last executing test programs: 3.509339381s ago: executing program 2 (id=148): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_connect$uac1(0x5, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x82, &(0x7f0000000380)=@string={0x82, 0x3, "ddd7984b47f680658f1337f20ac041e3186264cd6b9cdf180f061caf1149778d243a5ee65cb228ef3b25433eab0aeda7c7bc09d9224f1b8e5cce72c6b8da058427cf1980db93bb20373f8116ae0e34407b5923f305b0d853cfffd933cabd914f27b4c1d236c1b8da549104cc0f3c5a1598bfddc0f1506d0c6576177cc14bdc76"}}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x5, 0x2f, &(0x7f0000000500)={{0x12, 0x1, 0x300, 0x2, 0xd6, 0x63, 0xff, 0x9aa, 0x1000, 0xe3c8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1d, 0x1, 0xb4, 0xe7, 0xc0, 0x12, [{{0x9, 0x4, 0xf3, 0x8, 0x1, 0x8c, 0xf2, 0xfc, 0x2d, [], [{{0x9, 0x5, 0x80, 0x8, 0x200, 0xf0, 0x7, 0x5, [@generic={0x2, 0x24}]}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 3.200083384s ago: executing program 0 (id=154): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup3(r0, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x14, 0x0, &(0x7f0000000000)) 3.078940864s ago: executing program 0 (id=157): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000e80)={0x2c, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000740)={0x34, &(0x7f0000000100)={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.812214301s ago: executing program 4 (id=169): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000000040)={'\x00\f\x00', 0x0, 0x5, 0x2, 0x0, 0x0, "00000000020000000000002100", "00004702", "0300", "97ad3700", ["fdffffff84a438dfc5d5c010", "d78cb8b0211a83be12ff0bff", "0000efffffffffffbfff00"]}) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f00000000c0)={"4c97aef4", 0xb, 0x5, 0x0, 0x3, 0x1000006, "5b0004000001030094000000f000", "1575a859", "0725eade", '\'q6O', ["5a535857c62224475793eca7", "7f9ce2d2c4f439ff80e1d1c8", "fa89bbe62b42a3023be516d1", "969a13a6806ad2b97b77791a"]}) 1.75857451s ago: executing program 1 (id=170): mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,mpol=interleave']) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000003c0), 0xb315) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f00000000c0)={0x0, 0x0, 0x300, 0x80000001}) 1.609072404s ago: executing program 3 (id=171): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f0000000500), &(0x7f00000002c0)=r0}, 0x20) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r1, r2, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r1}, &(0x7f00000006c0), &(0x7f0000000700)=r0}, 0x20) 1.587390311s ago: executing program 1 (id=172): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r1, &(0x7f0000000240)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000040)=""/2, 0x2, 0x0, 0x3, 0x0, 0x0, 0xc07}}, 0x120) readv(r1, &(0x7f0000000a00)=[{&(0x7f0000000900)=""/193, 0xc1}], 0x1) 1.586872991s ago: executing program 4 (id=173): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000b80)={{0xeb9f, 0x1, 0x0, 0xfc5f, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0xfc5f}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x5000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f00000000c0)={0x0, 0x0, &(0x7f000000f000/0x2000)=nil}) 1.554254574s ago: executing program 2 (id=174): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f0000000240)=0x1000, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e20, 0x1b, @local, 0x3}, 0x1c) getsockopt$inet6_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) 1.397582872s ago: executing program 3 (id=175): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0x449) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0x200) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x80000006) setxattr$incfs_size(&(0x7f0000000300)='./file0\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) 1.306412203s ago: executing program 2 (id=176): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aeb2, &(0x7f0000000300)={0x0, 0x12c, @ioapic={0xffff1000, 0x8000, 0x2, 0x80000001, 0x0, [{0x1, 0x85, 0x1, '\x00', 0x4}, {0x5, 0x3, 0x0, '\x00', 0x6}, {0x7, 0x3, 0xe, '\x00', 0x3b}, {0x4e, 0xe, 0xd6, '\x00', 0x86}, {0xc, 0xb, 0x6, '\x00', 0x4}, {0xf, 0x8, 0xf5, '\x00', 0x3}, {0x2, 0xa, 0x54, '\x00', 0x6}, {0x88, 0x3, 0x2a, '\x00', 0x80}, {0x4, 0x0, 0xa, '\x00', 0x1}, {0x8, 0x9, 0x3, '\x00', 0x8}, {0x3, 0x6, 0x3, '\x00', 0x6}, {0x2, 0x9, 0x0, '\x00', 0x7f}, {0x14, 0x51, 0xa, '\x00', 0xfc}, {0xe, 0xfc, 0x5, '\x00', 0x1}, {0x9, 0x2, 0x6, '\x00', 0x9}, {0x1, 0x3, 0xfe, '\x00', 0x3}, {0x2, 0xb, 0xd6, '\x00', 0x7f}, {0x7, 0x15, 0xca, '\x00', 0x6}, {0x0, 0x1, 0x4, '\x00', 0x13}, {0x4, 0x0, 0x40, '\x00', 0xda}, {0x3, 0x3, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x1, '\x00', 0x2}, {0xf9, 0x1, 0x4, '\x00', 0x8}, {0x8, 0xc, 0x0, '\x00', 0x6}]}}) 1.234635124s ago: executing program 3 (id=177): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000024d564b000000eccd"]) 1.19103371s ago: executing program 1 (id=178): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) ioperm(0x0, 0x2, 0x7e) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) 1.184776827s ago: executing program 4 (id=179): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000480)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xffffff0b}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x2, 0x2101, 0x0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000000)="2670e400a7cd2502df7986430458f68b124c93cfde5e8611861d74a5572162658ecb1f0717e5b2f49b6d2f60797d2975a524be5f71a43b3dadfa6e06f319bf57fb379cf068a0920ef790b0a8c7288632220046ce2922bc20d8f6ec8902c7b2b0a962fe09a3f14946fcd55fcebaa1294cb515cbdb5d25a98010fc3c7e8e6eb254451832f7b5944de95d2b2608b9c4ba8fd75f6c9d98007df452e472f9b1e9d30b90779ee42fcd88e8b4175066b73858f4164bd1bb22ebd829dc8d90fd8516187e40417efc5c759ada70450be2efd08b40ed4e77ea41920c381dcf69fd6a", 0xdd}, {&(0x7f00000001c0)="53812f25b1e42e134f4e75a76aad6ce9d6e1727644d2179fdb23bdb4a90dedb3ddcde79706ee102d63e1589cb57c5d038803359f1e3a928b0a61189782f3b37c9680813d0ab217665df4b2d515c27f4e8df80a0dfee70129ebab9d4779a5ad4260a674b13a1b364ec09325f6a7e51e6a732d376442cba82eed6473ef3c162e12dff86e8ec888be76181667ca6b360f1ae6160f821780abbb17c558d25a1ae439710b5f6d1e8347f52dafe63e88d4ba3b9dbaebc2fcd5b9a3ab53d9", 0xbb}, {&(0x7f00000012c0)="f588bd9f2abdd7d8dd7a06f14e413244d7b6097391319685aa96fca605b7a47808c790b144f745abe9c6f5f72b22c861ae5ef2f02482a3421af130b69aeb04e3b0bded0e4bcefeaf3d0d5dfe4f78ba7b91763da04708d65737c06b32e47a3bfcd00a773bba8a7781ec9e96b6e92618ada819f5bed6cc264111c90ceb0bf508b91eddd6371d022ed45857d592bb8c86294c6db801b113ebbb2ce00674a13fb8ba550bd192035b6fded86a62a789b87281520131477a57445ac0b6b613456d2526c345da572dde3268cd88a873a8774733a2415f72c74cec4f9944938cbbbfecce9c9de6051e2667c97447294726d24f8390895e306bd1115ac0f4f09cb6da57472cb57239ab53638fe4b0335cfca04ff5231788036e53e093f9b571f27b5108e5f48019087d3422dfcca76c5c75bf59cdc4bedd5c8da21def2cf9c23176b9917ab6f37725e8d917f12b771d56bf54afbf72881d59ace3cf7ba48ff1d0f800628e8721eddb8477d55e40ebd7bb989bb394f1e65548f7dc764faac92b26b46e3d302be95b74ba3241c01b810f18cdfbc593f90b2c4e225e943b0c75273e9026fd5ae5a0eee82662f819cf7b2e7b1b0ced24a32ced4308472e867db38e205b33c65f3430cf18df8146558723980fb0faea832a4b4810f74c18c4f3d8e9c00b2a6bfaaf38c1e0afd2ff03b5f7384662d0816b1d2a96f1131c0e69f360f3c68ea077fdc6f030d3e2a5ed47a8808716935dc075b19fe2a99eee1e0bbdd115a64b38b77e080210f69236dc9f0911cbd9bde6881800db97288a94b5ce9be36dc42ecfda3d0736ca3dc9ac2564e459a9a970fe8e4cb653ae62e8e4afd094d7cbf67d2f44a4472f28471783bcacf6aa8140112a45394490957f0d1afc80f53c92dc723d14bc5b81989a403d875f16a0c056497cd0eb8f1ed97ff65e745cb24c38aa03d2de7650e71a771d200dd2486a7477b74ba28ed0224035f0fdba2fda3aae13f65709bd2f1b67a7ce80c91a251469774773e16f7829eea5e505c3571f930ea304b8b30860008365122620711cc96aa54d9153b767683973f49b8d2be4bc6bda861b8ad777eebc994c82fbe6d455077c7f0021cafff738ab2a26ffadfe5f94cd83b88483ba8cf71088d056ec946644bd1e926b59bf6775d7437e8675e49d9e8698a9b524b5e6e1b54ff25e2915c42b94967e526ac66566350edb06e658d5f56084c746ba01288c59b64b749381c833c797cc2568bcd033969bf817b662689dfd911a0f3aba5e9913b330fac8276199079ccc0ad97a39de253d5d2db359d9d13710dbf787de0644c1580d4fa0d4cfa3f7feb29151ff6d41c65bec9cb1613a3a6c7819d929b0befec5acc55cfb1bb1f546afa9ebfaa485645f8344d073e3503b1ee684a40d58d39da9d826c6dfd92eabdc9fca4bad148c4ea5c3a7622de74408facb4bec3958555060d5ecb55da7123887e774402e036532c5e17a097999627563b0466055face10172c717b86d1966e45c86e3caecf029dee5ca0954ac47d264fe7898c1b92814825aa42823b6c1de401571a15d24e4bd7f5d25d5b5189088bb9340e7b185af73849dbfb23af66e0eb88be443df859e4d22b48d5573164966e7e004e4b2d6bccc7c5cd779721c82d415ae41a320f15518623a768fe96ac9526c7d6760912104576a8d163c1120d038241359f27adda8c692ca608dde4789fc620264257d88028b5584a1799935ce37b4c97bd531eba463d0cdfa9465137ad8e6883c366477c3c20a49c0ba3e613a4a6859ab76f332b315394074d83782b11d8aeae7d419c952e036bc6d179aa975cbbbf456ddabc5b988b415e901b8f9755262edff1326f4a6b0c0046aa942e8e03d9bdd692b5d87fe974f51defc99b19e03a73fe7c779caf5268af157c12b1132f2273e13b41f484ccf43cc0376e66f8d8f86a1de1f18dc00be52477ce432fa791850bba55d87a1092a2636fdaa9210efbae6f4142c8f78451f45afb9ec1eb97a8538d116ba80a95e0a40a4453ed7bbe66b4da04993ee8f6f706d6150692145bd829bd4529e1d078767b8584d8491ae7036307097c5929d667e61f781a9b5eadab675eed4bab14a9b4be505062cdfbfbf9e00d66a7f80d7c535af13cda726eb3d1b52a348e9de0815a625d02c9bffdc0e5dbb760923e4e3a70f3aca157ed5748cf08d66140cf400ad6f55f586382dae5d1c934d91f978b7b5a5e3707ba8b36418d9cd5d8cbebd6f5aeca9044161e787fc921c0417b9f0dac1d924c1ce3cea2c9c5bdd93d492a8b29fdf82b5677a9faf51b2aedbecd749a4ad52cca28769515793060dfde5d10f5f2f2d0c79e8147dd921df436511aabd34821aaced4eb617bb87d4077dd7df197fa214050fb90e88669bef83b179d873a8cdd064e4dc78e5a99a2680bf41a6c8d34ceecd93371571c1ce6915ecbc1413cc7b1c05680a787b0fbd28c214b4674b30da8922ef4d04cfff51b2a67ad387916e1707a8bc8e88395293c53c52799b70e5e0377015a3b711f03d9988ca13ea1ad26f70334c0c4dbcc0043271156883f18daa39c99b47f3c65f70fef2f19b9195068bf2e4076f1f6dfbe601e60f22c3d51d1b9663ee14d0cc3e4cff620993e1267131553679be8fd321c264ebc77b0afcb3fffb19a99a05cfab3a1746c577fe6bfba2d69bffccf224156b1db705b998ad033d5168b5a44052c6b9f5e40d110cc5a60fef3167133b0d5e16cdacbc807f32bbcbd16c7be9e867b5bf3f13ef3541aa0ea63d155cd0e41fcb68b32da7758920b06811ac786bb2d8632910d85ede6a72c9819f264a777a1feada2f14cb3a43b52cf6a142f312ac996aba941cd64143ef90401038eccb6bce4a849a93bd355430ff7857abfdfb56441fcde17585e6581ae0565d98d07ec4fccf72d96deb5830f1924a17c870d0adfc2d0634a308db0b11580c1c315b44fdde9115e6ddd7bc4cdc20427107fa244edf2d89f6d8508ea3ab9a52caaa21853bbbf9499fa2baf361f93c2767255315ae5bd18f8ddaf4eb5ffe93b33ab53f287f7a5c9bc78d5ac26c0f095b08cc1237faa081320e5b48ff224052a910d1d45e67b47b90875370bbce7c2082b8f372d90ac2f9f032c1b4667159f494e0a33ab8d404f4018cc2f881ee0439ee38e28cd76083717e079f1a8ecf3dce0334c433d1bd1a7b79371ece3fedc991f69e091e6ee55331ca2d843675f7784737938e91b93a58114ec201e4b56ab391b4452ff1eb53d25a2a185c0d95b90d0edfdd4c7866d10fde465ea0c72caf3b67cf13e0dfe5f096cb2898b629ff7bfd7cae4f8fd2e94bada955c8595770263bfbe13efb8e6004fd3053bc61a16f5dbae327fb3d96825da172f2c64951ec0f899bc1c2e05de8a72be992d259b6950e3458bc5ab331a0c27e5003f0a34388dced98dd8cd5fd22eedeeb4b9ec918ec67729b0c4f003b31a5e69693181d7e1cc44f6bf90cfee6a52a96016af280e761d24fad75c932b1f2ac3c955eebfa3ccf533559ffbe8a4d30787f4f1b58424ae6fde9b7007a38bf8efb85fe9f350d58a32bc26b1f7bea68743483c4716d342fdaf583c98138052c596c4369ff66da04a5a8a33418a40f787a20e0074052b147366f6969cec9a1f0d60b2f3b1d47cfc186b66965207c45b82b4f4438ef2ebd7f219f78ccf6f56e585a05eb70ea4d53e06db498e41df132928f82b6684d62aeaa9b5fb68c1c2a1bc6ea3e4f71cae76996f5a04d234ad3e928ecc67d6f54684c2faa06efdfe96aa36f22d566aec2f0bdb1f796a07e7084cb83dfacff7484a7098e4e9a34f9b50ee81afb018fe4d219767565c887b50c0449347a00c3708d7b689c21c85e9226933e84126123dfa10dbd84495b1e7714ab2c48605e8dbc2339e0d59cbdf6e884b4edb2bcbac51b0698a314b6e5f734bfdc9c60ba2f7cb7fcfa8dfc7ae38e6b7be15048d038a0245bc4ddffee4726168284aade372c66439cb12b40860fad3824bbeeb84c8f24f194134b43353a995792a1567961698cad32bc524e80c4847ca9e4a0176545cacd6ffdeced5ceb317f5b0013cd4dad37a59e6e83d9e7e5fbd0779c92fbccd7a3f53a5f5764055ee16ad13c1c072acc98799a16e50f4ff2af1cf0974c5009fc94c3cdf52f68ded56ebef3ca4a895fb9a09f37791abd2de5035ebdf067b4cf8d46454cee0e89a47a962628a08d482fe831d3a133bad5c310abbfb0499acb821b83b636d6cd549bab54206506e1172b4e4ab6b20ac442927db3dac1c7eccd1adeae91bcc67d69b28a56c4655ab200919ba600a9dfb19f7c29810383c007ce06a0c60fc00a789ab0ca4f77786ac80563663a0b26ecbc3fd23df49bdfb536ad8a63b1c52f96fdea93bb59acf6bf091f30bbce3049e66e32411ee1a9c1db60d564e7681bd23014f56a532f93f8845d245bf91a3c2aa42dc7e2e0b4c2a7603c7d399107371c786339828b1a147487150d1cbceef447eba69dc37ec8a034733cf20249f7a5b159e87bb5b967cf99464f77af5e2583e27b74510847a265a45212949f3b2a8aec9b698861b6d9115ff082e74785e593b7eb88a9d96b06a250447777766f6a0ccb1adab0761033f683a96287820f8ae81e7306675b8b8b3d9b086613fc81ed0da77fbccbd932fc245f9d4bbc6a0a533348c654bc03f7740bc35d75ad121180782a10451757f3ee9d07ccf481deda11537b38a69a631f5c661aa6eeea668745db18d461059ae0a51946fc0d96fc182fd4ff106c9aa89a93de51d461b5da05d6d4d8fcfb25183853a1766e3c1b04e19f6516503c8fd8f8ce9b8548dd2d5cfc1d6600f8941c1f08f74747524e63999fd4a3f837b8e9393fc34ed0534f518c31be7317833edbc85cc65b518aecae6b9ee72a62139879304a3601b4495db4cd6a1b8581df58d14c49c6fd75b82f6031c6e0c8e96065416e6d8750bde2ec5fbeeb7b1fe31f4f9e08cad5d7de6c5b92340ed90423a01a2ab3253d348dd0097c7426d348ed4ddbd54cca3a8ef7d591b5cd9d111486c22cdaa0dc91aa14b7521b39b05f9011474009369a2dacbc5095a59553f521bbd4f6183803a3aed6a288869d5280482a488d4245b73fc16d0bce0a28b13df7d5ed16f3734ecb76d123c91875aaa9ecab6c7a2f150f5f093903e4f351701680a48a9c675ea93bd7618e2c42bbcaf16f6f8efaed5a287037065d4e309387073442bd38764a13a4d70c8e0fd8d74b55043", 0xe69}], 0x3) 1.006704466s ago: executing program 2 (id=180): timer_create(0x7, &(0x7f0000000200)={0x0, 0x11}, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="a1"}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000006, 0x31, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 944.899793ms ago: executing program 4 (id=181): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000001c00)=[{{&(0x7f00000000c0)=@alg, 0x0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/97}, {&(0x7f0000000240)=""/121}, {&(0x7f0000000340)=""/107}, {&(0x7f00000001c0)=""/12}, {&(0x7f00000003c0)=""/124}, {&(0x7f0000001cc0)=""/213}, {&(0x7f0000000580)=""/181}], 0x0, &(0x7f00000009c0)=""/4096}, 0xbac00000}, {{&(0x7f00000006c0), 0x0, &(0x7f00000002c0)=[{&(0x7f0000000740)=""/214}, {&(0x7f0000000840)=""/201}]}, 0x100}, {{&(0x7f00000019c0)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x0, &(0x7f0000000940)=[{&(0x7f0000001a40)=""/207}], 0x0, &(0x7f0000001b40)=""/173}, 0x7a}], 0x400000000000273, 0x2b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 925.303517ms ago: executing program 0 (id=182): r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r0, &(0x7f0000000400)={'#! ', './file0', [], 0xa, "1f411d2552ad52cb07410969e814977e4f2c4a80522094786c8673fb61cf8b86bda4de504f5a3c7c04055f1f70e4064d46b2bb9e5100d446bb6a"}, 0x2) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='\t'], 0x28) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 869.40965ms ago: executing program 3 (id=183): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000036000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x100000, 0xeeef0000, 0x3, 0xad, 0x3, 0xd2, 0x81, 0x7, 0x0, 0x2b, 0x9}, {0x4000, 0x3000, 0x3, 0x0, 0x40, 0x9, 0x7f, 0x1, 0x5, 0x0, 0x3}, {0x3000, 0x1000, 0x8, 0x5, 0x1, 0x2, 0x0, 0x9, 0x0, 0xa7, 0xb, 0x81}, {0xdddd1000, 0x100000, 0xc, 0xe7, 0x3, 0x2, 0x1, 0xfb, 0x8, 0x7, 0xe, 0xf1}, {0xdddd0000, 0x2000, 0xd, 0xf7, 0x5, 0x86, 0xa, 0x7f, 0x2, 0x0, 0xf7, 0x43}, {0x1000, 0x8080000, 0x3, 0x80, 0xb1, 0x8, 0x4, 0x80, 0x80, 0xf, 0x1, 0x8}, {0xdddd0000, 0x11d004, 0xc, 0x7, 0x0, 0x5, 0x1, 0x3, 0x5, 0x80, 0x3, 0x4}, {0x100000, 0x1, 0xb, 0x5, 0x5, 0x7, 0x1, 0x37, 0x2, 0x8, 0xf0, 0xa}, {0xeeef0000, 0x70}, {0xdddd0000, 0x7}, 0x80000037, 0x0, 0xeeee0000, 0x2004, 0xf, 0x0, 0x3000, [0x8000000000000000, 0xfffffffffffffffc, 0x15e, 0x3]}) 745.117382ms ago: executing program 0 (id=184): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r2 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000340)={r3, 0x87, 0x30, 0x10}, &(0x7f0000000400)=0x18) 703.33669ms ago: executing program 4 (id=185): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000940)={{0x0, 0x2000, 0x0, 0xffff}, 'syz0\x00'}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f00000002c0)={{}, 0x12, 0xff9b}, 0x18) 510.75725ms ago: executing program 0 (id=186): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r1, 0x2f126000) r2 = syz_open_dev$media(&(0x7f0000000080), 0x2e17, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f00000001c0)={0x80000000, &(0x7f00000011c0), 0x0}) 480.051401ms ago: executing program 2 (id=187): openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000c40)={0x8000203d}) 474.66119ms ago: executing program 4 (id=188): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000086d044fc200000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="0023a1000000"], 0x0, 0x0, 0x0, 0x0}, 0x0) 421.11112ms ago: executing program 3 (id=189): r0 = inotify_init1(0x800) inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0xc0000484) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180), 0x0, 0x0, 0x0) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000000080)=""/50, 0x32}], 0x1) 328.096803ms ago: executing program 2 (id=190): r0 = syz_usb_connect(0x0, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000001c0)={&(0x7f0000000180)=[{0xb4b1, 0x4200, 0x0, 0x0}, {0x9, 0x221, 0x0, 0x0}], 0x2}) 252.302775ms ago: executing program 3 (id=191): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000000)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000001c0)=@e={0xff, 0xa, 0xc, 0x2, @generic=0x1f, 0x8, 0x7, 0x4}) 183.376646ms ago: executing program 1 (id=192): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x688200, 0x0) fchdir(r0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/211, 0xd3) 89.663862ms ago: executing program 0 (id=193): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a3b370086d04ae085811f10103010902"], 0x0) rseq(&(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) r1 = io_uring_setup(0x30df, &(0x7f0000000000)={0x0, 0x54cd, 0x800, 0x0, 0x1d}) close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_disconnect(r0) 89.22444ms ago: executing program 1 (id=194): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2}}, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) sendmmsg$inet6(r1, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="8de9", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000e40)="89", 0x1}], 0x1}}], 0x2, 0x40081) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/179, 0xb3, 0x0, 0x0}, &(0x7f0000000280)=0x40) 0s ago: executing program 1 (id=195): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0xff) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8080, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'pimreg1\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x8, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.228' (ED25519) to the list of known hosts. [ 82.213482][ T5823] cgroup: Unknown subsys name 'net' [ 82.344435][ T5823] cgroup: Unknown subsys name 'cpuset' [ 82.353919][ T5823] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.990640][ T5823] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.696810][ T5836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.705368][ T5836] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.712096][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.719634][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.727967][ T5836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.734233][ T5839] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.736285][ T5836] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.750289][ T5836] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.752563][ T5839] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.758715][ T5836] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.780991][ T5845] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.792753][ T5845] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.807212][ T5841] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.815643][ T5841] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.823386][ T5841] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.831642][ T5841] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.841007][ T5841] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.847720][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 86.849492][ T5841] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.858241][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.870248][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.890883][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 86.899985][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 86.910720][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 86.918707][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 87.592870][ T5848] chnl_net:caif_netlink_parms(): no params data found [ 87.802432][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 87.867908][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.876901][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.886625][ T5848] bridge_slave_0: entered allmulticast mode [ 87.895190][ T5848] bridge_slave_0: entered promiscuous mode [ 87.905050][ T5834] chnl_net:caif_netlink_parms(): no params data found [ 87.917575][ T5843] chnl_net:caif_netlink_parms(): no params data found [ 87.953124][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.960559][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.967797][ T5848] bridge_slave_1: entered allmulticast mode [ 87.976045][ T5848] bridge_slave_1: entered promiscuous mode [ 88.069074][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 88.103426][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.115500][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.246134][ T5848] team0: Port device team_slave_0 added [ 88.255806][ T5848] team0: Port device team_slave_1 added [ 88.326218][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.333816][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.341448][ T5840] bridge_slave_0: entered allmulticast mode [ 88.348693][ T5840] bridge_slave_0: entered promiscuous mode [ 88.356161][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.363981][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.371314][ T5843] bridge_slave_0: entered allmulticast mode [ 88.378573][ T5843] bridge_slave_0: entered promiscuous mode [ 88.432345][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.439553][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.447464][ T5840] bridge_slave_1: entered allmulticast mode [ 88.455516][ T5840] bridge_slave_1: entered promiscuous mode [ 88.462934][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.470116][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.477608][ T5843] bridge_slave_1: entered allmulticast mode [ 88.486435][ T5843] bridge_slave_1: entered promiscuous mode [ 88.494427][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.501736][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.527808][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.566910][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.574229][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.581619][ T5834] bridge_slave_0: entered allmulticast mode [ 88.588984][ T5834] bridge_slave_0: entered promiscuous mode [ 88.629341][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.636497][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.662758][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.674402][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.682032][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.689224][ T5833] bridge_slave_0: entered allmulticast mode [ 88.696579][ T5833] bridge_slave_0: entered promiscuous mode [ 88.704900][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.712240][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.719439][ T5834] bridge_slave_1: entered allmulticast mode [ 88.726925][ T5834] bridge_slave_1: entered promiscuous mode [ 88.769902][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.777144][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.785458][ T5833] bridge_slave_1: entered allmulticast mode [ 88.794090][ T5833] bridge_slave_1: entered promiscuous mode [ 88.829870][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.843277][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.853574][ T5156] Bluetooth: hci0: command tx timeout [ 88.853582][ T51] Bluetooth: hci1: command tx timeout [ 88.858122][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.878310][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.931151][ T5156] Bluetooth: hci2: command tx timeout [ 88.935270][ T51] Bluetooth: hci4: command tx timeout [ 88.936665][ T5845] Bluetooth: hci3: command tx timeout [ 88.995213][ T5843] team0: Port device team_slave_0 added [ 89.004297][ T5843] team0: Port device team_slave_1 added [ 89.013617][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.025594][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.038441][ T5840] team0: Port device team_slave_0 added [ 89.087333][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.099068][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.124430][ T5840] team0: Port device team_slave_1 added [ 89.159026][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.168137][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.194941][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.236053][ T5834] team0: Port device team_slave_0 added [ 89.262296][ T5848] hsr_slave_0: entered promiscuous mode [ 89.268788][ T5848] hsr_slave_1: entered promiscuous mode [ 89.277012][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.284476][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.311013][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.337623][ T5834] team0: Port device team_slave_1 added [ 89.344357][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.351832][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.377822][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.416101][ T5833] team0: Port device team_slave_0 added [ 89.436514][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.444718][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.471152][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.495247][ T5833] team0: Port device team_slave_1 added [ 89.557147][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.564586][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.591272][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.604348][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.611593][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.638095][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.684020][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.691140][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.717779][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.773590][ T5843] hsr_slave_0: entered promiscuous mode [ 89.780360][ T5843] hsr_slave_1: entered promiscuous mode [ 89.786685][ T5843] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.794928][ T5843] Cannot create hsr debugfs directory [ 89.818587][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.825647][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.851726][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.903431][ T5840] hsr_slave_0: entered promiscuous mode [ 89.909901][ T5840] hsr_slave_1: entered promiscuous mode [ 89.916465][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.924270][ T5840] Cannot create hsr debugfs directory [ 90.013300][ T5833] hsr_slave_0: entered promiscuous mode [ 90.019759][ T5833] hsr_slave_1: entered promiscuous mode [ 90.026568][ T5833] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.035180][ T5833] Cannot create hsr debugfs directory [ 90.119731][ T5834] hsr_slave_0: entered promiscuous mode [ 90.126949][ T5834] hsr_slave_1: entered promiscuous mode [ 90.133579][ T5834] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.144083][ T5834] Cannot create hsr debugfs directory [ 90.611461][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.624733][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.656061][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.669179][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.752678][ T5843] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 90.776654][ T5843] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.797224][ T5843] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.818601][ T5843] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 90.898241][ T5833] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.919361][ T5833] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.930471][ T5845] Bluetooth: hci1: command tx timeout [ 90.936136][ T5156] Bluetooth: hci0: command tx timeout [ 90.946062][ T5833] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.963649][ T5833] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.011940][ T5156] Bluetooth: hci2: command tx timeout [ 91.017388][ T5156] Bluetooth: hci4: command tx timeout [ 91.023006][ T5845] Bluetooth: hci3: command tx timeout [ 91.095338][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.104384][ T5834] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.116761][ T5834] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.162248][ T5834] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.175577][ T5834] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.235321][ T5848] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.272178][ T5840] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.283818][ T5840] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.294526][ T5840] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.308331][ T5840] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.344711][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.351944][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.387168][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.394358][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.443294][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.527627][ T5843] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.552944][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.560326][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.593475][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.600698][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.652462][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.727015][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.748700][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.779432][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.786686][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.799103][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.806359][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.878307][ T5834] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.957592][ T1142] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.964857][ T1142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.980038][ T1142] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.987295][ T1142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.993045][ T44] cfg80211: failed to load regulatory.db [ 92.004154][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.197357][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.242572][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.279648][ T1131] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.286893][ T1131] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.314574][ T1131] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.321804][ T1131] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.379564][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.559170][ T5848] veth0_vlan: entered promiscuous mode [ 92.615007][ T5848] veth1_vlan: entered promiscuous mode [ 92.754390][ T5848] veth0_macvtap: entered promiscuous mode [ 92.788031][ T5848] veth1_macvtap: entered promiscuous mode [ 92.891509][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.913615][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.942602][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.984729][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.014486][ T5156] Bluetooth: hci0: command tx timeout [ 93.021636][ T5845] Bluetooth: hci1: command tx timeout [ 93.032095][ T5848] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.046733][ T5848] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.055727][ T5848] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.065079][ T5848] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.093685][ T5156] Bluetooth: hci4: command tx timeout [ 93.099173][ T5156] Bluetooth: hci3: command tx timeout [ 93.105857][ T5845] Bluetooth: hci2: command tx timeout [ 93.265196][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.274563][ T5833] veth0_vlan: entered promiscuous mode [ 93.314854][ T5834] veth0_vlan: entered promiscuous mode [ 93.324278][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.353636][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.378288][ T5833] veth1_vlan: entered promiscuous mode [ 93.408375][ T5834] veth1_vlan: entered promiscuous mode [ 93.455096][ T5843] veth0_vlan: entered promiscuous mode [ 93.479580][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.489985][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.505401][ T5843] veth1_vlan: entered promiscuous mode [ 93.581783][ T5833] veth0_macvtap: entered promiscuous mode [ 93.594671][ T5840] veth0_vlan: entered promiscuous mode [ 93.596951][ T5848] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 93.633606][ T5834] veth0_macvtap: entered promiscuous mode [ 93.649710][ T5833] veth1_macvtap: entered promiscuous mode [ 93.691910][ T5843] veth0_macvtap: entered promiscuous mode [ 93.709246][ T5843] veth1_macvtap: entered promiscuous mode [ 93.738866][ T5840] veth1_vlan: entered promiscuous mode [ 93.759544][ T5834] veth1_macvtap: entered promiscuous mode [ 93.791641][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.825456][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.851536][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.867893][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.910695][ T5833] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.919484][ T5833] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.929188][ T5833] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.955084][ T5833] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.994094][ T5840] veth0_macvtap: entered promiscuous mode [ 94.009704][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.075993][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.086410][ T5959] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 94.100753][ T5840] veth1_macvtap: entered promiscuous mode [ 94.117224][ T5843] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.127053][ T5843] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.142120][ T5843] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.156011][ T5843] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.196354][ T5834] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.212291][ T5834] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.222898][ T5834] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.232066][ T5834] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.308475][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.383421][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.432630][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.446431][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.471166][ T5840] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.483595][ T5840] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.493528][ T5840] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.502612][ T5840] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.589409][ T1131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.610322][ T1131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.628154][ T1131] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.642183][ T1131] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.717409][ T1142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.732801][ T980] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 94.736181][ T1142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.828689][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.857255][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.934746][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.949637][ T980] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 94.964888][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.975768][ T980] usb 3-1: New USB device found, idVendor=046d, idProduct=08c1, bcdDevice=ee.8d [ 94.985652][ T980] usb 3-1: New USB device strings: Mfr=32, Product=0, SerialNumber=9 [ 94.994746][ T980] usb 3-1: Manufacturer: syz [ 94.999398][ T980] usb 3-1: SerialNumber: syz [ 95.067080][ T980] usb 3-1: config 0 descriptor?? [ 95.074865][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.090777][ T5845] Bluetooth: hci0: command tx timeout [ 95.096258][ T5845] Bluetooth: hci1: command tx timeout [ 95.107218][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.170850][ T5156] Bluetooth: hci3: command tx timeout [ 95.171436][ T51] Bluetooth: hci4: command tx timeout [ 95.176316][ T5845] Bluetooth: hci2: command tx timeout [ 95.380695][ T1131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.404117][ T1131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.640354][ T9] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 95.837826][ T9] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 95.861598][ T9] usb 1-1: config 0 has no interface number 0 [ 95.882479][ T9] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 95.903127][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.947116][ T5897] usb 3-1: USB disconnect, device number 2 [ 95.960234][ T9] usb 1-1: Product: syz [ 95.965834][ T9] usb 1-1: Manufacturer: syz [ 95.993893][ T9] usb 1-1: SerialNumber: syz [ 96.071091][ T9] usb 1-1: config 0 descriptor?? [ 96.083007][ T5991] vivid-000: disconnect [ 96.112272][ T5986] vivid-000: reconnect [ 96.381453][ T5897] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 96.487896][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.580410][ T5897] usb 2-1: Using ep0 maxpacket: 32 [ 96.592592][ T5897] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 96.609963][ T5897] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.631876][ T5897] usb 2-1: config 0 descriptor?? [ 96.670767][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 96.683625][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 96.714258][ T24] usb 4-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x11, changing to 0x1 [ 96.729731][ T24] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 96.747857][ T24] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 96.767050][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 96.789487][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.799195][ T24] usb 4-1: Product: syz [ 96.808295][ T24] usb 4-1: Manufacturer: syz [ 96.814018][ T24] usb 4-1: SerialNumber: syz [ 96.830034][ T5989] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 96.856324][ T5897] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 96.874514][ T5897] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 96.887330][ T5897] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 96.895100][ T5897] usb 2-1: media controller created [ 96.912333][ T9] asix 1-1:0.251 (unnamed net_device) (uninitialized): Invalid PHY address 0x39 [ 96.932899][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 96.960381][ T5970] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 97.058186][ T5897] az6027: usb out operation failed. (-71) [ 97.066664][ T5897] az6027: usb out operation failed. (-71) [ 97.072930][ T5897] stb0899_attach: Driver disabled by Kconfig [ 97.079005][ T5897] az6027: no front-end attached [ 97.079005][ T5897] [ 97.088824][ T5897] az6027: usb out operation failed. (-71) [ 97.098109][ T5897] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 97.108295][ T5897] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 97.131330][ T5970] usb 3-1: Using ep0 maxpacket: 32 [ 97.133487][ T5897] dvb-usb: schedule remote query interval to 400 msecs. [ 97.149669][ T5970] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 97.155247][ T5897] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 97.171651][ T9] usb 1-1: USB disconnect, device number 2 [ 97.195698][ T5970] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 97.208047][ T5970] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 97.224336][ T5970] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 97.234683][ T5897] usb 2-1: USB disconnect, device number 2 [ 97.265853][ T5970] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 97.286775][ T5970] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 97.297950][ T5970] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.313780][ T5970] usb 3-1: Product: syz [ 97.318261][ T5970] usb 3-1: Manufacturer: syz [ 97.325341][ T5970] usb 3-1: SerialNumber: syz [ 97.349060][ T5970] usb 3-1: config 0 descriptor?? [ 97.433686][ T5897] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 97.454160][ T6003] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 97.791455][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 97.804289][ T5970] input input6: Device does not respond to id packet M [ 97.838185][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 97.876983][ T5970] input input6: Device does not respond to id packet P [ 97.909628][ T24] cdc_ncm 4-1:1.0: bind() failure [ 97.950854][ T24] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 97.971491][ T24] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 97.991958][ T24] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 98.041361][ T24] usb 4-1: USB disconnect, device number 2 [ 98.106407][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 98.145429][ T5970] input input6: Device does not respond to id packet N [ 98.188472][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 98.203476][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 98.222468][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 98.241383][ T5970] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 98.269371][ T5970] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input6 [ 98.359302][ T5970] usb 3-1: USB disconnect, device number 3 [ 98.631161][ T6029] ======================================================= [ 98.631161][ T6029] WARNING: The mand mount option has been deprecated and [ 98.631161][ T6029] and is ignored by this kernel. Remove the mand [ 98.631161][ T6029] option from the mount to silence this warning. [ 98.631161][ T6029] ======================================================= [ 98.738877][ T6031] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 99.337626][ T6051] netlink: 'syz.1.43': attribute type 3 has an invalid length. [ 99.365766][ T6051] netlink: 64 bytes leftover after parsing attributes in process `syz.1.43'. [ 101.537017][ T6115] syz.4.73 uses obsolete (PF_INET,SOCK_PACKET) [ 101.667289][ T6117] netlink: 28 bytes leftover after parsing attributes in process `syz.0.74'. [ 101.711992][ T6117] netlink: 'syz.0.74': attribute type 7 has an invalid length. [ 101.732097][ T6117] netlink: 'syz.0.74': attribute type 8 has an invalid length. [ 101.782302][ T6117] netlink: 4 bytes leftover after parsing attributes in process `syz.0.74'. [ 101.820517][ T6117] gretap0: entered promiscuous mode [ 101.841745][ T6117] batadv_slave_1: entered promiscuous mode [ 101.868575][ T6117] gretap0: left promiscuous mode [ 101.887940][ T6117] batadv_slave_1: left promiscuous mode [ 102.306112][ T6128] input: syz0 as /devices/virtual/input/input7 [ 102.332835][ T6128] input: failed to attach handler leds to device input7, error: -6 [ 102.426650][ T6131] netlink: 'syz.1.79': attribute type 64 has an invalid length. [ 102.456474][ T6131] netlink: 20 bytes leftover after parsing attributes in process `syz.1.79'. [ 102.487412][ T6132] netlink: 'syz.1.79': attribute type 64 has an invalid length. [ 102.544072][ T6132] netlink: 20 bytes leftover after parsing attributes in process `syz.1.79'. [ 102.585170][ T6132] Zero length message leads to an empty skb [ 103.165679][ T6145] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 103.291570][ T6149] netlink: 176 bytes leftover after parsing attributes in process `syz.2.85'. [ 103.642268][ T5970] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 103.722712][ T24] Process accounting resumed [ 103.815436][ T5970] usb 1-1: Using ep0 maxpacket: 32 [ 103.836184][ T5970] usb 1-1: config index 0 descriptor too short (expected 6683, got 27) [ 103.853475][ T5970] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 103.870091][ T5970] usb 1-1: config 0 has no interface number 0 [ 103.891595][ T5970] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 103.929358][ T5970] usb 1-1: config 0 interface 85 has no altsetting 0 [ 103.944124][ T5970] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 103.954275][ T5970] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.964390][ T5970] usb 1-1: Product: syz [ 103.968614][ T5970] usb 1-1: Manufacturer: syz [ 103.990293][ T5970] usb 1-1: SerialNumber: syz [ 104.013997][ T5970] usb 1-1: config 0 descriptor?? [ 104.111851][ T24] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 104.176159][ T6168] evm: overlay not supported [ 104.353552][ T24] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.377916][ T24] usb 4-1: config 0 interface 0 has no altsetting 0 [ 104.396615][ T24] usb 4-1: New USB device found, idVendor=054c, idProduct=03d5, bcdDevice= 0.00 [ 104.446884][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.488555][ T24] usb 4-1: config 0 descriptor?? [ 104.794034][ T5970] appletouch 1-1:0.85: Geyser mode initialized. [ 104.816309][ T5970] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.85/input/input8 [ 104.846262][ C1] appletouch 1-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 105.013090][ T24] input: HID 054c:03d5 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:054C:03D5.0001/input/input9 [ 105.062418][ T5970] usb 1-1: USB disconnect, device number 3 [ 105.242450][ T24] sony 0003:054C:03D5.0001: input,hidraw0: USB HID v0.00 Joystick [HID 054c:03d5] on usb-dummy_hcd.3-1/input0 [ 105.282942][ T5970] appletouch 1-1:0.85: input: appletouch disconnected [ 105.290756][ T24] usb 4-1: USB disconnect, device number 3 [ 105.564150][ T6197] fido_id[6197]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 105.578620][ T6200] sp0: Synchronizing with TNC [ 105.904761][ T30] audit: type=1326 audit(1752717032.583:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6213 comm="syz.2.114" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff65ff8e929 code=0x0 [ 105.944443][ T30] audit: type=1326 audit(1752717032.583:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6213 comm="syz.2.114" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff65ff8e929 code=0x0 [ 106.184497][ T5970] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 106.255149][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 106.352319][ T5970] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 106.379060][ T5970] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 106.399763][ T5970] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 106.409902][ T5970] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 106.418332][ T5970] usb 4-1: SerialNumber: syz [ 106.427242][ T10] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 106.437885][ T10] usb 2-1: config 0 has no interface number 0 [ 106.466431][ T10] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 106.483266][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.492831][ T10] usb 2-1: Product: syz [ 106.497208][ T10] usb 2-1: Manufacturer: syz [ 106.505834][ T10] usb 2-1: SerialNumber: syz [ 106.551424][ T10] usb 2-1: config 0 descriptor?? [ 106.699088][ T5970] usb 4-1: 0:2 : does not exist [ 106.749846][ T5970] usb 4-1: USB disconnect, device number 4 [ 106.792961][ T10] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 106.837387][ T5979] udevd[5979]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 106.843318][ T10] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 106.903432][ T10] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 106.913214][ T10] usb 2-1: media controller created [ 106.952587][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 108.052381][ T6227] usb 2-1: dvb_usb_ec168: I2C read not implemented [ 108.059680][ T10] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 108.168411][ T10] usb 2-1: USB disconnect, device number 3 [ 108.180592][ T5897] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 108.244473][ T30] audit: type=1326 audit(1752717034.933:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6263 comm="syz.0.132" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbf0338e929 code=0x0 [ 108.370413][ T5897] usb 5-1: Using ep0 maxpacket: 8 [ 108.382210][ T5897] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.392491][ T5897] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 108.402035][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.413361][ T5897] usb 5-1: config 0 descriptor?? [ 108.424933][ T5897] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 109.440844][ T5897] gspca_vc032x: reg_r err -71 [ 109.445782][ T5897] vc032x 5-1:0.0: probe with driver vc032x failed with error -71 [ 109.498161][ T5897] usb 5-1: USB disconnect, device number 2 [ 109.569234][ T6285] netlink: 4 bytes leftover after parsing attributes in process `syz.0.141'. [ 109.630791][ T6285] chnl_net:caif_netlink_parms(): no params data found [ 110.165682][ T5897] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 110.330524][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 110.346958][ T5897] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.359231][ T5897] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.372169][ T5897] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 110.385648][ T5897] usb 3-1: config 0 interface 0 has no altsetting 0 [ 110.393995][ T5897] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 110.403758][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.416676][ T5897] usb 3-1: config 0 descriptor?? [ 110.550435][ T5913] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 110.651441][ T6327] process 'syz.4.160' launched './file1' with NULL argv: empty string added [ 110.730345][ T5913] usb 1-1: Using ep0 maxpacket: 32 [ 110.738819][ T5913] usb 1-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 110.761443][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.776918][ T5913] usb 1-1: config 0 descriptor?? [ 110.796617][ T5913] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 110.848931][ T6301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.881022][ T6301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.911703][ T6333] Driver unsupported XDP return value 0 on prog (id 12) dev N/A, expect packet loss! [ 110.932409][ T5897] hid (null): unknown global tag 0xd [ 110.937889][ T5897] hid (null): invalid report_size 1580868749 [ 110.960400][ T5897] hid (null): unknown global tag 0xe [ 110.968975][ T5897] hid (null): unknown global tag 0xe [ 111.162240][ T5897] usb 3-1: USB disconnect, device number 4 [ 111.829677][ T5913] gspca_nw80x: reg_w err -71 [ 111.834595][ T5913] nw80x 1-1:0.0: probe with driver nw80x failed with error -71 [ 111.876037][ T5913] usb 1-1: USB disconnect, device number 4 [ 111.935704][ T5918] hid-generic 0000:0003:0000.0003: unknown main item tag 0x0 [ 111.962297][ T5918] hid-generic 0000:0003:0000.0003: unknown main item tag 0x0 [ 112.017224][ T5918] hid-generic 0000:0003:0000.0003: hidraw0: HID v0.00 Device [syz0] on syz1 [ 112.189443][ T6362] fido_id[6362]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 112.394296][ T6373] binder: 6372:6373 ioctl 40046205 0 returned -22 [ 112.761073][ T6386] input: syz0 as /devices/virtual/input/input10 [ 113.264308][ T5918] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 113.300232][ T5970] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 113.401039][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 113.430230][ T5918] usb 5-1: Using ep0 maxpacket: 8 [ 113.438514][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.450829][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 113.460989][ T5918] usb 5-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 113.471006][ T5918] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.481967][ T5918] usb 5-1: config 0 descriptor?? [ 113.490627][ T5970] usb 3-1: Using ep0 maxpacket: 16 [ 113.500830][ T5970] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 113.512540][ T5970] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.522528][ T5970] usb 3-1: Product: syz [ 113.526779][ T5970] usb 3-1: Manufacturer: syz [ 113.531973][ T5970] usb 3-1: SerialNumber: syz [ 113.544054][ T5970] usb 3-1: config 0 descriptor?? [ 113.552835][ T10] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 113.566263][ T10] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 113.576405][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 113.585612][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 113.593271][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.608999][ T6401] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 113.621213][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 113.705822][ T5882] udevd[5882]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: Read-only file system [ 113.760388][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 113.768880][ T9] usb 1-1: config 0 has no interfaces? [ 113.779456][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 113.788925][ T9] usb 1-1: New USB device strings: Mfr=241, Product=1, SerialNumber=3 [ 113.797213][ T9] usb 1-1: Product: syz [ 113.801706][ T9] usb 1-1: Manufacturer: syz [ 113.806369][ T9] usb 1-1: SerialNumber: syz [ 113.816838][ T9] usb 1-1: config 0 descriptor?? [ 113.906983][ T5918] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 113.919115][ T5918] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 113.928663][ T5918] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 113.938736][ T5918] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 113.948420][ T5918] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 113.963655][ T5918] logitech 0003:046D:C24F.0004: hidraw0: USB HID v0.00 Device [HID 046d:c24f] on usb-dummy_hcd.4-1/input0 [ 113.979892][ T5970] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 113.989281][ T5918] logitech 0003:046D:C24F.0004: no inputs found [ 114.005797][ T5970] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 114.019276][ T5970] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 114.043888][ T6410] ================================================================== [ 114.052030][ T6410] BUG: KASAN: slab-use-after-free in report_descriptor_read+0xb5/0x100 [ 114.060324][ T6410] Read of size 5 at addr ffff88807a77e1e0 by task fido_id/6410 [ 114.060603][ T5970] usb 3-1: media controller created [ 114.067882][ T6410] [ 114.067925][ T6410] CPU: 1 UID: 0 PID: 6410 Comm: fido_id Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 114.067950][ T6410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 114.067971][ T6410] Call Trace: [ 114.067984][ T6410] [ 114.067994][ T6410] dump_stack_lvl+0x189/0x250 [ 114.068026][ T6410] ? __virt_addr_valid+0x1c8/0x5c0 [ 114.068056][ T6410] ? rcu_is_watching+0x15/0xb0 [ 114.068083][ T6410] ? __pfx_dump_stack_lvl+0x10/0x10 [ 114.068106][ T6410] ? rcu_is_watching+0x15/0xb0 [ 114.068131][ T6410] ? lock_release+0x4b/0x3e0 [ 114.068151][ T6410] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 114.068213][ T6410] ? __virt_addr_valid+0x1c8/0x5c0 [ 114.068240][ T6410] ? __virt_addr_valid+0x4a5/0x5c0 [ 114.068268][ T6410] print_report+0xca/0x230 [ 114.068302][ T6410] ? report_descriptor_read+0xb5/0x100 [ 114.068331][ T6410] kasan_report+0x118/0x150 [ 114.068367][ T6410] ? report_descriptor_read+0xb5/0x100 [ 114.068400][ T6410] kasan_check_range+0x2b0/0x2c0 [ 114.068432][ T6410] ? report_descriptor_read+0xb5/0x100 [ 114.068462][ T6410] __asan_memcpy+0x29/0x70 [ 114.068489][ T6410] report_descriptor_read+0xb5/0x100 [ 114.068518][ T6410] ? __pfx_sysfs_kf_bin_read+0x10/0x10 [ 114.068552][ T6410] kernfs_fop_read_iter+0x3fe/0x640 [ 114.068587][ T6410] vfs_read+0x4d0/0x980 [ 114.068620][ T6410] ? __pfx_vfs_read+0x10/0x10 [ 114.068652][ T6410] ? do_sys_openat2+0x154/0x1c0 [ 114.068674][ T6410] ? kmem_cache_free+0x18f/0x400 [ 114.068714][ T6410] ksys_read+0x145/0x250 [ 114.068744][ T6410] ? __pfx_ksys_read+0x10/0x10 [ 114.068777][ T6410] ? do_syscall_64+0xbe/0x3b0 [ 114.068800][ T6410] do_syscall_64+0xfa/0x3b0 [ 114.068821][ T6410] ? lockdep_hardirqs_on+0x9c/0x150 [ 114.068853][ T6410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.068876][ T6410] ? clear_bhb_loop+0x60/0xb0 [ 114.068901][ T6410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.068923][ T6410] RIP: 0033:0x7fa2214a7407 [ 114.068949][ T6410] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 114.068967][ T6410] RSP: 002b:00007ffd00d457e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 114.068992][ T6410] RAX: ffffffffffffffda RBX: 00007fa221c55880 RCX: 00007fa2214a7407 [ 114.069009][ T6410] RDX: 0000000000001000 RSI: 00007ffd00d45830 RDI: 0000000000000004 [ 114.069023][ T6410] RBP: 000055dd8f492730 R08: 0000000000000000 R09: 0000000000000000 [ 114.069038][ T6410] R10: 0000000000000000 R11: 0000000000000202 R12: 000055dd8f491930 [ 114.069051][ T6410] R13: 00007ffd00d45830 R14: 0000000000000004 R15: 000055dd51fae4d8 [ 114.069077][ T6410] [ 114.069085][ T6410] [ 114.084255][ T5918] usb 4-1: USB disconnect, device number 5 [ 114.087208][ T6410] Allocated by task 5918: [ 114.087223][ T6410] kasan_save_track+0x3e/0x80 [ 114.351864][ T6410] __kasan_kmalloc+0x93/0xb0 [ 114.356483][ T6410] __kmalloc_node_track_caller_noprof+0x271/0x4e0 [ 114.362924][ T6410] kmemdup_noprof+0x2b/0x70 [ 114.367467][ T6410] hid_open_report+0x208/0xee0 [ 114.372245][ T6410] lg_probe+0x270/0x7d0 [ 114.376416][ T6410] hid_device_probe+0x3a0/0x710 [ 114.381286][ T6410] really_probe+0x26a/0x9a0 [ 114.385831][ T6410] __driver_probe_device+0x18c/0x2f0 [ 114.391217][ T6410] driver_probe_device+0x4f/0x430 [ 114.396254][ T6410] __device_attach_driver+0x2ce/0x530 [ 114.401638][ T6410] bus_for_each_drv+0x251/0x2e0 [ 114.406495][ T6410] __device_attach+0x2b8/0x400 [ 114.411270][ T6410] bus_probe_device+0x185/0x260 [ 114.416131][ T6410] device_add+0x7b6/0xb50 [ 114.420471][ T6410] hid_add_device+0x398/0x540 [ 114.425160][ T6410] usbhid_probe+0xe13/0x12a0 [ 114.429762][ T6410] usb_probe_interface+0x641/0xbc0 [ 114.434881][ T6410] really_probe+0x26a/0x9a0 [ 114.439395][ T6410] __driver_probe_device+0x18c/0x2f0 [ 114.444701][ T6410] driver_probe_device+0x4f/0x430 [ 114.449741][ T6410] __device_attach_driver+0x2ce/0x530 [ 114.455126][ T6410] bus_for_each_drv+0x251/0x2e0 [ 114.460002][ T6410] __device_attach+0x2b8/0x400 [ 114.464780][ T6410] bus_probe_device+0x185/0x260 [ 114.469639][ T6410] device_add+0x7b6/0xb50 [ 114.473981][ T6410] usb_set_configuration+0x1a87/0x20e0 [ 114.479452][ T6410] usb_generic_driver_probe+0x8d/0x150 [ 114.484919][ T6410] usb_probe_device+0x1c4/0x390 [ 114.489783][ T6410] really_probe+0x26a/0x9a0 [ 114.494316][ T6410] __driver_probe_device+0x18c/0x2f0 [ 114.499615][ T6410] driver_probe_device+0x4f/0x430 [ 114.504662][ T6410] __device_attach_driver+0x2ce/0x530 [ 114.510057][ T6410] bus_for_each_drv+0x251/0x2e0 [ 114.514926][ T6410] __device_attach+0x2b8/0x400 [ 114.519735][ T6410] bus_probe_device+0x185/0x260 [ 114.524598][ T6410] device_add+0x7b6/0xb50 [ 114.528938][ T6410] usb_new_device+0xa39/0x16c0 [ 114.533720][ T6410] hub_event+0x2941/0x4a00 [ 114.538170][ T6410] process_scheduled_works+0xade/0x17b0 [ 114.543735][ T6410] worker_thread+0x8a0/0xda0 [ 114.548359][ T6410] kthread+0x711/0x8a0 [ 114.552447][ T6410] ret_from_fork+0x3fc/0x770 [ 114.557047][ T6410] ret_from_fork_asm+0x1a/0x30 [ 114.561830][ T6410] [ 114.564164][ T6410] Freed by task 5918: [ 114.568153][ T6410] kasan_save_track+0x3e/0x80 [ 114.572861][ T6410] kasan_save_free_info+0x46/0x50 [ 114.577898][ T6410] __kasan_slab_free+0x62/0x70 [ 114.582677][ T6410] kfree+0x18e/0x440 [ 114.586589][ T6410] hid_close_report+0x632/0x720 [ 114.591448][ T6410] hid_device_probe+0x5e9/0x710 [ 114.596345][ T6410] really_probe+0x26a/0x9a0 [ 114.600864][ T6410] __driver_probe_device+0x18c/0x2f0 [ 114.606163][ T6410] driver_probe_device+0x4f/0x430 [ 114.611207][ T6410] __device_attach_driver+0x2ce/0x530 [ 114.616595][ T6410] bus_for_each_drv+0x251/0x2e0 [ 114.621461][ T6410] __device_attach+0x2b8/0x400 [ 114.626238][ T6410] bus_probe_device+0x185/0x260 [ 114.631095][ T6410] device_add+0x7b6/0xb50 [ 114.635438][ T6410] hid_add_device+0x398/0x540 [ 114.640125][ T6410] usbhid_probe+0xe13/0x12a0 [ 114.644739][ T6410] usb_probe_interface+0x641/0xbc0 [ 114.649864][ T6410] really_probe+0x26a/0x9a0 [ 114.654409][ T6410] __driver_probe_device+0x18c/0x2f0 [ 114.659735][ T6410] driver_probe_device+0x4f/0x430 [ 114.664785][ T6410] __device_attach_driver+0x2ce/0x530 [ 114.670185][ T6410] bus_for_each_drv+0x251/0x2e0 [ 114.675061][ T6410] __device_attach+0x2b8/0x400 [ 114.679853][ T6410] bus_probe_device+0x185/0x260 [ 114.684767][ T6410] device_add+0x7b6/0xb50 [ 114.689109][ T6410] usb_set_configuration+0x1a87/0x20e0 [ 114.694592][ T6410] usb_generic_driver_probe+0x8d/0x150 [ 114.700079][ T6410] usb_probe_device+0x1c4/0x390 [ 114.704971][ T6410] really_probe+0x26a/0x9a0 [ 114.709499][ T6410] __driver_probe_device+0x18c/0x2f0 [ 114.714803][ T6410] driver_probe_device+0x4f/0x430 [ 114.719846][ T6410] __device_attach_driver+0x2ce/0x530 [ 114.725232][ T6410] bus_for_each_drv+0x251/0x2e0 [ 114.730094][ T6410] __device_attach+0x2b8/0x400 [ 114.734878][ T6410] bus_probe_device+0x185/0x260 [ 114.739762][ T6410] device_add+0x7b6/0xb50 [ 114.744107][ T6410] usb_new_device+0xa39/0x16c0 [ 114.748892][ T6410] hub_event+0x2941/0x4a00 [ 114.753328][ T6410] process_scheduled_works+0xade/0x17b0 [ 114.758887][ T6410] worker_thread+0x8a0/0xda0 [ 114.763503][ T6410] kthread+0x711/0x8a0 [ 114.767591][ T6410] ret_from_fork+0x3fc/0x770 [ 114.772206][ T6410] ret_from_fork_asm+0x1a/0x30 [ 114.776992][ T6410] [ 114.779321][ T6410] The buggy address belongs to the object at ffff88807a77e1e0 [ 114.779321][ T6410] which belongs to the cache kmalloc-8 of size 8 [ 114.793043][ T6410] The buggy address is located 0 bytes inside of [ 114.793043][ T6410] freed 8-byte region [ffff88807a77e1e0, ffff88807a77e1e8) [ 114.806518][ T6410] [ 114.808848][ T6410] The buggy address belongs to the physical page: [ 114.815316][ T6410] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a77e [ 114.824090][ T6410] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 114.831651][ T6410] page_type: f5(slab) [ 114.835642][ T6410] raw: 00fff00000000000 ffff88801a441500 0000000000000000 dead000000000001 [ 114.844233][ T6410] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 114.852816][ T6410] page dumped because: kasan: bad access detected [ 114.859236][ T6410] page_owner tracks the page as allocated [ 114.864956][ T6410] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5848, tgid 5848 (syz-executor), ts 96009789082, free_ts 96009769310 [ 114.884277][ T6410] post_alloc_hook+0x240/0x2a0 [ 114.889069][ T6410] get_page_from_freelist+0x21d5/0x22b0 [ 114.894632][ T6410] __alloc_frozen_pages_noprof+0x181/0x370 [ 114.900467][ T6410] alloc_pages_mpol+0x232/0x4a0 [ 114.905340][ T6410] allocate_slab+0x8a/0x3b0 [ 114.909857][ T6410] ___slab_alloc+0xbfc/0x1480 [ 114.914540][ T6410] __kmalloc_node_noprof+0x2fd/0x4e0 [ 114.919838][ T6410] __vmalloc_node_range_noprof+0x5a9/0x12f0 [ 114.925748][ T6410] vzalloc_noprof+0xb2/0xf0 [ 114.930350][ T6410] __do_replace+0xab/0x970 [ 114.934776][ T6410] do_ipt_set_ctl+0xa0d/0xcd0 [ 114.939475][ T6410] nf_setsockopt+0x26c/0x290 [ 114.944093][ T6410] do_sock_setsockopt+0x25a/0x3e0 [ 114.949151][ T6410] __x64_sys_setsockopt+0x18b/0x220 [ 114.954375][ T6410] do_syscall_64+0xfa/0x3b0 [ 114.958891][ T6410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.964794][ T6410] page last free pid 5848 tgid 5848 stack trace: [ 114.971134][ T6410] __free_frozen_pages+0xc65/0xe60 [ 114.976311][ T6410] kasan_populate_vmalloc+0x18a/0x1a0 [ 114.981696][ T6410] alloc_vmap_area+0xd51/0x1490 [ 114.986559][ T6410] __get_vm_area_node+0x1f8/0x300 [ 114.991604][ T6410] __vmalloc_node_range_noprof+0x301/0x12f0 [ 114.997521][ T6410] vzalloc_noprof+0xb2/0xf0 [ 115.002037][ T6410] __do_replace+0xab/0x970 [ 115.006462][ T6410] do_ipt_set_ctl+0xa0d/0xcd0 [ 115.011162][ T6410] nf_setsockopt+0x26c/0x290 [ 115.015767][ T6410] do_sock_setsockopt+0x25a/0x3e0 [ 115.020800][ T6410] __x64_sys_setsockopt+0x18b/0x220 [ 115.026037][ T6410] do_syscall_64+0xfa/0x3b0 [ 115.030551][ T6410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.036470][ T6410] [ 115.038810][ T6410] Memory state around the buggy address: [ 115.044451][ T6410] ffff88807a77e080: fa fc fc fc 06 fc fc fc 06 fc fc fc fa fc fc fc [ 115.052535][ T6410] ffff88807a77e100: fa fc fc fc fa fc fc fc fa fc fc fc 05 fc fc fc [ 115.060608][ T6410] >ffff88807a77e180: 06 fc fc fc 04 fc fc fc fa fc fc fc fa fc fc fc [ 115.068673][ T6410] ^ [ 115.075887][ T6410] ffff88807a77e200: fa fc fc fc 06 fc fc fc fa fc fc fc fa fc fc fc [ 115.083965][ T6410] ffff88807a77e280: 00 fc fc fc 07 fc fc fc 06 fc fc fc 07 fc fc fc [ 115.092033][ T6410] ================================================================== [ 115.131124][ T5970] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 115.133820][ T6399] dtv5100: wlen = 0, aborting. [ 115.159084][ T6410] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 115.166355][ T6410] CPU: 0 UID: 0 PID: 6410 Comm: fido_id Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 115.178115][ T6410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 115.188212][ T6410] Call Trace: [ 115.191524][ T6410] [ 115.194496][ T6410] dump_stack_lvl+0x99/0x250 [ 115.199140][ T6410] ? __asan_memcpy+0x40/0x70 [ 115.203857][ T6410] ? __pfx_dump_stack_lvl+0x10/0x10 [ 115.209105][ T6410] ? __pfx__printk+0x10/0x10 [ 115.213749][ T6410] panic+0x2db/0x790 [ 115.217681][ T6410] ? __pfx_preempt_schedule+0x10/0x10 [ 115.223110][ T6410] ? __pfx_panic+0x10/0x10 [ 115.227575][ T6410] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 115.233528][ T6410] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 115.239905][ T6410] ? report_descriptor_read+0xb5/0x100 [ 115.245412][ T6410] check_panic_on_warn+0x89/0xb0 [ 115.250401][ T6410] ? report_descriptor_read+0xb5/0x100 [ 115.255902][ T6410] end_report+0x78/0x160 [ 115.260197][ T6410] kasan_report+0x129/0x150 [ 115.264741][ T6410] ? report_descriptor_read+0xb5/0x100 [ 115.270234][ T6410] kasan_check_range+0x2b0/0x2c0 [ 115.275306][ T6410] ? report_descriptor_read+0xb5/0x100 [ 115.280784][ T6410] __asan_memcpy+0x29/0x70 [ 115.285217][ T6410] report_descriptor_read+0xb5/0x100 [ 115.290533][ T6410] ? __pfx_sysfs_kf_bin_read+0x10/0x10 [ 115.296028][ T6410] kernfs_fop_read_iter+0x3fe/0x640 [ 115.301248][ T6410] vfs_read+0x4d0/0x980 [ 115.305424][ T6410] ? __pfx_vfs_read+0x10/0x10 [ 115.310123][ T6410] ? do_sys_openat2+0x154/0x1c0 [ 115.314996][ T6410] ? kmem_cache_free+0x18f/0x400 [ 115.319962][ T6410] ksys_read+0x145/0x250 [ 115.324223][ T6410] ? __pfx_ksys_read+0x10/0x10 [ 115.329002][ T6410] ? do_syscall_64+0xbe/0x3b0 [ 115.333697][ T6410] do_syscall_64+0xfa/0x3b0 [ 115.338220][ T6410] ? lockdep_hardirqs_on+0x9c/0x150 [ 115.343446][ T6410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.349539][ T6410] ? clear_bhb_loop+0x60/0xb0 [ 115.354241][ T6410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.360154][ T6410] RIP: 0033:0x7fa2214a7407 [ 115.364592][ T6410] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 115.384209][ T6410] RSP: 002b:00007ffd00d457e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 115.392638][ T6410] RAX: ffffffffffffffda RBX: 00007fa221c55880 RCX: 00007fa2214a7407 [ 115.400632][ T6410] RDX: 0000000000001000 RSI: 00007ffd00d45830 RDI: 0000000000000004 [ 115.408633][ T6410] RBP: 000055dd8f492730 R08: 0000000000000000 R09: 0000000000000000 [ 115.416620][ T6410] R10: 0000000000000000 R11: 0000000000000202 R12: 000055dd8f491930 [ 115.424608][ T6410] R13: 00007ffd00d45830 R14: 0000000000000004 R15: 000055dd51fae4d8 [ 115.432626][ T6410] [ 115.436023][ T6410] Kernel Offset: disabled [ 115.440362][ T6410] Rebooting in 86400 seconds..