last executing test programs: 6m35.33365336s ago: executing program 5 (id=6): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x6, @loopback, 0x9}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x5, 0x5, 0xe, 0x5, 0xff, 0x1, 0xea, 0xfa, 0x2, 0x4, 0x5, 0xa, 0x6, 0x1b}, 0xe) sendto$inet6(r0, &(0x7f0000000080)="1a", 0x34000, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) close(r0) 6m30.308485009s ago: executing program 5 (id=16): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e0010140120a02000010000000010902270001010080fa0904000003e00101000705810200020007050202000200070583031000"], 0x0) 6m25.122149842s ago: executing program 5 (id=21): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{0x0}], 0x1}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) recvmmsg$unix(r0, 0x0, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe000001000000000a00120002"], 0x30}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b70400000000040085"], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1002, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e0b06c900060008"], 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000009c0)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x203, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ppoll(&(0x7f0000000140)=[{r4, 0x4002}], 0x1, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x181a82, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) ioprio_set$uid(0x8a9abff8a5dcea9b, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/card0/oss_mixer\x00', 0x2, 0x0) 6m22.123945057s ago: executing program 5 (id=27): socket$nl_generic(0x10, 0x3, 0x10) flock(0xffffffffffffffff, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0xfffffff6, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000000b40)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019b40)=0x7) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) io_setup(0x3f, &(0x7f0000019b80)=0x0) timerfd_create(0x0, 0x0) io_submit(r4, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b04, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r5, 0x0, 0x0) shutdown(r5, 0x1) semop(0x0, 0x0, 0x0) 6m18.552027275s ago: executing program 5 (id=29): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x4000040) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1000}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5195c342}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x4010) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000002880), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000028c0)={'syzkaller0\x00', 0x1002}) 6m3.58750448s ago: executing program 0 (id=50): openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000480)=0x0) prlimit64(r0, 0xe, &(0x7f00000004c0)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000540), 0x2, 0x4a102) writev(r1, &(0x7f0000000580)=[{&(0x7f00000005c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x2, 0x7, 0x2) r2 = fsopen(&(0x7f0000000600)='binfmt_misc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x1) fchdir(r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x8880, 0x85) lseek(r4, 0x101, 0x1) r5 = socket(0x10, 0x2, 0x0) clock_adjtime(0x0, &(0x7f0000000680)={0x2925, 0x0, 0x0, 0x200000000000003, 0xd4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x40000000, 0x40000000, 0x7ff, 0x3, 0x0, 0x4ac, 0x0, 0x4, 0xfffffffeffffffff, 0x2000800, 0x0, 0x0, 0x59, 0x7, 0x2000}) write(r5, &(0x7f0000000780)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r5, &(0x7f00000007c0), 0x400000000000ec0, 0x2, &(0x7f0000000800)={0x77359400}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000840)={0x0, 0x0, 0x7}) openat$dlm_monitor(0xffffff9c, &(0x7f0000000880), 0x402, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpgid(0x0) 6m2.546175687s ago: executing program 32 (id=29): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x4000040) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1000}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5195c342}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x4010) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000002880), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000028c0)={'syzkaller0\x00', 0x1002}) 5m58.336214893s ago: executing program 0 (id=58): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x822b01) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) close(r0) 5m57.678215817s ago: executing program 0 (id=59): r0 = syz_open_dev$vim2m(&(0x7f0000000280), 0x6, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f00000000c0)={0xf0f003, 0x4}) 5m56.835590618s ago: executing program 0 (id=61): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0xfffffffe, 0x12c}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x5, 0x0, 0x8, 0x0, 0xfdfffe0000000004, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(0xffffffffffffffff, 0x40044103, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000580)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000500)={0x0, 0x1fffd, 0x800, 0x3}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x10, 0x2, 0xe3, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x800000, 0x0, {}, 0x1f, r4, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x3d}) 5m53.947045906s ago: executing program 2 (id=64): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f00000002c0)='match_busid\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='del 1', 0x5) 5m53.151867029s ago: executing program 0 (id=65): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f00000000c0)={0x1000, {{0xa, 0x4e22, 0xba68, @rand_addr=' \x01\x00', 0x2}}}, 0x88) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0x0}, 0x50) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000019740)={0x0, 0x0, &(0x7f0000019780)={&(0x7f00000197c0)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x100040d3}, 0x22000010) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r5, &(0x7f0000000340)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000019340)=0x4000007) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000019400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000019480)={0x15, 0x1c, &(0x7f0000019540)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x40}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0xf1}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x1, 0xb, 0xa, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {}, {0x18, 0x6, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000019640)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) socket$inet6(0xa, 0x80002, 0x0) 5m51.292249298s ago: executing program 2 (id=66): r0 = socket(0x10, 0x803, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x0, 0xa541, 0x2, 0x2, 0x33}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xea2, 0x80, 0x2, 0x315}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5341, 0x4, 0x3, 0x38e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9188, 0x20000, 0x1, 0x2f5}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5f48, 0x20, 0x0, 0xa8}}], 0x4, &(0x7f0000001940)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x3}, 0x0, 0x0, '\x00', {0x1, 0x822, 0x0, &(0x7f0000000940)=@buf_4k="d05728dd6bed64a707d15edbd7c0fe653baf78e9feafd66a43abc3f361be24e8734a17ddbd6a7127acffd471de2596e924109ff68cb32db0f473925dd32b41c636da074d14eca2edf5c06988b5ad8c32c51b889e057a490f5006e296ad5aa7148189fd729abfb05602e3b9e66048c0d1e2ffecf4772f7f8fdc4d753ea07c386ed03afd7d32cb2595cb48f8e76b1fa063aca641bfd06d3592a272e3ffc88c6421d1de54fdcae398bb4d0f88b65ac02711dfe8d999b8d86006beb86942f52302743b79c62ec389db2f56e4688cd789355ec04fa9a27a3a36d2b10a7270e3de6afc772b4caae9ffef5218fb98dc2cfde5d6658eb3d0e243e61bd0ebb7bc6c80fc5c3eafca16e30c85b4dfb5704a4c4f2127b2e326e5ede14928067b364fe225db6b82cf3ff3377e2a587281f9afcde75b56b937de0b7b23c82ef303688c225ce6758a2d803bb1376122d133f8ad54cc6f949fd00411c5112cb5aa5c10f61d48adc5334d239ee6b6b7f0bbe32e65dbbb1cb9343729cfdcf0ed7a43105af3186a26da2fd7ebe4cf896556ce95eb8390f4fcfb96f0141390e81d38a4582da42bdf7bb349be1e9e44801bd443a7d2320344cbc2b886719c643e5becb7b775a199e81161422308d487e30df96f1ebdbd1b1449bdd9242fdff49ef9d67e6bc69236f7ee4485de5ff46f799d35d51b96654e4c38c82097063e409c7d9b1a2cef792623166caebb365d444b41b33d355b39baa4ce4614f5c0a8d8a3b64058598ae0372ca79888bc41a1b21352b3eabc8e26fd577393be8ab0e7636916372dae4c67ad3e5fe6349515c12fca0aab34efd3dab9f1fd78aa6508e1c58cef44987ab3736904533fecc7ad70ff29b933860838e8b61cade875ac37214dbc20fb9c7fd69023ffa38f034c15e6394e18997a17813919ae544aeacece7898fc3a5ac961f3bfafd2bb32d69d3e290032d513f80ee1e352b71240ced15c23198d906cdb263d7f8cab594d4bb5f90c5b15945ecf709ed6ea59b9f4602f177f040772ea47e45d5e3a538319f8d6a261aa1a34c51e765331b2d65a9beac79e2f61a40c3fa8b91a5ef2b36e09a67595d022d857caaba2e24a394e34f6558854ef36a452006ba677515cbd190ac0db248432b3d30c24c0e561696c8a68e8315ebbdbe8e504be5c2d71056853eabe0b3499e653bb2f33c68b78649315c475e766f80516e6db97ecac405bb54e3b28757cecee4a40cefa08c4ffc38b2c062213ac9a514951bfaebc581b0d928730b8b59f6ea07814927c952fa4777f565dc7e258900a017d0b9ce2a3a4950024de786a0a7fb0f91f0b8ec20f478b1e665a03daaf033a2ce7806f0905ff2cff7d458ef27043dad17e4c4f0a8b193ba8648e847584d6fc498fd76e2a64b6401134e9cb4c13e609695d417f3267ee53364f190a0cea3249c752d81e4c1b7e112d89a4590966e2b07c7950e67aec1ea3be7627901811f90f7dc50f8121447b324baf77195d5cdcd2439ec11e29649365a57af22fefba18222c895177ea531c5958b110464825cd35791ebb1f54c27bbe3e307482c449743664efd65b233fb29b7bffc37fab45aa4446c92310f32567e429fc6331e91e548fa48a992784e9fc2b6a23b5c264b45faea4fc3c7b3de35672802546ba689d03d7b7b04241c8fddde3d7658af3dca4885b15adb2fb70bc5c969278ce44814ccf0b9f3eb7864136784cdf5e5322b14aae2df3606e89a8f1bb1bd9e8f3f1c514be00facc1acc269bae18de3868db995bbe2415e20aeef0647e65945c1eb899c4abe243c427a373f116c00e6925b74935ea641fda4be700306d36236e5876b62d7f6f41e8557624fa78c9fc0cc1dd89246d0ea3dc957f20f72ed5ec3f10a630dd60e3442de5a57b879ee7e8bf73c8d151643356f1a8c8cb1c05f2b4f49bd8e477877241b9c77539b3b52f2d47d6e917956c4d8d2e9a783d6d7800d071554cd49a7b4f964635ca88448124fd33bc3e556d500762b0ae5a0de65369b6d30be62120904893a8ba99a9afe9bec66be451ee02835793e6e308cc416170f89bdb7259d5a99e41f0459ea7b11712e4cea144c06d3b1a4c6d38bf4b40f90479e58166cf4c9cf77fb20f2ae1c3ff4ea309a0a89134b437158d48b0fbcb132d6f3cff4b332a66c0a2207fec9294fa7e8973d489c21974a5014f52eab2bb7d3527686c00664d6f174c9f4a55edff5c6cb369fd4ae7fa0750ee8d3860013d35212d8b9036615f20b69e7b4abfe4d6373f0ad60a5cba16e6ca4185ad170c6adad53602c97fb3039a2c852f0ff4e3492e337c584ea53ec72804ec919f4161585774a554d8eefb11a4ea139cb0bcbdb9a0c3af488ab2a8b06dbfed57645e2e1baa279ff063acf96e907c91b42899ad2940ab1ac71a540cee5509674fc70f5c246e27ef3aeda89a6338e846694206487edddd70bb1b86b80419f067640138c30e96410e47008b6215fcdfa4e695bda9476c64282ea8e51a2efa41f4bc2e4c0e37368073eac40945950c6ce857ce11add9aeea93fa2fdcefbb857b6d541cefa9ef2a8df758b855d6922514e3b8d593202a085c937a8a1d4b147a6378ba29f347a91b3555a75bc25ea5fa021c095a5ffbb056145996662a9220843599a96a3a24623bcc9b288ea32166f92a8f69282009232ae93f5cb912b59d68ba07d0171025507f51a1d5cf05d2be376aec4208c43cd921538067316213692048c6a81cd0b3ec8f8d03bfeebb8f0994b1ecd2fde0e6cd0392e612b934fd5ea2e76e3a7cf3b6b31cf4a0b69ffecb936197c22ec401c212549b6fc623043d07b1c616e1e28074c07eae4ec507f0213354af369c2f897c45339475cb8656f8b31d5f905340a2a3fcb023373415c905aa768ee9ae55d7fcf8f6fceb583bb20bc9ec9f52cb609b520f49a6866e6c88b19959c66cb2f3c3a1c1010f5c989c78c211ac71811b7820d41a2f814214e0596ae80cfa1687e50bb746f7bf3ff54fecf713dd108f65ba552b0edec55059e19954f9e027561896fdcf1ee0c43f70b250bd960bfb79e153dbdc86585251ab5d1f5f24b4b55a5226040f81bd32bb9f1fb6ffd90e25f725a20a0172fb4fdf119d93c1331fbfc3106801a6eb2b99630d1ca8d276d3d5379aea094bc1a33995af916c37988b27177e2f5f3ce4e6994def5bddc6f4984d29627025591986f9f047b51f15e2f1c463c79d9f3a14842ef6d978b0a18ef341079bfa5da5266cd284d8777fc58930ae13b9edeecce3a8caea518821b75bb4dddeb1bdb2fc6a1fe637d900d61644b1330995d2a81930edba62a1f5248dcb89c02b6debb7d2370210565c23ff8ebff1515817d92167417e57b0eaf9fb88642900b644d4f443edc76ba903fe9582037fc5675e77672ed9f872c07f36d054d9754e7b72083fecfaabd71cf7c588e2e2aaeeb34e757406e4e3eccddcc9a834da882c6f83466dad2bb612d916617e5cfadb2b2e51859eba588655e5453b30b44669b9682e4b8c63e2b7c7c2f1b13e0ecca0623f60baf42d75aae2964ec24609a05292f82f8e54b0bc36886e1cf42d9bfd5e848f3127acff7b6d076022aac888352ab76c7f97508bc9a187ede49507b93540e014047ce12ba8b952e43d0c74de67719ee88faca3a1e9d848818a5054b518f2770ca2b280c450058fac5bdd3eddc70ac814eb16466998de3c7f69921758e17ac05d5af667fc05cc77dbdcb21cb2ab1e81a599b97c1d1864b68bc5b3ffa6fef213ae0c1cd0ec39eab3c3e4b60a5f6fa2d291c8f9ca77787f7ee12c08e76aada0e1016e36aa00ed090770b970889a8e542c0a2c6f4a8e35662600ae35339040d49eb4558efdb3a5ebf60829035992390a6b91e9a7b0ac991dd7afc6de902a946dbfd1fe2b1baa44a6f73874416ed419c71944933b977a86c8fb8ef36e226bbe55ace51e339ed56eeff1278ed2f407aa2256aa323b291efbca4c18feb56bfca8f4eec8d4813e3cb76304950a8c677d8d0b787aff0ec7a2cee24f0276aa440c698e891c17efe98788822638dc6716484d661bda7cc80c9a4b49f6d7617af320ce8c6d8fb18b505aeec6d415f71a33a64c23825c58b89c8e69d8504f535c78a6e25a323a92878660c6e34f0714e66b5a5bdcd1c46cbe193a0c1f218cc4bbcd4e11a2ac68637012fa6432e120d75195b2f46ecb4eec2609e102fd5f6493b8fe478be0ac43e34dd78b0d8d1610faa9bd98ba408be3884ad1eb7b1094fa06bf855c12ff72c90851d68aa50cdd57e597336a9fe3e932da3d1715561cc3effefd24507f087b68ba07417b5e7295d7589ca2fcf4ebc5302b8be1c98b80c908890c2eeee3d651a830d0f681a550b092542e6ab265615d1c1461e421f47f26f546489b331ef04ad834f33c3d4cb1789dc4bdb3e45ffb87b8ab6ca0a5be10f1422c0a0313a7d2f54c0128c7880852aa18812a02294b86f9ed2702171afc76b4b8abffd468e72c3787d839e34548bcbc8e5bc73adf178143c2e7352970390f64d958689c844cd2e97377ed8369409bcc7c6a02989558d9b6987ea9daabd8a0b24bb2efaa772db4cb254554220eae79d93c17b06baa660d8545fd606befefc318dbc4f950bc8bcdef97ff58360bd62ed379b1101ff4ffe4903ac2d2c84f0924ee0a5fcd01e10a80e45868843e051e5e8c7c5f8697b3a4ac13a7d8049677e28472430d8c2de2d192a01abf283f86b58289f20be29f68f94e673a50e17d909e7c007670e559ff2025335b482f0b29c8ecb79a37b41db5fa3735dd14cc6ec205483f6c0ce729723a0be0a5ec49410e94af387f152011ae36fe7d28872b47c353556ba8ceec26aa1e394fcd6e663fcf7e000bbe45127d62735fa63796a0dbb22797bf3338a0d4a36ea09e5bb1d0bdb2f25f4740416fb1eaeb67ad653b8488ceb336722ef75e236721c5696824ce04c871acb6aa66e595f69ab01024dde2e38ce7fec92c988f564d04984717cd84c032d33fcb2cc23053ab995c925c561893432bf7bb97347e5e3097ab4cf3abd5cd2d82eb45c55cf580f64fd5cfd17e716640027ec220355ece239351f0f6f5af8fa404f8956cedcb24e7235c7528659114ba96497c8fb2913eb1676b18708b266b229c7cd3e50ea44ff8e20a570d99604462458bdbb5985b059dbe76a0efe55648cc359b209808aee31d5eff3c0c31cd13cd8f5db7c28c440ff58488a6adf87eaced1303e7bfd7389f8c0c7b56632f5287334fa4f65207e1469b53be38db2ad2dd2863a03583f0ec85339ff55949c751767bc2e4a1734a448358bde1b4af8e030c91215e4ff358f9876fee1ab2916b3ce9003e256562a93a4e7c22d237e95dc1272b48a48d25f4d36e6ece475b2f4df7f4f941371824955fb5a07e82d0094ad982d3def874259acd14b70a4e43cb9d8580a5ce3437f8b5076caeaa1bfb1426a18014badbbad9d1a00835301896ee57619f7f681dd45a663d88b0b512f475819c9ceae96ac22ea0d1863d95f7a6db43547674478b8733b210855a78c762c092d76562c0d2083b3c300eaa49d11d78f37cce2a51a7df2d243591b5affe1afb347054c84f1850c3a42bac0843ecc3f68e750e4b69137a58a53037c0b13fd69f923b7c4f1f073f2d06259641d2889b4da79995e370a30c416a1a5fbf3f809b459308600a2bfb64b7945cf3b9563a093cdad6c65fe68c061de07fa4a6a83de820f7aa0b67014ae4aa74269cc2dcc909ce8939734ec307d7c6c5c877dc0f6da20dff0ba9e759887859934649a0072be80b8dd2a8360a51266b84be34357c74b6689aa24ef15185df9ddd4a"}}, &(0x7f00000019c0)) r2 = syz_io_uring_setup(0xefd, &(0x7f0000000580)={0x0, 0x0, 0x400, 0x2, 0x55, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r0, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0, 0x80000080}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) r7 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) dup2(r6, r7) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f0000000300), 0x2, 0x143102) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000380)="94", 0xf000}, {0x0}], 0x2) mlockall(0x2) shmctl$SHM_LOCK(0x0, 0xb) r9 = syz_open_dev$vim2m(&(0x7f0000000400), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000440)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r9, 0xc058560f, &(0x7f0000000480)=@mmap={0x1, 0x1, 0x4, 0x8030, 0xffffffff, {0x77359400}, {0x0, 0x1, 0xf1, 0xa, 0x0, 0x1, "bf231e4b"}}) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448cb, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bind$bt_hci(r10, &(0x7f0000000500)={0x1f, 0x0, 0x1}, 0x6) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0x40045612, &(0x7f0000000540)=0x1) io_uring_enter(r2, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) 5m50.120648987s ago: executing program 0 (id=67): syz_open_dev$video(&(0x7f00000002c0), 0x5, 0x2) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x800000000007, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000440)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000480)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000a80)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000019a80)=0x7) listen(0xffffffffffffffff, 0xfffd) mount$9p_fd(0x0, &(0x7f0000019b80)='.\x00', &(0x7f0000019bc0), 0x200040c, 0x0) 5m47.504649856s ago: executing program 2 (id=70): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x822b01) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) close(r0) 5m44.580115212s ago: executing program 2 (id=74): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000003c0)=0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$inet6_sctp(0xa, 0x5, 0x84) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r3, &(0x7f0000000900)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019900)=0x7) pipe(0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f00000002c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) 5m41.960454828s ago: executing program 2 (id=75): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000600)=""/102392, 0x18ff8) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000019600)={0x40000000, 0x0, &(0x7f0000019640)={&(0x7f0000019680)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000196c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000019700)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000019740)={{{@in=@multicast2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffa, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r4, 0x0, 0x0, 0x1c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 5m34.613655629s ago: executing program 33 (id=67): syz_open_dev$video(&(0x7f00000002c0), 0x5, 0x2) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x800000000007, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000440)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000480)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000a80)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000019a80)=0x7) listen(0xffffffffffffffff, 0xfffd) mount$9p_fd(0x0, &(0x7f0000019b80)='.\x00', &(0x7f0000019bc0), 0x200040c, 0x0) 5m28.527377925s ago: executing program 2 (id=86): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x844) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000500)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000580), 0x0, 0x0) read$msr(r3, &(0x7f00000005c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f00000195c0)=0x7) mkdir(&(0x7f0000019600)='dir0\x00', 0x80) mount(0x0, &(0x7f0000019640)='dir0\x00', &(0x7f0000019680)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000196c0)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) 5m13.127614448s ago: executing program 34 (id=86): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x844) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000500)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000580), 0x0, 0x0) read$msr(r3, &(0x7f00000005c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f00000195c0)=0x7) mkdir(&(0x7f0000019600)='dir0\x00', 0x80) mount(0x0, &(0x7f0000019640)='dir0\x00', &(0x7f0000019680)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000196c0)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) 16.864341323s ago: executing program 1 (id=441): syz_open_dev$vim2m(0x0, 0x7, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) request_key(0x0, 0x0, 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x14b102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x42, 0x2, 0x8, 0x0, 0x1}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r1}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x8000, r2, 0x0, 0xf2ffffffffffffff}, 0x38) 15.646742489s ago: executing program 3 (id=442): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000001c0)={0x20, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15.339102136s ago: executing program 1 (id=443): r0 = socket(0x10, 0x803, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x0, 0xa541, 0x2, 0x2, 0x33}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xea2, 0x80, 0x2, 0x315}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5341, 0x4, 0x3, 0x38e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9188, 0x20000, 0x1, 0x2f5}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5f48, 0x20, 0x0, 0xa8}}], 0x4, &(0x7f0000001940)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x3}, 0x0, 0x0, '\x00', {0x1, 0x822, 0x0, &(0x7f0000000940)=@buf_4k="d05728dd6bed64a707d15edbd7c0fe653baf78e9feafd66a43abc3f361be24e8734a17ddbd6a7127acffd471de2596e924109ff68cb32db0f473925dd32b41c636da074d14eca2edf5c06988b5ad8c32c51b889e057a490f5006e296ad5aa7148189fd729abfb05602e3b9e66048c0d1e2ffecf4772f7f8fdc4d753ea07c386ed03afd7d32cb2595cb48f8e76b1fa063aca641bfd06d3592a272e3ffc88c6421d1de54fdcae398bb4d0f88b65ac02711dfe8d999b8d86006beb86942f52302743b79c62ec389db2f56e4688cd789355ec04fa9a27a3a36d2b10a7270e3de6afc772b4caae9ffef5218fb98dc2cfde5d6658eb3d0e243e61bd0ebb7bc6c80fc5c3eafca16e30c85b4dfb5704a4c4f2127b2e326e5ede14928067b364fe225db6b82cf3ff3377e2a587281f9afcde75b56b937de0b7b23c82ef303688c225ce6758a2d803bb1376122d133f8ad54cc6f949fd00411c5112cb5aa5c10f61d48adc5334d239ee6b6b7f0bbe32e65dbbb1cb9343729cfdcf0ed7a43105af3186a26da2fd7ebe4cf896556ce95eb8390f4fcfb96f0141390e81d38a4582da42bdf7bb349be1e9e44801bd443a7d2320344cbc2b886719c643e5becb7b775a199e81161422308d487e30df96f1ebdbd1b1449bdd9242fdff49ef9d67e6bc69236f7ee4485de5ff46f799d35d51b96654e4c38c82097063e409c7d9b1a2cef792623166caebb365d444b41b33d355b39baa4ce4614f5c0a8d8a3b64058598ae0372ca79888bc41a1b21352b3eabc8e26fd577393be8ab0e7636916372dae4c67ad3e5fe6349515c12fca0aab34efd3dab9f1fd78aa6508e1c58cef44987ab3736904533fecc7ad70ff29b933860838e8b61cade875ac37214dbc20fb9c7fd69023ffa38f034c15e6394e18997a17813919ae544aeacece7898fc3a5ac961f3bfafd2bb32d69d3e290032d513f80ee1e352b71240ced15c23198d906cdb263d7f8cab594d4bb5f90c5b15945ecf709ed6ea59b9f4602f177f040772ea47e45d5e3a538319f8d6a261aa1a34c51e765331b2d65a9beac79e2f61a40c3fa8b91a5ef2b36e09a67595d022d857caaba2e24a394e34f6558854ef36a452006ba677515cbd190ac0db248432b3d30c24c0e561696c8a68e8315ebbdbe8e504be5c2d71056853eabe0b3499e653bb2f33c68b78649315c475e766f80516e6db97ecac405bb54e3b28757cecee4a40cefa08c4ffc38b2c062213ac9a514951bfaebc581b0d928730b8b59f6ea07814927c952fa4777f565dc7e258900a017d0b9ce2a3a4950024de786a0a7fb0f91f0b8ec20f478b1e665a03daaf033a2ce7806f0905ff2cff7d458ef27043dad17e4c4f0a8b193ba8648e847584d6fc498fd76e2a64b6401134e9cb4c13e609695d417f3267ee53364f190a0cea3249c752d81e4c1b7e112d89a4590966e2b07c7950e67aec1ea3be7627901811f90f7dc50f8121447b324baf77195d5cdcd2439ec11e29649365a57af22fefba18222c895177ea531c5958b110464825cd35791ebb1f54c27bbe3e307482c449743664efd65b233fb29b7bffc37fab45aa4446c92310f32567e429fc6331e91e548fa48a992784e9fc2b6a23b5c264b45faea4fc3c7b3de35672802546ba689d03d7b7b04241c8fddde3d7658af3dca4885b15adb2fb70bc5c969278ce44814ccf0b9f3eb7864136784cdf5e5322b14aae2df3606e89a8f1bb1bd9e8f3f1c514be00facc1acc269bae18de3868db995bbe2415e20aeef0647e65945c1eb899c4abe243c427a373f116c00e6925b74935ea641fda4be700306d36236e5876b62d7f6f41e8557624fa78c9fc0cc1dd89246d0ea3dc957f20f72ed5ec3f10a630dd60e3442de5a57b879ee7e8bf73c8d151643356f1a8c8cb1c05f2b4f49bd8e477877241b9c77539b3b52f2d47d6e917956c4d8d2e9a783d6d7800d071554cd49a7b4f964635ca88448124fd33bc3e556d500762b0ae5a0de65369b6d30be62120904893a8ba99a9afe9bec66be451ee02835793e6e308cc416170f89bdb7259d5a99e41f0459ea7b11712e4cea144c06d3b1a4c6d38bf4b40f90479e58166cf4c9cf77fb20f2ae1c3ff4ea309a0a89134b437158d48b0fbcb132d6f3cff4b332a66c0a2207fec9294fa7e8973d489c21974a5014f52eab2bb7d3527686c00664d6f174c9f4a55edff5c6cb369fd4ae7fa0750ee8d3860013d35212d8b9036615f20b69e7b4abfe4d6373f0ad60a5cba16e6ca4185ad170c6adad53602c97fb3039a2c852f0ff4e3492e337c584ea53ec72804ec919f4161585774a554d8eefb11a4ea139cb0bcbdb9a0c3af488ab2a8b06dbfed57645e2e1baa279ff063acf96e907c91b42899ad2940ab1ac71a540cee5509674fc70f5c246e27ef3aeda89a6338e846694206487edddd70bb1b86b80419f067640138c30e96410e47008b6215fcdfa4e695bda9476c64282ea8e51a2efa41f4bc2e4c0e37368073eac40945950c6ce857ce11add9aeea93fa2fdcefbb857b6d541cefa9ef2a8df758b855d6922514e3b8d593202a085c937a8a1d4b147a6378ba29f347a91b3555a75bc25ea5fa021c095a5ffbb056145996662a9220843599a96a3a24623bcc9b288ea32166f92a8f69282009232ae93f5cb912b59d68ba07d0171025507f51a1d5cf05d2be376aec4208c43cd921538067316213692048c6a81cd0b3ec8f8d03bfeebb8f0994b1ecd2fde0e6cd0392e612b934fd5ea2e76e3a7cf3b6b31cf4a0b69ffecb936197c22ec401c212549b6fc623043d07b1c616e1e28074c07eae4ec507f0213354af369c2f897c45339475cb8656f8b31d5f905340a2a3fcb023373415c905aa768ee9ae55d7fcf8f6fceb583bb20bc9ec9f52cb609b520f49a6866e6c88b19959c66cb2f3c3a1c1010f5c989c78c211ac71811b7820d41a2f814214e0596ae80cfa1687e50bb746f7bf3ff54fecf713dd108f65ba552b0edec55059e19954f9e027561896fdcf1ee0c43f70b250bd960bfb79e153dbdc86585251ab5d1f5f24b4b55a5226040f81bd32bb9f1fb6ffd90e25f725a20a0172fb4fdf119d93c1331fbfc3106801a6eb2b99630d1ca8d276d3d5379aea094bc1a33995af916c37988b27177e2f5f3ce4e6994def5bddc6f4984d29627025591986f9f047b51f15e2f1c463c79d9f3a14842ef6d978b0a18ef341079bfa5da5266cd284d8777fc58930ae13b9edeecce3a8caea518821b75bb4dddeb1bdb2fc6a1fe637d900d61644b1330995d2a81930edba62a1f5248dcb89c02b6debb7d2370210565c23ff8ebff1515817d92167417e57b0eaf9fb88642900b644d4f443edc76ba903fe9582037fc5675e77672ed9f872c07f36d054d9754e7b72083fecfaabd71cf7c588e2e2aaeeb34e757406e4e3eccddcc9a834da882c6f83466dad2bb612d916617e5cfadb2b2e51859eba588655e5453b30b44669b9682e4b8c63e2b7c7c2f1b13e0ecca0623f60baf42d75aae2964ec24609a05292f82f8e54b0bc36886e1cf42d9bfd5e848f3127acff7b6d076022aac888352ab76c7f97508bc9a187ede49507b93540e014047ce12ba8b952e43d0c74de67719ee88faca3a1e9d848818a5054b518f2770ca2b280c450058fac5bdd3eddc70ac814eb16466998de3c7f69921758e17ac05d5af667fc05cc77dbdcb21cb2ab1e81a599b97c1d1864b68bc5b3ffa6fef213ae0c1cd0ec39eab3c3e4b60a5f6fa2d291c8f9ca77787f7ee12c08e76aada0e1016e36aa00ed090770b970889a8e542c0a2c6f4a8e35662600ae35339040d49eb4558efdb3a5ebf60829035992390a6b91e9a7b0ac991dd7afc6de902a946dbfd1fe2b1baa44a6f73874416ed419c71944933b977a86c8fb8ef36e226bbe55ace51e339ed56eeff1278ed2f407aa2256aa323b291efbca4c18feb56bfca8f4eec8d4813e3cb76304950a8c677d8d0b787aff0ec7a2cee24f0276aa440c698e891c17efe98788822638dc6716484d661bda7cc80c9a4b49f6d7617af320ce8c6d8fb18b505aeec6d415f71a33a64c23825c58b89c8e69d8504f535c78a6e25a323a92878660c6e34f0714e66b5a5bdcd1c46cbe193a0c1f218cc4bbcd4e11a2ac68637012fa6432e120d75195b2f46ecb4eec2609e102fd5f6493b8fe478be0ac43e34dd78b0d8d1610faa9bd98ba408be3884ad1eb7b1094fa06bf855c12ff72c90851d68aa50cdd57e597336a9fe3e932da3d1715561cc3effefd24507f087b68ba07417b5e7295d7589ca2fcf4ebc5302b8be1c98b80c908890c2eeee3d651a830d0f681a550b092542e6ab265615d1c1461e421f47f26f546489b331ef04ad834f33c3d4cb1789dc4bdb3e45ffb87b8ab6ca0a5be10f1422c0a0313a7d2f54c0128c7880852aa18812a02294b86f9ed2702171afc76b4b8abffd468e72c3787d839e34548bcbc8e5bc73adf178143c2e7352970390f64d958689c844cd2e97377ed8369409bcc7c6a02989558d9b6987ea9daabd8a0b24bb2efaa772db4cb254554220eae79d93c17b06baa660d8545fd606befefc318dbc4f950bc8bcdef97ff58360bd62ed379b1101ff4ffe4903ac2d2c84f0924ee0a5fcd01e10a80e45868843e051e5e8c7c5f8697b3a4ac13a7d8049677e28472430d8c2de2d192a01abf283f86b58289f20be29f68f94e673a50e17d909e7c007670e559ff2025335b482f0b29c8ecb79a37b41db5fa3735dd14cc6ec205483f6c0ce729723a0be0a5ec49410e94af387f152011ae36fe7d28872b47c353556ba8ceec26aa1e394fcd6e663fcf7e000bbe45127d62735fa63796a0dbb22797bf3338a0d4a36ea09e5bb1d0bdb2f25f4740416fb1eaeb67ad653b8488ceb336722ef75e236721c5696824ce04c871acb6aa66e595f69ab01024dde2e38ce7fec92c988f564d04984717cd84c032d33fcb2cc23053ab995c925c561893432bf7bb97347e5e3097ab4cf3abd5cd2d82eb45c55cf580f64fd5cfd17e716640027ec220355ece239351f0f6f5af8fa404f8956cedcb24e7235c7528659114ba96497c8fb2913eb1676b18708b266b229c7cd3e50ea44ff8e20a570d99604462458bdbb5985b059dbe76a0efe55648cc359b209808aee31d5eff3c0c31cd13cd8f5db7c28c440ff58488a6adf87eaced1303e7bfd7389f8c0c7b56632f5287334fa4f65207e1469b53be38db2ad2dd2863a03583f0ec85339ff55949c751767bc2e4a1734a448358bde1b4af8e030c91215e4ff358f9876fee1ab2916b3ce9003e256562a93a4e7c22d237e95dc1272b48a48d25f4d36e6ece475b2f4df7f4f941371824955fb5a07e82d0094ad982d3def874259acd14b70a4e43cb9d8580a5ce3437f8b5076caeaa1bfb1426a18014badbbad9d1a00835301896ee57619f7f681dd45a663d88b0b512f475819c9ceae96ac22ea0d1863d95f7a6db43547674478b8733b210855a78c762c092d76562c0d2083b3c300eaa49d11d78f37cce2a51a7df2d243591b5affe1afb347054c84f1850c3a42bac0843ecc3f68e750e4b69137a58a53037c0b13fd69f923b7c4f1f073f2d06259641d2889b4da79995e370a30c416a1a5fbf3f809b459308600a2bfb64b7945cf3b9563a093cdad6c65fe68c061de07fa4a6a83de820f7aa0b67014ae4aa74269cc2dcc909ce8939734ec307d7c6c5c877dc0f6da20dff0ba9e759887859934649a0072be80b8dd2a8360a51266b84be34357c74b6689aa24ef15185df9ddd4a"}}, &(0x7f00000019c0)) r2 = syz_io_uring_setup(0xefd, &(0x7f0000000580)={0x0, 0x0, 0x400, 0x2, 0x55, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r0, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0, 0x80000080}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001a00)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x130, 0x1c8, 0xffffffff, 0xffffffff, 0x98, 0x130, 0x1c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf, 0x7, 0x5b4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) r7 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) dup2(r6, r7) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f00000008c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f0000000300), 0x2, 0x143102) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000380)="94", 0xf000}, {0x0}], 0x2) mlockall(0x2) shmctl$SHM_LOCK(0x0, 0xb) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000400), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000440)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r9, 0xc058560f, &(0x7f0000000480)=@mmap={0x1, 0x1, 0x4, 0x8030, 0xffffffff, {0x77359400}, {0x0, 0x1, 0xf1, 0xa, 0x0, 0x1, "bf231e4b"}}) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448cb, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bind$bt_hci(r10, &(0x7f0000000500)={0x1f, 0x0, 0x1}, 0x6) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0x40045612, &(0x7f0000000540)=0x1) io_uring_enter(r2, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) 12.829054459s ago: executing program 1 (id=444): mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x101042, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000480)='./file0/file1\x00', 0x20400, 0x20) truncate(&(0x7f00000004c0)='./file0/file1\x00', 0xe2) fadvise64(r0, 0x2, 0xc, 0x0) sched_setaffinity(0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x1) sched_setscheduler(0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) 12.176937783s ago: executing program 1 (id=445): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="120100008e88052086800095d893010203010902120001"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f00000001c0)={0x20, 0x3}, 0x0, 0x0, 0x0, 0x0}) 10.684354822s ago: executing program 4 (id=446): setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0xfffff000, 0xe, 0x4a, &(0x7f0000000300)="a03c3f980100000005a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) write(r1, 0x0, 0x0) close(r1) write(0xffffffffffffffff, &(0x7f00000001c0)='1\n\x00', 0x3) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/target/usb_gadget\x00', 0x1ff) 10.308574685s ago: executing program 4 (id=447): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) madvise(&(0x7f0000cf6000/0x4000)=nil, 0x4000, 0x16) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000240)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x8e, 0x0, 0x0, 0x100000c01, 0x38, 0x0, 0x34, 0x3e}) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_lsm={0x6, 0x3, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000740)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000100)={r2, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000d40)={0x0, 0xfffffffe, &(0x7f0000000d80)=[{&(0x7f0000000dc0)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000900)=@filter={'filter\x00', 0xe, 0x4, 0x3a8, 0xffffffff, 0x0, 0x230, 0x230, 0xffffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, &(0x7f0000000180), {[{{@uncond, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@inet=@set4={{0x50}, {{0x1, 0x3}, {{0x353733de}, 0x7}, {{0x2}, 0x2}, 0x4}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private2, [0x0, 0x0, 0xff000000, 0xff], 0x4e23, 0x4e22, 0x4e23, 0x4e24, 0x1, 0x9, 0xee, 0x1, 0x6cde}}}, {{@ip={@rand_addr=0x64010102, @empty, 0xff000000, 0xff000000, 'veth0_vlan\x00', 'geneve0\x00', {0xff}, {0xff}, 0x62, 0x2}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@addrtype={{0x30}, {0x862, 0x232, 0x1, 0x1}}, @common=@icmp={{0x28}, {0x7677c3378b2b8f48, "c531", 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'ipvlan1\x00', {0x4cd8}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@common=@ttl={{0x28}, {0x1, 0x8}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private1, 'ip6_vti0\x00', {0x4485}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x408) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a2, &(0x7f0000000000)='bridge0\x00') socket(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)={0x1c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}}, 0x0) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000100), 0x6, 0x0) 10.18447682s ago: executing program 3 (id=448): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f00000000c0)={0x3f}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000000500)={'syz1\x00', {}, 0x51, [0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x1000020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], [0x0, 0xfffffffd, 0x3, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x200000, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf51, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80, 0x0, 0x5, 0x0, 0xffffffff, 0x7fffffff, 0x0, 0x0, 0x2], [0x0, 0x0, 0x4, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x788c1f3, 0x20000, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x2, 0x0, 0xfaea, 0x0, 0x0, 0x0, 0x6, 0x0, 0x200, 0x3], [0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffd, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x203, 0x400, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_PUBL_GET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYRES16, @ANYBLOB], 0xdc}, 0x1, 0x0, 0x0, 0x6}, 0x4020) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = getpid() socket$kcm(0x2, 0x3, 0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000000200), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000240), 0x10106, 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000280)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r6, &(0x7f0000000340)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) sendto$inet(r6, &(0x7f0000000380), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000003c0)='bic', 0x19) recvfrom$inet(r6, &(0x7f0000000400)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$UI_DEV_CREATE(r0, 0x5501) 8.358456876s ago: executing program 1 (id=449): r0 = openat$nsim_port_qreset(0xffffffffffffff9c, &(0x7f00000000c0)={'/sys/kernel/debug/netdevsim/netdevsim', 0x0, '/ports/', 0x31}, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000180)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000000280)=""/102392, 0x18ff8) sendmsg$nl_generic(r1, &(0x7f0000019280)={0x0, 0x0, &(0x7f00000192c0)={&(0x7f0000019300)={0x20, 0x10, 0x701, 0x70bd2a, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x5d27963e}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r5, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xffffffe2}}, './file0\x00'}) ioctl$USBDEVFS_RELEASEINTERFACE(r6, 0x80045510, &(0x7f0000000040)) write$nsim_port_qreset(r0, &(0x7f00000001c0)={0x32, 0x20, 0x33}, 0x3) 6.117945061s ago: executing program 1 (id=450): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0), 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000200)={'vcan0\x00'}) r2 = landlock_create_ruleset(&(0x7f0000000140)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) 6.10154149s ago: executing program 3 (id=451): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) r0 = socket$netlink(0x10, 0x3, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r1, &(0x7f0000000380)='100', 0x3) r2 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x20000) ioctl$SG_BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000400)={'\x00', 0x23f5, 0xdd33, 0x8, 0xffffffffffffffff, 0x2}) r3 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f00000001c0)={0x1, r3}) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)}], 0x1) ioctl$I2C_PEC(0xffffffffffffffff, 0x708, 0xb8f7) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) 6.022447283s ago: executing program 4 (id=452): socket$kcm(0x11, 0x200000000000002, 0x300) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) socket$inet(0x2, 0x3, 0x2) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='children\x00') unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/custom1\x00') prlimit64(0x0, 0xe, &(0x7f0000002680)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000026c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000002700)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000002780)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000002800), 0x651, 0x0) recvmmsg(r2, &(0x7f0000002840), 0x10106, 0x2, 0x0) r4 = socket(0x2b, 0x80801, 0x1) listen(r4, 0xf) listen(r4, 0x4) preadv(r0, &(0x7f0000000200)=[{&(0x7f0000000240)=""/119, 0x77}], 0x1, 0x4f, 0x4e) r5 = getpgrp(0xffffffffffffffff) syz_open_procfs(r5, &(0x7f00000002c0)='fdinfo\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000003, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000340)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) read(0xffffffffffffffff, &(0x7f0000000380)=""/145, 0x91) msync(&(0x7f0000009000/0x2000)=nil, 0x2000, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 4.351296153s ago: executing program 4 (id=453): r0 = socket(0x10, 0x803, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x0, 0xa541, 0x2, 0x2, 0x33}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xea2, 0x80, 0x2, 0x315}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5341, 0x4, 0x3, 0x38e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9188, 0x20000, 0x1, 0x2f5}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5f48, 0x20, 0x0, 0xa8}}], 0x4, &(0x7f0000001940)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x3}, 0x0, 0x0, '\x00', {0x1, 0x822, 0x0, &(0x7f0000000940)=@buf_4k="d05728dd6bed64a707d15edbd7c0fe653baf78e9feafd66a43abc3f361be24e8734a17ddbd6a7127acffd471de2596e924109ff68cb32db0f473925dd32b41c636da074d14eca2edf5c06988b5ad8c32c51b889e057a490f5006e296ad5aa7148189fd729abfb05602e3b9e66048c0d1e2ffecf4772f7f8fdc4d753ea07c386ed03afd7d32cb2595cb48f8e76b1fa063aca641bfd06d3592a272e3ffc88c6421d1de54fdcae398bb4d0f88b65ac02711dfe8d999b8d86006beb86942f52302743b79c62ec389db2f56e4688cd789355ec04fa9a27a3a36d2b10a7270e3de6afc772b4caae9ffef5218fb98dc2cfde5d6658eb3d0e243e61bd0ebb7bc6c80fc5c3eafca16e30c85b4dfb5704a4c4f2127b2e326e5ede14928067b364fe225db6b82cf3ff3377e2a587281f9afcde75b56b937de0b7b23c82ef303688c225ce6758a2d803bb1376122d133f8ad54cc6f949fd00411c5112cb5aa5c10f61d48adc5334d239ee6b6b7f0bbe32e65dbbb1cb9343729cfdcf0ed7a43105af3186a26da2fd7ebe4cf896556ce95eb8390f4fcfb96f0141390e81d38a4582da42bdf7bb349be1e9e44801bd443a7d2320344cbc2b886719c643e5becb7b775a199e81161422308d487e30df96f1ebdbd1b1449bdd9242fdff49ef9d67e6bc69236f7ee4485de5ff46f799d35d51b96654e4c38c82097063e409c7d9b1a2cef792623166caebb365d444b41b33d355b39baa4ce4614f5c0a8d8a3b64058598ae0372ca79888bc41a1b21352b3eabc8e26fd577393be8ab0e7636916372dae4c67ad3e5fe6349515c12fca0aab34efd3dab9f1fd78aa6508e1c58cef44987ab3736904533fecc7ad70ff29b933860838e8b61cade875ac37214dbc20fb9c7fd69023ffa38f034c15e6394e18997a17813919ae544aeacece7898fc3a5ac961f3bfafd2bb32d69d3e290032d513f80ee1e352b71240ced15c23198d906cdb263d7f8cab594d4bb5f90c5b15945ecf709ed6ea59b9f4602f177f040772ea47e45d5e3a538319f8d6a261aa1a34c51e765331b2d65a9beac79e2f61a40c3fa8b91a5ef2b36e09a67595d022d857caaba2e24a394e34f6558854ef36a452006ba677515cbd190ac0db248432b3d30c24c0e561696c8a68e8315ebbdbe8e504be5c2d71056853eabe0b3499e653bb2f33c68b78649315c475e766f80516e6db97ecac405bb54e3b28757cecee4a40cefa08c4ffc38b2c062213ac9a514951bfaebc581b0d928730b8b59f6ea07814927c952fa4777f565dc7e258900a017d0b9ce2a3a4950024de786a0a7fb0f91f0b8ec20f478b1e665a03daaf033a2ce7806f0905ff2cff7d458ef27043dad17e4c4f0a8b193ba8648e847584d6fc498fd76e2a64b6401134e9cb4c13e609695d417f3267ee53364f190a0cea3249c752d81e4c1b7e112d89a4590966e2b07c7950e67aec1ea3be7627901811f90f7dc50f8121447b324baf77195d5cdcd2439ec11e29649365a57af22fefba18222c895177ea531c5958b110464825cd35791ebb1f54c27bbe3e307482c449743664efd65b233fb29b7bffc37fab45aa4446c92310f32567e429fc6331e91e548fa48a992784e9fc2b6a23b5c264b45faea4fc3c7b3de35672802546ba689d03d7b7b04241c8fddde3d7658af3dca4885b15adb2fb70bc5c969278ce44814ccf0b9f3eb7864136784cdf5e5322b14aae2df3606e89a8f1bb1bd9e8f3f1c514be00facc1acc269bae18de3868db995bbe2415e20aeef0647e65945c1eb899c4abe243c427a373f116c00e6925b74935ea641fda4be700306d36236e5876b62d7f6f41e8557624fa78c9fc0cc1dd89246d0ea3dc957f20f72ed5ec3f10a630dd60e3442de5a57b879ee7e8bf73c8d151643356f1a8c8cb1c05f2b4f49bd8e477877241b9c77539b3b52f2d47d6e917956c4d8d2e9a783d6d7800d071554cd49a7b4f964635ca88448124fd33bc3e556d500762b0ae5a0de65369b6d30be62120904893a8ba99a9afe9bec66be451ee02835793e6e308cc416170f89bdb7259d5a99e41f0459ea7b11712e4cea144c06d3b1a4c6d38bf4b40f90479e58166cf4c9cf77fb20f2ae1c3ff4ea309a0a89134b437158d48b0fbcb132d6f3cff4b332a66c0a2207fec9294fa7e8973d489c21974a5014f52eab2bb7d3527686c00664d6f174c9f4a55edff5c6cb369fd4ae7fa0750ee8d3860013d35212d8b9036615f20b69e7b4abfe4d6373f0ad60a5cba16e6ca4185ad170c6adad53602c97fb3039a2c852f0ff4e3492e337c584ea53ec72804ec919f4161585774a554d8eefb11a4ea139cb0bcbdb9a0c3af488ab2a8b06dbfed57645e2e1baa279ff063acf96e907c91b42899ad2940ab1ac71a540cee5509674fc70f5c246e27ef3aeda89a6338e846694206487edddd70bb1b86b80419f067640138c30e96410e47008b6215fcdfa4e695bda9476c64282ea8e51a2efa41f4bc2e4c0e37368073eac40945950c6ce857ce11add9aeea93fa2fdcefbb857b6d541cefa9ef2a8df758b855d6922514e3b8d593202a085c937a8a1d4b147a6378ba29f347a91b3555a75bc25ea5fa021c095a5ffbb056145996662a9220843599a96a3a24623bcc9b288ea32166f92a8f69282009232ae93f5cb912b59d68ba07d0171025507f51a1d5cf05d2be376aec4208c43cd921538067316213692048c6a81cd0b3ec8f8d03bfeebb8f0994b1ecd2fde0e6cd0392e612b934fd5ea2e76e3a7cf3b6b31cf4a0b69ffecb936197c22ec401c212549b6fc623043d07b1c616e1e28074c07eae4ec507f0213354af369c2f897c45339475cb8656f8b31d5f905340a2a3fcb023373415c905aa768ee9ae55d7fcf8f6fceb583bb20bc9ec9f52cb609b520f49a6866e6c88b19959c66cb2f3c3a1c1010f5c989c78c211ac71811b7820d41a2f814214e0596ae80cfa1687e50bb746f7bf3ff54fecf713dd108f65ba552b0edec55059e19954f9e027561896fdcf1ee0c43f70b250bd960bfb79e153dbdc86585251ab5d1f5f24b4b55a5226040f81bd32bb9f1fb6ffd90e25f725a20a0172fb4fdf119d93c1331fbfc3106801a6eb2b99630d1ca8d276d3d5379aea094bc1a33995af916c37988b27177e2f5f3ce4e6994def5bddc6f4984d29627025591986f9f047b51f15e2f1c463c79d9f3a14842ef6d978b0a18ef341079bfa5da5266cd284d8777fc58930ae13b9edeecce3a8caea518821b75bb4dddeb1bdb2fc6a1fe637d900d61644b1330995d2a81930edba62a1f5248dcb89c02b6debb7d2370210565c23ff8ebff1515817d92167417e57b0eaf9fb88642900b644d4f443edc76ba903fe9582037fc5675e77672ed9f872c07f36d054d9754e7b72083fecfaabd71cf7c588e2e2aaeeb34e757406e4e3eccddcc9a834da882c6f83466dad2bb612d916617e5cfadb2b2e51859eba588655e5453b30b44669b9682e4b8c63e2b7c7c2f1b13e0ecca0623f60baf42d75aae2964ec24609a05292f82f8e54b0bc36886e1cf42d9bfd5e848f3127acff7b6d076022aac888352ab76c7f97508bc9a187ede49507b93540e014047ce12ba8b952e43d0c74de67719ee88faca3a1e9d848818a5054b518f2770ca2b280c450058fac5bdd3eddc70ac814eb16466998de3c7f69921758e17ac05d5af667fc05cc77dbdcb21cb2ab1e81a599b97c1d1864b68bc5b3ffa6fef213ae0c1cd0ec39eab3c3e4b60a5f6fa2d291c8f9ca77787f7ee12c08e76aada0e1016e36aa00ed090770b970889a8e542c0a2c6f4a8e35662600ae35339040d49eb4558efdb3a5ebf60829035992390a6b91e9a7b0ac991dd7afc6de902a946dbfd1fe2b1baa44a6f73874416ed419c71944933b977a86c8fb8ef36e226bbe55ace51e339ed56eeff1278ed2f407aa2256aa323b291efbca4c18feb56bfca8f4eec8d4813e3cb76304950a8c677d8d0b787aff0ec7a2cee24f0276aa440c698e891c17efe98788822638dc6716484d661bda7cc80c9a4b49f6d7617af320ce8c6d8fb18b505aeec6d415f71a33a64c23825c58b89c8e69d8504f535c78a6e25a323a92878660c6e34f0714e66b5a5bdcd1c46cbe193a0c1f218cc4bbcd4e11a2ac68637012fa6432e120d75195b2f46ecb4eec2609e102fd5f6493b8fe478be0ac43e34dd78b0d8d1610faa9bd98ba408be3884ad1eb7b1094fa06bf855c12ff72c90851d68aa50cdd57e597336a9fe3e932da3d1715561cc3effefd24507f087b68ba07417b5e7295d7589ca2fcf4ebc5302b8be1c98b80c908890c2eeee3d651a830d0f681a550b092542e6ab265615d1c1461e421f47f26f546489b331ef04ad834f33c3d4cb1789dc4bdb3e45ffb87b8ab6ca0a5be10f1422c0a0313a7d2f54c0128c7880852aa18812a02294b86f9ed2702171afc76b4b8abffd468e72c3787d839e34548bcbc8e5bc73adf178143c2e7352970390f64d958689c844cd2e97377ed8369409bcc7c6a02989558d9b6987ea9daabd8a0b24bb2efaa772db4cb254554220eae79d93c17b06baa660d8545fd606befefc318dbc4f950bc8bcdef97ff58360bd62ed379b1101ff4ffe4903ac2d2c84f0924ee0a5fcd01e10a80e45868843e051e5e8c7c5f8697b3a4ac13a7d8049677e28472430d8c2de2d192a01abf283f86b58289f20be29f68f94e673a50e17d909e7c007670e559ff2025335b482f0b29c8ecb79a37b41db5fa3735dd14cc6ec205483f6c0ce729723a0be0a5ec49410e94af387f152011ae36fe7d28872b47c353556ba8ceec26aa1e394fcd6e663fcf7e000bbe45127d62735fa63796a0dbb22797bf3338a0d4a36ea09e5bb1d0bdb2f25f4740416fb1eaeb67ad653b8488ceb336722ef75e236721c5696824ce04c871acb6aa66e595f69ab01024dde2e38ce7fec92c988f564d04984717cd84c032d33fcb2cc23053ab995c925c561893432bf7bb97347e5e3097ab4cf3abd5cd2d82eb45c55cf580f64fd5cfd17e716640027ec220355ece239351f0f6f5af8fa404f8956cedcb24e7235c7528659114ba96497c8fb2913eb1676b18708b266b229c7cd3e50ea44ff8e20a570d99604462458bdbb5985b059dbe76a0efe55648cc359b209808aee31d5eff3c0c31cd13cd8f5db7c28c440ff58488a6adf87eaced1303e7bfd7389f8c0c7b56632f5287334fa4f65207e1469b53be38db2ad2dd2863a03583f0ec85339ff55949c751767bc2e4a1734a448358bde1b4af8e030c91215e4ff358f9876fee1ab2916b3ce9003e256562a93a4e7c22d237e95dc1272b48a48d25f4d36e6ece475b2f4df7f4f941371824955fb5a07e82d0094ad982d3def874259acd14b70a4e43cb9d8580a5ce3437f8b5076caeaa1bfb1426a18014badbbad9d1a00835301896ee57619f7f681dd45a663d88b0b512f475819c9ceae96ac22ea0d1863d95f7a6db43547674478b8733b210855a78c762c092d76562c0d2083b3c300eaa49d11d78f37cce2a51a7df2d243591b5affe1afb347054c84f1850c3a42bac0843ecc3f68e750e4b69137a58a53037c0b13fd69f923b7c4f1f073f2d06259641d2889b4da79995e370a30c416a1a5fbf3f809b459308600a2bfb64b7945cf3b9563a093cdad6c65fe68c061de07fa4a6a83de820f7aa0b67014ae4aa74269cc2dcc909ce8939734ec307d7c6c5c877dc0f6da20dff0ba9e759887859934649a0072be80b8dd2a8360a51266b84be34357c74b6689aa24ef15185df9ddd4a"}}, &(0x7f00000019c0)) r2 = syz_io_uring_setup(0xefd, &(0x7f0000000580)={0x0, 0x0, 0x400, 0x2, 0x55, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r0, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0, 0x80000080}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001a00)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x130, 0x1c8, 0xffffffff, 0xffffffff, 0x98, 0x130, 0x1c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf, 0x7, 0x5b4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) r7 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) dup2(r6, r7) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f00000008c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f0000000300), 0x2, 0x143102) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000380)="94", 0xf000}, {0x0}], 0x2) mlockall(0x2) shmctl$SHM_LOCK(0x0, 0xb) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000400), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000440)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r9, 0xc058560f, &(0x7f0000000480)=@mmap={0x1, 0x1, 0x4, 0x8030, 0xffffffff, {0x77359400}, {0x0, 0x1, 0xf1, 0xa, 0x0, 0x1, "bf231e4b"}}) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448cb, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bind$bt_hci(r10, &(0x7f0000000500)={0x1f, 0x0, 0x1}, 0x6) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0x40045612, &(0x7f0000000540)=0x1) io_uring_enter(r2, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) 4.037441631s ago: executing program 3 (id=454): mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) close(r0) add_key$fscrypt_v1(0x0, &(0x7f0000000040)={'fscrypt:', @desc3}, 0x0, 0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$vimc1(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010018"], 0x1c}}, 0x0) 2.316527497s ago: executing program 4 (id=455): mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x141102) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000140)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010018"], 0x1c}}, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000240), 0xffffffffffffffff) getpgrp(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000280)={0x9000000d}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newlink={0x30, 0x10, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x21d62, 0x5}, [@IFLA_TARGET_NETNSID={0x8, 0x2e, 0x1}, @IFLA_NET_NS_FD={0x8, 0x1c, r4}]}, 0x30}}, 0x20084084) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r6 = dup2(r5, r5) bind$bt_hci(r6, &(0x7f00000005c0)={0x1f, 0x1, 0x3}, 0x6) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000680), 0x200, 0x0) io_submit(0x0, 0x4, &(0x7f0000000900)=[&(0x7f0000000600)={0x0, 0x0, 0x0, 0x2, 0x7ff, r0, &(0x7f0000000580)="ebdba1bebfbe29b148ad", 0xa, 0x3, 0x0, 0x3, r6}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x6, 0x8001, 0xffffffffffffffff, &(0x7f0000000640)="eaced474107360e53c053d9025b771a052d0e4cb6f", 0x15, 0x6, 0x0, 0x2, r7}, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x10, r1, &(0x7f0000000700)="6d580ae4266ad076e0c80d7da56771e83b3c65f98203aac06a94958f1f6ea68ae32a6a4499a7fb596874da29685874733e40d693e0fe3c38ba14bf8416fa477e43edc0b217856e0aa2811efa4ec73dab8da939e67b84386ecb15ebf02f6ebdf5fa07d538c759b73d5dfd91f5560fa9962f9827f72b30aba45c5f12b2feb4a12e8678a5cbae4d661608967a07a17ca125918e9cf4c35d4d9fe9ae969f283deb4879d69ea510e1687670523b1784", 0xad, 0x8, 0x0, 0x1}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x7, 0x8, 0xffffffffffffffff, &(0x7f0000000800), 0x0, 0x81, 0x0, 0x2}]) sendmsg$nl_generic(r3, 0x0, 0xc004) 1.244613311s ago: executing program 3 (id=456): setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0xfffff000, 0xe, 0x4a, &(0x7f0000000300)="a03c3f980100000005a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) write(r1, 0x0, 0x0) close(r1) write(0xffffffffffffffff, &(0x7f00000001c0)='1\n\x00', 0x3) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/target/usb_gadget\x00', 0x1ff) 251.512046ms ago: executing program 4 (id=457): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_clone(0x20000, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpu.stat\x00', 0x275a, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x80002, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) getpeername$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000200)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, 0x0, &(0x7f0000000240)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x2043, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x800093ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 0s ago: executing program 3 (id=458): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002240)='./debug\x00', 0xf2) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff) kernel console output (not intermixed with test programs): 93548][ T5636] veth0_macvtap: entered promiscuous mode [ 98.669978][ T5636] veth1_macvtap: entered promiscuous mode [ 98.685870][ T5634] veth0_vlan: entered promiscuous mode [ 98.703086][ T5633] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 98.715712][ T5635] veth1_vlan: entered promiscuous mode [ 98.801224][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.801255][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.826428][ T5634] veth1_vlan: entered promiscuous mode [ 98.877288][ T5636] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.880708][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.880735][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.908716][ T5636] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.962360][ T5637] veth0_vlan: entered promiscuous mode [ 98.984407][ T1529] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.986880][ T62] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.986944][ T62] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.987005][ T62] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.009787][ T5635] veth0_macvtap: entered promiscuous mode [ 99.016303][ T5635] veth1_macvtap: entered promiscuous mode [ 99.040992][ T5637] veth1_vlan: entered promiscuous mode [ 99.079080][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.117798][ T5634] veth0_macvtap: entered promiscuous mode [ 99.132900][ T5634] veth1_macvtap: entered promiscuous mode [ 99.139298][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.257036][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.257066][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.304612][ T1529] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.304680][ T1529] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.304741][ T1529] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.304801][ T1529] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.331137][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.331704][ T5637] veth0_macvtap: entered promiscuous mode [ 99.409270][ T5637] veth1_macvtap: entered promiscuous mode [ 99.432458][ T1529] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.432487][ T1529] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.452235][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.582121][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.582151][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.609516][ T1211] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.609970][ T1211] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.636271][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.786609][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.786639][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.812398][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.878052][ T1529] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.887253][ T62] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.075600][ T1529] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.075678][ T1529] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.094052][ T1211] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.094261][ T1211] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.102915][ T1529] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.102940][ T1529] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.350128][ T24] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 100.408431][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.408462][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.481882][ T5882] capability: warning: `syz.1.7' uses 32-bit capabilities (legacy support in use) [ 100.516715][ T24] usb 4-1: New USB device found: idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 100.522913][ T24] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 100.522942][ T24] usb 4-1: config 0 has no interface number 0 [ 100.538726][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.538764][ T24] usb 4-1: Product: syz [ 100.538788][ T24] usb 4-1: Manufacturer: syz [ 100.538813][ T24] usb 4-1: SerialNumber: syz [ 100.591840][ T24] usb 4-1: config 0 descriptor?? [ 100.641388][ T24] usb 4-1: selecting invalid altsetting 1 [ 100.641738][ T24] dvb_ttusb_budget: ttusb_init_controller: error [ 100.641781][ T24] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 102.981572][ T1092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.981621][ T1092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.011600][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 103.081966][ T1211] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.081995][ T1211] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.278639][ T24] DVB: Unable to find symbol stv0299_attach() [ 103.622501][ T24] DVB: Unable to find symbol tda8083_attach() [ 103.622522][ T24] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 103.658454][ T24] usb 4-1: USB disconnect, device number 2 [ 103.704593][ T1710] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 103.867336][ T1710] usb 2-1: New USB device found: idVendor=072f, idProduct=2200, bcdDevice=1.00 [ 103.871624][ T1710] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.064875][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 104.093730][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 104.143739][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 104.193739][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.343742][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.363736][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 104.474368][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 106.273736][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.203756][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 107.353737][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 108.547396][ T1710] usb 2-1: NFC: Reader power on cmd error -71 [ 108.547432][ T1710] pn533_usb 2-1:1.0: NFC: Couldn't poweron the reader (error -71) [ 108.547580][ T1710] pn533_usb 2-1:1.0: probe with driver pn533_usb failed with error -71 [ 108.668745][ T1710] usb 2-1: USB disconnect, device number 2 [ 110.581678][ T5769] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 111.522555][ T5769] usb 6-1: New USB device found: idVendor=0a12, idProduct=0002, bcdDevice=10.00 [ 111.538443][ T5769] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 111.538510][ T5769] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.059196][ T24] usb 6-1: USB disconnect, device number 2 [ 114.413023][ T5978] netlink: 8 bytes leftover after parsing attributes in process `syz.5.21'. [ 114.427856][ T5649] Bluetooth: to_multiplier 8192 > 3200 [ 114.997479][ T5988] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 116.076386][ T5986] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 116.485745][ T5649] Bluetooth: hci4: command tx timeout [ 117.753857][ T5769] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 117.992917][ T5769] usb 5-1: New USB device found: idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 118.047708][ T5769] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 118.067218][ T5769] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.337560][ T5769] usb 5-1: config 0 descriptor?? [ 118.384799][ T5769] pwc: Askey VC010 type 2 USB webcam detected. [ 120.826606][ T5769] pwc: send_video_command error -71 [ 120.826629][ T5769] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 120.826741][ T5769] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 120.834768][ T5769] usb 5-1: USB disconnect, device number 2 [ 122.456364][ T6028] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 129.651558][ T30] audit: type=1800 audit(1793365426.292:2): pid=6061 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.39" name=08 dev="sda1" ino=2051 res=0 errno=-22 [ 130.233785][ T5769] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 130.322348][ T6057] can: request_module (can-proto-0) failed. [ 130.385063][ T5769] usb 5-1: Using ep0 maxpacket: 32 [ 130.385815][ T5769] usb 5-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 130.387500][ T5769] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.387549][ T5769] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 58999, setting to 1024 [ 130.387612][ T5769] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.392832][ T5769] usb 5-1: config 0 descriptor?? [ 130.458406][ T6056] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 130.497831][ T5769] hub 5-1:0.0: USB hub found [ 130.675326][ T5769] hub 5-1:0.0: 1 port detected [ 130.813096][ T6070] Zero length message leads to an empty skb [ 131.053902][ T5782] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 131.207242][ T5782] usb 3-1: not running at top speed; connect to a high speed hub [ 131.207288][ T5782] usb 3-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 131.211798][ T5782] usb 3-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 131.221658][ T5782] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.221696][ T5782] usb 3-1: Product: syz [ 131.221722][ T5782] usb 3-1: Manufacturer: syz [ 131.221753][ T5782] usb 3-1: SerialNumber: syz [ 131.262861][ T5782] keyspan 3-1:1.0: Keyspan 4 port adapter converter detected [ 131.263927][ T5782] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 131.345477][ T5782] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 131.388111][ T5782] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 131.451255][ T5782] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 131.492711][ T5782] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 132.097051][ T1710] usb 3-1: USB disconnect, device number 2 [ 132.159835][ T1710] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 132.177611][ T1710] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 132.191792][ T1710] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 132.218169][ T5769] usb 5-1: reset high-speed USB device number 3 using dummy_hcd [ 132.226971][ T1710] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 132.260519][ T1710] keyspan 3-1:1.0: device disconnected [ 132.306210][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.306314][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.369452][ T6056] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 132.784454][ T5762] usb 5-1: USB disconnect, device number 3 [ 135.108404][ T6124] Cannot find set identified by id 1 to match [ 136.986680][ T6137] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 140.914993][ T5652] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 140.916672][ T5652] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 140.917568][ T5652] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 140.918534][ T5652] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 140.919190][ T5652] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 143.024060][ T5649] Bluetooth: hci6: command tx timeout [ 145.107687][ T5649] Bluetooth: hci6: command tx timeout [ 147.658340][ T5649] Bluetooth: hci6: command tx timeout [ 148.023032][ T6151] rxe_eth0 speed is unknown, defaulting to 1000 [ 148.640699][ T6217] FAULT_INJECTION: forcing a failure. [ 148.640699][ T6217] name failslab, interval 1, probability 0, space 0, times 1 [ 148.640734][ T6217] CPU: 1 UID: 0 PID: 6217 Comm: syz.3.49 Not tainted syzkaller #0 PREEMPT(full) [ 148.640773][ T6217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 148.640790][ T6217] Call Trace: [ 148.640799][ T6217] [ 148.640810][ T6217] dump_stack_lvl+0x100/0x190 [ 148.640859][ T6217] should_fail_ex.cold+0x5/0xa [ 148.640901][ T6217] should_failslab+0xc2/0x120 [ 148.640944][ T6217] __kmalloc_noprof+0xfc/0x840 [ 148.640978][ T6217] ? srso_alias_return_thunk+0x5/0xfbef5 [ 148.641014][ T6217] ? lsm_blob_alloc+0x68/0x90 [ 148.641049][ T6217] lsm_blob_alloc+0x68/0x90 [ 148.641077][ T6217] security_prepare_creds+0x2d/0x290 [ 148.641125][ T6217] prepare_creds+0x5d6/0x950 [ 148.641161][ T6217] restrict_one_thread_callback+0x17a/0xb70 [ 148.641209][ T6217] ? _raw_spin_unlock_irq+0x23/0x50 [ 148.641245][ T6217] task_work_run+0x150/0x240 [ 148.641278][ T6217] ? __pfx_task_work_run+0x10/0x10 [ 148.641310][ T6217] ? srso_alias_return_thunk+0x5/0xfbef5 [ 148.641351][ T6217] get_signal+0x1bd/0x21d0 [ 148.641390][ T6217] ? __pfx_io_submit_one+0x10/0x10 [ 148.641430][ T6217] ? __pfx_get_signal+0x10/0x10 [ 148.641460][ T6217] ? lock_acquire+0x1d1/0x380 [ 148.641496][ T6217] ? percpu_ref_put_many.constprop.0+0x23/0x2a0 [ 148.641532][ T6217] ? srso_alias_return_thunk+0x5/0xfbef5 [ 148.641566][ T6217] ? find_held_lock+0x2b/0x80 [ 148.641599][ T6217] arch_do_signal_or_restart+0x91/0x7e0 [ 148.641648][ T6217] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 148.641710][ T6217] ? srso_alias_return_thunk+0x5/0xfbef5 [ 148.641754][ T6217] exit_to_user_mode_loop+0x139/0x700 [ 148.641802][ T6217] ? srso_alias_return_thunk+0x5/0xfbef5 [ 148.641836][ T6217] ? rcu_is_watching+0x13/0xc0 [ 148.641868][ T6217] do_syscall_64+0x661/0x790 [ 148.641909][ T6217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.641939][ T6217] RIP: 0033:0x7f9b2af9f559 [ 148.641962][ T6217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.641989][ T6217] RSP: 002b:00007f9b2bf1e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 148.642016][ T6217] RAX: 0000000000000001 RBX: 00007f9b2b225fa0 RCX: 00007f9b2af9f559 [ 148.642034][ T6217] RDX: 0000200000000600 RSI: 0000000000000001 RDI: 00007f9b2befd000 [ 148.642053][ T6217] RBP: 00007f9b2b036b20 R08: 0000000000000000 R09: 0000000000000000 [ 148.642070][ T6217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 148.642087][ T6217] R13: 00007f9b2b226038 R14: 00007f9b2b225fa0 R15: 00007ffe72548948 [ 148.642126][ T6217] [ 149.204547][ T6222] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 149.664269][ T5649] Bluetooth: hci6: command tx timeout [ 151.099542][ T30] audit: type=1800 audit(1793365449.165:3): pid=6226 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.68" name=08 dev="sda1" ino=2051 res=0 errno=-22 [ 157.714325][ T6151] bridge0: port 1(bridge_slave_0) entered blocking state [ 157.714842][ T6151] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.715010][ T6151] bridge_slave_0: entered allmulticast mode [ 157.761645][ T6151] bridge_slave_0: entered promiscuous mode [ 157.791863][ T6151] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.799649][ T6151] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.799819][ T6151] bridge_slave_1: entered allmulticast mode [ 157.833568][ T6151] bridge_slave_1: entered promiscuous mode [ 158.201560][ T6151] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 158.247381][ T6151] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 158.683161][ T6151] team0: Port device team_slave_0 added [ 158.732520][ T6151] team0: Port device team_slave_1 added [ 158.784345][ T6275] comedi comedi1: Minor 48 is invalid! [ 159.395932][ T6151] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 159.395952][ T6151] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 159.395985][ T6151] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 161.058697][ T6151] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 161.058769][ T6151] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 161.058880][ T6151] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 162.421659][ T6151] hsr_slave_0: entered promiscuous mode [ 162.444992][ T6151] hsr_slave_1: entered promiscuous mode [ 162.448774][ T6151] debugfs: 'hsr0' already exists in 'hsr' [ 162.448807][ T6151] Cannot create hsr debugfs directory [ 167.230223][ T5652] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 167.250470][ T5652] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 167.251076][ T5652] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 167.268158][ T5652] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 167.276408][ T5652] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 167.742502][ T6151] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 167.787315][ T6151] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 167.788154][ T6151] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 167.827838][ T6151] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 167.854786][ T6151] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 167.937553][ T6151] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 167.958416][ T6151] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 168.016208][ T6151] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 168.765072][ T1153] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.488680][ T5652] Bluetooth: hci4: command tx timeout [ 171.361510][ T1153] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.977509][ T1153] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.518142][ T1153] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.554662][ T5652] Bluetooth: hci4: command tx timeout [ 172.818107][ T6151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.840477][ T6297] rxe_eth0 speed is unknown, defaulting to 1000 [ 172.922314][ T6151] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.982568][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.982680][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.051707][ T1111] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.051798][ T1111] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.716374][ T1153] bridge_slave_1: left allmulticast mode [ 173.716424][ T1153] bridge_slave_1: left promiscuous mode [ 173.717210][ T1153] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.818899][ T1153] bridge_slave_0: left allmulticast mode [ 173.841509][ T1153] bridge_slave_0: left promiscuous mode [ 173.841701][ T1153] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.217452][ T5652] Bluetooth: hci4: command tx timeout [ 178.224437][ T5652] Bluetooth: hci4: command tx timeout [ 178.976526][ T1153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 179.029864][ T1153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 179.054851][ T1153] bond0 (unregistering): Released all slaves [ 179.324881][ T6151] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 179.324918][ T6151] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 180.459990][ T5865] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 180.627207][ T5865] usb 2-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 180.676693][ T5865] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 180.676757][ T5865] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 180.676807][ T5865] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 180.676880][ T5865] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.244281][ T5865] usb 2-1: config 0 descriptor?? [ 181.497996][ T5865] usbhid 2-1:0.0: can't add hid device: -71 [ 181.498101][ T5865] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 181.532310][ T5865] usb 2-1: USB disconnect, device number 3 [ 186.034752][ T6297] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.044236][ T6297] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.044424][ T6297] bridge_slave_0: entered allmulticast mode [ 186.183862][ T6297] bridge_slave_0: entered promiscuous mode [ 186.218280][ T6297] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.218384][ T6297] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.218509][ T6297] bridge_slave_1: entered allmulticast mode [ 186.318846][ T6297] bridge_slave_1: entered promiscuous mode [ 187.052075][ T6297] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 187.111440][ T6297] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 187.362359][ T5649] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 187.371645][ T5649] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 187.382498][ T5649] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 187.384928][ T5649] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 187.385656][ T5649] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 188.349391][ T1153] hsr_slave_0: left promiscuous mode [ 188.372572][ T1153] hsr_slave_1: left promiscuous mode [ 188.381348][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 188.381391][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 188.405120][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 188.405146][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 188.490778][ T1153] veth1_macvtap: left promiscuous mode [ 188.490825][ T1153] veth0_macvtap: left promiscuous mode [ 188.490923][ T1153] veth1_vlan: left promiscuous mode [ 188.491001][ T1153] veth0_vlan: left promiscuous mode [ 189.033893][ T5641] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 189.216326][ T5641] usb 4-1: not running at top speed; connect to a high speed hub [ 189.216377][ T5641] usb 4-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 189.219777][ T5641] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 189.272389][ T5641] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.272428][ T5641] usb 4-1: Product: syz [ 189.272453][ T5641] usb 4-1: Manufacturer: syz [ 189.272479][ T5641] usb 4-1: SerialNumber: syz [ 189.381851][ T5641] keyspan 4-1:1.0: Keyspan 4 port adapter converter detected [ 189.434930][ T5652] Bluetooth: hci2: command tx timeout [ 189.455817][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 189.531886][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 189.608790][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 189.705014][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 190.274249][ T24] usb 4-1: USB disconnect, device number 3 [ 190.360732][ T24] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 190.382316][ T24] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 190.440126][ T24] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 190.472800][ T24] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 190.492225][ T24] keyspan 4-1:1.0: device disconnected [ 191.141744][ T1153] team0 (unregistering): Port device team_slave_1 removed [ 191.443294][ T1153] team0 (unregistering): Port device team_slave_0 removed [ 191.463110][ T6446] input: syz1 as /devices/virtual/input/input5 [ 191.504384][ T5652] Bluetooth: hci2: command tx timeout [ 192.807992][ T6454] usb usb1: usbfs: process 6454 (syz.3.106) did not claim interface 0 before use [ 193.056625][ T6297] team0: Port device team_slave_0 added [ 193.087170][ T6151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.133927][ T5296] 8021q: adding VLAN 0 to HW filter on device eth1 [ 193.584179][ T5652] Bluetooth: hci2: command tx timeout [ 193.627530][ T6297] team0: Port device team_slave_1 added [ 193.756263][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.756382][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.675364][ T6297] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 194.675384][ T6297] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 194.675417][ T6297] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 194.721101][ T6297] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 194.721124][ T6297] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 194.721168][ T6297] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 194.959864][ T6485] netlink: 'syz.4.110': attribute type 1 has an invalid length. [ 195.423904][ T6297] hsr_slave_0: entered promiscuous mode [ 195.424966][ T6297] hsr_slave_1: entered promiscuous mode [ 195.438028][ T6297] debugfs: 'hsr0' already exists in 'hsr' [ 195.438055][ T6297] Cannot create hsr debugfs directory [ 195.664544][ T5652] Bluetooth: hci2: command tx timeout [ 197.187295][ T1153] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.310780][ T6507] overlayfs: missing 'lowerdir' [ 197.500784][ T6419] rxe_eth0 speed is unknown, defaulting to 1000 [ 197.892336][ T1153] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.698098][ T1153] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.860072][ T5649] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 200.872250][ T5649] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 200.873113][ T5649] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 200.895971][ T5649] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 200.899285][ T5649] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 201.215699][ T1153] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.036290][ T6297] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 202.105460][ T6297] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 202.133805][ T5762] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 202.178398][ T6297] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 202.218937][ T6297] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 202.219791][ T6297] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 202.260469][ T6297] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 202.285014][ T5762] usb 5-1: Using ep0 maxpacket: 8 [ 202.285843][ T5762] usb 5-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 202.289616][ T5762] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.289654][ T5762] usb 5-1: Product: syz [ 202.289678][ T5762] usb 5-1: Manufacturer: syz [ 202.289702][ T5762] usb 5-1: SerialNumber: syz [ 202.323211][ T5762] usb 5-1: config 0 descriptor?? [ 202.360297][ T6297] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 202.419503][ T6297] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 202.559992][ T5762] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 202.602594][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 203.023812][ T5652] Bluetooth: hci1: command tx timeout [ 203.444186][ T1153] bridge_slave_1: left allmulticast mode [ 203.444222][ T1153] bridge_slave_1: left promiscuous mode [ 203.444518][ T1153] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.482213][ T1153] bridge_slave_0: left allmulticast mode [ 203.482262][ T1153] bridge_slave_0: left promiscuous mode [ 203.482470][ T1153] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.087051][ T5762] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 204.089271][ T5762] usb 5-1: USB disconnect, device number 4 [ 204.819039][ T1153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 204.852211][ T1153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 204.889268][ T1153] bond0 (unregistering): Released all slaves [ 205.103873][ T5652] Bluetooth: hci1: command tx timeout [ 205.623119][ T6570] netlink: 'syz.4.123': attribute type 1 has an invalid length. [ 206.046770][ T6528] rxe_eth0 speed is unknown, defaulting to 1000 [ 206.263246][ T6297] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.489854][ T6419] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.490922][ T6419] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.491081][ T6419] bridge_slave_0: entered allmulticast mode [ 206.492696][ T6586] overlayfs: missing 'lowerdir' [ 206.496890][ T6419] bridge_slave_0: entered promiscuous mode [ 206.519341][ T6297] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.525054][ T6419] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.525403][ T6419] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.525614][ T6419] bridge_slave_1: entered allmulticast mode [ 206.537479][ T6419] bridge_slave_1: entered promiscuous mode [ 206.618016][ T6591] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 206.618016][ T6591] The task syz.1.124 (6591) triggered the difference, watch for misbehavior. [ 206.666554][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.666756][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.782973][ T6419] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 206.820760][ T6419] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 206.850721][ T5924] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.850814][ T5924] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.095074][ T6419] team0: Port device team_slave_0 added [ 207.105214][ T6419] team0: Port device team_slave_1 added [ 207.183906][ T5652] Bluetooth: hci1: command tx timeout [ 208.624070][ T6419] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 208.624095][ T6419] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 208.624140][ T6419] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 208.667823][ T6419] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 208.667846][ T6419] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 208.667894][ T6419] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 209.268620][ T5649] Bluetooth: hci1: command tx timeout [ 209.316724][ T5296] 8021q: adding VLAN 0 to HW filter on device eth4 [ 211.304665][ T5649] Bluetooth: hci3: command 0x0406 tx timeout [ 211.304684][ T5645] Bluetooth: hci5: command 0x0406 tx timeout [ 213.546360][ T6419] hsr_slave_0: entered promiscuous mode [ 213.551861][ T6419] hsr_slave_1: entered promiscuous mode [ 213.570858][ T6419] debugfs: 'hsr0' already exists in 'hsr' [ 213.570892][ T6419] Cannot create hsr debugfs directory [ 213.603016][ T6626] netlink: 'syz.1.134': attribute type 1 has an invalid length. [ 213.683674][ T1153] hsr_slave_0: left promiscuous mode [ 213.691097][ T1153] hsr_slave_1: left promiscuous mode [ 213.705201][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 213.705229][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 213.730742][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 213.730769][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 213.767807][ T1153] veth1_macvtap: left promiscuous mode [ 213.767852][ T1153] veth0_macvtap: left promiscuous mode [ 213.767973][ T1153] veth1_vlan: left promiscuous mode [ 213.768056][ T1153] veth0_vlan: left promiscuous mode [ 213.963245][ T6629] overlay: ./file0 is not a directory [ 217.713746][ T1153] team0 (unregistering): Port device team_slave_1 removed [ 217.766353][ T1153] team0 (unregistering): Port device team_slave_0 removed [ 217.790292][ T6643] usb usb1: usbfs: process 6643 (syz.3.142) did not claim interface 0 before use [ 219.429420][ T30] audit: type=1800 audit(1793365518.529:4): pid=6655 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.145" name=08 dev="sda1" ino=2051 res=0 errno=-22 [ 222.764508][ T5641] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 223.837927][ T5641] usb 4-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 223.842669][ T5641] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 223.842716][ T5641] usb 4-1: can't read configurations, error -71 [ 223.872618][ T6419] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 223.898692][ T6419] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 223.900497][ T6528] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.902425][ T6528] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.902579][ T6528] bridge_slave_0: entered allmulticast mode [ 223.909921][ T6528] bridge_slave_0: entered promiscuous mode [ 224.164710][ T6419] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 224.214423][ T6419] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 224.232192][ T6528] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.232311][ T6528] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.232481][ T6528] bridge_slave_1: entered allmulticast mode [ 224.279322][ T6528] bridge_slave_1: entered promiscuous mode [ 224.415428][ T6419] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 224.450359][ T6419] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 224.476179][ T6419] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 224.508618][ T6419] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 224.558582][ T6528] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 224.602856][ T6528] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.786159][ T5296] 8021q: adding VLAN 0 to HW filter on device eth2 [ 224.842541][ T6528] team0: Port device team_slave_0 added [ 224.858819][ T6528] team0: Port device team_slave_1 added [ 225.177912][ T6736] netlink: 'syz.4.157': attribute type 1 has an invalid length. [ 225.297339][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 225.297363][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.297408][ T6528] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 226.152232][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 226.152258][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 226.152303][ T6528] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 227.326098][ T1153] bridge_slave_1: left allmulticast mode [ 227.326134][ T1153] bridge_slave_1: left promiscuous mode [ 227.326370][ T1153] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.359218][ T1153] bridge_slave_0: left allmulticast mode [ 227.359250][ T1153] bridge_slave_0: left promiscuous mode [ 227.359468][ T1153] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.484828][ T4951] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 227.494364][ T4951] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 227.495015][ T4951] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 227.496349][ T4951] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 227.497039][ T4951] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 228.861524][ T5641] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 228.994639][ T1153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 229.001262][ T1153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 229.007853][ T1153] bond0 (unregistering): Released all slaves [ 229.182297][ T6528] hsr_slave_0: entered promiscuous mode [ 229.206134][ T6528] hsr_slave_1: entered promiscuous mode [ 229.218332][ T6528] debugfs: 'hsr0' already exists in 'hsr' [ 229.218360][ T6528] Cannot create hsr debugfs directory [ 229.505029][ T4951] Bluetooth: hci6: command tx timeout [ 229.521142][ T5641] usb 5-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 229.523670][ T5641] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 229.523750][ T5641] usb 5-1: can't read configurations, error -71 [ 230.190251][ T1153] hsr_slave_0: left promiscuous mode [ 230.202098][ T1153] hsr_slave_1: left promiscuous mode [ 230.203080][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 230.225527][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 230.499234][ T6799] comedi comedi4: bad chanlist[0]=0x03333333 chan=13107 range length=2 [ 231.646086][ T4951] Bluetooth: hci6: command tx timeout [ 233.664535][ T4951] Bluetooth: hci6: command tx timeout [ 233.903403][ T1153] team0 (unregistering): Port device team_slave_1 removed [ 233.937814][ T1153] team0 (unregistering): Port device team_slave_0 removed [ 234.584624][ T3218] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 234.742492][ T3218] usb 5-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 234.745449][ T3218] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.745497][ T3218] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 234.745535][ T3218] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 234.745595][ T3218] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.760212][ T3218] usb 5-1: config 0 descriptor?? [ 234.823187][ T6419] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.916343][ T6749] rxe_eth0 speed is unknown, defaulting to 1000 [ 235.007336][ T3218] usbhid 5-1:0.0: can't add hid device: -71 [ 235.007460][ T3218] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 235.008782][ T6419] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.055285][ T3218] usb 5-1: USB disconnect, device number 7 [ 235.083082][ T1223] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.083215][ T1223] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.102827][ T1223] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.102953][ T1223] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.193839][ T5641] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 235.349879][ T5641] usb 4-1: not running at top speed; connect to a high speed hub [ 235.349913][ T5641] usb 4-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 235.387268][ T5641] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.387308][ T5641] usb 4-1: Product: syz [ 235.387334][ T5641] usb 4-1: Manufacturer: syz [ 235.387360][ T5641] usb 4-1: SerialNumber: syz [ 235.435776][ T5641] keyspan 4-1:1.0: Keyspan 4 port adapter converter detected [ 235.461743][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 235.481749][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 235.507785][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 235.529970][ T5641] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 235.703401][ C0] usb 4-1: malformed indat packet [ 235.703716][ C0] usb 4-1: malformed indat packet [ 235.709063][ C0] usb 4-1: malformed indat packet [ 235.714404][ C0] usb 4-1: malformed indat packet [ 235.719662][ C0] usb 4-1: malformed indat packet [ 235.724998][ C0] usb 4-1: malformed indat packet [ 235.725295][ C0] usb 4-1: malformed indat packet [ 235.743870][ T4951] Bluetooth: hci6: command tx timeout [ 236.036870][ T5641] usb 4-1: USB disconnect, device number 6 [ 236.073291][ T6843] syz.4.181 uses obsolete (PF_INET,SOCK_PACKET) [ 236.202343][ T5641] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 236.232894][ T5641] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 236.257852][ T5641] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 236.289963][ T5641] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 236.304668][ T5641] keyspan 4-1:1.0: device disconnected [ 237.605674][ T6528] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 237.634220][ T6528] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 237.730195][ T6873] tipc: Enabling of bearer rejected, failed to enable media [ 237.732093][ T6877] netlink: 12 bytes leftover after parsing attributes in process `syz.1.184'. [ 237.732598][ T6528] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 237.791247][ T6528] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 237.799522][ T6528] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 237.828201][ T6528] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 237.840820][ T6528] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 237.861933][ T6528] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 238.601242][ T5296] 8021q: adding VLAN 0 to HW filter on device eth6 [ 238.624334][ T1153] bridge_slave_1: left allmulticast mode [ 238.624369][ T1153] bridge_slave_1: left promiscuous mode [ 238.624580][ T1153] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.633472][ T1153] bridge_slave_0: left allmulticast mode [ 238.633502][ T1153] bridge_slave_0: left promiscuous mode [ 238.634276][ T1153] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.426447][ T6905] FAULT_INJECTION: forcing a failure. [ 240.426447][ T6905] name failslab, interval 1, probability 0, space 0, times 0 [ 240.426482][ T6905] CPU: 1 UID: 0 PID: 6905 Comm: syz.3.189 Not tainted syzkaller #0 PREEMPT(full) [ 240.426514][ T6905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 240.426531][ T6905] Call Trace: [ 240.426540][ T6905] [ 240.426551][ T6905] dump_stack_lvl+0x100/0x190 [ 240.426604][ T6905] should_fail_ex.cold+0x5/0xa [ 240.426646][ T6905] should_failslab+0xc2/0x120 [ 240.426688][ T6905] __kmalloc_noprof+0xfc/0x840 [ 240.426722][ T6905] ? srso_alias_return_thunk+0x5/0xfbef5 [ 240.426757][ T6905] ? get_current_details+0x171/0x670 [ 240.426812][ T6905] get_current_details+0x171/0x670 [ 240.426863][ T6905] ? srso_alias_return_thunk+0x5/0xfbef5 [ 240.426904][ T6905] landlock_merge_ruleset+0x838/0xdd0 [ 240.426945][ T6905] __do_sys_landlock_restrict_self+0x264/0x10a0 [ 240.426994][ T6905] do_syscall_64+0x123/0x790 [ 240.427035][ T6905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.427064][ T6905] RIP: 0033:0x7f9b2af9f559 [ 240.427086][ T6905] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.427113][ T6905] RSP: 002b:00007f9b2bf1e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001be [ 240.427140][ T6905] RAX: ffffffffffffffda RBX: 00007f9b2b225fa0 RCX: 00007f9b2af9f559 [ 240.427159][ T6905] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 240.427176][ T6905] RBP: 00007f9b2b036b20 R08: 0000000000000000 R09: 0000000000000000 [ 240.427193][ T6905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.427210][ T6905] R13: 00007f9b2b226038 R14: 00007f9b2b225fa0 R15: 00007ffe72548948 [ 240.427249][ T6905] [ 240.491286][ T6906] netlink: 'syz.4.190': attribute type 1 has an invalid length. [ 240.897682][ T1153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 240.917615][ T1153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 240.923408][ T1153] bond0 (unregistering): Released all slaves [ 241.744241][ T24] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 241.910369][ T24] usb 4-1: not running at top speed; connect to a high speed hub [ 241.910404][ T24] usb 4-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 241.940090][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.940128][ T24] usb 4-1: Product: syz [ 241.940154][ T24] usb 4-1: Manufacturer: syz [ 241.940181][ T24] usb 4-1: SerialNumber: syz [ 242.078535][ T24] keyspan 4-1:1.0: Keyspan 4 port adapter converter detected [ 242.150883][ T24] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 242.226600][ T24] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 242.271406][ T6528] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.305332][ T24] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 242.345212][ T24] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 242.345397][ C1] usb 4-1: malformed indat packet [ 242.345725][ C1] usb 4-1: malformed indat packet [ 242.346360][ C1] usb 4-1: malformed indat packet [ 242.346669][ C1] usb 4-1: malformed indat packet [ 242.346953][ C1] usb 4-1: malformed indat packet [ 242.347223][ C1] usb 4-1: malformed indat packet [ 242.347510][ C1] usb 4-1: malformed indat packet [ 242.427369][ T6528] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.474187][ T6419] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 242.539731][ T1223] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.539856][ T1223] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.593157][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.593280][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.730002][ T5769] usb 4-1: USB disconnect, device number 7 [ 242.888344][ T6914] udevd[6914]: setting owner of /dev/ttyUSB0 to uid=0, gid=18 failed: No such file or directory [ 242.900316][ T5769] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 243.038202][ T5769] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 243.151950][ T5769] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 243.225970][ T5769] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 243.232472][ T5769] keyspan 4-1:1.0: device disconnected [ 243.793257][ T1153] hsr_slave_0: left promiscuous mode [ 243.808643][ T1153] hsr_slave_1: left promiscuous mode [ 243.811282][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 243.850028][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 244.283901][ T5769] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 244.455880][ T5769] usb 2-1: Using ep0 maxpacket: 8 [ 244.456608][ T5769] usb 2-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 244.484362][ T5769] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.484402][ T5769] usb 2-1: Product: syz [ 244.484427][ T5769] usb 2-1: Manufacturer: syz [ 244.484460][ T5769] usb 2-1: SerialNumber: syz [ 244.535775][ T5769] usb 2-1: config 0 descriptor?? [ 244.807581][ T5769] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 245.673304][ T1153] team0 (unregistering): Port device team_slave_1 removed [ 245.890234][ T1153] team0 (unregistering): Port device team_slave_0 removed [ 246.558904][ T5769] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 246.664779][ T5769] usb 2-1: USB disconnect, device number 4 [ 247.646977][ T5652] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 247.653345][ T5652] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 247.669425][ T5652] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 247.672969][ T5652] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 247.674001][ T5652] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 247.726879][ T5296] 8021q: adding VLAN 0 to HW filter on device eth7 [ 247.977601][ T6986] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 248.317902][ T6749] bridge0: port 1(bridge_slave_0) entered blocking state [ 248.318352][ T6749] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.319176][ T6749] bridge_slave_0: entered allmulticast mode [ 248.458710][ T6749] bridge_slave_0: entered promiscuous mode [ 248.770954][ T6749] bridge0: port 2(bridge_slave_1) entered blocking state [ 248.771522][ T6749] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.803071][ T6749] bridge_slave_1: entered allmulticast mode [ 248.826980][ T6749] bridge_slave_1: entered promiscuous mode [ 249.183549][ T6749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 249.232228][ T6749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 249.668604][ T6749] team0: Port device team_slave_0 added [ 249.835199][ T5652] Bluetooth: hci4: command tx timeout [ 250.449239][ T6995] netlink: 'syz.4.203': attribute type 1 has an invalid length. [ 250.471316][ T6749] team0: Port device team_slave_1 added [ 251.904125][ T5652] Bluetooth: hci4: command tx timeout [ 252.144223][ T6749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 252.144248][ T6749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 252.144292][ T6749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 252.206806][ T6749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 252.206829][ T6749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 252.206874][ T6749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 253.311332][ T6749] hsr_slave_0: entered promiscuous mode [ 253.344351][ T6749] hsr_slave_1: entered promiscuous mode [ 253.344972][ T6749] debugfs: 'hsr0' already exists in 'hsr' [ 253.344993][ T6749] Cannot create hsr debugfs directory [ 255.547187][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.547262][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.548105][ T5652] Bluetooth: hci4: command tx timeout [ 257.477260][ T6978] rxe_eth0 speed is unknown, defaulting to 1000 [ 257.584059][ T5652] Bluetooth: hci4: command tx timeout [ 258.488187][ T5296] 8021q: adding VLAN 0 to HW filter on device eth8 [ 258.619725][ T1460] bridge_slave_1: left allmulticast mode [ 258.619762][ T1460] bridge_slave_1: left promiscuous mode [ 258.620052][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.708411][ T1460] bridge_slave_0: left allmulticast mode [ 258.708449][ T1460] bridge_slave_0: left promiscuous mode [ 258.740280][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.117517][ T4951] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 260.121936][ T4951] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 260.132435][ T4951] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 260.133887][ T4951] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 260.149362][ T4951] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 261.124238][ T7071] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.111556][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 262.263864][ T5652] Bluetooth: hci2: command tx timeout [ 262.440458][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 262.484770][ T1460] bond0 (unregistering): Released all slaves [ 263.084913][ T5641] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 263.326929][ T5641] usb 4-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 263.372973][ T5641] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 263.373176][ T5641] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 263.373232][ T5641] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 263.373429][ T5641] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.898065][ T5641] usb 4-1: config 0 descriptor?? [ 264.303832][ T5652] Bluetooth: hci2: command tx timeout [ 264.313906][ T5641] usbhid 4-1:0.0: can't add hid device: -71 [ 264.314050][ T5641] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 264.480763][ T5641] usb 4-1: USB disconnect, device number 8 [ 265.132997][ T7099] netlink: 'syz.1.217': attribute type 1 has an invalid length. [ 265.245969][ T1460] hsr_slave_0: left promiscuous mode [ 265.259026][ T1460] hsr_slave_1: left promiscuous mode [ 265.263437][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 265.277595][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 266.384990][ T5652] Bluetooth: hci2: command tx timeout [ 266.403376][ T7111] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 267.405836][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 267.472239][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 268.377822][ T5296] 8021q: adding VLAN 0 to HW filter on device eth9 [ 268.661987][ T5652] Bluetooth: hci2: command tx timeout [ 269.759099][ T7142] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 270.163669][ T7149] input: syz1 as /devices/virtual/input/input6 [ 270.992501][ T7067] rxe_eth0 speed is unknown, defaulting to 1000 [ 271.128087][ T6749] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 271.309228][ T6749] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 271.352922][ T6749] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 271.418288][ T6749] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 271.435076][ T6749] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 271.482560][ T6749] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 271.513097][ T6749] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 272.298820][ T6749] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 272.800873][ T6978] bridge0: port 1(bridge_slave_0) entered blocking state [ 272.801054][ T6978] bridge0: port 1(bridge_slave_0) entered disabled state [ 272.801220][ T6978] bridge_slave_0: entered allmulticast mode [ 272.840536][ T6978] bridge_slave_0: entered promiscuous mode [ 273.093934][ T985] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 273.245835][ T985] usb 2-1: not running at top speed; connect to a high speed hub [ 273.245880][ T985] usb 2-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=1.00 [ 273.279256][ T985] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.279296][ T985] usb 2-1: Product: syz [ 273.279322][ T985] usb 2-1: Manufacturer: syz [ 273.279347][ T985] usb 2-1: SerialNumber: syz [ 273.284622][ T6978] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.284741][ T6978] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.284934][ T6978] bridge_slave_1: entered allmulticast mode [ 273.313537][ T6978] bridge_slave_1: entered promiscuous mode [ 273.340168][ T985] keyspan 2-1:1.0: Keyspan 4 port adapter converter detected [ 273.358752][ T985] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 273.390272][ T985] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 273.419884][ T985] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 273.436617][ T985] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 273.856955][ C0] usb 2-1: malformed indat packet [ 273.857256][ C0] usb 2-1: malformed indat packet [ 273.857533][ C0] usb 2-1: malformed indat packet [ 273.857801][ C0] usb 2-1: malformed indat packet [ 273.858072][ C0] usb 2-1: malformed indat packet [ 273.858338][ C0] usb 2-1: malformed indat packet [ 273.858605][ C0] usb 2-1: malformed indat packet [ 273.858891][ C0] usb 2-1: malformed indat packet [ 274.682646][ T6978] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 274.716533][ T6978] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 274.729747][ T1710] usb 2-1: USB disconnect, device number 5 [ 274.912879][ T1710] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 274.975768][ T1710] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 275.009518][ T1710] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 275.060296][ T1710] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 275.080783][ T1710] keyspan 2-1:1.0: device disconnected [ 275.389455][ T7195] FAULT_INJECTION: forcing a failure. [ 275.389455][ T7195] name fail_futex, interval 1, probability 0, space 0, times 1 [ 275.389506][ T7195] CPU: 0 UID: 0 PID: 7195 Comm: syz.4.232 Not tainted syzkaller #0 PREEMPT(full) [ 275.389542][ T7195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 275.389559][ T7195] Call Trace: [ 275.389571][ T7195] [ 275.389584][ T7195] dump_stack_lvl+0x100/0x190 [ 275.389646][ T7195] should_fail_ex.cold+0x5/0xa [ 275.389691][ T7195] get_futex_key+0x1c9/0x13e0 [ 275.389747][ T7195] ? __pfx_get_futex_key+0x10/0x10 [ 275.389802][ T7195] ? try_to_wake_up+0x158/0x1ca0 [ 275.389864][ T7195] futex_wait_setup+0x91/0x540 [ 275.389922][ T7195] __futex_wait+0x19f/0x360 [ 275.389977][ T7195] ? __pfx___futex_wait+0x10/0x10 [ 275.390020][ T7195] ? futex_hash+0x311/0x400 [ 275.390089][ T7195] ? __pfx_futex_wake_mark+0x10/0x10 [ 275.390139][ T7195] ? __pfx_futex_hash+0x10/0x10 [ 275.390201][ T7195] ? __pfx_get_futex_key+0x10/0x10 [ 275.390266][ T7195] ? srso_alias_return_thunk+0x5/0xfbef5 [ 275.390316][ T7195] ? srso_alias_return_thunk+0x5/0xfbef5 [ 275.390367][ T7195] futex_wait+0xe6/0x370 [ 275.390414][ T7195] ? __pfx_futex_wait+0x10/0x10 [ 275.390458][ T7195] ? get_signal+0x16b/0x21d0 [ 275.390511][ T7195] do_futex+0x265/0x440 [ 275.390546][ T7195] ? __pfx_do_futex+0x10/0x10 [ 275.390576][ T7195] ? arch_do_signal_or_restart+0x1f9/0x7e0 [ 275.390627][ T7195] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 275.390680][ T7195] __x64_sys_futex+0x34f/0x4d0 [ 275.390717][ T7195] ? __pfx___x64_sys_futex+0x10/0x10 [ 275.390756][ T7195] ? srso_alias_return_thunk+0x5/0xfbef5 [ 275.390799][ T7195] do_syscall_64+0x123/0x790 [ 275.390842][ T7195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.390872][ T7195] RIP: 0033:0x7fe15bb9f559 [ 275.390896][ T7195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.390924][ T7195] RSP: 002b:00007fe15cb460e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 275.390954][ T7195] RAX: ffffffffffffffda RBX: 00007fe15be25fa8 RCX: 00007fe15bb9f559 [ 275.390973][ T7195] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe15be25fa8 [ 275.390992][ T7195] RBP: 00007fe15be25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 275.391010][ T7195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 275.391027][ T7195] R13: 00007fe15be26038 R14: 00007ffdb5103570 R15: 00007ffdb5103658 [ 275.391071][ T7195] [ 275.738594][ T7199] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 275.745321][ T6978] team0: Port device team_slave_0 added [ 275.841075][ T6978] team0: Port device team_slave_1 added [ 275.888870][ T7203] netlink: 'syz.1.233': attribute type 1 has an invalid length. [ 276.197516][ T6978] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 276.197541][ T6978] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 276.199234][ T6978] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 276.250091][ T6978] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 276.250111][ T6978] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 276.250145][ T6978] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 277.316832][ T7208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 277.972526][ T6978] hsr_slave_0: entered promiscuous mode [ 277.987277][ T6978] hsr_slave_1: entered promiscuous mode [ 278.005904][ T6978] debugfs: 'hsr0' already exists in 'hsr' [ 278.005936][ T6978] Cannot create hsr debugfs directory [ 282.021382][ T1460] bridge_slave_1: left allmulticast mode [ 282.021424][ T1460] bridge_slave_1: left promiscuous mode [ 282.021673][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.077720][ T1460] bridge_slave_0: left allmulticast mode [ 282.077751][ T1460] bridge_slave_0: left promiscuous mode [ 282.077957][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.460784][ T7246] FAULT_INJECTION: forcing a failure. [ 282.460784][ T7246] name fail_futex, interval 1, probability 0, space 0, times 0 [ 282.460821][ T7246] CPU: 1 UID: 0 PID: 7246 Comm: syz.4.244 Not tainted syzkaller #0 PREEMPT(full) [ 282.460854][ T7246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 282.460871][ T7246] Call Trace: [ 282.460880][ T7246] [ 282.460891][ T7246] dump_stack_lvl+0x100/0x190 [ 282.460941][ T7246] should_fail_ex.cold+0x5/0xa [ 282.460983][ T7246] get_futex_key+0x1c9/0x13e0 [ 282.461037][ T7246] ? __pfx_get_futex_key+0x10/0x10 [ 282.461085][ T7246] ? lock_acquire+0x1d1/0x380 [ 282.461123][ T7246] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.461157][ T7246] ? do_raw_spin_lock+0x128/0x260 [ 282.461207][ T7246] futex_wait_setup+0x91/0x540 [ 282.461255][ T7246] __futex_wait+0x19f/0x360 [ 282.461296][ T7246] ? __pfx___futex_wait+0x10/0x10 [ 282.461332][ T7246] ? futex_hash+0x311/0x400 [ 282.461381][ T7246] ? __pfx_futex_wake_mark+0x10/0x10 [ 282.461424][ T7246] ? __pfx_futex_hash+0x10/0x10 [ 282.461467][ T7246] ? __pfx_get_futex_key+0x10/0x10 [ 282.461519][ T7246] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.461555][ T7246] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.461595][ T7246] futex_wait+0xe6/0x370 [ 282.461632][ T7246] ? __pfx_futex_wait+0x10/0x10 [ 282.461667][ T7246] ? get_signal+0x16b/0x21d0 [ 282.461718][ T7246] do_futex+0x265/0x440 [ 282.461750][ T7246] ? __pfx_do_futex+0x10/0x10 [ 282.461780][ T7246] ? arch_do_signal_or_restart+0x1f9/0x7e0 [ 282.461829][ T7246] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 282.461881][ T7246] __x64_sys_futex+0x34f/0x4d0 [ 282.461916][ T7246] ? __pfx___x64_sys_futex+0x10/0x10 [ 282.461954][ T7246] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.461995][ T7246] do_syscall_64+0x123/0x790 [ 282.462037][ T7246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.462066][ T7246] RIP: 0033:0x7fe15bb9f559 [ 282.462089][ T7246] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 282.462116][ T7246] RSP: 002b:00007fe15cb460e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 282.462143][ T7246] RAX: ffffffffffffffda RBX: 00007fe15be25fa8 RCX: 00007fe15bb9f559 [ 282.462162][ T7246] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe15be25fa8 [ 282.462179][ T7246] RBP: 00007fe15be25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 282.462197][ T7246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 282.462214][ T7246] R13: 00007fe15be26038 R14: 00007ffdb5103570 R15: 00007ffdb5103658 [ 282.462252][ T7246] [ 283.000708][ T7250] netlink: 'syz.3.245': attribute type 1 has an invalid length. [ 283.184675][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 283.415307][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 283.514867][ T1460] bond0 (unregistering): Released all slaves [ 283.997188][ T7251] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 284.372656][ T7256] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 284.785058][ T6749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 291.109967][ T1460] hsr_slave_0: left promiscuous mode [ 291.153526][ T1460] hsr_slave_1: left promiscuous mode [ 291.160735][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 291.187432][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 291.331280][ T4951] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 291.342914][ T4951] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 291.354696][ T4951] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 291.361644][ T4951] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 291.362329][ T4951] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 292.508843][ T7297] input: syz1 as /devices/virtual/input/input7 [ 293.424824][ T4951] Bluetooth: hci1: command tx timeout [ 295.018739][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 295.239703][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 295.504608][ T4951] Bluetooth: hci1: command tx timeout [ 296.461069][ T7313] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 297.146730][ T7318] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 297.584453][ T4951] Bluetooth: hci1: command tx timeout [ 298.083040][ T5296] 8021q: adding VLAN 0 to HW filter on device eth11 [ 298.108554][ T7067] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.108692][ T7067] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.108881][ T7067] bridge_slave_0: entered allmulticast mode [ 298.147567][ T7067] bridge_slave_0: entered promiscuous mode [ 298.198051][ T7067] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.198233][ T7067] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.198421][ T7067] bridge_slave_1: entered allmulticast mode [ 298.229682][ T7067] bridge_slave_1: entered promiscuous mode [ 299.056573][ T7330] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 299.530818][ T7067] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 299.575564][ T7067] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 299.664542][ T4951] Bluetooth: hci1: command tx timeout [ 300.728024][ T7067] team0: Port device team_slave_0 added [ 300.864342][ T7067] team0: Port device team_slave_1 added [ 304.087804][ T7067] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 304.087829][ T7067] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 304.087874][ T7067] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 304.169037][ T7067] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 304.169070][ T7067] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 304.169115][ T7067] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 304.611587][ T7067] hsr_slave_0: entered promiscuous mode [ 304.623638][ T7067] hsr_slave_1: entered promiscuous mode [ 304.633570][ T7067] debugfs: 'hsr0' already exists in 'hsr' [ 304.633815][ T7067] Cannot create hsr debugfs directory [ 304.967052][ T7285] rxe_eth0 speed is unknown, defaulting to 1000 [ 307.822241][ T7369] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 308.881350][ T7376] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 309.150814][ T5652] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 309.167452][ T5652] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 309.168204][ T5652] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 309.185356][ T5652] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 309.186159][ T5652] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 311.201312][ T1460] bridge_slave_1: left allmulticast mode [ 311.201349][ T1460] bridge_slave_1: left promiscuous mode [ 311.201610][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.253136][ T1460] bridge_slave_0: left allmulticast mode [ 311.253173][ T1460] bridge_slave_0: left promiscuous mode [ 311.253435][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.275367][ T4951] Bluetooth: hci6: command tx timeout [ 311.664866][ T24] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 312.155956][ T24] usb 5-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 312.217379][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 312.217435][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 312.217475][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 312.217537][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 312.755820][ T24] usb 5-1: config 0 descriptor?? [ 313.344743][ T4951] Bluetooth: hci6: command tx timeout [ 313.628644][ T24] usbhid 5-1:0.0: can't add hid device: -71 [ 313.807912][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 313.859371][ T24] usb 5-1: USB disconnect, device number 8 [ 314.507179][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 314.539625][ T7426] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 314.562589][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 314.564587][ T1460] bond0 (unregistering): Released all slaves [ 315.424006][ T4951] Bluetooth: hci6: command tx timeout [ 317.240178][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.240256][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.949854][ T4951] Bluetooth: hci6: command tx timeout [ 318.360193][ T7447] input: syz1 as /devices/virtual/input/input8 [ 319.287125][ T5652] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 319.292876][ T5652] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 319.310491][ T5652] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 319.316382][ T5652] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 319.317146][ T5652] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 319.593658][ T1460] hsr_slave_0: left promiscuous mode [ 319.612441][ T1460] hsr_slave_1: left promiscuous mode [ 319.613517][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 319.633207][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 320.885948][ T7478] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.433873][ T5652] Bluetooth: hci4: command tx timeout [ 321.590936][ T7485] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 322.069062][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 322.727099][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 323.504287][ T5652] Bluetooth: hci4: command tx timeout [ 323.616438][ T7378] rxe_eth0 speed is unknown, defaulting to 1000 [ 324.250365][ T5296] 8021q: adding VLAN 0 to HW filter on device eth12 [ 324.761004][ T7285] bridge0: port 1(bridge_slave_0) entered blocking state [ 324.761222][ T7285] bridge0: port 1(bridge_slave_0) entered disabled state [ 324.761418][ T7285] bridge_slave_0: entered allmulticast mode [ 324.814072][ T7285] bridge_slave_0: entered promiscuous mode [ 324.855432][ T7285] bridge0: port 2(bridge_slave_1) entered blocking state [ 324.855569][ T7285] bridge0: port 2(bridge_slave_1) entered disabled state [ 324.855784][ T7285] bridge_slave_1: entered allmulticast mode [ 324.902999][ T7285] bridge_slave_1: entered promiscuous mode [ 325.347066][ T7523] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 325.583950][ T5652] Bluetooth: hci4: command tx timeout [ 327.029624][ T7285] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 327.117331][ T7285] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 327.664896][ T5652] Bluetooth: hci4: command tx timeout [ 327.776279][ T7285] team0: Port device team_slave_0 added [ 330.257958][ T7285] team0: Port device team_slave_1 added [ 331.056821][ T7285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 331.056848][ T7285] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 331.056902][ T7285] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 331.165641][ T7285] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 331.165662][ T7285] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 331.165696][ T7285] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 332.328207][ T7550] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 334.298148][ T7285] hsr_slave_0: entered promiscuous mode [ 334.331737][ T7285] hsr_slave_1: entered promiscuous mode [ 334.342752][ T7564] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 334.369971][ T7285] debugfs: 'hsr0' already exists in 'hsr' [ 334.370003][ T7285] Cannot create hsr debugfs directory [ 334.397672][ T7462] rxe_eth0 speed is unknown, defaulting to 1000 [ 336.551166][ T5296] 8021q: adding VLAN 0 to HW filter on device eth13 [ 337.060946][ T7581] input: syz1 as /devices/virtual/input/input9 [ 344.096429][ T1460] bridge_slave_1: left allmulticast mode [ 344.096459][ T1460] bridge_slave_1: left promiscuous mode [ 344.096660][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.150875][ T1460] bridge_slave_0: left allmulticast mode [ 344.150906][ T1460] bridge_slave_0: left promiscuous mode [ 344.151107][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.901196][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 346.320290][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 346.535327][ T1460] bond0 (unregistering): Released all slaves [ 348.419574][ T7378] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.419712][ T7378] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.419919][ T7378] bridge_slave_0: entered allmulticast mode [ 348.466370][ T7378] bridge_slave_0: entered promiscuous mode [ 348.496522][ T4951] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 348.512463][ T4951] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 348.515134][ T4951] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 348.531079][ T4951] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 348.533316][ T4951] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 348.564167][ T7378] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.564360][ T7378] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.564542][ T7378] bridge_slave_1: entered allmulticast mode [ 348.616278][ T7378] bridge_slave_1: entered promiscuous mode [ 348.667036][ T7635] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 350.626045][ T4951] Bluetooth: hci2: command tx timeout [ 350.683120][ T1460] hsr_slave_0: left promiscuous mode [ 350.725440][ T1460] hsr_slave_1: left promiscuous mode [ 350.788938][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 350.806499][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 352.576736][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 352.665627][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 352.704374][ T4951] Bluetooth: hci2: command tx timeout [ 354.783856][ T4951] Bluetooth: hci2: command tx timeout [ 354.996436][ T7667] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 357.294812][ T4951] Bluetooth: hci2: command tx timeout [ 357.440393][ T7378] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 357.492218][ T7378] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 357.674831][ T7378] team0: Port device team_slave_0 added [ 358.222009][ T30] audit: type=1800 audit(1793365656.909:5): pid=7683 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.307" name=08 dev="sda1" ino=2051 res=0 errno=-22 [ 358.346896][ T7378] team0: Port device team_slave_1 added [ 358.448377][ T7378] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 358.448402][ T7378] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.448446][ T7378] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 358.500554][ T7378] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 358.500612][ T7378] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.500662][ T7378] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 358.681313][ T7378] hsr_slave_0: entered promiscuous mode [ 358.682651][ T7378] hsr_slave_1: entered promiscuous mode [ 358.701280][ T7378] debugfs: 'hsr0' already exists in 'hsr' [ 358.701312][ T7378] Cannot create hsr debugfs directory [ 359.278875][ T7692] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 360.682064][ T7709] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 363.751582][ T7462] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.763845][ T7462] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.765247][ T7462] bridge_slave_0: entered allmulticast mode [ 363.852594][ T7462] bridge_slave_0: entered promiscuous mode [ 363.971317][ T7634] rxe_eth0 speed is unknown, defaulting to 1000 [ 364.021631][ T7462] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.022322][ T7462] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.038100][ T7462] bridge_slave_1: entered allmulticast mode [ 364.151464][ T7462] bridge_slave_1: entered promiscuous mode [ 364.900614][ T7462] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.008505][ T7462] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.987946][ T7736] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 366.284911][ T7462] team0: Port device team_slave_0 added [ 367.082491][ T7462] team0: Port device team_slave_1 added [ 369.404478][ T7462] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 369.404504][ T7462] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.404548][ T7462] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 369.476379][ T7462] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 369.476408][ T7462] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.476454][ T7462] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 373.129782][ T7462] hsr_slave_0: entered promiscuous mode [ 373.147819][ T7462] hsr_slave_1: entered promiscuous mode [ 373.158612][ T7462] debugfs: 'hsr0' already exists in 'hsr' [ 373.158639][ T7462] Cannot create hsr debugfs directory [ 373.253268][ T1460] bridge_slave_1: left allmulticast mode [ 373.253299][ T1460] bridge_slave_1: left promiscuous mode [ 373.253508][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.313423][ T1460] bridge_slave_0: left allmulticast mode [ 373.313453][ T1460] bridge_slave_0: left promiscuous mode [ 373.313663][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 373.338862][ T5652] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 373.350866][ T5652] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 373.364220][ T5652] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 373.367818][ T5652] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 373.368734][ T5652] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 373.716274][ T7767] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 374.064516][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 374.104451][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 374.150288][ T1460] bond0 (unregistering): Released all slaves [ 374.357619][ T7772] netlink: 'syz.4.324': attribute type 1 has an invalid length. [ 375.424668][ T5652] Bluetooth: hci1: command tx timeout [ 376.748979][ T7784] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 377.503912][ T5652] Bluetooth: hci1: command tx timeout [ 377.677599][ T7786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 378.015341][ T1460] hsr_slave_0: left promiscuous mode [ 378.038739][ T1460] hsr_slave_1: left promiscuous mode [ 378.043219][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 378.075770][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.075847][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.164902][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 379.918485][ T5652] Bluetooth: hci1: command tx timeout [ 382.224316][ T5652] Bluetooth: hci1: command tx timeout [ 382.676254][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 382.840694][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 383.327284][ T4951] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 383.345849][ T4951] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 383.363530][ T4951] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 383.374941][ T4951] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 383.375677][ T4951] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 384.504466][ T7762] rxe_eth0 speed is unknown, defaulting to 1000 [ 385.425178][ T5652] Bluetooth: hci6: command tx timeout [ 385.782138][ T7634] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.794685][ T7634] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.797036][ T7634] bridge_slave_0: entered allmulticast mode [ 386.014388][ T7634] bridge_slave_0: entered promiscuous mode [ 388.592638][ T5652] Bluetooth: hci6: command tx timeout [ 388.758622][ T7634] bridge0: port 2(bridge_slave_1) entered blocking state [ 388.758786][ T7634] bridge0: port 2(bridge_slave_1) entered disabled state [ 388.759033][ T7634] bridge_slave_1: entered allmulticast mode [ 388.773497][ T7634] bridge_slave_1: entered promiscuous mode [ 388.957355][ T7634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 388.993500][ T7634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 389.250911][ T7634] team0: Port device team_slave_0 added [ 389.250981][ T7804] rxe_eth0 speed is unknown, defaulting to 1000 [ 389.282418][ T7634] team0: Port device team_slave_1 added [ 389.779697][ T7634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 389.779723][ T7634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.779768][ T7634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 389.910591][ T7634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.910617][ T7634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.910662][ T7634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 390.172616][ T1460] bridge_slave_1: left allmulticast mode [ 390.172653][ T1460] bridge_slave_1: left promiscuous mode [ 390.172897][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.234505][ T1460] bridge_slave_0: left allmulticast mode [ 390.234561][ T1460] bridge_slave_0: left promiscuous mode [ 390.234869][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.326645][ T7840] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 390.386563][ T1460] bridge_slave_1: left allmulticast mode [ 390.386605][ T1460] bridge_slave_1: left promiscuous mode [ 390.386927][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.415224][ T1460] bridge_slave_0: left allmulticast mode [ 390.415253][ T1460] bridge_slave_0: left promiscuous mode [ 390.415435][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.623873][ T4951] Bluetooth: hci6: command tx timeout [ 393.481734][ T4951] Bluetooth: hci6: command tx timeout [ 393.697950][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 393.735983][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 393.761505][ T1460] bond0 (unregistering): Released all slaves [ 393.929923][ T7860] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 394.286173][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 394.310335][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 394.331923][ T1460] bond0 (unregistering): Released all slaves [ 396.492020][ T7634] hsr_slave_0: entered promiscuous mode [ 396.494668][ T7634] hsr_slave_1: entered promiscuous mode [ 396.499446][ T7634] debugfs: 'hsr0' already exists in 'hsr' [ 396.499475][ T7634] Cannot create hsr debugfs directory [ 399.555366][ T1460] hsr_slave_0: left promiscuous mode [ 399.570327][ T1460] hsr_slave_1: left promiscuous mode [ 399.745505][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 399.778501][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 399.857137][ T1460] hsr_slave_0: left promiscuous mode [ 399.872953][ T1460] hsr_slave_1: left promiscuous mode [ 399.883352][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 399.950294][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.147012][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 401.218382][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 403.891810][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 404.053247][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 404.180559][ T7931] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 407.825598][ T7965] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 410.131439][ T1460] bridge_slave_1: left allmulticast mode [ 410.141431][ T1460] bridge_slave_1: left promiscuous mode [ 410.157258][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 410.322814][ T1460] bridge_slave_0: left allmulticast mode [ 410.323764][ T1460] bridge_slave_0: left promiscuous mode [ 410.350007][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 410.604911][ T5652] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 410.615532][ T5652] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 410.622101][ T5652] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 410.632859][ T5652] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 410.636966][ T5652] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 412.715711][ T5652] Bluetooth: hci4: command tx timeout [ 413.072353][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 413.282628][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.326152][ T1460] bond0 (unregistering): Released all slaves [ 413.341852][ T7998] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 414.863864][ T5652] Bluetooth: hci4: command tx timeout [ 415.153117][ T7804] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.155984][ T7804] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.156168][ T7804] bridge_slave_0: entered allmulticast mode [ 415.235667][ T7804] bridge_slave_0: entered promiscuous mode [ 415.248218][ T7762] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.248326][ T7762] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.248458][ T7762] bridge_slave_0: entered allmulticast mode [ 415.539828][ T7762] bridge_slave_0: entered promiscuous mode [ 415.610476][ T7804] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.637214][ T7804] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.638012][ T7804] bridge_slave_1: entered allmulticast mode [ 415.801330][ T7804] bridge_slave_1: entered promiscuous mode [ 415.862047][ T7762] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.862748][ T7762] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.863446][ T7762] bridge_slave_1: entered allmulticast mode [ 416.148733][ T7762] bridge_slave_1: entered promiscuous mode [ 416.944093][ T5652] Bluetooth: hci4: command tx timeout [ 417.616353][ T8032] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 418.480142][ T7804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.850953][ T7762] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.882282][ T7762] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 418.926386][ T7804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 419.024386][ T5652] Bluetooth: hci4: command tx timeout [ 419.190091][ T1460] hsr_slave_0: left promiscuous mode [ 419.200937][ T1460] hsr_slave_1: left promiscuous mode [ 419.204518][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 419.229449][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.722276][ T8046] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 420.296606][ T5762] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 421.244323][ T5762] usb 4-1: Using ep0 maxpacket: 8 [ 421.245617][ T5762] usb 4-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 421.252851][ T5762] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.252884][ T5762] usb 4-1: Product: syz [ 421.252904][ T5762] usb 4-1: Manufacturer: syz [ 421.252924][ T5762] usb 4-1: SerialNumber: syz [ 421.296109][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 421.298804][ T5762] usb 4-1: config 0 descriptor?? [ 421.407726][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 421.519725][ T5762] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 421.659058][ T8062] input: syz1 as /devices/virtual/input/input11 [ 422.250211][ T7804] team0: Port device team_slave_0 added [ 422.324836][ T7762] team0: Port device team_slave_0 added [ 422.330911][ T7804] team0: Port device team_slave_1 added [ 422.448170][ T7762] team0: Port device team_slave_1 added [ 422.708241][ T7804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 422.708261][ T7804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.708296][ T7804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 422.710432][ T7804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 422.710448][ T7804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.710482][ T7804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 422.849686][ T7980] rxe_eth0 speed is unknown, defaulting to 1000 [ 422.852496][ T7762] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 422.852518][ T7762] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.852563][ T7762] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 422.922878][ T7762] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 422.922904][ T7762] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.922950][ T7762] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 423.054469][ T5762] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 423.090421][ T5762] usb 4-1: USB disconnect, device number 10 [ 423.341902][ T7804] hsr_slave_0: entered promiscuous mode [ 423.353558][ T7804] hsr_slave_1: entered promiscuous mode [ 423.368092][ T7804] debugfs: 'hsr0' already exists in 'hsr' [ 423.368125][ T7804] Cannot create hsr debugfs directory [ 423.644221][ T7762] hsr_slave_0: entered promiscuous mode [ 423.651510][ T7762] hsr_slave_1: entered promiscuous mode [ 423.686894][ T7762] debugfs: 'hsr0' already exists in 'hsr' [ 423.686927][ T7762] Cannot create hsr debugfs directory [ 425.940887][ T5296] 8021q: adding VLAN 0 to HW filter on device eth10 [ 426.585960][ T5641] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 426.726564][ T5641] usb 5-1: device descriptor read/64, error -71 [ 426.973915][ T5641] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 427.145523][ T5641] usb 5-1: device descriptor read/64, error -71 [ 427.254247][ T5641] usb usb5-port1: attempt power cycle [ 427.596985][ T5641] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 427.625172][ T5641] usb 5-1: device descriptor read/8, error -71 [ 427.664358][ T8112] MTDSB: Device #1 doesn't appear to exist [ 427.664358][ T8112] [ 427.769144][ T8116] netlink: 8 bytes leftover after parsing attributes in process `syz.3.379'. [ 427.800495][ T5652] Bluetooth: to_multiplier 8192 > 3200 [ 427.863936][ T5641] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 427.884966][ T5641] usb 5-1: device descriptor read/8, error -71 [ 428.004305][ T5641] usb usb5-port1: unable to enumerate USB device [ 428.379024][ T1460] bridge_slave_1: left allmulticast mode [ 428.379061][ T1460] bridge_slave_1: left promiscuous mode [ 428.379322][ T1460] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.383050][ T1460] bridge_slave_0: left allmulticast mode [ 428.383080][ T1460] bridge_slave_0: left promiscuous mode [ 428.423132][ T1460] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.559576][ T8124] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 428.690422][ T1460] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.737146][ T1460] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.750688][ T1460] bond0 (unregistering): Released all slaves [ 428.770522][ T5296] 8021q: adding VLAN 0 to HW filter on device eth11 [ 429.287074][ T8134] netlink: 'syz.1.384': attribute type 1 has an invalid length. [ 429.337321][ T8135] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 429.823881][ T5652] Bluetooth: hci3: command 0x0406 tx timeout [ 431.651150][ T1460] hsr_slave_0: left promiscuous mode [ 431.652042][ T1460] hsr_slave_1: left promiscuous mode [ 431.653432][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 431.655257][ T1460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 432.650389][ T4951] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 432.665673][ T4951] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 432.681715][ T4951] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 432.696135][ T4951] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 432.696739][ T4951] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 433.157755][ T1460] team0 (unregistering): Port device team_slave_1 removed [ 433.229486][ T1460] team0 (unregistering): Port device team_slave_0 removed [ 433.283021][ T8174] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 433.863126][ T5296] 8021q: adding VLAN 0 to HW filter on device eth14 [ 434.131045][ T8181] input: syz1 as /devices/virtual/input/input12 [ 434.783956][ T5652] Bluetooth: hci2: command tx timeout [ 435.050943][ T7980] bridge0: port 1(bridge_slave_0) entered blocking state [ 435.051145][ T7980] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.051344][ T7980] bridge_slave_0: entered allmulticast mode [ 435.083218][ T7980] bridge_slave_0: entered promiscuous mode [ 435.098513][ T7980] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.098632][ T7980] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.098865][ T7980] bridge_slave_1: entered allmulticast mode [ 435.130666][ T7980] bridge_slave_1: entered promiscuous mode [ 435.175287][ T7980] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 435.179272][ T7980] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 435.576699][ T7980] team0: Port device team_slave_0 added [ 435.602212][ T7980] team0: Port device team_slave_1 added [ 435.771723][ T7980] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 435.771750][ T7980] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.771796][ T7980] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 435.788356][ T7980] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 435.788380][ T7980] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.788425][ T7980] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 437.395176][ T5652] Bluetooth: hci2: command tx timeout [ 437.411557][ T9] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 438.004213][ T9] usb 5-1: device descriptor read/64, error -71 [ 438.101183][ T7980] hsr_slave_0: entered promiscuous mode [ 438.102507][ T7980] hsr_slave_1: entered promiscuous mode [ 438.106599][ T7980] debugfs: 'hsr0' already exists in 'hsr' [ 438.106627][ T7980] Cannot create hsr debugfs directory [ 438.253886][ T9] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 438.350587][ T8218] netlink: 'syz.1.397': attribute type 1 has an invalid length. [ 439.725826][ T8225] Process accounting resumed [ 440.469870][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.469949][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.481901][ T4951] Bluetooth: hci2: command tx timeout [ 440.519243][ T8166] rxe_eth0 speed is unknown, defaulting to 1000 [ 442.545932][ T4951] Bluetooth: hci2: command tx timeout [ 442.774167][ T6122] bridge_slave_1: left allmulticast mode [ 442.774205][ T6122] bridge_slave_1: left promiscuous mode [ 442.774461][ T6122] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.807173][ T6122] bridge_slave_0: left allmulticast mode [ 442.807212][ T6122] bridge_slave_0: left promiscuous mode [ 442.812074][ T6122] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.212354][ T6122] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 445.246477][ T6122] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 445.261531][ T6122] bond0 (unregistering): Released all slaves [ 445.387255][ T5652] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 445.390680][ T5652] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 445.403867][ T5652] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 445.404770][ T8246] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 445.422481][ T5652] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 445.424096][ T5652] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 446.814628][ T6122] hsr_slave_0: left promiscuous mode [ 446.838358][ T6122] hsr_slave_1: left promiscuous mode [ 446.842100][ T6122] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 446.862240][ T6122] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 447.135891][ T8280] netlink: 'syz.4.408': attribute type 1 has an invalid length. [ 447.196705][ T3218] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 447.423891][ T4951] Bluetooth: hci1: command tx timeout [ 447.479013][ T3218] usb 4-1: unable to get BOS descriptor or descriptor too short [ 447.489446][ T3218] usb 4-1: not running at top speed; connect to a high speed hub [ 447.489512][ T3218] usb 4-1: New USB device found: idVendor=04dd, idProduct=9031, bcdDevice=28.e6 [ 447.496171][ T3218] usb 4-1: config 7 has an invalid interface number: 48 but max is 0 [ 447.496213][ T3218] usb 4-1: config 7 contains an unexpected descriptor of type 0x2, skipping [ 447.496244][ T3218] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 447.496277][ T3218] usb 4-1: config 7 has no interface number 0 [ 447.496320][ T3218] usb 4-1: config 7 interface 48 has no altsetting 0 [ 447.522659][ T3218] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.522700][ T3218] usb 4-1: Product: syz [ 447.522726][ T3218] usb 4-1: Manufacturer: syz [ 447.522752][ T3218] usb 4-1: SerialNumber: syz [ 448.391687][ T6122] team0 (unregistering): Port device team_slave_1 removed [ 448.409100][ T6122] team0 (unregistering): Port device team_slave_0 removed [ 448.968368][ T3218] cdc_ether 4-1:7.48: skipping garbage [ 448.968401][ T3218] cdc_ether 4-1:7.48: bad CDC descriptors [ 449.000679][ T3218] usb 4-1: unsupported MDLM descriptors [ 449.031638][ T3218] usb 4-1: USB disconnect, device number 11 [ 450.331051][ T4951] Bluetooth: hci1: command tx timeout [ 451.149799][ T8247] rxe_eth0 speed is unknown, defaulting to 1000 [ 451.165845][ T7980] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 452.368034][ T7980] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 452.369254][ T7980] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 452.383896][ T4951] Bluetooth: hci1: command tx timeout [ 453.581885][ T7980] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 453.891248][ T7980] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 453.929387][ T7980] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 454.133590][ T7980] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 454.167110][ T7980] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 454.463809][ T4951] Bluetooth: hci1: command tx timeout [ 455.744744][ T8166] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.744865][ T8166] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.745044][ T8166] bridge_slave_0: entered allmulticast mode [ 455.776555][ T8166] bridge_slave_0: entered promiscuous mode [ 455.805606][ T8166] bridge0: port 2(bridge_slave_1) entered blocking state [ 455.805732][ T8166] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.805931][ T8166] bridge_slave_1: entered allmulticast mode [ 455.826077][ T8166] bridge_slave_1: entered promiscuous mode [ 456.657315][ T8166] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 456.675307][ T8166] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 456.968967][ T8166] team0: Port device team_slave_0 added [ 456.989759][ T8166] team0: Port device team_slave_1 added [ 457.363672][ T8166] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 457.363699][ T8166] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.364157][ T8166] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 457.372907][ T8166] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 457.372937][ T8166] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.372985][ T8166] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 458.080330][ T8363] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 458.301477][ T6122] bridge_slave_1: left allmulticast mode [ 458.301516][ T6122] bridge_slave_1: left promiscuous mode [ 458.301774][ T6122] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.331761][ T6122] bridge_slave_0: left allmulticast mode [ 458.331798][ T6122] bridge_slave_0: left promiscuous mode [ 458.332053][ T6122] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.540793][ T6122] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 460.570130][ T6122] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 460.582906][ T6122] bond0 (unregistering): Released all slaves [ 460.686314][ T8166] hsr_slave_0: entered promiscuous mode [ 460.689059][ T8166] hsr_slave_1: entered promiscuous mode [ 460.695628][ T8166] debugfs: 'hsr0' already exists in 'hsr' [ 460.695655][ T8166] Cannot create hsr debugfs directory [ 461.629098][ T6122] hsr_slave_0: left promiscuous mode [ 461.640559][ T6122] hsr_slave_1: left promiscuous mode [ 461.641406][ T6122] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 461.662886][ T6122] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 464.857042][ T5762] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 464.929039][ T6122] team0 (unregistering): Port device team_slave_1 removed [ 464.966502][ T6122] team0 (unregistering): Port device team_slave_0 removed [ 465.005905][ T5762] usb 4-1: Using ep0 maxpacket: 16 [ 465.006543][ T5762] usb 4-1: New USB device found: idVendor=045e, idProduct=07da, bcdDevice=0.00 [ 465.022914][ T5762] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 465.022969][ T5762] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 465.023009][ T5762] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 465.023072][ T5762] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.810959][ T5762] usb 4-1: config 0 descriptor?? [ 467.719654][ T5762] usb 4-1: can't set config #0, error -71 [ 467.736894][ T5762] usb 4-1: USB disconnect, device number 12 [ 468.536062][ T8416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.428'. [ 468.712561][ T4951] Bluetooth: to_multiplier 8192 > 3200 [ 468.779048][ T7980] 8021q: adding VLAN 0 to HW filter on device bond0 [ 469.152339][ T8247] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.152547][ T8247] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.152707][ T8247] bridge_slave_0: entered allmulticast mode [ 469.155599][ T8247] bridge_slave_0: entered promiscuous mode [ 469.159008][ T8247] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.159128][ T8247] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.159276][ T8247] bridge_slave_1: entered allmulticast mode [ 469.161212][ T8247] bridge_slave_1: entered promiscuous mode [ 469.202722][ T8247] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 469.211717][ T8247] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 470.373347][ T8247] team0: Port device team_slave_0 added [ 470.498718][ T8247] team0: Port device team_slave_1 added [ 470.785227][ T4951] Bluetooth: hci3: command 0x0406 tx timeout [ 471.600211][ T8434] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 471.648529][ T5645] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 471.650461][ T5645] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 471.651113][ T5645] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 471.652477][ T5645] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 471.653491][ T5645] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 474.019793][ T4951] Bluetooth: hci6: command tx timeout [ 474.141698][ T8247] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 474.141724][ T8247] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.141771][ T8247] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 474.193213][ T8247] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 474.193238][ T8247] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.193285][ T8247] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 475.457246][ T8247] hsr_slave_0: entered promiscuous mode [ 475.502054][ T8247] hsr_slave_1: entered promiscuous mode [ 475.520624][ T8247] debugfs: 'hsr0' already exists in 'hsr' [ 475.520653][ T8247] Cannot create hsr debugfs directory [ 476.063836][ T4951] Bluetooth: hci6: command tx timeout [ 478.144642][ T4951] Bluetooth: hci6: command tx timeout [ 478.842400][ T8166] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 479.100724][ T8166] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 479.208194][ T8166] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 479.234409][ T8166] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 479.247411][ T8166] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 481.220886][ T4951] Bluetooth: hci6: command tx timeout [ 481.225400][ T8166] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 481.425969][ T8166] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 482.012437][ T8166] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 482.297534][ T8435] rxe_eth0 speed is unknown, defaulting to 1000 [ 483.615420][ T6122] bridge_slave_1: left allmulticast mode [ 483.615457][ T6122] bridge_slave_1: left promiscuous mode [ 483.615706][ T6122] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.658323][ T6122] bridge_slave_0: left allmulticast mode [ 483.658360][ T6122] bridge_slave_0: left promiscuous mode [ 483.667577][ T6122] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.280222][ T8517] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 484.390337][ T3218] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 485.060458][ T3218] usb 4-1: Using ep0 maxpacket: 8 [ 485.196001][ T3218] usb 4-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 485.553500][ T3218] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.553544][ T3218] usb 4-1: Product: syz [ 485.553570][ T3218] usb 4-1: Manufacturer: syz [ 485.553596][ T3218] usb 4-1: SerialNumber: syz [ 486.176041][ T3218] usb 4-1: config 0 descriptor?? [ 486.317186][ T6122] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 486.359350][ T6122] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 486.381289][ T6122] bond0 (unregistering): Released all slaves [ 486.438016][ T3218] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 486.812800][ T8519] evm: overlay not supported [ 488.415053][ T3218] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 488.417425][ T24] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 488.418002][ T3218] usb 4-1: USB disconnect, device number 13 [ 488.584291][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 488.585372][ T24] usb 2-1: New USB device found: idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 488.597794][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.597834][ T24] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 488.600605][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.600643][ T24] usb 2-1: Product: syz [ 488.600772][ T24] usb 2-1: Manufacturer: syz [ 488.600798][ T24] usb 2-1: SerialNumber: syz [ 488.700060][ T24] usb 2-1: config 0 descriptor?? [ 488.946514][ T6122] hsr_slave_0: left promiscuous mode [ 488.949947][ T6122] hsr_slave_1: left promiscuous mode [ 488.952997][ T6122] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 488.982097][ T6122] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 489.289842][ T8543] netlink: 'syz.4.447': attribute type 10 has an invalid length. [ 490.641155][ T6122] team0 (unregistering): Port device team_slave_1 removed [ 490.707087][ T6122] team0 (unregistering): Port device team_slave_0 removed [ 490.852737][ T1710] usb 2-1: USB disconnect, device number 6 [ 492.938060][ T8543] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 492.961589][ T8247] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 493.004514][ T8247] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 493.108281][ T8247] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 493.141902][ T8247] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 493.153503][ T8247] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 493.228789][ T8247] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 493.290035][ T8247] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 493.349721][ T8247] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 493.919367][ T8568] FAULT_INJECTION: forcing a failure. [ 493.919367][ T8568] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 493.919416][ T8568] CPU: 0 UID: 0 PID: 8568 Comm: syz.3.451 Not tainted syzkaller #0 PREEMPT(full) [ 493.919460][ T8568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 493.919483][ T8568] Call Trace: [ 493.919496][ T8568] [ 493.919510][ T8568] dump_stack_lvl+0x100/0x190 [ 493.919574][ T8568] should_fail_ex.cold+0x5/0xa [ 493.919635][ T8568] should_fail_alloc_page+0xeb/0x140 [ 493.919695][ T8568] prepare_alloc_pages+0x1f0/0x5b0 [ 493.919749][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.919802][ T8568] __alloc_frozen_pages_noprof+0x1b1/0x3280 [ 493.919846][ T8568] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 493.919890][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.919935][ T8568] ? lockdep_hardirqs_on+0x7d/0x110 [ 493.919989][ T8568] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 493.920033][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.920078][ T8568] ? stack_depot_save_flags+0x49a/0xa10 [ 493.920132][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.920178][ T8568] ? kasan_save_stack+0x3f/0x50 [ 493.920225][ T8568] ? kasan_save_stack+0x30/0x50 [ 493.920273][ T8568] ? kasan_save_track+0x14/0x30 [ 493.920319][ T8568] ? __kasan_kmalloc+0xaa/0xb0 [ 493.920365][ T8568] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 493.920413][ T8568] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 493.920454][ T8568] ? blk_trace_setup+0x217/0x440 [ 493.920504][ T8568] ? __x64_sys_ioctl+0x18e/0x210 [ 493.920553][ T8568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.920634][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.920679][ T8568] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 493.920740][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.920785][ T8568] ? policy_nodemask+0xed/0x5e0 [ 493.920847][ T8568] alloc_pages_mpol+0x201/0x560 [ 493.920907][ T8568] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 493.920968][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.921020][ T8568] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 493.921071][ T8568] alloc_pages_noprof+0x1a/0x160 [ 493.921111][ T8568] relay_open_buf.part.0+0x261/0xb70 [ 493.921178][ T8568] relay_open+0x7b9/0xa00 [ 493.921233][ T8568] blk_trace_setup_prepare+0x35c/0x6c0 [ 493.921291][ T8568] blk_trace_setup+0x217/0x440 [ 493.921348][ T8568] ? __pfx_blk_trace_setup+0x10/0x10 [ 493.921398][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.921454][ T8568] ? find_held_lock+0x2b/0x80 [ 493.921491][ T8568] ? tomoyo_path_number_perm+0x28f/0x580 [ 493.921543][ T8568] ? tomoyo_path_number_perm+0x28f/0x580 [ 493.921630][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.921675][ T8568] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 493.921737][ T8568] sg_ioctl+0x10fe/0x26d0 [ 493.921811][ T8568] ? __pfx_sg_ioctl+0x10/0x10 [ 493.921867][ T8568] ? __fget_files+0x34/0x3d0 [ 493.921928][ T8568] ? find_held_lock+0x2b/0x80 [ 493.921967][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.922013][ T8568] ? hook_file_ioctl_common+0x140/0x440 [ 493.922080][ T8568] ? srso_alias_return_thunk+0x5/0xfbef5 [ 493.922125][ T8568] ? __fget_files+0x21f/0x3d0 [ 493.922191][ T8568] ? __pfx_sg_ioctl+0x10/0x10 [ 493.922253][ T8568] __x64_sys_ioctl+0x18e/0x210 [ 493.922307][ T8568] do_syscall_64+0x123/0x790 [ 493.922360][ T8568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.922399][ T8568] RIP: 0033:0x7f9b2af9f559 [ 493.922428][ T8568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.922466][ T8568] RSP: 002b:00007f9b2bf1e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 493.922502][ T8568] RAX: ffffffffffffffda RBX: 00007f9b2b225fa0 RCX: 00007f9b2af9f559 [ 493.922529][ T8568] RDX: 0000200000000400 RSI: 00000000c0481273 RDI: 0000000000000005 [ 493.922553][ T8568] RBP: 00007f9b2b036b20 R08: 0000000000000000 R09: 0000000000000000 [ 493.922576][ T8568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 493.922600][ T8568] R13: 00007f9b2b226038 R14: 00007f9b2b225fa0 R15: 00007ffe72548948 [ 493.922651][ T8568] [ 495.094109][ T5645] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 495.104201][ T5645] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 495.111564][ T5645] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 495.120936][ T5645] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 495.121707][ T5645] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 495.240484][ T8247] 8021q: adding VLAN 0 to HW filter on device bond0 [ 495.507124][ T8584] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 497.185582][ T5645] Bluetooth: hci4: command tx timeout [ 499.071307][ T8247] 8021q: adding VLAN 0 to HW filter on device team0 [ 499.083652][ T8435] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.083972][ T8435] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.084157][ T8435] bridge_slave_0: entered allmulticast mode [ 499.096905][ T8435] bridge_slave_0: entered promiscuous mode [ 499.263903][ T5645] Bluetooth: hci4: command tx timeout [ 499.456638][ T8609] [ 499.458994][ T8609] ====================================================== [ 499.465999][ T8609] WARNING: possible circular locking dependency detected [ 499.473121][ T8609] syzkaller #0 Not tainted [ 499.477527][ T8609] ------------------------------------------------------ [ 499.484532][ T8609] syz.3.458/8609 is trying to acquire lock: [ 499.490412][ T8609] ffff8880260770c0 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 499.501871][ T8609] [ 499.501871][ T8609] but task is already holding lock: [ 499.509247][ T8609] ffffffff916b23a0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 499.518629][ T8609] [ 499.518629][ T8609] which lock already depends on the new lock. [ 499.518629][ T8609] [ 499.529019][ T8609] [ 499.529019][ T8609] the existing dependency chain (in reverse order) is: [ 499.538022][ T8609] [ 499.538022][ T8609] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 499.545940][ T8609] lock_acquire+0x1d1/0x380 [ 499.550973][ T8609] __mutex_lock+0x19f/0x1c10 [ 499.556118][ T8609] tcm_alloc+0x20/0x440 [ 499.560806][ T8609] usb_get_function+0x5e/0xd0 [ 499.566003][ T8609] config_usb_cfg_link+0x1ed/0x3a0 [ 499.571649][ T8609] configfs_symlink+0x695/0x1340 [ 499.577099][ T8609] vfs_symlink+0x17b/0x4e0 [ 499.582040][ T8609] filename_symlinkat+0x2a6/0x560 [ 499.587584][ T8609] __x64_sys_symlinkat+0x9c/0xe0 [ 499.593036][ T8609] do_syscall_64+0x123/0x790 [ 499.598151][ T8609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.604564][ T8609] [ 499.604564][ T8609] -> #1 (&gi->lock){+.+.}-{4:4}: [ 499.611699][ T8609] lock_acquire+0x1d1/0x380 [ 499.616735][ T8609] __mutex_lock+0x19f/0x1c10 [ 499.621853][ T8609] config_usb_cfg_link+0x57/0x3a0 [ 499.627418][ T8609] configfs_symlink+0x695/0x1340 [ 499.632871][ T8609] vfs_symlink+0x17b/0x4e0 [ 499.637815][ T8609] filename_symlinkat+0x2a6/0x560 [ 499.643377][ T8609] __x64_sys_symlinkat+0x9c/0xe0 [ 499.648832][ T8609] do_syscall_64+0x123/0x790 [ 499.653951][ T8609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.660385][ T8609] [ 499.660385][ T8609] -> #0 (&sb->s_type->i_mutex_key#28){++++}-{4:4}: [ 499.669089][ T8609] check_prev_add+0xeb/0xe60 [ 499.674229][ T8609] __lock_acquire+0x1528/0x1f40 [ 499.679603][ T8609] lock_acquire+0x1d1/0x380 [ 499.684626][ T8609] down_write+0x86/0x1f0 [ 499.689397][ T8609] configfs_depend_item_unlocked+0xf3/0x6a0 [ 499.695839][ T8609] usbg_make_tpg+0x251/0x610 [ 499.700959][ T8609] target_fabric_make_tpg+0xab/0x8c0 [ 499.706769][ T8609] configfs_mkdir+0x525/0xd40 [ 499.711980][ T8609] vfs_mkdir+0x367/0x850 [ 499.716740][ T8609] filename_mkdirat+0x48b/0x5e0 [ 499.722106][ T8609] __x64_sys_mkdirat+0x89/0xc0 [ 499.727383][ T8609] do_syscall_64+0x123/0x790 [ 499.732497][ T8609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.738921][ T8609] [ 499.738921][ T8609] other info that might help us debug this: [ 499.738921][ T8609] [ 499.749133][ T8609] Chain exists of: [ 499.749133][ T8609] &sb->s_type->i_mutex_key#28 --> &gi->lock --> tpg_instances_lock [ 499.749133][ T8609] [ 499.762978][ T8609] Possible unsafe locking scenario: [ 499.762978][ T8609] [ 499.770421][ T8609] CPU0 CPU1 [ 499.775776][ T8609] ---- ---- [ 499.781131][ T8609] lock(tpg_instances_lock); [ 499.785812][ T8609] lock(&gi->lock); [ 499.792231][ T8609] lock(tpg_instances_lock); [ 499.799432][ T8609] lock(&sb->s_type->i_mutex_key#28); [ 499.804908][ T8609] [ 499.804908][ T8609] *** DEADLOCK *** [ 499.804908][ T8609] [ 499.813050][ T8609] locks held by syz.3.458/8609: 4, last CPU#1: [ 499.819201][ T8609] #0: ffff88801f734460 (sb_writers#16){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 499.828756][ T8609] #1: ffff88805299ac00 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 499.839625][ T8609] #2: ffffffff911e2248 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4c0/0xd40 [ 499.849442][ T8609] #3: ffffffff916b23a0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 499.859248][ T8609] [ 499.859248][ T8609] stack backtrace: [ 499.865135][ T8609] CPU: 1 UID: 0 PID: 8609 Comm: syz.3.458 Not tainted syzkaller #0 PREEMPT(full) [ 499.874337][ T8609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 499.884391][ T8609] Call Trace: [ 499.887669][ T8609] [ 499.890596][ T8609] dump_stack_lvl+0x100/0x190 [ 499.895303][ T8609] print_circular_bug.cold+0x178/0x1be [ 499.900797][ T8609] check_noncircular+0x146/0x160 [ 499.905757][ T8609] check_prev_add+0xeb/0xe60 [ 499.910365][ T8609] __lock_acquire+0x1528/0x1f40 [ 499.915268][ T8609] ? srso_alias_return_thunk+0x5/0xfbef5 [ 499.920916][ T8609] ? rcu_is_watching+0x13/0xc0 [ 499.925690][ T8609] lock_acquire+0x1d1/0x380 [ 499.930208][ T8609] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 499.936308][ T8609] ? __pfx___might_resched+0x10/0x10 [ 499.941610][ T8609] down_write+0x86/0x1f0 [ 499.945877][ T8609] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 499.951974][ T8609] ? __pfx_down_write+0x10/0x10 [ 499.956848][ T8609] ? kstrtou16+0xde/0x130 [ 499.961189][ T8609] configfs_depend_item_unlocked+0xf3/0x6a0 [ 499.967113][ T8609] usbg_make_tpg+0x251/0x610 [ 499.971735][ T8609] ? __pfx_usbg_make_tpg+0x10/0x10 [ 499.976863][ T8609] ? srso_alias_return_thunk+0x5/0xfbef5 [ 499.982512][ T8609] ? srso_alias_return_thunk+0x5/0xfbef5 [ 499.988158][ T8609] ? find_held_lock+0x2b/0x80 [ 499.992840][ T8609] ? __pfx_usbg_make_tpg+0x10/0x10 [ 499.997972][ T8609] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 500.003881][ T8609] target_fabric_make_tpg+0xab/0x8c0 [ 500.009188][ T8609] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 500.015094][ T8609] configfs_mkdir+0x525/0xd40 [ 500.019810][ T8609] ? __pfx_configfs_mkdir+0x10/0x10 [ 500.025035][ T8609] ? srso_alias_return_thunk+0x5/0xfbef5 [ 500.030690][ T8609] ? srso_alias_return_thunk+0x5/0xfbef5 [ 500.036341][ T8609] vfs_mkdir+0x367/0x850 [ 500.040603][ T8609] filename_mkdirat+0x48b/0x5e0 [ 500.045466][ T8609] ? __pfx_filename_mkdirat+0x10/0x10 [ 500.050846][ T8609] ? strncpy_from_user+0x19d/0x2d0 [ 500.055966][ T8609] ? srso_alias_return_thunk+0x5/0xfbef5 [ 500.061615][ T8609] ? do_getname+0x191/0x390 [ 500.066132][ T8609] __x64_sys_mkdirat+0x89/0xc0 [ 500.070903][ T8609] do_syscall_64+0x123/0x790 [ 500.075515][ T8609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.081422][ T8609] RIP: 0033:0x7f9b2af9f559 [ 500.085838][ T8609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.105454][ T8609] RSP: 002b:00007f9b2bf1e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 500.113875][ T8609] RAX: ffffffffffffffda RBX: 00007f9b2b225fa0 RCX: 00007f9b2af9f559 [ 500.121847][ T8609] RDX: 00000000000001ff RSI: 0000200000000280 RDI: ffffffffffffff9c [ 500.129818][ T8609] RBP: 00007f9b2b036b20 R08: 0000000000000000 R09: 0000000000000000 [ 500.137788][ T8609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 500.145757][ T8609] R13: 00007f9b2b226038 R14: 00007f9b2b225fa0 R15: 00007ffe72548948 [ 500.153750][ T8609] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 500.458814][ T8435] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.458877][ T8435] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.459016][ T8435] bridge_slave_1: entered allmulticast mode [ 500.459812][ T8435] bridge_slave_1: entered promiscuous mode [ 500.476778][ T8435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 500.484860][ T8435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 500.500595][ T8435] team0: Port device team_slave_0 added [ 500.502247][ T1529] bridge0: port 1(bridge_slave_0) entered blocking state [ 500.502333][ T1529] bridge0: port 1(bridge_slave_0) entered forwarding state [ 500.627339][ T759] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.627428][ T759] bridge0: port 2(bridge_slave_1) entered forwarding state [ 500.630310][ T8435] team0: Port device team_slave_1 added [ 500.946447][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.946510][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.344104][ T5645] Bluetooth: hci4: command tx timeout [ 501.483443][ T12] bridge_slave_1: left allmulticast mode [ 501.483478][ T12] bridge_slave_1: left promiscuous mode [ 501.483647][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.522298][ T12] bridge_slave_0: left allmulticast mode [ 501.522332][ T12] bridge_slave_0: left promiscuous mode [ 501.522505][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.950764][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 502.003028][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 502.010830][ T12] bond0 (unregistering): Released all slaves [ 502.377193][ T12] hsr_slave_0: left promiscuous mode [ 502.377720][ T12] hsr_slave_1: left promiscuous mode [ 502.378315][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 502.378885][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 502.461601][ T12] team0 (unregistering): Port device team_slave_1 removed [ 502.471558][ T12] team0 (unregistering): Port device team_slave_0 removed [ 502.661368][ T5296] 8021q: adding VLAN 0 to HW filter on device eth10 [ 502.821357][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.855772][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.902120][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.930633][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.078155][ T5296] 8021q: adding VLAN 0 to HW filter on device eth13 [ 503.363325][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.430968][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.453622][ T5296] 8021q: adding VLAN 0 to HW filter on device eth11 [ 503.479325][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.499810][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.603311][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.641781][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.698124][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.740133][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.829348][ T12] bridge_slave_1: left allmulticast mode [ 503.829382][ T12] bridge_slave_1: left promiscuous mode [ 503.829554][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.833150][ T12] bridge_slave_0: left allmulticast mode [ 503.833177][ T12] bridge_slave_0: left promiscuous mode [ 503.833328][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.876943][ T12] bridge_slave_1: left allmulticast mode [ 503.876980][ T12] bridge_slave_1: left promiscuous mode [ 503.877125][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.878785][ T12] bridge_slave_0: left allmulticast mode [ 503.878812][ T12] bridge_slave_0: left promiscuous mode [ 503.878976][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.906312][ T12] bridge_slave_1: left allmulticast mode [ 503.906341][ T12] bridge_slave_1: left promiscuous mode [ 503.906494][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.920253][ T12] bridge_slave_0: left allmulticast mode [ 503.920281][ T12] bridge_slave_0: left promiscuous mode [ 503.920450][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.953654][ T12] bridge_slave_1: left allmulticast mode [ 503.953682][ T12] bridge_slave_1: left promiscuous mode [ 503.955986][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.965801][ T12] bridge_slave_0: left allmulticast mode [ 503.965828][ T12] bridge_slave_0: left promiscuous mode [ 503.965976][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.997074][ T12] bridge_slave_1: left allmulticast mode [ 503.997107][ T12] bridge_slave_1: left promiscuous mode [ 503.997264][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.998757][ T12] bridge_slave_0: left allmulticast mode [ 503.998783][ T12] bridge_slave_0: left promiscuous mode [ 503.998942][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.227121][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.230335][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.232160][ T12] bond0 (unregistering): Released all slaves [ 504.319268][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.321204][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.322498][ T12] bond0 (unregistering): Released all slaves [ 504.404776][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.408432][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.410439][ T12] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 504.411851][ T12] bond0 (unregistering): Released all slaves [ 504.478828][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.480382][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.481349][ T12] bond0 (unregistering): Released all slaves [ 504.532525][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.542947][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.545761][ T12] bond0 (unregistering): Released all slaves [ 504.568817][ T5296] 8021q: adding VLAN 0 to HW filter on device eth16 [ 504.990627][ T5296] 8021q: adding VLAN 0 to HW filter on device eth17 [ 505.541469][ T12] hsr_slave_0: left promiscuous mode [ 505.542028][ T12] hsr_slave_1: left promiscuous mode [ 505.542644][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.542672][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.543313][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.543337][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.617909][ T12] hsr_slave_0: left promiscuous mode [ 505.618588][ T12] hsr_slave_1: left promiscuous mode [ 505.619356][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.619881][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.623451][ T12] hsr_slave_0: left promiscuous mode [ 505.656200][ T12] hsr_slave_1: left promiscuous mode [ 505.656805][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.656830][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.657432][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.657457][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.660958][ T12] hsr_slave_0: left promiscuous mode [ 505.661476][ T12] hsr_slave_1: left promiscuous mode [ 505.662093][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.662119][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.662693][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.662718][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.749934][ T12] veth1_macvtap: left promiscuous mode [ 505.749978][ T12] veth0_macvtap: left promiscuous mode [ 505.750063][ T12] veth1_vlan: left promiscuous mode [ 505.750127][ T12] veth0_vlan: left promiscuous mode [ 505.751329][ T12] veth1_macvtap: left promiscuous mode [ 505.751366][ T12] veth0_macvtap: left promiscuous mode [ 505.751448][ T12] veth1_vlan: left promiscuous mode [ 505.751511][ T12] veth0_vlan: left promiscuous mode [ 505.752551][ T12] veth1_macvtap: left promiscuous mode [ 505.752587][ T12] veth0_macvtap: left promiscuous mode [ 505.752681][ T12] veth1_vlan: left promiscuous mode [ 505.752741][ T12] veth0_vlan: left promiscuous mode [ 506.096741][ T12] team0 (unregistering): Port device team_slave_1 removed [ 506.116551][ T12] team0 (unregistering): Port device team_slave_0 removed [ 506.292218][ T12] team0 (unregistering): Port device team_slave_1 removed [ 506.307578][ T12] team0 (unregistering): Port device team_slave_0 removed [ 506.477313][ T12] team0 (unregistering): Port device team_slave_1 removed [ 506.492019][ T12] team0 (unregistering): Port device team_slave_0 removed [ 506.556879][ T12] team0 (unregistering): Port device team_slave_1 removed [ 506.561809][ T12] team0 (unregistering): Port device team_slave_0 removed [ 506.698881][ T12] team0 (unregistering): Port device team_slave_1 removed [ 506.717810][ T12] team0 (unregistering): Port device team_slave_0 removed [ 507.593576][ T5296] 8021q: adding VLAN 0 to HW filter on device eth12 [ 508.653080][ T5296] 8021q: adding VLAN 0 to HW filter on device eth14 [ 509.022168][ T5296] 8021q: adding VLAN 0 to HW filter on device eth15