0x5}, {0x1, 0x5, 0xd, 0x1}], 0x10, 0xdce}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={r1, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000006c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, &(0x7f0000000700)=[0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xf3, &(0x7f0000000780)=[{}, {}], 0x10, 0x10, &(0x7f00000007c0), &(0x7f0000000800), 0x8, 0x13, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={r1, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000006c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, &(0x7f0000000700)=[0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xf3, &(0x7f0000000780)=[{}, {}], 0x10, 0x10, &(0x7f00000007c0), &(0x7f0000000800), 0x8, 0x13, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000009c0)=r4, 0x4) (async) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000009c0)=r4, 0x4) unshare(0x10040000) r6 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000a00)=0xc0) (async) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000a00)=0xc0) io_uring_register$IORING_UNREGISTER_EVENTFD(r1, 0x5, 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r1, 0x5, 0x0, 0x0) creat(&(0x7f0000000a40)='./file0\x00', 0x40) socket(0x2c, 0x6, 0x4) unshare(0x100) setuid(0x0) readahead(r3, 0x0, 0xd4) (async) readahead(r3, 0x0, 0xd4) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a80)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000ac0)={r3, r7, 0x6, 0x0, @val=@netfilter={0x0, 0x1, 0x3}}, 0x20) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000b00), 0xc00, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000b40), 0x200801, 0x0) quotactl_fd$Q_SYNC(0xffffffffffffffff, 0xffffffff80000101, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000b80)={0x5, r5, 0x2}) socket$key(0xf, 0x3, 0x2) syz_usb_connect(0x0, 0xbcd, &(0x7f0000000bc0)={{0x12, 0x1, 0x200, 0x1e, 0x5b, 0x7b, 0x0, 0xdb0, 0x871c, 0x690f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xbbb, 0x3, 0x6, 0xfe, 0x0, 0x5, [{{0x9, 0x4, 0x95, 0x2, 0x3, 0x3f, 0xdb, 0x3, 0x58, [@uac_as={[@format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x7, 0xfffa, 0x0, "5bbb4fb08c9366ad"}, @as_header={0x7, 0x24, 0x1, 0x5, 0x2, 0x1002}]}, @uac_as={[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x10, 0x2, 0x6, 0xe, "857a"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x3, 0x2, 0x28, 0x9, "", "c088b0"}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x27, 0x4, 0xf6, 0x2, "e8d2d5"}, @as_header={0x7, 0x24, 0x1, 0x7f, 0x5c, 0x1001}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x1, 0x9, 0x4, "162d"}, @as_header={0x7, 0x24, 0x1, 0x40, 0xb}]}], [{{0x9, 0x5, 0x9, 0x10, 0x200, 0x6, 0x2, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xff, 0x9}]}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0x20, 0x9, 0x87}}, {{0x9, 0x5, 0x80, 0x1, 0x200, 0x4, 0x3, 0x4, [@generic={0xfd, 0x31, "6a36c75b72a83a80c7fb2f7fcec6273b708893b33ed01a907dac8b1df767ae48b40f53aea04cfacaee3b917daa5255347e3ff9106c1ad504b84f59ce8d2f628b5a3ee1be83134a87a126586d7c6ec5f750a442fc98b101f087d1d849cf4fb5df1af3639d885425a5341930bb45f383bc37ef8b0f6b898cc556d8ddea5b4204808a0722675ffd10880ca18a4371771e215a4c45256f40159555d08898845bd844d03c04eb39d2c5d7a8683b36fb4bbde107105fad4342e919f65fb328b878ce775f25e4e6cbdd8f1396f1881c0f2af2a581d15d4de8b7e9c09681c1440f5cca55a29da8e04e588b2cb22a78e63ee8ea83e5ab39ec21f62e89c181b0"}]}}]}}, {{0x9, 0x4, 0xbf, 0x1, 0x9, 0x18, 0x2, 0x1b, 0x8, [@cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "0423ab"}, {0x5, 0x24, 0x0, 0xe}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x2, 0x7, 0x3}, [@mdlm_detail={0x91, 0x24, 0x13, 0xd, "2740a6a569c002360e56b737269f221239add99862c7d624b544e2bf7b7648d2d171eec9e1a44bc181c16f0e13c7911f254aebef1ccb9bebc7870a7bc5e2b796bd7bdfd6e357d99f6a29000141d64658c126722414f897a6098a1873681c4b8461bb263d27e8ae66c5251e0c0d4b97cb8d74ca552b03da63bca487a85282163c3de8b4037ff1bb97aca1c4b881"}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0x4}, @network_terminal={0x7, 0x24, 0xa, 0x0, 0x3, 0xc8, 0x7f}, @mdlm_detail={0x34, 0x24, 0x13, 0x8, "744b89600774882265691d98a0a97d67db546736f92c15079e8e6c9ace337ec72e1e08fddf2911e5fe56b9904fd00260"}, @mbim_extended={0x8, 0x24, 0x1c, 0x67b, 0x7, 0x62}]}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "26e7a3"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x8d7b, 0xfffb, 0xfbff, 0x10}, [@network_terminal={0x7, 0x24, 0xa, 0x6c, 0x8, 0x5b, 0xb}, @country_functional={0x8, 0x24, 0x7, 0x1, 0x5, [0x40]}, @country_functional={0xa, 0x24, 0x7, 0x7, 0x68, [0x7, 0xc]}, @mdlm_detail={0x3c, 0x24, 0x13, 0x5a, "63062cf3613495ee56f70862302fa0863d58a496efb1dd5c0aac05ec3da9766985f2e6c3951cc5d669c9022a027c482a1d61815262c46b5d"}, @country_functional={0xa, 0x24, 0x7, 0x4, 0x101, [0xffff, 0x1]}]}], [{{0x9, 0x5, 0x5, 0xc, 0x3e7, 0x9, 0xb, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x3, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0xfa, 0x1}]}}, {{0x9, 0x5, 0xb, 0x0, 0x8, 0x81, 0x6, 0x8f, [@generic={0x6b, 0x11, "6ad239f8f170ce2afb506fe6b1eddc817d38c8749cd477e33852ac4cb7934025142f1f9234cd4a76a9447271539aa6150fb294d722d51cea9d7917b20c5a4e9c32f211fc2ba5620df268325bc08c2fa118bbe83e10b338ae9e20ab0f776a9432440119b2de9ee1f25e"}, @generic={0xb3, 0x9, "cd2035383e8515878bbda286520610e71788e3786b28af33173acf449f9c98ac1cffb7e5091884bd4887168013f4d8692350ae91c20e71f6f8e4c83c54cae135756a8f9f907e87e347a04b24acfc6aab21c664c6f5e23079834fc20a9fbbb9289dc678d2448fbb3e9e4dc7357ef0951fa13d1572df1b99f3decb16bb3df47d82295186ec043dce9598b8ed109055a27d14fb908f2614785729f190629b4780186929f2894140d18b3de1711cc5c65d8a59"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x20, 0x2, 0xd6, 0x3}}, {{0x9, 0x5, 0xf, 0x4, 0x40, 0x1, 0x1, 0x0, [@generic={0xd3, 0x21, "9948b5fa1ffec05d3235ecb7f6699bfad9687ad9823079dbdb092dbb4bce374cd8c4766074351b7ef43d6b97a3e7aa334bcc90fae0b1ee0edc117ab4ede90d53d9b78bc81b00acb83dc7fbae9f6e4e4d2e3b8d77513b40f86992a889608fcb69862d4ecd708d2442dd5e6cf67e72c25ac8e81b1459da7d0d41c69b59a01ce1ca5250674409797df3dd1b2724a1b2c5e25e2e82fc0441e25bfc735eab2258f3202418964e763ba70b54e7ed79f0b55d81176431287f29c5bb775a6677882853c2aa64ca91bdac136ab95c259251b4d08b40"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0xbc, 0x9}]}}, {{0x9, 0x5, 0x4, 0x2, 0x8, 0x56, 0x0, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x20, 0x9, 0x6, 0x4, [@generic={0xc6, 0x31, "e1012fd4caffa73762ede44be21ec2a2478bb09a60fd6077e70bfb8de1cddf4a992f26a913ba08cccbb8c85b9786737f7e7e1a344702161d6f9614665553058f6a8c9183304eb762f76194381411c08725c584e4e0b69df5be2bba8b94b70a3f014f111f086aee19ac3f63f86693e173da8457a54b6e7c9f1c8ec3b815da019dee846070c8b2bffc3cd08dcfeef7fc0a4a329905c54f5ed1b23f846cced21ff2855350045d676f0d80bdc9bb9efcf88c6220f5e28bfb70c7d3fa50dbaee86a7a6721ef6c"}, @generic={0x76, 0x11, "70da71d601dab51a96f19d98e4c08d9a76fdc8b21dc89db950d1dbd13535cb1309abb2651c173065d07c331985e5225e2ae0085b96af634eb9b6105a080f24e60cc3aa61a14611caf5fb8528faeda7965a705eb6c9aaa6f4cc358cfabf9c051b8ba22b118086e61c13aeb4e23445924a8c11624f"}]}}, {{0x9, 0x5, 0xb, 0x2, 0x8, 0x8, 0x5}}, {{0x9, 0x5, 0xd, 0xc, 0x20, 0x17, 0x3, 0x5}}, {{0x9, 0x5, 0x4, 0x2, 0x8, 0x1, 0xc1, 0x8}}]}}, {{0x9, 0x4, 0xaa, 0xa1, 0x10, 0xff, 0x7c, 0x87, 0x6, [@cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, "ff"}, {0x5, 0x24, 0x0, 0x200}, {0xd, 0x24, 0xf, 0x1, 0x4, 0xfff7, 0xf, 0x3}, {0x6, 0x24, 0x1a, 0x200, 0x21}}], [{{0x9, 0x5, 0xe, 0x10, 0x200, 0x80, 0x6, 0x8, [@generic={0xe, 0x21, "f3d93a875a87b9920ce9550c"}, @generic={0xe, 0xb, "4bc91ae72b3cb12abc05d215"}]}}, {{0x9, 0x5, 0x9, 0x1, 0x3ff, 0xbc, 0x1, 0xf0, [@generic={0x7a, 0xa, "4f68f8fd31b4fcfdaaed341212e4f013d33e93ada56728493ada6f2f65f081a9d7d5a36b8c0a772ea7116b972382d51d964e3ca6250aca20b755b94b344798e1d1b1874bc9876a8ddeab2c9aed04e97991faf86af42b0354cb6cefbf9cd8dcdca51844f08cc74b1fcd815ca53df70d9ffb2061def4327957"}, @generic={0x7f, 0x7, "215ea218f3e243c1c66291e1d672575c4b1942703fe01bca6d168ea1bb6687811b201c667ceed66047b856dd2eddd9e283223e171d3325bb49753936cecd863d274662a4f99bd1e245b63ccaf20394d734c5e74078868e41989282e862ffa7b8d6272885b8f0dd2ce3b03e6087d391842f8bcb80234ceaebc5868db7ea"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x3ff, 0x4, 0x3}}, {{0x9, 0x5, 0x5, 0x10, 0x8, 0x6, 0x9, 0x2, [@generic={0x88, 0x23, "5f9ef5aeb60487bad4083b152d8f6a6c225a45975e8ec34986ae9d1c8b45ee7cfe19078dcb7dc6995af8364923cfb13159b53994c549d15cd814c29232c4542ec6ee29fab5870e9b2e5eb9eba37fd76698bff7ee3dbea0a9ee9e6abbcb3d44f58648ae0fc7a70390bea852dd800a0e016de2628b9c4e52fedca1aa69e093af80a3960c1df4f1"}, @generic={0x63, 0x4, "043e9c56635bf16cc267907151c180be22a8fb7d29a9efdf80da7b36305faef9021db29007c833381b51d09b7c9f9b14c64e1d9c85e9b3d4298b8d8743d6b5d36d451d155d2ed04300d8937d0744034e958dfdb157ea51f69f126903a1664983c2"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x59f, 0xd, 0x8, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0xb, 0xfff9}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0xa, 0xe0}]}}, {{0x9, 0x5, 0xe, 0xc, 0x3ff, 0x80, 0x8, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x40, 0x9}, @generic={0x4b, 0x7, "4f5a812eb9252253f2f9aaaeab69cfaea31998b709dbb3115e98c986745b095b3c138cee51582fa6568f39a71db7cf544866e4a81dcbd765193a5e44735df60e7b369cb7e0ca1a1f83"}]}}, {{0x9, 0x5, 0x3, 0x1, 0x400, 0x9, 0x80, 0x0, [@generic={0x4c, 0x24, "7ccd7638e52ce98822fbcb02491e20abeaeaec71e51f7c217a23437fe9676f9b731245f58b2232ccfc86750eb23e0fda4ab83cb701835c14d661d0ffea28add92407c828084f5ca865b2"}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0xcf, 0x5}]}}, {{0x9, 0x5, 0x7, 0x2, 0x20, 0x3, 0x9, 0x8, [@generic={0x26, 0xe, "9923d9365667083e2f2b2c6eeb86a4a4fe6b567c092b8e6ff87cc5a7c365acca7b5d097a"}]}}, {{0x9, 0x5, 0x9, 0x1, 0x400, 0xc0, 0x5, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x67, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x7, 0x5}]}}, {{0x9, 0x5, 0x8, 0x3, 0x400, 0xe, 0x1b, 0x2a, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0x4a2}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x0, 0x3}]}}, {{0x9, 0x5, 0x5, 0x3, 0x20, 0x3, 0xc, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x53, 0xf}]}}, {{0x9, 0x5, 0x8, 0x8, 0x200, 0x8, 0x9, 0x6, [@generic={0xc0, 0xf, "1ca502d9d697df438661f52ed43e979fa3c0f262c8dc50db53b9b9a35afe5b928eeede66f87bafeceb4bdd9b5e48cca49e88712aadb0fa93cf8aa5989606570d1e9e21d82179afb800693c0f37fccd42e543be81ac956584fc291de7ac9071349d43fc7365f9cc20a6d5bf52447c5ce4c9bf71455ef58f596a28c5f1939d64cd32a3f94a583b9384bcbb403af5e30c7b5d41c08cfad1de210facfcf18df56539353324f4e042d4a7aab07fb7d89460a1a07b3e0e11447d9d40c0d82dd504"}]}}, {{0x9, 0x5, 0x1, 0x0, 0x8, 0x2c, 0x8, 0x4}}, {{0x9, 0x5, 0x5, 0x8, 0x200, 0x4, 0x5, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x80, 0x57}]}}, {{0x9, 0x5, 0x3, 0x3, 0x400, 0xa0, 0x1c, 0x8}}, {{0x9, 0x5, 0xf, 0x8, 0x40, 0x9, 0x7, 0xaf, [@generic={0xb0, 0x22, "3898614cea0f1c8ee24aa4ec8393770cce3d17428407e5074f17de8eb55174ea86a49125bfc4d55b4dba271b78134383c68e9051c0947e260a7171720e4e12a5fc47e444a74616fe599bdcc0d559e6df97d710cf984ca6df4e2ae9680dc2652f78bc57a18c81b3df501aca6fcd74d65f701a5c35fe6d35098c288b6996091ddf3e4cf04e1c61ca7ed9f718c99cefae6f6c52db6bf2f365b1bf4ebdff2c74930ca3bb6d15f094716ede0b733359a6"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x4, 0x1}]}}]}}]}}]}}, &(0x7f0000001980)={0xa, &(0x7f00000017c0)={0xa, 0x6, 0x200, 0xf8, 0xfc, 0xa, 0x40, 0x54}, 0x20, &(0x7f0000001800)={0x5, 0xf, 0x20, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x7, "c0a32f3cda9d29014b7b9ef88bc315c7"}, @ext_cap={0x7, 0x10, 0x2, 0x14, 0x6, 0x9}]}, 0x2, [{0xd3, &(0x7f0000001840)=@string={0xd3, 0x3, "15bcd26fbe692bd860c0b27f6a50a165b069723944362774ae81a90a1c558a400665f13cac9bfb83b9c36c66cb1a7cdad383359119c68523e93bad891e4af8382e9d0081110d4a79dfbc026ad8a3921313a78d3901b9c54868c65f7915993c800d7c49ee3fec8d86f309579254e8a59f77cf4c35c70c5c6fce74d8c0d435ac1ffa7c2635110eaf9fe3a1095dd8d433e3564ee244a6ae5686c646a7da732dee4e698828f6afc29386cb24968dfdccf4c2f24142fbcd4610e79bddfd71d6b5cc1e71921c6dd9502a5ed266ca8bac8eac0442"}}, {0x1f, &(0x7f0000001940)=@string={0x1f, 0x3, "56df5b1476878ab96f0c3a781b34b8b6f31dcfc4b1748099785fdd9619"}}]}) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001a00)=@generic={&(0x7f00000019c0)='./file0\x00', r8}, 0x18) (async) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001a00)=@generic={&(0x7f00000019c0)='./file0\x00', r8}, 0x18) ioctl$TIOCL_PASTESEL(r8, 0x541c, &(0x7f0000001a40)) unshare(0x32040800) (async) unshare(0x32040800) socket$nl_crypto(0x10, 0x3, 0x15) 5.861690114s ago: executing program 6 (id=487): mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000080)={0x4, 0x2, 0x340000000000000, 0x0, 0x2, 0xb, 0x4, 0x9, 0x7ffffffc}) 5.595046349s ago: executing program 6 (id=488): r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x0, 0x200000009}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) pread64(r0, 0x0, 0x0, 0x78f2a36b) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000300)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000380)={0x0, 0x0, r2, r3, 0x3, 0x1f5, 0x0, 0x0, {0x4, 0xfffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x92f, 0x8001, 0xfffffffa, "b4bc323ef77d1f000071849800000000dfff00"}}) 5.594686443s ago: executing program 0 (id=489): mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xfffffffffffffffd, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1041, 0x178d9}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_FWMARK={0x8, 0x14, 0x3}]}}}]}, 0x3c}, 0x1, 0x8100, 0x0, 0x40840}, 0x1800c85c) ioctl$SNDCTL_TMR_SELECT(0xffffffffffffffff, 0x40045408) open(&(0x7f0000000200)='./file0\x00', 0x4008040, 0x0) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r3, 0x0, r2, 0x0, 0x6, 0x0) write(r2, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r4 = io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xc8df, 0xc000, 0xa, 0x20002f7}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_GET(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000010901"], 0x14}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) listen(r6, 0x2) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) 5.480002318s ago: executing program 3 (id=490): bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xffff, @loopback}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c00000010003df600"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001400030064766d727009000000000000000000001800128008000100707070000c00028008000100"], 0x4c}}, 0x0) pipe2(0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vxcan1\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0x5, 0xfffffffc, 0x4, 0x5e0c, r2, 0x5, '\x00', r3, 0xffffffffffffffff, 0x4, 0x5, 0x1, 0xb}, 0x50) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioprio_set$pid(0x2, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002140)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in=@rand_addr=0x64010100, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x3, 0x7e, 0x0, 0x80, 0xa0}, {@in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x4d6, 0x33}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffed, 0x3}, {0x0, 0x0, 0x2, 0xfffbfffffffffffe}, {0x0, 0x3, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe55286f1921f74be}, 0x0, 0x1a0b1}}, 0xf8}, 0x1, 0x0, 0x0, 0x20054040}, 0x0) r4 = io_uring_setup(0x780, &(0x7f0000000040)={0x0, 0x20c89f, 0x1c881, 0x1, 0xd1}) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x5, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="85000000ad"], 0x0, 0x8}, 0x94) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) 5.371817585s ago: executing program 6 (id=491): socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1840, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x4e6fee4953b126d2, 0x3}}, 0x20) r3 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(r3, r2, 0x0, 0x40001) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) 4.93530794s ago: executing program 3 (id=492): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000080000000850000002b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000000000000000000000000001802"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) setfsgid(0xee00) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, r3, 0x5, 0x0, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x1}]}, 0x38}}, 0x0) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x100, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000340)={0x2, @win={{0x1, 0x6, 0x5, 0xffff}, 0x4, 0x5, 0x0, 0xbb8e, 0x0}}) mlockall(0x3) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x132, 0xffffffffffffffff, 0x8000000) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ff2000/0x3000)=nil) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000300)={0x68, r7, 0x1, 0xfffffffd, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME={0x4b, 0x33, @action={{{}, {}, @broadcast, @device_a, @random="777347e97c11"}, @sp_mp_confirm={0xf, 0x2, {0x2100, @default, {0x1, 0x3, [{0xc}, {0x2, 0x1}, {0x24, 0x1}]}, @val={0x72, 0x6}, @val={0x2d, 0x1a, {0x20, 0x1, 0x2, 0x0, {0x5, 0x80, 0x0, 0x6, 0x0, 0x0, 0x1, 0x3, 0x1}, 0x1, 0x6, 0x29}}}}}}]}, 0x68}}, 0x20000090) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="c1dfb061cd21d3084d94d35486dd", 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.003032729s ago: executing program 0 (id=493): getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x3) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x804, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x9, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sock}, 0x94) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e00), 0xffffffffffffffff) execveat(r4, &(0x7f0000000240)='./file0\x00', &(0x7f00000004c0)={[&(0x7f0000000280)='{\x00', &(0x7f00000002c0)='$$+)\x00', &(0x7f0000000300)='*+\x00', &(0x7f0000000340)='802.15.4 MAC\x00', &(0x7f00000003c0)='#\x00', &(0x7f0000000400)='++\x00', &(0x7f0000000440)='&+\'.{#:.#&\x00', &(0x7f0000000480)='\x00']}, &(0x7f0000000580)={[&(0x7f0000000540)='-#]\x00']}, 0x1000) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000e40)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4040) sendmmsg$unix(r4, &(0x7f0000003140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x40001}}], 0x1, 0x20000000) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x0, '\x00', 0x0, r7, 0x4, 0x1, 0x3}, 0x50) r8 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, 0x0) mmap$binder(&(0x7f000023d000/0x2000)=nil, 0x2000, 0x1, 0x11, r8, 0x6) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r9, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000000100), 0x4) 3.929257462s ago: executing program 3 (id=494): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="5800000040001901feffffff00000000017c0000340041802d000a000229a2517945a71f852b20c694feb2c60d660ade200fff9c5408fbd224968e91f66612039a7624b7b50000000c0001800600060065310000040002"], 0x58}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000040000000000000000000300000a20000000000a05000000000000000000070000000900010073797a300000000044000000090a010400000000000000000700ffff08000a40000000030900020073797a31000000000900010073797a3000000000080005400000002105000d40"], 0xe8}, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000004c0)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6, 0x0, 0x0, 0x8010}], 0x1, 0x40800) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000800)={0x0, {0x7f, 0x81, 0x5, 0x6, 0x20000001, 0x7ffffffe}}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000ffe800"/20, @ANYRES32=0x0, @ANYRES8=r1, @ANYBLOB='\x00'/28], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0600000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="00000071740278621453c8000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000020000000000076dec9c07c9f04428b000000000000181100007edb55a9fc281c9a06973f8b4257098bd05477504a1428451697a9c2883e11addd027f0a219134ed3e97b16c53589f63f5ac0f1efa4a3c349f8ee5584318d044a92970b5bdb9e45715232a8c40bfec9944c798575a08f204666f2c9f55839710638872522c71ba61fcc20d1a89b1d873f659027a45b85e06a28ed379bb7b0dfd4f1c21f3e605c900fc30e3dbaf5c83a2a1c778404549f87e8054e5233cd0a3644853b4ccc9cf498351659f25d2f1c688aa50872dcf279a9af0d9966c3eba0ba7c38904752fffd01e8e30fa5e4f2a165f2dc6c3d48623f059f3a6ad43f79b", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000810000087b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085006e544518ced0a68b3d4b5b000003"], 0x0, 0x20000000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r8, 0x4) sendmsg$unix(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000001c0)={{0x0, 0x0, 0xfffd, 0x8001}, 'syz1\x00'}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000900)={'syz1\x00', {0x9, 0x0, 0x6}, 0x37b4, [0xfeff, 0x4, 0x9, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x3, 0x5, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x10000000, 0x10000000, 0xbffffffe, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x8, 0x1, 0x0, 0x9, 0x3, 0xffffffff, 0xfffffffe, 0x4, 0x80, 0x20, 0x101, 0x3a3, 0x0, 0x0, 0x0, 0x8, 0x2, 0xfffffffd, 0x0, 0x6, 0x0, 0x7, 0x1000, 0x6, 0x0, 0x2000000, 0x20004, 0x0, 0x0, 0x105, 0x0, 0x800000], [0x11, 0xffff0003, 0x7, 0x0, 0xffffffff, 0x9, 0xad9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, 0x4f3, 0x0, 0x4, 0xbb, 0x1, 0xfffffffc, 0x5, 0x800, 0x8001, 0xfffffffe, 0x0, 0x100, 0x40, 0x10000, 0xec6a, 0xca86, 0x40000000, 0xffffffff, 0xfffffffc, 0x8, 0xfffffffd, 0x7fffffff, 0xfffffffc, 0x1, 0x0, 0x0, 0x4, 0x0, 0x3, 0xfffffffc, 0x4, 0x18c, 0x0, 0xfffffffd, 0x4000002, 0x5, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x4, 0x9dd, 0x80, 0x8000, 0x40000004, 0x6, 0x3, 0x8f, 0x7], [0xe, 0x4, 0x0, 0x0, 0xffffffff, 0x1, 0x2000000, 0x0, 0xfff, 0xffff7fff, 0xfffffffd, 0x0, 0x6cd7, 0x0, 0x1, 0x6, 0x0, 0x0, 0x10000, 0x0, 0x2, 0x420, 0xc, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xfffffffc, 0x7, 0x5, 0x2af, 0x5, 0x9, 0x0, 0x10000, 0x3, 0x0, 0x0, 0x0, 0x8, 0x401, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x1, 0x0, 0xff, 0x4000005, 0x0, 0x4, 0x4, 0x400000, 0x0, 0x6, 0x0, 0x0, 0x1, 0xd, 0xffffffdb], [0x2, 0x0, 0x4, 0x6, 0x0, 0x401, 0x1000, 0x215, 0x4, 0x7ff, 0x100, 0x3, 0xa, 0xf862, 0x7d, 0x0, 0x3, 0x0, 0x7d, 0x5, 0x7fff, 0x3, 0x4, 0x71, 0x0, 0xfffffffe, 0x0, 0x0, 0x5d66, 0x1, 0x2, 0x9, 0x3, 0x0, 0x0, 0x6, 0xbfb6, 0x4, 0x4, 0x3, 0x0, 0xfffffffd, 0x1, 0xffffffff, 0x100, 0x74, 0x6, 0x3, 0xfffffffd, 0x53591a27, 0x3fffffd, 0x0, 0x0, 0x5, 0x400, 0x5, 0x9, 0x0, 0x0, 0x80000000, 0x1000000, 0x80000000, 0x5, 0x400]}, 0x45c) ioctl(r3, 0x8b2a, &(0x7f0000000040)) fchdir(r2) 2.76578451s ago: executing program 0 (id=495): getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x3) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x804, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x9, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sock}, 0x94) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e00), r5) execveat(r4, &(0x7f0000000240)='./file0\x00', &(0x7f00000004c0)={[&(0x7f0000000280)='{\x00', &(0x7f00000002c0)='$$+)\x00', &(0x7f0000000300)='*+\x00', &(0x7f0000000340)='802.15.4 MAC\x00', &(0x7f00000003c0)='#\x00', &(0x7f0000000400)='++\x00', &(0x7f0000000440)='&+\'.{#:.#&\x00', &(0x7f0000000480)='\x00']}, &(0x7f0000000580)={[&(0x7f0000000540)='-#]\x00']}, 0x1000) sendmsg$IEEE802154_LIST_PHY(r6, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000e40)={0x14, r7, 0x1, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4040) sendmmsg$unix(r4, &(0x7f0000003140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x40001}}], 0x1, 0x20000000) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x3}, 0x50) r8 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, 0x0) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r9, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000000100), 0x4) 2.498449495s ago: executing program 7 (id=496): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) fchmodat(0xffffffffffffffff, 0x0, 0x82) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001b80)=[{{&(0x7f0000000080)=@sco, 0x80, &(0x7f0000000100)=[{&(0x7f0000000240)=""/124, 0x7c}, {&(0x7f00000002c0)=""/209, 0xd1}, {&(0x7f00000003c0)=""/148, 0x94}], 0x3, &(0x7f0000000480)=""/163, 0xa3}, 0xfff}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)=""/4096, 0x1000}], 0x1, &(0x7f0000001540)=""/204, 0xcc}, 0x1c}, {{&(0x7f0000001640)=@un=@abs, 0x80, &(0x7f0000001ac0)=[{&(0x7f00000016c0)=""/105, 0x69}, {&(0x7f0000001740)=""/40, 0x28}, {&(0x7f0000001780)=""/126, 0x7e}, {&(0x7f0000001800)=""/138, 0x8a}, {&(0x7f00000018c0)=""/130, 0x82}, {&(0x7f0000001980)=""/110, 0x6e}, {&(0x7f0000001a00)=""/140, 0x8c}], 0x7, &(0x7f0000001b40)=""/26, 0x1a}, 0x660b}], 0x3, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) r3 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x800) r4 = socket$qrtr(0x2a, 0x2, 0x0) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x2) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r6 = dup(r5) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r6) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r8, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r8, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000001e00)='vegas', 0x5) sendmmsg$inet(r8, &(0x7f0000001100)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad0", 0x21}, {&(0x7f0000000640)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b", 0x19}, {&(0x7f0000000300)="864d7f54c4fd623f8f7da15688b99be9a0026b27248b61562abac23fd47e95799277c683b78afa173c7e40073a27da2d4b6096868f173e469f029ad1a5fe0f57f7a25026bcf8ad0aef2bcb20738a7632d8afea65cda79daf5d6ff447540d88ebe12243aa4073d4077ab7144970f87e4ef73fb27aae440b02903b062ffb6641a771f8167a801691d896242e8a6d0036727688592cfb7083437b6c37a6156c1be6a6", 0xa1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="66f5", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f00000003c0)="76cd3737249e92cdbad7b6e704e8cae7f405a85f7d8e20b8d0bb939237bc52d18c99e0a611809bd4669407806d66cda69d59ed38ec6858a4cdacb848a5361397f7b242c223b0b522ada187c93dd27de49a68ccfaaabd0d43c93068f7de9619227f9d6f92ba57e70eab0767d64a76396f0d84380f3cf7d53968105101474bf9d8b3599b0e30aeae778963534b920e853f2bbbb68fed30c6395bdfc18f0484da05decdb889af633d216d3cb43ffefe6da687d69fc53f946a78b41c0c8b4685f4aa19caa8d8e24de898f7", 0xc9}, {&(0x7f0000000180)="e6b533355df96cf11386c82eddb922d918cc7dcb06d2bc76aa2fa0ac0c49a89beb25118cd309894183b5bbd2210a36", 0x2f}, {&(0x7f0000000500)="1f9a2da343bd64eb324c2599923ba656bf6dfd65ffea98851d45bb9192b600f72b1f2802cfb066ce7d5a75d802cc8c5a116313e88ea8cf11ad276d47b4542c993afd", 0x42}, {&(0x7f0000000680)="3d232fac2533383b925780ae295b", 0xe}], 0x4}}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000c00)="07e52a4b97e622f07ea82f4dd40086d5c93d422e43e62cce8225c43bb642867c6f520ab3a61f5b503f801ca6ed80ab50055d0dae240192a4d7f833481e642fad0c0903b6d56093996f2ec935115cc4e4373c0a4e4d46ea04305651067e43e638f54dfb95f65afb591924849d8e", 0x6d}], 0x1}}], 0x4, 0xe0d0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r6) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r6, &(0x7f0000001dc0)={&(0x7f0000001c40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001d80)={&(0x7f0000001c80)=ANY=[@ANYBLOB="f8000000d0420248067e408bf91fedeccf96a6209b9d5a6f62c15522f0cc0d001f41993fdcafc2ee29e8bee66cbdd100eacc9472324acd7530d59fdd9a716bc44188a8ac3539ea1bb2cd", @ANYRES16=r3, @ANYRESHEX=r7], 0xf8}, 0x1, 0x0, 0x0, 0x800}, 0x40000) sendmsg$sock(r4, &(0x7f0000000000)={&(0x7f0000000140)=@pppoe={0x2a, 0x1000000, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'team_slave_0\x00'}}, 0x80, 0x0}, 0x0) 1.459416514s ago: executing program 0 (id=497): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_QUERYCTRL(r0, 0xc0445624, &(0x7f00000000c0)={0x80000001, 0x203, "a9814949afb2659dcc0594d35b7302fe21d0081226f691e9730395f504c632e3", 0x210, 0x7, 0x0, 0x5, 0x40001048}) ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f00000002c0)={{0x2, @name="8841ba0c5d5c59645517cea309e382a27bcc6336bdf9327ac8b56b72028ccae5"}, "3c6bfb8805508b1c1985cefd234cf1229db567d07a94c51eebb3189f2852e018", 0x2}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120109008e88052086800095d8b601020301090212000100000000090401000015cc1c00"], 0x0) r2 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) timer_create(0x7, &(0x7f000049efa0)={0x0, 0x14, 0x4, @tid=r2}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x77359400}, {0x0, 0x989680}}, 0x0) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) r4 = socket$netlink(0x10, 0x3, 0x8000000004) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001300)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@enum, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x4000000, [{0x0, 0x3}]}, @volatile={0x0, 0x0, 0x0, 0x9, 0x1}]}}, 0x0, 0x4a, 0x0, 0x1}, 0x28) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x800, 0x3c11, 0x63, 0x0}], 0x1}) r5 = accept(r4, &(0x7f0000000080)=@generic, &(0x7f0000000140)=0x80) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000680)={0x14, &(0x7f00000004c0)={0x20, 0x7, 0xc6, {0xc6, 0x1, "2cead0d11dcbc91d5c4221a5b78f60ff745b073dae4f13fd5eeb17c029210597a960b0ed8b0b2f17ade822e978991bf33a56bc99c1ddf6e2e58b6bdb22722a7078a57b13ca6a21ca6dd96acd4d6845293ea1d12884ca683de3755eee274cdb3946485d4ec3394ddaaa5670de221d7f9d234187554887daef43c1b15ec56d23eb56af9f9a4b2ccf9419412d1b2fe077bc4ea43897f426bc5a48a861380d0724c78624d512becc655a180e4ebd0ca890bae6e64a3b5b24450efa54a8aee7c6da3938feacc2"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000840)={0x1c, &(0x7f0000000880)=ANY=[@ANYBLOB="200edd000000f52b4c3740668649fae967d39767e2f421a22bdb20df3bebfbbda7352e9b3c26e4547be60ed9b7d3d24aefba280ae95410ccfa1324d6e3e7434b8b1451a4847afd6d625b5af4c58dc7e5fbfc33b51643ff102130f28ecac222d5b95b9cce4c14d2b27955f1ef5f8a248de5009e6c7e10004167be0142d308282143f2edbf3597902e2b6a9274aa8576865a97e7177c8a8fe76375a49969ee555d3787fd80223f30c865d5b91131b2e4be59e9069665182bc4762230de2fdd86bcfb97bf91755b11cfc6a4ea216194ef40efe367d151cb73d81385c8d67ee663275678ba8782165667c813f5f3b2cb8ec6809a03b7f34092cefb2ec4e2a9ed0110f50f386338e7acc74da3177e12c0e7b4cc1d129d20dd69b31a8e8a9cce38c1599bfd28de90f4ab6d3b271d5300"/311], &(0x7f00000007c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000800)={0x0, 0x8, 0x1, 0x5}}) ioctl$sock_SIOCDELRT(r5, 0x890c, &(0x7f00000001c0)={0x0, @nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x800000}, @l2tp={0x2, 0x0, @multicast2, 0x3}, @phonet={0x23, 0x81, 0x81, 0xf}, 0x5, 0x0, 0x0, 0x0, 0x81, &(0x7f0000000180)='geneve0\x00', 0x1ff, 0x8, 0xa}) ioctl$VIDIOC_S_EDID(r0, 0xc0285629, &(0x7f0000000400)={0x0, 0x1000, 0x2, '\x00', &(0x7f00000003c0)=0x6a}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000004, 0x13, r6, 0x100000000) socket$inet_udplite(0x2, 0x2, 0x88) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000440)={0xdc000000, "a07c90a219c108c0764e6ec74e1eeebabd4f386577bf3f2f274aa0fca29a51aa", 0x2, 0x7, 0x1, 0xffffff, 0x2000000, 0x2}) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x0, 0x3, 0x3, {0xa, 0x4e24, 0xff0, @mcast1, 0x6}}}, 0x3a) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x101000, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r8, 0x40106410, &(0x7f00000002c0)={0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000006c0)={{0x1, 0x1, 0x18, r7, {0x4}}, './file0\x00'}) 402.04499ms ago: executing program 7 (id=498): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x12, 0x2, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000040)}, 0x20) 235.029044ms ago: executing program 6 (id=499): mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000080)={0x4, 0x2, 0x340000000000000, 0x0, 0x2, 0xb, 0x4, 0x9, 0x7ffffffc}) 63.94389ms ago: executing program 6 (id=500): readv(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f00000005c0)=""/198, 0xc6}, {&(0x7f0000000480)=""/88, 0x58}, {&(0x7f0000000500)=""/2, 0x2}, {&(0x7f0000000780)=""/13, 0xd}, {&(0x7f0000000a80)=""/122, 0x7a}, {&(0x7f00000007c0)=""/11, 0xb}], 0x6) 0s ago: executing program 7 (id=501): r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x0, 0x200000009}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) pread64(r0, 0x0, 0x0, 0x78f2a36b) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000300)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000380)={0x0, 0x0, r2, r3, 0x3, 0x1f5, 0x0, 0x0, {0x4, 0xfffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x92f, 0x8001, 0xfffffffa, "b4bc323ef77d1f000071849800000000dfff00"}}) kernel console output (not intermixed with test programs): ] usb 4-1: config index 0 descriptor too short (expected 65, got 36) [ 265.061712][ T5924] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 265.061757][ T5924] usb 4-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 265.061781][ T5924] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.107469][ T5924] usb 4-1: config 0 descriptor?? [ 265.221398][ T5924] pxrc 4-1:0.0: Could not find endpoint [ 265.224858][ T5885] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 265.239214][ T5924] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 265.334423][ T5924] usb 4-1: USB disconnect, device number 15 [ 265.398604][ T5885] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 265.398635][ T5885] usb 1-1: config 0 has no interface number 0 [ 265.398677][ T5885] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.398704][ T5885] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.398742][ T5885] usb 1-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 265.398763][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.460496][ T5885] usb 1-1: config 0 descriptor?? [ 266.654569][ T5811] Bluetooth: hci4: command tx timeout [ 267.448739][ T5885] usbhid 1-1:0.1: can't add hid device: -71 [ 267.448882][ T5885] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 267.515385][ T5885] usb 1-1: USB disconnect, device number 12 [ 269.096031][ T5811] Bluetooth: hci4: command tx timeout [ 269.661402][ T7039] netlink: 'syz.3.221': attribute type 10 has an invalid length. [ 269.721779][ T7042] overlayfs: failed to resolve './file1/file0': -2 [ 271.345487][ T6935] chnl_net:caif_netlink_parms(): no params data found [ 271.965008][ T6969] chnl_net:caif_netlink_parms(): no params data found [ 271.998934][ T7054] netlink: 'syz.2.222': attribute type 25 has an invalid length. [ 271.998958][ T7054] netlink: 'syz.2.222': attribute type 7 has an invalid length. [ 271.998972][ T7054] netlink: 156 bytes leftover after parsing attributes in process `syz.2.222'. [ 272.268415][ T7062] netlink: 'syz.2.225': attribute type 27 has an invalid length. [ 272.268434][ T7062] netlink: 'syz.2.225': attribute type 3 has an invalid length. [ 272.268442][ T7062] netlink: 132 bytes leftover after parsing attributes in process `syz.2.225'. [ 274.694563][ T7067] netlink: 204 bytes leftover after parsing attributes in process `syz.0.226'. [ 277.935725][ T10] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 278.379771][ T10] usb 1-1: device descriptor read/64, error -71 [ 278.506848][ T7082] netlink: 'syz.3.233': attribute type 25 has an invalid length. [ 278.506881][ T7082] netlink: 'syz.3.233': attribute type 7 has an invalid length. [ 278.506895][ T7082] netlink: 156 bytes leftover after parsing attributes in process `syz.3.233'. [ 278.576770][ T6935] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.576931][ T6935] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.577181][ T6935] bridge_slave_0: entered allmulticast mode [ 278.580214][ T6935] bridge_slave_0: entered promiscuous mode [ 278.614812][ T10] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 278.999088][ T10] usb 1-1: device descriptor read/64, error -71 [ 279.068843][ T6935] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.069011][ T6935] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.069217][ T6935] bridge_slave_1: entered allmulticast mode [ 279.071315][ T6935] bridge_slave_1: entered promiscuous mode [ 279.106213][ T10] usb usb1-port1: attempt power cycle [ 279.158287][ T6969] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.158774][ T6969] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.158985][ T6969] bridge_slave_0: entered allmulticast mode [ 279.160915][ T6969] bridge_slave_0: entered promiscuous mode [ 279.196996][ T6935] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 279.369763][ T6969] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.369904][ T6969] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.370146][ T6969] bridge_slave_1: entered allmulticast mode [ 279.371959][ T6969] bridge_slave_1: entered promiscuous mode [ 279.381741][ T6935] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 279.467896][ T10] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 279.485768][ T10] usb 1-1: device descriptor read/8, error -71 [ 279.516393][ T6969] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 279.519529][ T6935] team0: Port device team_slave_0 added [ 279.522155][ T6969] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 279.552754][ T6935] team0: Port device team_slave_1 added [ 280.658393][ T7083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.658755][ T7083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.473329][ T10] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 281.485600][ T10] usb 1-1: device descriptor read/8, error -71 [ 281.539392][ T7101] netlink: 'syz.3.235': attribute type 10 has an invalid length. [ 281.595871][ T10] usb usb1-port1: unable to enumerate USB device [ 281.602825][ T7102] overlayfs: failed to resolve './file1/file0': -2 [ 281.732482][ T6969] team0: Port device team_slave_0 added [ 281.797221][ T6969] team0: Port device team_slave_1 added [ 281.842663][ T6935] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 281.842681][ T6935] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.842697][ T6935] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 281.917461][ T6935] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 281.917479][ T6935] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.917502][ T6935] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 282.010079][ T6969] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.010096][ T6969] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.010120][ T6969] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 282.012440][ T6969] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 282.012454][ T6969] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.012474][ T6969] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 282.402893][ T6935] hsr_slave_0: entered promiscuous mode [ 282.404620][ T6935] hsr_slave_1: entered promiscuous mode [ 282.417826][ T6935] debugfs: 'hsr0' already exists in 'hsr' [ 282.417855][ T6935] Cannot create hsr debugfs directory [ 282.443227][ T6969] hsr_slave_0: entered promiscuous mode [ 282.457842][ T6969] hsr_slave_1: entered promiscuous mode [ 282.458480][ T6969] debugfs: 'hsr0' already exists in 'hsr' [ 282.458501][ T6969] Cannot create hsr debugfs directory [ 282.460598][ T1028] bridge_slave_1: left allmulticast mode [ 282.460624][ T1028] bridge_slave_1: left promiscuous mode [ 282.460888][ T1028] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.606054][ T1028] bridge_slave_0: left allmulticast mode [ 282.606086][ T1028] bridge_slave_0: left promiscuous mode [ 282.606400][ T1028] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.713648][ T1028] bridge_slave_1: left allmulticast mode [ 282.713683][ T1028] bridge_slave_1: left promiscuous mode [ 282.713951][ T1028] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.816752][ T1028] bridge_slave_0: left allmulticast mode [ 282.816785][ T1028] bridge_slave_0: left promiscuous mode [ 282.817059][ T1028] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.445527][ T37] kauditd_printk_skb: 24 callbacks suppressed [ 283.445585][ T37] audit: type=1326 audit(1771065463.621:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.445798][ T37] audit: type=1326 audit(1771065463.621:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.446002][ T37] audit: type=1326 audit(1771065463.621:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.446321][ T37] audit: type=1326 audit(1771065463.631:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.446562][ T37] audit: type=1326 audit(1771065463.631:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.446735][ T37] audit: type=1326 audit(1771065463.631:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2960b1c84e code=0x7ffc0000 [ 283.446937][ T37] audit: type=1326 audit(1771065463.631:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.447291][ T37] audit: type=1326 audit(1771065463.631:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.447492][ T37] audit: type=1326 audit(1771065463.641:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 283.447732][ T37] audit: type=1326 audit(1771065463.651:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7105 comm="syz.2.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 284.138539][ T7110] netlink: 204 bytes leftover after parsing attributes in process `syz.3.239'. [ 286.035994][ T1028] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 286.155950][ T1028] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 286.236742][ T1028] bond0 (unregistering): Released all slaves [ 287.285432][ T1028] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 287.349874][ T1028] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 287.388062][ T1028] bond0 (unregistering): Released all slaves [ 287.532953][ T7119] netlink: 'syz.2.242': attribute type 25 has an invalid length. [ 287.532978][ T7119] netlink: 'syz.2.242': attribute type 7 has an invalid length. [ 287.532991][ T7119] netlink: 156 bytes leftover after parsing attributes in process `syz.2.242'. [ 289.222740][ T5885] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 289.404931][ T5885] usb 1-1: Using ep0 maxpacket: 8 [ 289.411013][ T5885] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 289.411076][ T5885] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 289.411099][ T5885] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 289.411124][ T5885] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 289.411148][ T5885] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 289.411190][ T5885] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 289.411212][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.714650][ T5885] usb 1-1: GET_CAPABILITIES returned 0 [ 289.714845][ T5885] usbtmc 1-1:16.0: can't read capabilities [ 289.904973][ T1028] hsr_slave_0: left promiscuous mode [ 290.119788][ T7132] netlink: 'syz.3.247': attribute type 10 has an invalid length. [ 290.165118][ T1028] hsr_slave_1: left promiscuous mode [ 290.166230][ T1028] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 290.180343][ T7134] overlayfs: failed to resolve './file1/file0': -2 [ 290.186174][ T1028] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 291.534966][ T1028] hsr_slave_0: left promiscuous mode [ 291.574919][ T1028] hsr_slave_1: left promiscuous mode [ 291.576154][ T1028] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 291.625859][ T1028] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 293.583266][ T5885] usb 1-1: USB disconnect, device number 17 [ 293.614954][ T5924] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 293.758222][ T5924] usb 3-1: device descriptor read/64, error -71 [ 293.826118][ T1028] team0 (unregistering): Port device team_slave_1 removed [ 294.111839][ T5924] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 294.125219][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 294.125268][ T37] audit: type=1326 audit(1771065474.211:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.125664][ T37] audit: type=1326 audit(1771065474.211:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.125871][ T37] audit: type=1326 audit(1771065474.221:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.126080][ T37] audit: type=1326 audit(1771065474.221:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.126284][ T37] audit: type=1326 audit(1771065474.221:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.126550][ T37] audit: type=1326 audit(1771065474.231:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe8e098c84e code=0x7ffc0000 [ 294.126825][ T37] audit: type=1326 audit(1771065474.231:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.127026][ T37] audit: type=1326 audit(1771065474.231:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.127228][ T37] audit: type=1326 audit(1771065474.231:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.127428][ T37] audit: type=1326 audit(1771065474.241:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7142 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 294.744980][ T5924] usb 3-1: device descriptor read/64, error -71 [ 294.805665][ T1028] team0 (unregistering): Port device team_slave_0 removed [ 294.855536][ T5924] usb usb3-port1: attempt power cycle [ 295.941958][ T7155] netlink: 204 bytes leftover after parsing attributes in process `syz.0.252'. [ 296.545426][ T1028] team0 (unregistering): Port device team_slave_1 removed [ 296.725521][ T1028] team0 (unregistering): Port device team_slave_0 removed [ 300.876242][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 300.876291][ T37] audit: type=1326 audit(1771065481.071:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.876533][ T37] audit: type=1326 audit(1771065481.071:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.876745][ T37] audit: type=1326 audit(1771065481.071:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.877022][ T37] audit: type=1326 audit(1771065481.071:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.877224][ T37] audit: type=1326 audit(1771065481.081:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.877427][ T37] audit: type=1326 audit(1771065481.081:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2960b1c84e code=0x7ffc0000 [ 300.877647][ T37] audit: type=1326 audit(1771065481.091:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.877820][ T37] audit: type=1326 audit(1771065481.091:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.878121][ T37] audit: type=1326 audit(1771065481.101:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 300.878296][ T37] audit: type=1326 audit(1771065481.111:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7170 comm="syz.2.257" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 301.226592][ T10] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 301.665098][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 301.674619][ T10] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 301.674774][ T10] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 301.674799][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 301.674823][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 301.674846][ T10] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 301.674886][ T10] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 301.674907][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.940518][ T10] usb 4-1: GET_CAPABILITIES returned 0 [ 301.940570][ T10] usbtmc 4-1:16.0: can't read capabilities [ 302.605308][ T10] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 302.825580][ T10] usb 3-1: device descriptor read/64, error -71 [ 303.667604][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 303.794850][ T10] usb 3-1: device descriptor read/64, error -71 [ 303.911849][ T10] usb usb3-port1: attempt power cycle [ 304.259954][ T6935] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 304.304818][ T10] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 304.325928][ T10] usb 3-1: device descriptor read/8, error -71 [ 304.407672][ T6935] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 304.855581][ T10] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 305.513133][ T10] usb 3-1: device descriptor read/8, error -71 [ 305.513872][ T5885] usb 4-1: USB disconnect, device number 16 [ 305.569273][ T6935] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 305.617129][ T10] usb usb3-port1: unable to enumerate USB device [ 305.694876][ T5931] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 305.828144][ T5931] usb 1-1: device descriptor read/64, error -71 [ 305.854046][ T6935] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 306.072640][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 306.072691][ T37] audit: type=1326 audit(1771065486.181:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.072887][ T37] audit: type=1326 audit(1771065486.181:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.073276][ T37] audit: type=1326 audit(1771065486.191:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.073455][ T37] audit: type=1326 audit(1771065486.191:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.073661][ T37] audit: type=1326 audit(1771065486.191:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.073804][ T37] audit: type=1326 audit(1771065486.191:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.074014][ T37] audit: type=1326 audit(1771065486.191:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.074367][ T37] audit: type=1326 audit(1771065486.191:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.074581][ T37] audit: type=1326 audit(1771065486.191:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.204936][ T37] audit: type=1326 audit(1771065486.201:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7199 comm="syz.2.261" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2960b5bf79 code=0x7ffc0000 [ 306.689154][ T7205] netlink: 204 bytes leftover after parsing attributes in process `syz.3.263'. [ 306.929307][ T6969] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 306.964803][ T5931] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 307.015044][ T6969] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 307.086823][ T6969] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 307.094859][ T5931] usb 1-1: device descriptor read/64, error -71 [ 307.184887][ T808] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 307.235242][ T5931] usb usb1-port1: attempt power cycle [ 307.240484][ T6969] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 307.858626][ T6935] 8021q: adding VLAN 0 to HW filter on device bond0 [ 307.991380][ T6935] 8021q: adding VLAN 0 to HW filter on device team0 [ 308.005882][ T808] usb 4-1: Using ep0 maxpacket: 16 [ 308.010069][ T808] usb 4-1: config index 0 descriptor too short (expected 65, got 36) [ 308.010138][ T808] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 308.010161][ T808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 308.010185][ T808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 308.010204][ T808] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 308.010240][ T808] usb 4-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 308.010260][ T808] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.030959][ T808] usb 4-1: config 0 descriptor?? [ 308.359149][ T808] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input12 [ 308.386464][ T5150] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 309.316056][ T7241] 9p: Bad value for 'source' [ 309.395384][ T808] usb 4-1: USB disconnect, device number 17 [ 309.548139][ T1028] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.548381][ T1028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.620652][ T6437] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.620808][ T6437] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.332547][ T6969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 310.686173][ T6969] 8021q: adding VLAN 0 to HW filter on device team0 [ 310.781200][ T1028] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.781354][ T1028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.849981][ T1028] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.850256][ T1028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 311.068602][ T808] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 311.216668][ T808] usb 4-1: Using ep0 maxpacket: 16 [ 311.222644][ T808] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 311.222685][ T808] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 311.325753][ T808] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 311.325790][ T808] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.325811][ T808] usb 4-1: Product: syz [ 311.325826][ T808] usb 4-1: Manufacturer: syz [ 311.325840][ T808] usb 4-1: SerialNumber: syz [ 313.755885][ T808] usb 4-1: skipping empty audio interface (v1) [ 313.928022][ T7271] netlink: 20 bytes leftover after parsing attributes in process `syz.2.272'. [ 313.969559][ T808] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 313.994804][ T808] usb 4-1: USB disconnect, device number 18 [ 314.030905][ T6935] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.175959][ T6969] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.299607][ T6554] udevd[6554]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 315.577446][ T31] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 315.868143][ T31] usb 1-1: device descriptor read/64, error -71 [ 316.494888][ T5931] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 316.647730][ T5931] usb 3-1: config 5 has an invalid interface number: 62 but max is 0 [ 316.647762][ T5931] usb 3-1: config 5 has no interface number 0 [ 316.647796][ T5931] usb 3-1: config 5 interface 62 has no altsetting 0 [ 316.697167][ T5931] usb 3-1: New USB device found, idVendor=05c6, idProduct=9069, bcdDevice=3d.6c [ 316.697205][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.697226][ T5931] usb 3-1: Product: syz [ 316.697240][ T5931] usb 3-1: Manufacturer: syz [ 316.697255][ T5931] usb 3-1: SerialNumber: syz [ 316.787206][ T5811] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 316.806136][ T5811] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 316.808868][ T5811] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 316.826021][ T5811] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 316.830103][ T5811] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 316.874783][ T31] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 317.104811][ T31] usb 1-1: device descriptor read/64, error -71 [ 317.215367][ T31] usb usb1-port1: attempt power cycle [ 317.328788][ T5931] cdc_acm 3-1:5.62: Zero length descriptor references [ 317.328838][ T5931] cdc_acm 3-1:5.62: probe with driver cdc_acm failed with error -22 [ 317.362974][ T5931] usb 3-1: USB disconnect, device number 19 [ 317.385007][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.385116][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.530811][ T7314] 9p: Bad value for 'source' [ 317.724736][ T31] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 318.015256][ T31] usb 1-1: device not accepting address 23, error -71 [ 319.056485][ T5811] Bluetooth: hci5: command tx timeout [ 319.461383][ T7334] netlink: 12 bytes leftover after parsing attributes in process `syz.0.284'. [ 319.584083][ T7334] 8021q: VLANs not supported on sit0 [ 321.254742][ T5811] Bluetooth: hci5: command tx timeout [ 321.455289][ T7351] netlink: 16 bytes leftover after parsing attributes in process `syz.3.286'. [ 321.483588][ T5809] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 321.506565][ T5809] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 321.509901][ T5809] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 321.511730][ T5809] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 321.513439][ T5809] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 323.071522][ T808] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 323.279114][ T808] usb 1-1: device descriptor read/64, error -71 [ 323.429712][ T5811] Bluetooth: hci5: command tx timeout [ 323.599748][ T5809] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 323.603732][ T5809] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 323.614886][ T5809] Bluetooth: hci2: command tx timeout [ 323.624868][ T808] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 323.635597][ T5809] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 323.680358][ T5809] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 323.690039][ T5809] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 323.754853][ T808] usb 1-1: device descriptor read/64, error -71 [ 323.865146][ T808] usb usb1-port1: attempt power cycle [ 324.224888][ T808] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 324.249587][ T808] usb 1-1: device descriptor read/8, error -71 [ 324.445504][ T7375] 9p: Bad value for 'source' [ 324.484889][ T808] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 324.523034][ T808] usb 1-1: device descriptor read/8, error -71 [ 324.625164][ T808] usb usb1-port1: unable to enumerate USB device [ 325.190393][ T7305] chnl_net:caif_netlink_parms(): no params data found [ 325.454839][ T5809] Bluetooth: hci5: command tx timeout [ 325.694864][ T5809] Bluetooth: hci2: command tx timeout [ 325.774962][ T5809] Bluetooth: hci3: command tx timeout [ 326.721815][ T6438] bridge_slave_1: left allmulticast mode [ 326.721846][ T6438] bridge_slave_1: left promiscuous mode [ 326.722768][ T6438] bridge0: port 2(bridge_slave_1) entered disabled state [ 328.544840][ T5809] Bluetooth: hci3: command tx timeout [ 328.544836][ T5811] Bluetooth: hci2: command tx timeout [ 328.675434][ T6438] bridge_slave_0: left allmulticast mode [ 328.675463][ T6438] bridge_slave_0: left promiscuous mode [ 328.675768][ T6438] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.575403][ T5811] Bluetooth: hci3: command tx timeout [ 330.575443][ T5811] Bluetooth: hci2: command tx timeout [ 332.404895][ T808] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 332.465628][ T6438] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 332.546412][ T6438] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 332.565196][ T808] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 332.565228][ T808] usb 4-1: config 0 has no interface number 0 [ 332.565277][ T808] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 332.565305][ T808] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 332.565346][ T808] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 332.565370][ T808] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 332.571268][ T808] usb 4-1: config 0 descriptor?? [ 332.656300][ T60] Bluetooth: hci3: command tx timeout [ 332.668150][ T6438] bond0 (unregistering): Released all slaves [ 332.761145][ T7305] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.761297][ T7305] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.761550][ T7305] bridge_slave_0: entered allmulticast mode [ 332.786800][ T7305] bridge_slave_0: entered promiscuous mode [ 332.887160][ T7305] bridge0: port 2(bridge_slave_1) entered blocking state [ 332.887322][ T7305] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.887579][ T7305] bridge_slave_1: entered allmulticast mode [ 332.890684][ T7305] bridge_slave_1: entered promiscuous mode [ 333.284514][ T7305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 333.299870][ T7348] chnl_net:caif_netlink_parms(): no params data found [ 333.461011][ T7394] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 333.484899][ T6438] hsr_slave_0: left promiscuous mode [ 333.770923][ T6438] hsr_slave_1: left promiscuous mode [ 333.772072][ T6438] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 333.815963][ T6438] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.855759][ T6438] team0 (unregistering): Port device team_slave_1 removed [ 335.057134][ T6438] team0 (unregistering): Port device team_slave_0 removed [ 336.725495][ T7435] netlink: 16 bytes leftover after parsing attributes in process `syz.0.297'. [ 336.796352][ T7305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 336.887712][ T808] usbhid 4-1:0.1: can't add hid device: -71 [ 336.887858][ T808] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 336.917196][ T808] usb 4-1: USB disconnect, device number 19 [ 337.885934][ T5931] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 338.035526][ T5931] usb 1-1: device descriptor read/64, error -71 [ 338.255714][ T7305] team0: Port device team_slave_0 added [ 338.374868][ T5931] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 338.439664][ T7305] team0: Port device team_slave_1 added [ 338.514856][ T5931] usb 1-1: device descriptor read/64, error -71 [ 338.562453][ T7366] chnl_net:caif_netlink_parms(): no params data found [ 338.626726][ T5931] usb usb1-port1: attempt power cycle [ 338.779722][ T7305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 338.779742][ T7305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 338.779771][ T7305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 338.904080][ T7305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 338.904199][ T7305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 338.904230][ T7305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 338.964777][ T5931] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 338.992838][ T5931] usb 1-1: device descriptor read/8, error -71 [ 339.007804][ T7348] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.008037][ T7348] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.008248][ T7348] bridge_slave_0: entered allmulticast mode [ 339.011379][ T7348] bridge_slave_0: entered promiscuous mode [ 339.107545][ T7348] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.107681][ T7348] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.107873][ T7348] bridge_slave_1: entered allmulticast mode [ 339.110935][ T7348] bridge_slave_1: entered promiscuous mode [ 339.224919][ T5931] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 339.245485][ T5931] usb 1-1: device descriptor read/8, error -71 [ 339.355400][ T5931] usb usb1-port1: unable to enumerate USB device [ 339.414553][ T7348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 339.427182][ T7366] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.427375][ T7366] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.427637][ T7366] bridge_slave_0: entered allmulticast mode [ 339.430683][ T7366] bridge_slave_0: entered promiscuous mode [ 339.496693][ T7305] hsr_slave_0: entered promiscuous mode [ 339.497882][ T7305] hsr_slave_1: entered promiscuous mode [ 339.498945][ T7305] debugfs: 'hsr0' already exists in 'hsr' [ 339.498972][ T7305] Cannot create hsr debugfs directory [ 339.499594][ T7366] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.499733][ T7366] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.499940][ T7366] bridge_slave_1: entered allmulticast mode [ 339.502950][ T7366] bridge_slave_1: entered promiscuous mode [ 339.581065][ T7348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 340.249794][ T7469] netlink: 96 bytes leftover after parsing attributes in process `syz.3.301'. [ 340.603130][ T7448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.603499][ T7448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.636308][ T7366] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 341.674072][ T7348] team0: Port device team_slave_0 added [ 341.688548][ T7366] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.750639][ T7348] team0: Port device team_slave_1 added [ 342.104421][ T7366] team0: Port device team_slave_0 added [ 342.140329][ T7348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 342.140349][ T7348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 342.140379][ T7348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 342.203305][ T7366] team0: Port device team_slave_1 added [ 342.235866][ T7348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 342.235885][ T7348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 342.235914][ T7348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 343.797959][ T7366] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 343.797978][ T7366] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 343.798005][ T7366] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.846788][ T7454] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 345.877894][ T7366] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.877913][ T7366] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.877944][ T7366] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.628998][ T7348] hsr_slave_0: entered promiscuous mode [ 346.630645][ T7348] hsr_slave_1: entered promiscuous mode [ 346.634509][ T7348] debugfs: 'hsr0' already exists in 'hsr' [ 346.634539][ T7348] Cannot create hsr debugfs directory [ 347.415188][ T7506] netlink: 16 bytes leftover after parsing attributes in process `syz.3.305'. [ 347.799595][ T7366] hsr_slave_0: entered promiscuous mode [ 347.801333][ T7366] hsr_slave_1: entered promiscuous mode [ 347.802431][ T7366] debugfs: 'hsr0' already exists in 'hsr' [ 347.802457][ T7366] Cannot create hsr debugfs directory [ 347.821199][ T5931] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 347.994758][ T5931] usb 4-1: Using ep0 maxpacket: 8 [ 348.003536][ T5931] usb 4-1: config 0 interface 0 has no altsetting 0 [ 348.003583][ T5931] usb 4-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 348.003628][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.040541][ T5931] usb 4-1: config 0 descriptor?? [ 348.646050][ T37] kauditd_printk_skb: 67 callbacks suppressed [ 348.646101][ T37] audit: type=1326 audit(1771065528.621:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.646396][ T37] audit: type=1326 audit(1771065528.621:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.646710][ T37] audit: type=1326 audit(1771065528.631:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.646917][ T37] audit: type=1326 audit(1771065528.631:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.647502][ T37] audit: type=1326 audit(1771065528.631:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.649237][ T37] audit: type=1326 audit(1771065528.641:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.650190][ T37] audit: type=1326 audit(1771065528.641:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.651292][ T37] audit: type=1326 audit(1771065528.651:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.651616][ T37] audit: type=1326 audit(1771065528.651:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 348.661638][ T37] audit: type=1326 audit(1771065528.651:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7519 comm="syz.0.310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 349.330987][ T5931] logitech 0003:046D:C24F.0006: hidraw0: USB HID v4.0a Device [HID 046d:c24f] on usb-dummy_hcd.3-1/input0 [ 349.331022][ T5931] logitech 0003:046D:C24F.0006: no inputs found [ 349.531644][ T5885] usb 4-1: USB disconnect, device number 20 [ 353.562908][ T7557] netlink: 16 bytes leftover after parsing attributes in process `syz.0.316'. [ 353.968116][ T808] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 354.114956][ T808] usb 1-1: Using ep0 maxpacket: 16 [ 354.117660][ T808] usb 1-1: config index 0 descriptor too short (expected 65, got 36) [ 354.117687][ T808] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 354.117734][ T808] usb 1-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 354.117756][ T808] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 354.207793][ T808] usb 1-1: config 0 descriptor?? [ 354.234584][ T808] pxrc 1-1:0.0: Could not find endpoint [ 354.429697][ T6438] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.466999][ T5931] usb 1-1: USB disconnect, device number 33 [ 355.127725][ T37] kauditd_printk_skb: 21 callbacks suppressed [ 355.127745][ T37] audit: type=1326 audit(1771065535.371:243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.128012][ T37] audit: type=1326 audit(1771065535.371:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.128321][ T37] audit: type=1326 audit(1771065535.371:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=229 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.128655][ T37] audit: type=1326 audit(1771065535.371:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.129029][ T37] audit: type=1326 audit(1771065535.371:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.129071][ T37] audit: type=1326 audit(1771065535.371:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.129511][ T37] audit: type=1326 audit(1771065535.371:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.129948][ T37] audit: type=1326 audit(1771065535.371:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe8e098c84e code=0x7ffc0000 [ 355.130009][ T37] audit: type=1326 audit(1771065535.371:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.132717][ T37] audit: type=1326 audit(1771065535.371:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7586 comm="syz.0.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 355.417005][ T6438] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.719163][ T6438] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.030483][ T6438] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.225004][ T5811] Bluetooth: hci4: command 0x1003 tx timeout [ 357.225232][ T60] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 357.859780][ T6438] bridge_slave_1: left allmulticast mode [ 357.859805][ T6438] bridge_slave_1: left promiscuous mode [ 357.860004][ T6438] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.894607][ T7622] ======================================================= [ 357.894607][ T7622] WARNING: The mand mount option has been deprecated and [ 357.894607][ T7622] and is ignored by this kernel. Remove the mand [ 357.894607][ T7622] option from the mount to silence this warning. [ 357.894607][ T7622] ======================================================= [ 357.953263][ T7624] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 358.002293][ T6438] bridge_slave_0: left allmulticast mode [ 358.002325][ T6438] bridge_slave_0: left promiscuous mode [ 358.005915][ T6438] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.122983][ T6438] bridge_slave_1: left allmulticast mode [ 358.123007][ T6438] bridge_slave_1: left promiscuous mode [ 358.123179][ T6438] bridge0: port 2(bridge_slave_1) entered disabled state [ 359.519351][ T6438] bridge_slave_0: left allmulticast mode [ 359.519384][ T6438] bridge_slave_0: left promiscuous mode [ 359.681327][ T6438] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.285553][ T6438] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 361.355421][ T6438] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 361.377310][ T6438] bond0 (unregistering): Released all slaves [ 362.497270][ T6438] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 362.536747][ T6438] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 362.558941][ T6438] bond0 (unregistering): Released all slaves [ 362.575430][ T7632] netlink: 16 bytes leftover after parsing attributes in process `syz.0.324'. [ 362.933002][ T7305] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 363.236064][ T7305] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 363.319985][ T7305] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 363.345032][ T5931] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 363.531934][ T5931] usb 4-1: config 0 has an invalid interface number: 58 but max is 0 [ 363.531966][ T5931] usb 4-1: config 0 has no interface number 0 [ 363.532015][ T5931] usb 4-1: New USB device found, idVendor=041e, idProduct=400a, bcdDevice=49.f8 [ 363.532038][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.597792][ T5931] usb 4-1: config 0 descriptor?? [ 363.604366][ T5931] gspca_main: spca500-2.14.0 probing 041e:400a [ 363.827106][ T5931] usb 4-1: USB disconnect, device number 21 [ 363.925800][ T7305] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 364.374428][ T7650] FAULT_INJECTION: forcing a failure. [ 364.374428][ T7650] name failslab, interval 1, probability 0, space 0, times 0 [ 364.374455][ T7650] CPU: 0 UID: 0 PID: 7650 Comm: syz.0.327 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 364.374469][ T7650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 364.374476][ T7650] Call Trace: [ 364.374481][ T7650] [ 364.374486][ T7650] dump_stack_lvl+0xe8/0x150 [ 364.374518][ T7650] should_fail_ex+0x46b/0x600 [ 364.374537][ T7650] should_failslab+0xa8/0x100 [ 364.374551][ T7650] __kmalloc_cache_noprof+0x84/0x690 [ 364.374565][ T7650] ? tipc_conn_alloc+0x57/0x500 [ 364.374583][ T7650] tipc_conn_alloc+0x57/0x500 [ 364.374601][ T7650] tipc_topsrv_kern_subscr+0xf8/0x250 [ 364.374615][ T7650] ? tipc_own_addr+0x45/0x2a0 [ 364.374641][ T7650] ? __pfx_tipc_topsrv_kern_subscr+0x10/0x10 [ 364.374667][ T7650] ? tipc_own_addr+0x45/0x2a0 [ 364.374694][ T7650] ? __asan_memset+0x22/0x50 [ 364.374723][ T7650] tipc_group_create+0x364/0x500 [ 364.374758][ T7650] tipc_sk_join+0x256/0x6a0 [ 364.374789][ T7650] ? __pfx_tipc_sk_join+0x10/0x10 [ 364.374813][ T7650] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 364.374835][ T7650] ? lockdep_hardirqs_on+0x7a/0x110 [ 364.374867][ T7650] tipc_setsockopt+0x73e/0x990 [ 364.374898][ T7650] ? __pfx_tipc_setsockopt+0x10/0x10 [ 364.374920][ T7650] ? __fget_files+0x2a/0x420 [ 364.374951][ T7650] ? __fget_files+0x2a/0x420 [ 364.374976][ T7650] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 364.374997][ T7650] ? __pfx_tipc_setsockopt+0x10/0x10 [ 364.375017][ T7650] do_sock_setsockopt+0x17c/0x1b0 [ 364.375045][ T7650] __x64_sys_setsockopt+0x143/0x1b0 [ 364.375073][ T7650] do_syscall_64+0x14d/0xf80 [ 364.375092][ T7650] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.375108][ T7650] ? trace_irq_disable+0x37/0x100 [ 364.375121][ T7650] ? clear_bhb_loop+0x40/0x90 [ 364.375140][ T7650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.375155][ T7650] RIP: 0033:0x7fe8e09cbf79 [ 364.375171][ T7650] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.375185][ T7650] RSP: 002b:00007fe8dec1e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 364.375204][ T7650] RAX: ffffffffffffffda RBX: 00007fe8e0c45fa0 RCX: 00007fe8e09cbf79 [ 364.375216][ T7650] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003 [ 364.375226][ T7650] RBP: 00007fe8dec1e090 R08: 0000000000000010 R09: 0000000000000000 [ 364.375236][ T7650] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 364.375246][ T7650] R13: 00007fe8e0c46038 R14: 00007fe8e0c45fa0 R15: 00007ffc27095238 [ 364.375273][ T7650] [ 368.310891][ T7672] macvlan0: entered promiscuous mode [ 368.312258][ T7672] batadv0: entered promiscuous mode [ 368.617072][ T7348] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 368.917059][ T6438] hsr_slave_0: left promiscuous mode [ 368.958082][ T6438] hsr_slave_1: left promiscuous mode [ 368.959183][ T6438] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.056441][ T6438] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 369.534807][ T6438] hsr_slave_0: left promiscuous mode [ 369.704831][ T6438] hsr_slave_1: left promiscuous mode [ 369.706067][ T6438] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.706095][ T6438] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.895546][ T6438] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 369.895646][ T6438] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 370.045905][ T6438] veth1_macvtap: left promiscuous mode [ 370.045975][ T6438] veth0_macvtap: left promiscuous mode [ 370.046132][ T6438] veth1_vlan: left promiscuous mode [ 370.046243][ T6438] veth0_vlan: left promiscuous mode [ 372.513673][ T6438] team0 (unregistering): Port device team_slave_1 removed [ 372.757191][ T6438] team0 (unregistering): Port device team_slave_0 removed [ 376.295405][ T6438] team0 (unregistering): Port device team_slave_1 removed [ 376.485498][ T6438] team0 (unregistering): Port device team_slave_0 removed [ 377.023593][ T5811] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 377.060103][ T5811] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 377.061309][ T5811] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 377.063981][ T5811] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 377.103210][ T5811] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 378.346926][ T7684] netlink: 16 bytes leftover after parsing attributes in process `syz.0.333'. [ 378.429417][ T7348] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 378.526107][ T7348] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 378.708509][ T7348] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 378.855745][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.855815][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.143271][ T60] Bluetooth: hci4: command tx timeout [ 379.282634][ T7366] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 379.352017][ T7366] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 379.687584][ T7366] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 379.790543][ T7366] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 381.608434][ T60] Bluetooth: hci4: command tx timeout [ 381.699432][ T7741] FAULT_INJECTION: forcing a failure. [ 381.699432][ T7741] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 381.699478][ T7741] CPU: 0 UID: 0 PID: 7741 Comm: syz.3.338 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 381.699502][ T7741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 381.699515][ T7741] Call Trace: [ 381.699523][ T7741] [ 381.699532][ T7741] dump_stack_lvl+0xe8/0x150 [ 381.699566][ T7741] should_fail_ex+0x46b/0x600 [ 381.699596][ T7741] _copy_to_user+0x31/0xb0 [ 381.699627][ T7741] video_usercopy+0xe0a/0x1400 [ 381.699668][ T7741] ? __pfx___video_do_ioctl+0x10/0x10 [ 381.699700][ T7741] ? __pfx_video_usercopy+0x10/0x10 [ 381.699726][ T7741] ? smack_file_ioctl+0x2c2/0x360 [ 381.699771][ T7741] ? __fget_files+0x2a/0x420 [ 381.699798][ T7741] ? __fget_files+0x3a6/0x420 [ 381.699829][ T7741] v4l2_ioctl+0x190/0x1e0 [ 381.699859][ T7741] ? __pfx_v4l2_ioctl+0x10/0x10 [ 381.699886][ T7741] __se_sys_ioctl+0xff/0x170 [ 381.699911][ T7741] do_syscall_64+0x14d/0xf80 [ 381.699939][ T7741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.699959][ T7741] ? trace_irq_disable+0x37/0x100 [ 381.699977][ T7741] ? clear_bhb_loop+0x40/0x90 [ 381.700002][ T7741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.700020][ T7741] RIP: 0033:0x7ff53386bf79 [ 381.700037][ T7741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.700052][ T7741] RSP: 002b:00007ff531ac6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 381.700071][ T7741] RAX: ffffffffffffffda RBX: 00007ff533ae5fa0 RCX: 00007ff53386bf79 [ 381.700086][ T7741] RDX: 0000200000000940 RSI: 00000000c040565f RDI: 0000000000000003 [ 381.700100][ T7741] RBP: 00007ff531ac6090 R08: 0000000000000000 R09: 0000000000000000 [ 381.700113][ T7741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 381.700125][ T7741] R13: 00007ff533ae6038 R14: 00007ff533ae5fa0 R15: 00007fff96423ec8 [ 381.700158][ T7741] [ 382.556070][ T7697] chnl_net:caif_netlink_parms(): no params data found [ 382.793742][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 382.828137][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 382.832816][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 382.873015][ T5812] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 382.882022][ T5809] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 382.888022][ T5809] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 382.906626][ T5811] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 382.908583][ T5809] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 382.947718][ T5811] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 382.952988][ T5811] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 383.762313][ T60] Bluetooth: hci4: command tx timeout [ 384.424851][ T7773] netlink: 16 bytes leftover after parsing attributes in process `syz.3.341'. [ 384.841151][ T7697] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.841348][ T7697] bridge0: port 1(bridge_slave_0) entered disabled state [ 384.841519][ T7697] bridge_slave_0: entered allmulticast mode [ 384.867336][ T7697] bridge_slave_0: entered promiscuous mode [ 384.928241][ T7697] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.928532][ T7697] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.928796][ T7697] bridge_slave_1: entered allmulticast mode [ 384.968019][ T7697] bridge_slave_1: entered promiscuous mode [ 384.984792][ T60] Bluetooth: hci5: command tx timeout [ 385.170265][ T7697] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 385.214811][ T60] Bluetooth: hci6: command tx timeout [ 385.242310][ T7697] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 385.498845][ T7697] team0: Port device team_slave_0 added [ 385.775370][ T60] Bluetooth: hci4: command tx timeout [ 387.088584][ T60] Bluetooth: hci5: command tx timeout [ 387.244500][ T7697] team0: Port device team_slave_1 added [ 387.294798][ T5811] Bluetooth: hci6: command tx timeout [ 387.834573][ T7697] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 387.834593][ T7697] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.868879][ T7697] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.957600][ T7697] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.957620][ T7697] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.957649][ T7697] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 388.010915][ T37] kauditd_printk_skb: 414 callbacks suppressed [ 388.010932][ T37] audit: type=1326 audit(1771065568.251:667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7792 comm="syz.0.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 388.010980][ T37] audit: type=1326 audit(1771065568.251:668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7792 comm="syz.0.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=4 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 388.011020][ T37] audit: type=1326 audit(1771065568.251:669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7792 comm="syz.0.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 388.011056][ T37] audit: type=1326 audit(1771065568.251:670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7792 comm="syz.0.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 389.576009][ T5811] Bluetooth: hci5: command tx timeout [ 389.576048][ T5811] Bluetooth: hci6: command tx timeout [ 389.592460][ T7793] FAT-fs (nullb0): bogus number of reserved sectors [ 389.592485][ T7793] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 389.704779][ T37] audit: type=1326 audit(1771065569.931:671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7792 comm="syz.0.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 389.704841][ T37] audit: type=1326 audit(1771065569.931:672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7792 comm="syz.0.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 390.847041][ T7697] hsr_slave_0: entered promiscuous mode [ 390.854971][ T7697] hsr_slave_1: entered promiscuous mode [ 390.856023][ T7697] debugfs: 'hsr0' already exists in 'hsr' [ 390.856048][ T7697] Cannot create hsr debugfs directory [ 391.615193][ T60] Bluetooth: hci6: command tx timeout [ 391.615207][ T5811] Bluetooth: hci5: command tx timeout [ 392.251441][ T7833] ptrace attach of "./syz-executor exec"[7834] was attempted by "./syz-executor exec"[7833] [ 393.771491][ T7752] chnl_net:caif_netlink_parms(): no params data found [ 394.027301][ T7754] chnl_net:caif_netlink_parms(): no params data found [ 396.252027][ T7752] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.252174][ T7752] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.252442][ T7752] bridge_slave_0: entered allmulticast mode [ 396.289052][ T7752] bridge_slave_0: entered promiscuous mode [ 396.375509][ T7752] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.375703][ T7752] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.375914][ T7752] bridge_slave_1: entered allmulticast mode [ 396.447927][ T7752] bridge_slave_1: entered promiscuous mode [ 397.029852][ T7754] bridge0: port 1(bridge_slave_0) entered blocking state [ 397.030095][ T7754] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.030352][ T7754] bridge_slave_0: entered allmulticast mode [ 397.036174][ T7754] bridge_slave_0: entered promiscuous mode [ 398.762159][ T7754] bridge0: port 2(bridge_slave_1) entered blocking state [ 398.762330][ T7754] bridge0: port 2(bridge_slave_1) entered disabled state [ 398.762657][ T7754] bridge_slave_1: entered allmulticast mode [ 398.778386][ T7754] bridge_slave_1: entered promiscuous mode [ 398.783167][ T7752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.300337][ T7752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.948175][ T7754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 400.164418][ T7754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 400.536894][ T7752] team0: Port device team_slave_0 added [ 400.601018][ T7752] team0: Port device team_slave_1 added [ 400.686563][ T7814] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 401.209149][ T7754] team0: Port device team_slave_0 added [ 401.275016][ T10] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 401.426069][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 401.428620][ T10] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 401.428683][ T10] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 401.428706][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 401.428731][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 401.428755][ T10] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 401.428799][ T10] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 401.428823][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.553324][ T7754] team0: Port device team_slave_1 added [ 401.564929][ T7752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 401.564947][ T7752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.564975][ T7752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 401.664932][ T7752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 401.664952][ T7752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.665138][ T7752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 401.735847][ T10] usb 4-1: GET_CAPABILITIES returned 0 [ 401.735903][ T10] usbtmc 4-1:16.0: can't read capabilities [ 401.769073][ T7754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 401.769092][ T7754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.769120][ T7754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 401.826212][ T7754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 401.826225][ T7754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.826240][ T7754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 402.140309][ T7752] hsr_slave_0: entered promiscuous mode [ 402.141888][ T7752] hsr_slave_1: entered promiscuous mode [ 402.143087][ T7752] debugfs: 'hsr0' already exists in 'hsr' [ 402.143113][ T7752] Cannot create hsr debugfs directory [ 403.634125][ T7754] hsr_slave_0: entered promiscuous mode [ 403.642924][ T7754] hsr_slave_1: entered promiscuous mode [ 403.654197][ T7754] debugfs: 'hsr0' already exists in 'hsr' [ 403.654222][ T7754] Cannot create hsr debugfs directory [ 405.667119][ T10] usb 4-1: USB disconnect, device number 22 [ 406.171718][ T7697] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 406.294565][ T13] bridge_slave_1: left allmulticast mode [ 406.294597][ T13] bridge_slave_1: left promiscuous mode [ 406.308814][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.452943][ T13] bridge_slave_0: left allmulticast mode [ 406.452977][ T13] bridge_slave_0: left promiscuous mode [ 406.453277][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.610538][ T13] bridge_slave_1: left allmulticast mode [ 406.610573][ T13] bridge_slave_1: left promiscuous mode [ 406.644773][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.799778][ T13] bridge_slave_0: left allmulticast mode [ 406.799812][ T13] bridge_slave_0: left promiscuous mode [ 406.800090][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.919296][ T13] bridge_slave_1: left allmulticast mode [ 406.919328][ T13] bridge_slave_1: left promiscuous mode [ 406.919582][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.975953][ T13] bridge_slave_0: left allmulticast mode [ 406.975985][ T13] bridge_slave_0: left promiscuous mode [ 406.976168][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.026434][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 408.117019][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 409.158184][ T13] bond0 (unregistering): Released all slaves [ 410.199643][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 410.315747][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 410.403760][ T13] bond0 (unregistering): Released all slaves [ 412.566606][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 412.679950][ T7981] 9p: Bad value for 'wfdno' [ 412.687444][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 412.749903][ T13] bond0 (unregistering): Released all slaves [ 412.772118][ T7697] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 412.879526][ T7697] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 413.066290][ T7697] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 414.786011][ T13] hsr_slave_0: left promiscuous mode [ 414.824981][ T13] hsr_slave_1: left promiscuous mode [ 414.825737][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 414.848936][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 415.015010][ T13] hsr_slave_0: left promiscuous mode [ 415.035049][ T13] hsr_slave_1: left promiscuous mode [ 415.035888][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 415.081894][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 415.215674][ T13] hsr_slave_0: left promiscuous mode [ 415.235191][ T13] hsr_slave_1: left promiscuous mode [ 415.235911][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 415.275916][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 417.250760][ T37] audit: type=1800 audit(1771065597.491:673): pid=8010 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.380" name="file1" dev="tmpfs" ino=702 res=0 errno=0 [ 417.730209][ T8015] IPVS: length: 113 != 8 [ 418.498463][ T8018] FAULT_INJECTION: forcing a failure. [ 418.498463][ T8018] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 418.498530][ T8018] CPU: 0 UID: 0 PID: 8018 Comm: syz.0.383 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 418.498555][ T8018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 418.498567][ T8018] Call Trace: [ 418.498575][ T8018] [ 418.498585][ T8018] dump_stack_lvl+0xe8/0x150 [ 418.498609][ T8018] should_fail_ex+0x46b/0x600 [ 418.498626][ T8018] core_sys_select+0x8df/0xc30 [ 418.498652][ T8018] ? __pfx_core_sys_select+0x10/0x10 [ 418.498680][ T8018] ? __pfx_set_user_sigmask+0x10/0x10 [ 418.498694][ T8018] ? rt_mutex_slowunlock+0x1cb/0x300 [ 418.498708][ T8018] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 418.498724][ T8018] __se_sys_pselect6+0x267/0x320 [ 418.498742][ T8018] ? __pfx___se_sys_pselect6+0x10/0x10 [ 418.498757][ T8018] ? __pfx_ksys_write+0x10/0x10 [ 418.498771][ T8018] ? __x64_sys_pselect6+0x21/0xf0 [ 418.498787][ T8018] do_syscall_64+0x14d/0xf80 [ 418.498802][ T8018] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.498813][ T8018] ? clear_bhb_loop+0x40/0x90 [ 418.498827][ T8018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.498839][ T8018] RIP: 0033:0x7fe8e09cbf79 [ 418.498851][ T8018] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 418.498861][ T8018] RSP: 002b:00007fe8debfd028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 418.498876][ T8018] RAX: ffffffffffffffda RBX: 00007fe8e0c46090 RCX: 00007fe8e09cbf79 [ 418.498885][ T8018] RDX: 0000200000000040 RSI: 0000200000000240 RDI: 0000000000000040 [ 418.498893][ T8018] RBP: 00007fe8debfd090 R08: 0000000000000000 R09: 0000000000000000 [ 418.498901][ T8018] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 418.498908][ T8018] R13: 00007fe8e0c46128 R14: 00007fe8e0c46090 R15: 00007ffc27095238 [ 418.498926][ T8018] [ 419.760904][ T13] team0 (unregistering): Port device team_slave_1 removed [ 420.207057][ T13] team0 (unregistering): Port device team_slave_0 removed [ 425.423849][ T8038] ptrace attach of "./syz-executor exec"[8039] was attempted by "./syz-executor exec"[8038] [ 427.085408][ T13] team0 (unregistering): Port device team_slave_1 removed [ 427.225653][ T13] team0 (unregistering): Port device team_slave_0 removed [ 428.244833][ T808] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 428.395097][ T808] usb 4-1: Using ep0 maxpacket: 32 [ 428.428843][ T808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 428.428876][ T808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 428.432432][ T808] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=33.f9 [ 428.432463][ T808] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.432476][ T808] usb 4-1: Product: syz [ 428.432484][ T808] usb 4-1: Manufacturer: syz [ 428.432492][ T808] usb 4-1: SerialNumber: syz [ 428.437872][ T808] usb 4-1: config 0 descriptor?? [ 428.474213][ T808] input: KB Gear Tablet as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input13 [ 428.527798][ T13] team0 (unregistering): Port device team_slave_1 removed [ 428.681383][ T10] usb 4-1: USB disconnect, device number 23 [ 428.693391][ T13] team0 (unregistering): Port device team_slave_0 removed [ 429.986672][ T7697] 8021q: adding VLAN 0 to HW filter on device bond0 [ 430.102295][ T7697] 8021q: adding VLAN 0 to HW filter on device team0 [ 430.362858][ T1028] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.363008][ T1028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 430.434578][ T1028] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.434966][ T1028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 431.941470][ T7697] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 432.175104][ T7752] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 432.235942][ T7752] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 433.389800][ T7752] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 433.509276][ T7752] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 433.977554][ T8084] random: crng reseeded on system resumption [ 436.636644][ T7754] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 436.692520][ T7754] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 437.042505][ T7754] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 437.156490][ T7754] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 437.980409][ T5811] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 437.987170][ T5811] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 437.989684][ T5811] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 437.991098][ T5811] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 437.991857][ T5811] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 438.462604][ T7752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 438.585056][ T8132] netlink: 8 bytes leftover after parsing attributes in process `syz.0.398'. [ 439.470392][ T7754] 8021q: adding VLAN 0 to HW filter on device bond0 [ 439.483228][ T7752] 8021q: adding VLAN 0 to HW filter on device team0 [ 439.550182][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.550347][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.833981][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.834147][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.896517][ T7754] 8021q: adding VLAN 0 to HW filter on device team0 [ 440.094850][ T5811] Bluetooth: hci2: command tx timeout [ 441.817489][ T37] audit: type=1326 audit(1771065621.001:674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8167 comm="syz.3.402" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x0 [ 441.846897][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.846976][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.079873][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.080159][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 442.175347][ T5811] Bluetooth: hci2: command tx timeout [ 442.559928][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.572708][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 442.686376][ T8188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.404'. [ 442.939923][ T8119] chnl_net:caif_netlink_parms(): no params data found [ 443.320869][ T8195] netlink: 48 bytes leftover after parsing attributes in process `syz.0.405'. [ 443.566710][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 443.586594][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 443.588026][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 443.613486][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 443.614492][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 443.948494][ T5811] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 443.955680][ T5811] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 443.956995][ T5811] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 443.958437][ T5811] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 443.959155][ T5811] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 444.035596][ T5931] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 444.208058][ T5931] usb 1-1: Using ep0 maxpacket: 32 [ 444.211409][ T5931] usb 1-1: config 0 has an invalid interface number: 135 but max is 0 [ 444.211439][ T5931] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 444.211459][ T5931] usb 1-1: config 0 has no interface number 0 [ 444.211508][ T5931] usb 1-1: config 0 interface 135 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 444.211532][ T5931] usb 1-1: config 0 interface 135 altsetting 4 bulk endpoint 0x2 has invalid maxpacket 0 [ 444.211556][ T5931] usb 1-1: config 0 interface 135 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 444.211583][ T5931] usb 1-1: config 0 interface 135 has no altsetting 0 [ 444.221453][ T5931] usb 1-1: New USB device found, idVendor=0f11, idProduct=1011, bcdDevice=49.1a [ 444.221488][ T5931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.221510][ T5931] usb 1-1: Product: syz [ 444.221524][ T5931] usb 1-1: Manufacturer: syz [ 444.221539][ T5931] usb 1-1: SerialNumber: syz [ 444.252243][ T5931] usb 1-1: config 0 descriptor?? [ 444.274753][ T60] Bluetooth: hci2: command tx timeout [ 444.378550][ T5931] ldusb 1-1:0.135: Interrupt in endpoint not found [ 444.515308][ T5931] usb 1-1: USB disconnect, device number 34 [ 444.618048][ T8216] netlink: 'syz.3.403': attribute type 10 has an invalid length. [ 444.701381][ T8217] overlayfs: failed to resolve './file1/file0': -2 [ 445.700630][ T3097] bridge_slave_1: left allmulticast mode [ 445.700664][ T3097] bridge_slave_1: left promiscuous mode [ 445.700946][ T3097] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.784743][ T60] Bluetooth: hci3: command tx timeout [ 445.825979][ T3097] bridge_slave_0: left allmulticast mode [ 445.826004][ T3097] bridge_slave_0: left promiscuous mode [ 445.826199][ T3097] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.095141][ T60] Bluetooth: hci4: command tx timeout [ 446.635112][ T37] audit: type=1326 audit(1771065626.541:675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.635406][ T37] audit: type=1326 audit(1771065626.541:676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.635612][ T37] audit: type=1326 audit(1771065626.551:677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.636112][ T37] audit: type=1326 audit(1771065626.551:678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.636350][ T37] audit: type=1326 audit(1771065626.551:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.636552][ T37] audit: type=1326 audit(1771065626.551:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.636753][ T37] audit: type=1326 audit(1771065626.551:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.637047][ T37] audit: type=1326 audit(1771065626.551:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.637262][ T37] audit: type=1326 audit(1771065626.551:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8228 comm="syz.0.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7fe8e09cbf79 code=0x7ffc0000 [ 446.641503][ T60] Bluetooth: hci2: command tx timeout [ 448.975159][ T60] Bluetooth: hci3: command tx timeout [ 448.975199][ T60] Bluetooth: hci4: command tx timeout [ 449.015332][ T37] kauditd_printk_skb: 21 callbacks suppressed [ 449.015355][ T37] audit: type=1326 audit(1771065628.181:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8236 comm="syz.0.410" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe8e09cbf79 code=0x0 [ 451.062791][ T5811] Bluetooth: hci4: command tx timeout [ 451.062833][ T5811] Bluetooth: hci3: command tx timeout [ 451.196461][ T8244] RDS: rds_bind could not find a transport for fc01::, load rds_tcp or rds_rdma? [ 451.434809][ T5885] usb 1-1: new full-speed USB device number 35 using dummy_hcd [ 451.437245][ T3097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 451.515618][ T3097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 451.539819][ T3097] bond0 (unregistering): Released all slaves [ 451.587778][ T5885] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 451.587834][ T5885] usb 1-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.00 [ 451.587858][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.598115][ T5885] usb 1-1: config 0 descriptor?? [ 451.600423][ T8244] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 451.872363][ T8119] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.872479][ T8119] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.872673][ T8119] bridge_slave_0: entered allmulticast mode [ 451.898428][ T8119] bridge_slave_0: entered promiscuous mode [ 451.902805][ T8246] netlink: 132 bytes leftover after parsing attributes in process `syz.3.412'. [ 451.931322][ T8119] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.931553][ T8119] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.931794][ T8119] bridge_slave_1: entered allmulticast mode [ 451.965275][ T8119] bridge_slave_1: entered promiscuous mode [ 452.145389][ T3097] hsr_slave_0: left promiscuous mode [ 452.164931][ T3097] hsr_slave_1: left promiscuous mode [ 452.166087][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 452.208171][ T5885] usbhid 1-1:0.0: can't add hid device: -71 [ 452.208320][ T5885] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 452.218187][ T5885] usb 1-1: USB disconnect, device number 35 [ 452.224067][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 452.284863][ T5931] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 452.434895][ T5931] usb 4-1: Using ep0 maxpacket: 16 [ 452.441359][ T5931] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 452.441389][ T5931] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 452.441408][ T5931] usb 4-1: config 0 has no interface number 0 [ 452.441443][ T5931] usb 4-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 452.443129][ T5931] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 452.443153][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 452.443165][ T5931] usb 4-1: Product: syz [ 452.443173][ T5931] usb 4-1: SerialNumber: syz [ 452.455605][ T5931] usb 4-1: config 0 descriptor?? [ 452.478295][ T5931] usbhid 4-1:0.8: couldn't find an input interrupt endpoint [ 452.679396][ T5931] usb 4-1: USB disconnect, device number 24 [ 453.127631][ T8252] netlink: 'syz.0.414': attribute type 10 has an invalid length. [ 453.137477][ T5811] Bluetooth: hci4: command tx timeout [ 453.137668][ T60] Bluetooth: hci3: command tx timeout [ 453.267997][ T8253] overlayfs: failed to resolve './file1/file0': -2 [ 454.225892][ T3097] team0 (unregistering): Port device team_slave_1 removed [ 454.445421][ T3097] team0 (unregistering): Port device team_slave_0 removed [ 455.454446][ T37] audit: type=1326 audit(1771065635.641:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.455970][ T37] audit: type=1326 audit(1771065635.641:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.456189][ T37] audit: type=1326 audit(1771065635.641:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.456350][ T37] audit: type=1326 audit(1771065635.641:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.456554][ T37] audit: type=1326 audit(1771065635.641:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.456767][ T37] audit: type=1326 audit(1771065635.651:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.456952][ T37] audit: type=1326 audit(1771065635.651:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.457147][ T37] audit: type=1326 audit(1771065635.651:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.457327][ T37] audit: type=1326 audit(1771065635.651:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 455.457545][ T37] audit: type=1326 audit(1771065635.651:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8264 comm="syz.3.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x7ffc0000 [ 460.219283][ T8119] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.320294][ T8119] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 460.350092][ T8280] Invalid logical block size (1792) [ 460.508667][ T8119] team0: Port device team_slave_0 added [ 460.542699][ T8119] team0: Port device team_slave_1 added [ 460.728546][ T8119] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 460.728559][ T8119] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 460.728575][ T8119] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 460.732429][ T8119] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 460.732441][ T8119] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 460.732458][ T8119] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 461.202838][ T8119] hsr_slave_0: entered promiscuous mode [ 461.208950][ T8119] hsr_slave_1: entered promiscuous mode [ 461.210178][ T8119] debugfs: 'hsr0' already exists in 'hsr' [ 461.210201][ T8119] Cannot create hsr debugfs directory [ 461.565203][ T6537] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 461.626745][ T8196] chnl_net:caif_netlink_parms(): no params data found [ 461.714850][ T6537] usb 4-1: Using ep0 maxpacket: 8 [ 461.716525][ T6537] usb 4-1: config 0 has an invalid interface number: 255 but max is 0 [ 461.716544][ T6537] usb 4-1: config 0 has no interface number 0 [ 461.716573][ T6537] usb 4-1: New USB device found, idVendor=17cc, idProduct=1010, bcdDevice=38.34 [ 461.716590][ T6537] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.722837][ T6537] usb 4-1: config 0 descriptor?? [ 462.314176][ T8206] chnl_net:caif_netlink_parms(): no params data found [ 462.817625][ T6537] snd-usb-audio 4-1:0.255: probe with driver snd-usb-audio failed with error -110 [ 463.075826][ T6537] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 463.076589][ T8196] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.077371][ T8196] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.077553][ T8196] bridge_slave_0: entered allmulticast mode [ 463.079393][ T8196] bridge_slave_0: entered promiscuous mode [ 463.131892][ T8196] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.131984][ T8196] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.132130][ T8196] bridge_slave_1: entered allmulticast mode [ 463.133987][ T8196] bridge_slave_1: entered promiscuous mode [ 463.237539][ T6537] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 463.237689][ T6537] usb 1-1: config 0 has no interface number 0 [ 463.237739][ T6537] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 463.237760][ T6537] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 463.237785][ T6537] usb 1-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 463.237798][ T6537] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.243377][ T6537] usb 1-1: config 0 descriptor?? [ 463.739456][ T8196] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 463.761460][ T6537] usbhid 1-1:0.1: can't add hid device: -71 [ 463.761556][ T6537] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 463.787243][ T6537] usb 1-1: USB disconnect, device number 36 [ 463.922783][ T8196] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 463.923291][ T8206] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.923366][ T8206] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.923498][ T8206] bridge_slave_0: entered allmulticast mode [ 463.928582][ T8206] bridge_slave_0: entered promiscuous mode [ 464.145974][ T31] usb 4-1: USB disconnect, device number 25 [ 464.214923][ T8206] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.215002][ T8206] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.215175][ T8206] bridge_slave_1: entered allmulticast mode [ 464.216819][ T8206] bridge_slave_1: entered promiscuous mode [ 465.827937][ T8196] team0: Port device team_slave_0 added [ 465.970393][ T8206] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 466.004089][ T8196] team0: Port device team_slave_1 added [ 466.023258][ T8206] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 467.108128][ T37] kauditd_printk_skb: 21 callbacks suppressed [ 467.108183][ T37] audit: type=1326 audit(1771065647.351:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8315 comm="syz.3.426" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x0 [ 467.467057][ T8196] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 467.467076][ T8196] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 467.467101][ T8196] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 467.477281][ T8206] team0: Port device team_slave_0 added [ 467.526060][ T8196] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 467.526078][ T8196] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 467.526104][ T8196] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 467.603105][ T8206] team0: Port device team_slave_1 added [ 467.964365][ T8206] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 467.964385][ T8206] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 467.964415][ T8206] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 468.074372][ T8196] hsr_slave_0: entered promiscuous mode [ 468.077664][ T8196] hsr_slave_1: entered promiscuous mode [ 468.085248][ T8196] debugfs: 'hsr0' already exists in 'hsr' [ 468.085279][ T8196] Cannot create hsr debugfs directory [ 468.087071][ T8206] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 468.087085][ T8206] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 468.087110][ T8206] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 468.627651][ T8327] netlink: 'syz.0.428': attribute type 10 has an invalid length. [ 468.712192][ T8328] overlayfs: failed to resolve './file1/file0': -2 [ 469.458571][ T31] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 469.744791][ T31] usb 4-1: device descriptor read/64, error -71 [ 470.577565][ T31] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 470.704789][ T31] usb 4-1: device descriptor read/64, error -71 [ 470.780443][ T8206] hsr_slave_0: entered promiscuous mode [ 470.781339][ T8206] hsr_slave_1: entered promiscuous mode [ 470.781957][ T8206] debugfs: 'hsr0' already exists in 'hsr' [ 470.781982][ T8206] Cannot create hsr debugfs directory [ 470.811159][ T8119] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 470.827616][ T31] usb usb4-port1: attempt power cycle [ 470.859691][ T8119] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 470.894851][ T10] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 471.047703][ T10] usb 1-1: config index 0 descriptor too short (expected 38, got 36) [ 471.047734][ T10] usb 1-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 471.047755][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 471.047788][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 471.047804][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 471.047817][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 471.047842][ T10] usb 1-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 471.047856][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.051888][ T10] usb 1-1: config 0 descriptor?? [ 471.171959][ T8119] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 471.184784][ T31] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 471.212073][ T31] usb 4-1: device descriptor read/8, error -71 [ 471.256440][ T8119] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 471.454211][ T31] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 471.479077][ T31] usb 4-1: device descriptor read/8, error -71 [ 471.502814][ T10] input: HID 28bd:0909 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:28BD:0909.0007/input/input14 [ 471.584309][ T10] uclogic 0003:28BD:0909.0007: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.0-1/input0 [ 471.585089][ T31] usb usb4-port1: unable to enumerate USB device [ 471.698737][ T10] usb 1-1: USB disconnect, device number 37 [ 471.770512][ T8343] fido_id[8343]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 472.635841][ T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 472.667981][ T3097] bridge_slave_1: left allmulticast mode [ 472.668012][ T3097] bridge_slave_1: left promiscuous mode [ 472.668313][ T3097] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.746684][ T3097] bridge_slave_0: left allmulticast mode [ 472.746709][ T3097] bridge_slave_0: left promiscuous mode [ 472.746912][ T3097] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.787591][ T10] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 472.787623][ T10] usb 1-1: config 0 has no interface number 0 [ 472.787654][ T10] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 472.787670][ T10] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 472.787693][ T10] usb 1-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 472.787707][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.791602][ T10] usb 1-1: config 0 descriptor?? [ 472.852370][ T3097] bridge_slave_1: left allmulticast mode [ 472.852398][ T3097] bridge_slave_1: left promiscuous mode [ 472.852755][ T3097] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.953777][ T3097] bridge_slave_0: left allmulticast mode [ 472.954003][ T3097] bridge_slave_0: left promiscuous mode [ 472.954548][ T3097] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.945930][ T37] audit: type=1326 audit(1771065656.121:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8358 comm="syz.3.436" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff53386bf79 code=0x0 [ 477.520439][ T3097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 477.616530][ T3097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 477.710539][ T3097] bond0 (unregistering): Released all slaves [ 478.016361][ T10] usbhid 1-1:0.1: can't add hid device: -32 [ 478.016504][ T10] usbhid 1-1:0.1: probe with driver usbhid failed with error -32 [ 478.565239][ T5924] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 478.705277][ T5924] usb 4-1: device descriptor read/64, error -71 [ 478.955272][ T5924] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 479.125061][ T5924] usb 4-1: device descriptor read/64, error -71 [ 479.236786][ T5924] usb usb4-port1: attempt power cycle [ 479.584845][ T5924] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 479.615577][ T5924] usb 4-1: device descriptor read/8, error -71 [ 479.855171][ T5924] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 479.875514][ T5924] usb 4-1: device descriptor read/8, error -71 [ 479.875941][ T3097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 479.957466][ T3097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 479.978190][ T3097] bond0 (unregistering): Released all slaves [ 479.991446][ T5924] usb usb4-port1: unable to enumerate USB device [ 480.145418][ T5924] usb 1-1: USB disconnect, device number 38 [ 480.230117][ T8119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.294142][ T8119] 8021q: adding VLAN 0 to HW filter on device team0 [ 480.314252][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.314532][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 480.346861][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 480.347051][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 480.716496][ T8376] netlink: 'syz.0.438': attribute type 10 has an invalid length. [ 480.728530][ T8376] overlayfs: failed to resolve './file1/file0': -2 [ 481.973375][ T8387] netlink: 'syz.0.442': attribute type 11 has an invalid length. [ 482.055108][ T3097] hsr_slave_0: left promiscuous mode [ 482.104794][ T3097] hsr_slave_1: left promiscuous mode [ 482.105797][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 482.134797][ T5924] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 482.153171][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.302868][ T5924] usb 4-1: config index 0 descriptor too short (expected 38, got 36) [ 482.302900][ T5924] usb 4-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 482.302919][ T5924] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 482.302969][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 482.302987][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 482.302999][ T5924] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 482.303024][ T5924] usb 4-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 482.303037][ T5924] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.393515][ T5924] usb 4-1: config 0 descriptor?? [ 482.425652][ T3097] hsr_slave_0: left promiscuous mode [ 482.464894][ T3097] hsr_slave_1: left promiscuous mode [ 482.466045][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 482.488616][ T3097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.824336][ T5924] input: HID 28bd:0909 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:28BD:0909.0008/input/input15 [ 482.930360][ T5924] uclogic 0003:28BD:0909.0008: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.3-1/input0 [ 483.015784][ T8385] netlink: 56 bytes leftover after parsing attributes in process `syz.3.441'. [ 483.040903][ T5885] usb 4-1: USB disconnect, device number 34 [ 483.407568][ T3097] team0 (unregistering): Port device team_slave_1 removed [ 483.546716][ T3097] team0 (unregistering): Port device team_slave_0 removed [ 484.686393][ T5885] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 484.837188][ T5885] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 484.837219][ T5885] usb 4-1: config 0 has no interface number 0 [ 484.837270][ T5885] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 484.837297][ T5885] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 484.837338][ T5885] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 484.837363][ T5885] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.859719][ T5885] usb 4-1: config 0 descriptor?? [ 485.265621][ T3097] team0 (unregistering): Port device team_slave_1 removed [ 485.405695][ T3097] team0 (unregistering): Port device team_slave_0 removed [ 487.359144][ T5885] usbhid 4-1:0.1: can't add hid device: -71 [ 487.359288][ T5885] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 487.372275][ T5885] usb 4-1: USB disconnect, device number 35 [ 487.538358][ T8402] netlink: 'syz.0.446': attribute type 10 has an invalid length. [ 487.630852][ T8119] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 487.681632][ T8402] overlayfs: failed to resolve './file1/file0': -2 [ 490.878874][ T8196] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 491.398509][ T8196] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 491.651190][ T8196] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 491.860550][ T8196] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 492.495213][ T5924] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 493.026423][ T5924] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 493.026459][ T5924] usb 1-1: config 0 interface 0 has no altsetting 0 [ 493.044798][ T31] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 493.053300][ T5924] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 493.053330][ T5924] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 493.053348][ T5924] usb 1-1: Product: syz [ 493.053361][ T5924] usb 1-1: Manufacturer: syz [ 493.053374][ T5924] usb 1-1: SerialNumber: syz [ 493.059357][ T5924] usb 1-1: config 0 descriptor?? [ 493.081654][ T5924] usb 1-1: selecting invalid altsetting 0 [ 493.185662][ T31] usb 4-1: device descriptor read/64, error -71 [ 493.281557][ T8206] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 493.286108][ T8420] netlink: 16 bytes leftover after parsing attributes in process `syz.0.449'. [ 493.321103][ T8420] netlink: 16 bytes leftover after parsing attributes in process `syz.0.449'. [ 493.337671][ T8206] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 493.431184][ T31] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 493.434518][ T8206] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 493.447787][ T5924] usb 1-1: USB disconnect, device number 39 [ 493.530872][ T8206] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 493.570469][ T31] usb 4-1: device descriptor read/64, error -71 [ 493.676461][ T31] usb usb4-port1: attempt power cycle [ 493.679849][ T8119] veth0_vlan: entered promiscuous mode [ 493.821531][ T8119] veth1_vlan: entered promiscuous mode [ 493.966075][ T8119] veth0_macvtap: entered promiscuous mode [ 493.980250][ T8196] 8021q: adding VLAN 0 to HW filter on device bond0 [ 493.995106][ T8119] veth1_macvtap: entered promiscuous mode [ 494.015857][ T31] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 494.035934][ T31] usb 4-1: device descriptor read/8, error -71 [ 494.058232][ T8196] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.069055][ T8119] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 494.087186][ T6432] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.087274][ T6432] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.093908][ T8119] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 494.110172][ T8206] 8021q: adding VLAN 0 to HW filter on device bond0 [ 494.129330][ T1028] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.129434][ T1028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.161217][ T1028] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.169399][ T2830] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.176581][ T2830] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.185481][ T2830] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.211034][ T8206] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.274776][ T31] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 494.283713][ T3097] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.283891][ T3097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.295611][ T31] usb 4-1: device descriptor read/8, error -71 [ 494.410208][ T31] usb usb4-port1: unable to enumerate USB device [ 494.429857][ T1028] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.430007][ T1028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 495.287015][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.287041][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.385072][ T5931] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 495.435505][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.435528][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.503504][ T8206] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 495.547356][ T5931] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 495.547422][ T5931] usb 1-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 495.547447][ T5931] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.584849][ T5931] usb 1-1: config 0 descriptor?? [ 495.601827][ T5931] usb 1-1: bad CDC descriptors [ 495.978574][ T5931] usb 1-1: USB disconnect, device number 40 [ 496.110258][ T8196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 496.414898][ T5924] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 496.570670][ T8206] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 496.577554][ T5924] usb 4-1: config index 0 descriptor too short (expected 38, got 36) [ 496.577582][ T5924] usb 4-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 496.577602][ T5924] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 496.577650][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.577673][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 496.577694][ T5924] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 496.577732][ T5924] usb 4-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 496.577754][ T5924] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.592443][ T5924] usb 4-1: config 0 descriptor?? [ 497.108606][ T5924] input: HID 28bd:0909 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:28BD:0909.0009/input/input16 [ 497.200751][ T8458] netlink: 56 bytes leftover after parsing attributes in process `syz.3.451'. [ 497.287542][ T5924] uclogic 0003:28BD:0909.0009: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.3-1/input0 [ 497.322324][ T5924] usb 4-1: USB disconnect, device number 40 [ 497.339494][ T8196] veth0_vlan: entered promiscuous mode [ 497.374999][ T808] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 497.379832][ T8196] veth1_vlan: entered promiscuous mode [ 497.484792][ T31] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 497.502923][ T8196] veth0_macvtap: entered promiscuous mode [ 497.531350][ T808] usb 1-1: Using ep0 maxpacket: 8 [ 497.544758][ T808] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 497.544840][ T808] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 497.544865][ T808] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 497.544889][ T808] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 497.544913][ T808] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 497.544957][ T808] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 497.544979][ T808] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.638013][ T31] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 497.638045][ T31] usb 7-1: config 0 has no interface number 0 [ 497.638157][ T31] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 497.638185][ T31] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 497.638226][ T31] usb 7-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 497.638310][ T31] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.640090][ T8485] fido_id[8485]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 497.721289][ T8196] veth1_macvtap: entered promiscuous mode [ 497.807968][ T8196] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 497.829657][ T31] usb 7-1: config 0 descriptor?? [ 497.830164][ T8196] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 497.859174][ T1028] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.861294][ T1028] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.863000][ T1028] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.863210][ T1028] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.153830][ T5931] usb 1-1: USB disconnect, device number 41 [ 498.382886][ T31] usbhid 7-1:0.1: can't add hid device: -71 [ 498.383020][ T31] usbhid 7-1:0.1: probe with driver usbhid failed with error -71 [ 498.397814][ T31] usb 7-1: USB disconnect, device number 2 [ 498.726804][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.726830][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.798655][ T8206] veth0_vlan: entered promiscuous mode [ 498.845455][ T8206] veth1_vlan: entered promiscuous mode [ 498.853546][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.853569][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 499.146747][ T8206] veth0_macvtap: entered promiscuous mode [ 499.176487][ T8206] veth1_macvtap: entered promiscuous mode [ 499.259623][ T8206] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 499.286616][ T8206] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 499.434759][ T43] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.453307][ T43] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.466948][ T43] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.484725][ T6432] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.717154][ T8520] netlink: 'syz.3.456': attribute type 10 has an invalid length. [ 499.766452][ T8520] overlayfs: failed to resolve './file1/file0': -2 [ 499.824750][ T5871] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 499.994369][ T5871] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 499.994408][ T5871] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 499.994449][ T5871] usb 7-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 499.994472][ T5871] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.055438][ T5871] usb 7-1: config 0 descriptor?? [ 500.103796][ T8526] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 500.122076][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.122099][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.247349][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.247374][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.505981][ T5871] steelseries 0003:1038:12B6.000A: unknown main item tag 0x1 [ 500.506021][ T5871] steelseries 0003:1038:12B6.000A: item fetching failed at offset 5/7 [ 500.507028][ T5871] steelseries 0003:1038:12B6.000A: probe with driver steelseries failed with error -22 [ 501.184874][ T5924] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 501.554708][ T5924] usb 6-1: config index 0 descriptor too short (expected 38, got 36) [ 501.554739][ T5924] usb 6-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 501.554761][ T5924] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 501.554822][ T5924] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.554849][ T5924] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 501.554871][ T5924] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 501.554913][ T5924] usb 6-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 501.554936][ T5924] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.446590][ T5924] usb 6-1: config 0 descriptor?? [ 502.645191][ T10] usb 7-1: USB disconnect, device number 3 [ 503.184861][ T10] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 503.286606][ T8547] genirq: Flags mismatch irq 4. 00202000 (pcl812) vs. 00202080 (ttyS0) [ 504.103271][ T8530] netlink: 56 bytes leftover after parsing attributes in process `syz.5.463'. [ 504.355947][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 504.356011][ T10] usb 4-1: config 0 has no interface number 0 [ 504.356222][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 504.356265][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 504.356354][ T10] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 504.356380][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.938704][ T10] usb 4-1: config 0 descriptor?? [ 506.307501][ T5924] input: HID 28bd:0909 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:28BD:0909.000B/input/input17 [ 506.450594][ T10] usbhid 4-1:0.1: can't add hid device: -71 [ 506.450721][ T10] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 506.454228][ T10] usb 4-1: USB disconnect, device number 41 [ 506.596626][ T5924] uclogic 0003:28BD:0909.000B: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.5-1/input0 [ 506.604068][ T5924] usb 6-1: USB disconnect, device number 2 [ 508.415161][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 508.415245][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 508.875913][ T8583] program syz.0.477 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 509.098777][ T8587] syz.3.478 uses obsolete (PF_INET,SOCK_PACKET) [ 509.145682][ T8584] fido_id[8584]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 513.268788][ T5811] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 513.302910][ T5811] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 513.304506][ T5811] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 513.318016][ T8621] netlink: 'syz.6.474': attribute type 10 has an invalid length. [ 513.332588][ T5811] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 513.353628][ T5811] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 513.437755][ T8622] overlayfs: failed to resolve './file1/file0': -2 [ 513.438018][ T8621] team0: Failed to send options change via netlink (err -105) [ 513.438039][ T8621] team0: Port device dummy0 added [ 513.941961][ T8558] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.587149][ T8558] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.072587][ T8558] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.454874][ T60] Bluetooth: hci4: command tx timeout [ 515.586876][ T8558] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.887546][ T8619] chnl_net:caif_netlink_parms(): no params data found [ 516.072665][ T8671] 9p: Bad value for 'rfdno' [ 517.031878][ T8619] bridge0: port 1(bridge_slave_0) entered blocking state [ 517.032110][ T8619] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.032368][ T8619] bridge_slave_0: entered allmulticast mode [ 517.041842][ T8619] bridge_slave_0: entered promiscuous mode [ 517.048508][ T8619] bridge0: port 2(bridge_slave_1) entered blocking state [ 517.048743][ T8619] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.049317][ T8619] bridge_slave_1: entered allmulticast mode [ 517.052030][ T8619] bridge_slave_1: entered promiscuous mode [ 517.473609][ T8558] bridge_slave_1: left allmulticast mode [ 517.473638][ T8558] bridge_slave_1: left promiscuous mode [ 517.473863][ T8558] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.665475][ T60] Bluetooth: hci4: command tx timeout [ 518.735539][ T8558] bridge_slave_0: left allmulticast mode [ 518.735572][ T8558] bridge_slave_0: left promiscuous mode [ 518.735861][ T8558] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.746767][ T8694] netlink: 'syz.3.494': attribute type 10 has an invalid length. [ 519.774880][ T60] Bluetooth: hci4: command tx timeout [ 520.514808][ T6537] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 520.664723][ T6537] usb 1-1: Using ep0 maxpacket: 32 [ 520.696376][ T6537] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 520.696407][ T6537] usb 1-1: config 0 has no interface number 0 [ 520.702511][ T6537] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 520.702541][ T6537] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.702555][ T6537] usb 1-1: Product: syz [ 520.702563][ T6537] usb 1-1: Manufacturer: syz [ 520.702571][ T6537] usb 1-1: SerialNumber: syz [ 520.760426][ T6537] usb 1-1: config 0 descriptor?? [ 520.783898][ T6537] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 520.783928][ T6537] usb 1-1: selecting invalid altsetting 1 [ 520.783944][ T6537] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 520.900011][ T6537] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 520.900861][ T6537] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 520.900951][ T6537] usb 1-1: media controller created [ 520.947421][ T6537] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 521.378429][ T6537] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 521.579748][ T60] ================================================================== [ 521.579765][ T60] BUG: KASAN: vmalloc-out-of-bounds in __list_del_entry_valid_or_report+0xb5/0x190 [ 521.579799][ T60] Read of size 8 at addr ffffc90020484008 by task kworker/u9:0/60 [ 521.579816][ T60] [ 521.579827][ T60] CPU: 1 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 521.579850][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 521.579863][ T60] Workqueue: hci2 hci_rx_work [ 521.579894][ T60] Call Trace: [ 521.579902][ T60] [ 521.579910][ T60] dump_stack_lvl+0xe8/0x150 [ 521.579938][ T60] print_report+0xba/0x230 [ 521.579961][ T60] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 521.579982][ T60] kasan_report+0x117/0x150 [ 521.580003][ T60] ? rt_spin_lock+0x20e/0x400 [ 521.580024][ T60] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 521.580048][ T60] __list_del_entry_valid_or_report+0xb5/0x190 [ 521.580071][ T60] kcov_remote_start+0x2af/0x710 [ 521.580110][ T60] hci_rx_work+0x10f/0x1030 [ 521.580140][ T60] ? process_scheduled_works+0xa0f/0x17a0 [ 521.580164][ T60] process_scheduled_works+0xaec/0x17a0 [ 521.580198][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 521.580223][ T60] ? assign_work+0x3d5/0x5e0 [ 521.580246][ T60] worker_thread+0xa50/0xfc0 [ 521.580280][ T60] kthread+0x388/0x470 [ 521.580308][ T60] ? __pfx_worker_thread+0x10/0x10 [ 521.580329][ T60] ? __pfx_kthread+0x10/0x10 [ 521.580356][ T60] ret_from_fork+0x51e/0xb90 [ 521.580381][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 521.580403][ T60] ? __switch_to+0xc7d/0x1400 [ 521.580424][ T60] ? __pfx_kthread+0x10/0x10 [ 521.580450][ T60] ret_from_fork_asm+0x1a/0x30 [ 521.580485][ T60] [ 521.580492][ T60] [ 521.580498][ T60] The buggy address belongs to a vmalloc virtual mapping [ 521.580515][ T60] Memory state around the buggy address: [ 521.580526][ T60] ffffc90020483f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 521.580539][ T60] ffffc90020483f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 521.580552][ T60] >ffffc90020484000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 521.580561][ T60] ^ [ 521.580572][ T60] ffffc90020484080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 521.580585][ T60] ffffc90020484100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 521.580595][ T60] ================================================================== [ 521.580607][ T60] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 521.580622][ T60] CPU: 1 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 521.580644][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 521.580657][ T60] Workqueue: hci2 hci_rx_work [ 521.580693][ T60] Call Trace: [ 521.580700][ T60] [ 521.580707][ T60] vpanic+0x1e0/0x670 [ 521.580737][ T60] panic+0xc5/0xd0 [ 521.580761][ T60] ? __pfx_panic+0x10/0x10 [ 521.580787][ T60] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 521.580809][ T60] ? rcu_is_watching+0x15/0xb0 [ 521.580840][ T60] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 521.580861][ T60] check_panic_on_warn+0x89/0xb0 [ 521.580880][ T60] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 521.580900][ T60] end_report+0x6f/0x140 [ 521.580928][ T60] kasan_report+0x128/0x150 [ 521.580947][ T60] ? rt_spin_lock+0x20e/0x400 [ 521.580967][ T60] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 521.580992][ T60] __list_del_entry_valid_or_report+0xb5/0x190 [ 521.581014][ T60] kcov_remote_start+0x2af/0x710 [ 521.581045][ T60] hci_rx_work+0x10f/0x1030 [ 521.581074][ T60] ? process_scheduled_works+0xa0f/0x17a0 [ 521.581097][ T60] process_scheduled_works+0xaec/0x17a0 [ 521.581131][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 521.581156][ T60] ? assign_work+0x3d5/0x5e0 [ 521.581180][ T60] worker_thread+0xa50/0xfc0 [ 521.581214][ T60] kthread+0x388/0x470 [ 521.581240][ T60] ? __pfx_worker_thread+0x10/0x10 [ 521.581262][ T60] ? __pfx_kthread+0x10/0x10 [ 521.581289][ T60] ret_from_fork+0x51e/0xb90 [ 521.581313][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 521.581334][ T60] ? __switch_to+0xc7d/0x1400 [ 521.581356][ T60] ? __pfx_kthread+0x10/0x10 [ 521.581383][ T60] ret_from_fork_asm+0x1a/0x30 [ 521.581418][ T60] [ 521.594462][ T60] Kernel Offset: disabled