last executing test programs: 26m24.127027587s ago: executing program 2 (id=505): r0 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, 0x0, 0x0) getsockopt$ARPT_SO_GET_INFO(r5, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x0, [0xfffff001, 0x4, 0x5]}, &(0x7f00000003c0)=0x44) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[], 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, 0x0, 0x8000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) 26m22.642808515s ago: executing program 2 (id=508): r0 = socket$key(0xf, 0x3, 0x2) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="040f040402190431459a2dda0af8a29740787f077be6db13177179f6e69c874f24351bfe6a043771cc97266da70f541ceed323005ea2"], 0x7) sendmsg$key(r0, &(0x7f00000000c0)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x2, 0x5, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd}, 0x10}, 0x1, 0x7}, 0x12) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r1 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) sendfile(r2, r2, 0x0, 0x7e78a6f1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x50, &(0x7f0000000100), 0x48) fcntl$addseals(r2, 0x409, 0xc) getdents(r1, &(0x7f0000001fc0)=""/184, 0xb8) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000003c0), r3) 26m22.451621504s ago: executing program 2 (id=509): r0 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r0, 0x0) ftruncate(r0, 0x3) r1 = socket$inet6(0xa, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140)={0xfffffffffffffffe, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x9) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r2, 0x29, 0xc8, 0x0, 0xffdc) syz_emit_ethernet(0x2ca, &(0x7f0000000900)=ANY=[@ANYBLOB="bbbbbbbbbbbb0000000020008100080086dd67cde504029006fffe8000000000000000000000000000aa20010000000000000000000000000001320200f5680b9950c7d65e02d058750000000000000100c2040000260a04010f0502000705020000040108003b0800000000000005020006050200e001050000000000c20400000005000100050200080127630169e1ed9cefdbff7f0a6d2924ecc3a6960d62ba58ced75c39cd570fea392d9242bed1746eec000000110e0407f7480600ff010000000000000000000000000001ff020000000000000000000000000001fe880000000000000000000000000101fe8000000000000000000000000000aa200100000000000000000000000000000000f99b0000000000000000000000000001fc000000000000000000000000000001670a00060000000000000000000000000000000000000001fe8000000000000000000000000000bbfc020000000000000000000000000001fe800000000000000000000000000013fc020000000000000000000000000000890300000000000001020000c2040000010104017fc910fe8000000000000000000000000000bb000c02020c00000000fe8800000000000000000000000000013c0e04070820020020010000000000000000000000000001fe880000000000000000000000000001fe8000000000000000000000000000bbfe8000000000000000000000000000aa00000000000000000000ffffffffffff00000000000000000000000000000000feb700000000000000000000000000aa0000000000000000000000000000000300004e2200004e21000000000000000000000000000000000000000900000003fffffffa00000003000000e30000000000000060000000050000004000000008000000470000000e000000000000009000000003000000030000000800d51dc63e00000800000004000000007fffffff00000004000000040000000100000774000000060000200c42a87c01e6792a168e3bd40ca35e3523a3c1b6170e0c"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x400, 0x70bd25, 0xffffffc2, {0x0, 0x0, 0x0, r6, {0xe, 0xb}, {0x4, 0x4}, {0xffe0, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40083) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x8000, @local, 0x8}]}, &(0x7f0000000180)=0x10) prlimit64(0x0, 0xf, &(0x7f0000000040)={0x0, 0x100}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000340)={0x0, 0x2}, &(0x7f0000000400)=0x8) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000440)=@ethtool_rxnfc={0x29, 0xd, 0x3, {0xc, @udp_ip4_spec={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, 0x4e21, 0x4e21, 0x6}, {0x0, @local, 0x3, 0x0, [0x4, 0x1]}, @ah_ip4_spec={@initdev={0xac, 0x1e, 0x1, 0x0}, @local, 0x86a, 0x8}, {0x0, @multicast, 0x2, 0x81, [0x874, 0x955]}, 0x55, 0x3}, 0x5, [0x40, 0x200, 0x1, 0xc2ba, 0x1]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x3d5094, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) 26m19.886821935s ago: executing program 2 (id=522): r0 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) r2 = openat$cgroup(r1, 0x0, 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000100)='cgroup.events\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000004000)={0x2020}, 0x2020) 26m18.822164474s ago: executing program 2 (id=525): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x9730514a12869b60, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x402201, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000240)={0x7, 0x6, 0x4, 0x7, 0xc, "2b747961b5a31e1e343bc41ebce1902d8936d4"}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000180001000000005955ee0e662d"], 0x24}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\a\x00\x00', @ANYRES16=r2, @ANYBLOB="0100040000000000000001000000080007007f0000001400020077673000"/42], 0x30}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) r9 = syz_io_uring_setup(0xf02, &(0x7f0000002100)={0x0, 0x191e}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f00000020c0)) io_uring_enter(r9, 0xf, 0x7929, 0x1, 0x0, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r11 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r11, 0xc0184800, &(0x7f0000000340)={0xe939, r10}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, &(0x7f00000004c0)={0x0, 0x0, r12}) 26m18.365131912s ago: executing program 32 (id=525): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x9730514a12869b60, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x402201, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000240)={0x7, 0x6, 0x4, 0x7, 0xc, "2b747961b5a31e1e343bc41ebce1902d8936d4"}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000180001000000005955ee0e662d"], 0x24}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\a\x00\x00', @ANYRES16=r2, @ANYBLOB="0100040000000000000001000000080007007f0000001400020077673000"/42], 0x30}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) r9 = syz_io_uring_setup(0xf02, &(0x7f0000002100)={0x0, 0x191e}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f00000020c0)) io_uring_enter(r9, 0xf, 0x7929, 0x1, 0x0, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r11 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r11, 0xc0184800, &(0x7f0000000340)={0xe939, r10}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, &(0x7f00000004c0)={0x0, 0x0, r12}) 18m15.532458365s ago: executing program 3 (id=1904): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x62040, 0x20) socket$netlink(0x10, 0x3, 0x9) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, 0x0, 0x0) write$bt_hci(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="5300030002"], 0x8) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r3, 0x3b71, &(0x7f0000000040)={0x20, 0x3, 0x0, 0x0, 0xffffffffffff7fff}) ioctl$IOMMU_IOAS_COPY$syz(r3, 0x3b83, &(0x7f00000009c0)={0x28, 0x4, r4, r4, 0x8000000000000001, 0xfffffffffffffffc, 0x9, 0x4}) 18m14.176059557s ago: executing program 3 (id=1905): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="91100400000000009500000000000000ab89becd60798ba0c7b340b02956c1c3822c3f572da76a3b992d243e0b89f6b734d5fdf6cb7955ac9702e4a18821040f9856a1bf21bf5e9b77a91e739c3ee223bb727fb18bc991da02854893b585f4465da763f2ac1d5e22ab728ef23681fe8fdf16f570082bdfadcd7f48aa86c2c12a78db90a7781fa547451f272ad46f8e5733fb606f040417634328cbf1b47957851ce3cbc4eb683cc45e48df30ead552a32564e7d1ab13b4aa22e4dd4970134ec08873d32468bed08369a2ec7cef09ea5af2dfc3dbf2f13954a41a"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) pipe2$watch_queue(0x0, 0x80) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$evdev(0x0, 0x2, 0x862b01) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000003c0)={0x54, 0x0, 0x0, {0xffff, 0x1}, {0x50, 0x2}, @cond=[{0x8, 0x5388, 0x8, 0x800, 0xcb, 0x7}, {0x0, 0x5, 0x1, 0x3, 0x6}]}) write$char_usb(r3, 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x0, 0xfffffffe, {0x7, 0x0, 0x0, 0x0, 0x80, 0xc2}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4004000) r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') preadv(r5, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r2, 0x0, 0x2c, 0x24044000, &(0x7f0000000380)={0x2, 0x4e22, @remote}, 0x10) r6 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) shmctl$IPC_RMID(r6, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/fib_triestat\x00') preadv(r7, &(0x7f0000000640)=[{&(0x7f0000000140)=""/134, 0x86}], 0x1, 0x0, 0x0) 18m2.663157314s ago: executing program 3 (id=1924): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x5c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66) 17m54.0963696s ago: executing program 3 (id=1936): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) r1 = dup(r0) write$cgroup_subtree(r1, &(0x7f00000005c0)=ANY=[], 0x32600) write$P9_RRENAME(r1, &(0x7f0000000300)={0x7, 0x15, 0x1}, 0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close_range(r3, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 17m48.665643224s ago: executing program 3 (id=1946): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x5c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x66) 17m40.352898453s ago: executing program 3 (id=1961): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000640), 0x42, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f00000e6000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x3c}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x89a3, &(0x7f00000000c0)={'ip6gretap0\x00', @ifru_names='gretap0\x00'}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 17m24.52669855s ago: executing program 33 (id=1961): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000640), 0x42, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f00000e6000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x3c}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x89a3, &(0x7f00000000c0)={'ip6gretap0\x00', @ifru_names='gretap0\x00'}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 12.006939707s ago: executing program 4 (id=6399): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f000001cb80)=@delchain={0x24, 0x2c, 0xf31, 0x80, 0x2000, {0x0, 0x0, 0x0, r5, {0xa}, {0xfff1, 0x6}, {0xffff, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008844}, 0x40000) 11.987586362s ago: executing program 4 (id=6400): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[@ANYRES16=0x0], 0x5c}, 0x1, 0x0, 0x0, 0x8081}, 0x1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000080)="0f01390ff2f63e0fa10f01c966b80a00000066ba000000000f300f79d80f232d0f01c966b9024d564b0f32350280660f38dfec", 0xfffffe3d}], 0x1, 0x4, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 11.806328439s ago: executing program 4 (id=6401): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000700)=0x8, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 11.05062557s ago: executing program 0 (id=6403): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x4001, 0x3, 0x200, 0x0, 0x700001b, 0x148, 0x0, 0x148, 0x1b8, 0x206, 0x240, 0x1b8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@loopback, @empty, 0xffffffff, 0x0, 'tunl0\x00', 'veth0_to_bond\x00', {0xff}, {}, 0x1}, 0x1ea, 0x70, 0xd0, 0x0, {0x390, 0x8f00}}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x2, 0x3, 0x1, 0x2, 0x7], 0x2, 0x5}, {0x0, [0x3, 0x6f455bfb4ce26171, 0x6, 0x6, 0x2, 0x21debfafc4f76fce], 0x3}}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xe2002454fb7b9fcc, 0xff, 'team0\x00', 'gre0\x00', {}, {0xff}, 0x8, 0x2, 0x5}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x10, 0x9, 0xf9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x260) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000380)={@dev={0xac, 0x14, 0x14, 0x1e}, @loopback}, 0x8) 11.049945076s ago: executing program 0 (id=6404): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x5d, 0x0, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x34, 0x6, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x4) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) timerfd_create(0x5, 0x81800) syz_emit_ethernet(0x15b, &(0x7f0000000880)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv4={0x800, @generic={{0x14, 0x4, 0x2, 0x8, 0x14d, 0x67, 0x0, 0x7, 0x2, 0x0, @multicast2, @broadcast, {[@lsrr={0x83, 0xf, 0x61, [@dev={0xac, 0x14, 0x14, 0x34}, @empty, @broadcast]}, @cipso={0x86, 0x6, 0x1}, @timestamp={0x44, 0x24, 0x2c, 0x0, 0x0, [0x1e, 0x27, 0x10001, 0x90a, 0x6, 0x35e4, 0x7fffffff, 0x4]}]}}, "b5b6225f5672c14afe0a64bbd617e8e1beb2d08258192c28bb334268814ea2708298965e642da062829af92a3fdf35d198730709a51134a1905ab89c081055ccad857db02f188cc307245a2af170c206bc49b3b3a87a8aa6f83f437aaf3b3c59a8b0234fcee026ebd9476aec0f9ca28b3c1041e199c54debdf7c5eafbd40cff62e4464a4bab63c54a6c5992c9ab1b1144625f424b76dac5fe12a890ac25c93b70f363fa6ac147de76d2b6e8f39c8db023a60078054abdb86b35fea8b29fe99b244b0d79d56f2bd29fa45e28decc79fc3ec7421b8e5bfefd6c3790d71f2b722d30b50fef07de2312f328db7269535f281acfe2438b63c7814a69d50185d"}}}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x20, &(0x7f0000000680)=[@cr4={0x1, 0x100280}], 0x1) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="a00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c0002800500010000000000"], 0xa0}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x78, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_REPLY={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x78}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x0, 0x1000, 0x0, {0x0, 0x1}, {0x48, 0x2}, @period={0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x4}, 0x0, 0x0}}) r9 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) write$char_usb(r9, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCSCLOCKID(r9, 0x400445a0, &(0x7f0000000340)=0x7) 10.867572826s ago: executing program 4 (id=6405): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x0, 0x5, 0x5, 0x9206, 0x5}, 0x3, 0x4}, [{0xe, 0x7, 0x3, 0x8, 0x3, 0x4df}, {0x8, 0x8, 0x40, 0x8, 0x5, 0x1}, {0x7e12f9c5, 0xffffff61, 0x0, 0x6b5, 0x80000000, 0x101}, {0x9, 0xb1f, 0x3, 0x1, 0x1, 0x2}, {0xfffffe01, 0x5, 0xb91, 0x8, 0x6, 0x4}, {0xfffffffe, 0x0, 0x0, 0xe49, 0x4, 0x15}, {0x1, 0xa, 0xc79, 0x5, 0x401, 0xfffffff4}, {0x7, 0x8c0, 0x5, 0xffffffff, 0x2, 0x10001}, {0xfffffffa, 0x1, 0x7, 0xffffffff, 0x1, 0xffffffff}, {0x1, 0x100, 0x0, 0x80000000, 0x7f6b, 0x1}, {0x154, 0x8, 0xb, 0x2, 0x7fffffff, 0xb3e4}, {0x36, 0x7, 0xffff, 0xfffffff7, 0x10, 0xf7bb}, {0x8, 0x7, 0x401, 0x1, 0x400, 0x8565}, {0x5, 0x4, 0x80000000, 0xc50, 0x7, 0xfffffffd}, {0x4, 0x101, 0x2, 0x6, 0x6, 0x2}, {0x1000, 0x800, 0xe, 0x1, 0x7ff, 0xe}, {0x1, 0x9, 0x7, 0x3, 0xfffffff9, 0x4}, {0x1, 0x200, 0x975f, 0x2, 0x400, 0x3dc4}, {0x100, 0x200, 0x98, 0xf9d6, 0xb}, {0x1, 0x83, 0xf9, 0x5, 0x3}, {0x8000, 0x7, 0x1, 0x9, 0xc9d, 0x2}, {0x81, 0x7fffffff, 0x2, 0x7fff, 0x7, 0x5}, {0x80, 0x4, 0x2, 0x1, 0xf403, 0xfffffff1}, {0xffff, 0xedf, 0xc, 0x8, 0x5, 0x1}, {0x0, 0x4, 0x8000, 0xfa8, 0x6, 0x1}, {0xa7d, 0x6, 0x6, 0x80, 0x3f9, 0x9}, {0x2f, 0xdfb, 0x8, 0x4b, 0x7, 0x1}, {0x9, 0x7ff, 0xa, 0x280000, 0x2, 0x1}, {0x138, 0x51d, 0xf, 0x6, 0x4, 0x7}, {0x1ff, 0x6, 0x8, 0x8, 0x4, 0xb}, {0x4, 0x2be2, 0x79f29323, 0x3ff, 0x2, 0x4}, {0xd4, 0x5, 0x5, 0x7, 0xea4c, 0xa4b1}, {0x993, 0x4, 0xfff, 0x23b06916, 0x6, 0xfffffffc}, {0x6, 0x4a6, 0x3, 0x80, 0x7ff, 0xa}, {0x7, 0xfffffffb, 0x0, 0xffffffff, 0x1, 0xfb3}, {0x5, 0xe6, 0xfff, 0x0, 0x1, 0x400}, {0xfffff1a2, 0xa, 0x7, 0xa1, 0x5, 0x4}, {0xbe, 0x2000, 0xffffffff, 0xfffffc00, 0xe06, 0x6}, {0x100, 0x2, 0x8, 0x4, 0x4, 0x9497}, {0xd, 0x8001, 0xf2b, 0xffffffff, 0x3, 0xfffffff3}, {0x2, 0x80000000, 0x5a, 0x1, 0x5, 0x6}, {0x4, 0xc378, 0x8, 0xf, 0x7, 0x8144}, {0x6, 0x81, 0x5, 0x5, 0x3}, {0x9, 0x8001, 0xe10, 0x783, 0x7, 0x3}, {0x7fff, 0x1, 0xe05, 0xffffad2a, 0x4, 0x99c}, {0x99eb, 0x6, 0x5, 0x2, 0x2, 0x1fe0000}, {0x800, 0x9, 0x2a3b, 0x4, 0x7, 0x9}, {0x2, 0x6, 0x0, 0x9, 0xe, 0xe}, {0x65d, 0x8000, 0x6, 0xfffffffe, 0x400, 0x1}, {0xfffffff8, 0x7, 0x6, 0xd4, 0x1000, 0x4}, {0x0, 0xc, 0x5, 0x3, 0xb9, 0x3}, {0x205, 0xfffffffd, 0x9, 0x4, 0x4, 0x6}, {0x1, 0x0, 0x4, 0x100, 0x9, 0xa}, {0x3, 0x2, 0x10, 0x2, 0x5, 0x3}, {0xfffffff8, 0xe, 0xfd0, 0x9, 0x0, 0x7fff}, {0xb, 0x7ff, 0x7, 0xffffff81, 0x9, 0x3}, {0x4, 0xff, 0x10001, 0x0, 0x3, 0x4}, {0x8, 0x8, 0x3ff, 0xbf, 0x7, 0x10}, {0x2f, 0xfffffe00, 0xc6000000, 0x81, 0x6, 0xffffff01}, {0x5, 0x44bd, 0x3, 0x8, 0x0, 0xffffffff}, {0x800000, 0xd, 0x4737, 0xf0000, 0x8405, 0x3}, {0xa4, 0x7, 0x7, 0x7, 0x6, 0xda73}, {0x9, 0x1, 0x7, 0x8971, 0x8, 0x8}, {0x8, 0x1, 0x6, 0x68, 0x7fff, 0x4}, {0x201, 0xf9c3, 0x5, 0x9, 0x0, 0x6c}, {0x5, 0x6, 0x6, 0x1, 0xf, 0x9}, {0x1, 0xf580, 0x3ff, 0x6, 0x6e, 0x6}, {0xad, 0x9, 0x7fff, 0x6, 0x8}, {0x862, 0x0, 0x2800000, 0x2, 0x8, 0x8}, {0x4, 0x90000, 0x2, 0x8d1, 0x1, 0x4}, {0x200, 0xb, 0x40, 0x9, 0xfffffff9, 0x2}, {0x8, 0xdbb, 0x4, 0x3, 0x7, 0xfff}, {0x7, 0x4, 0xce, 0x9, 0x6, 0x4}, {0x5ae2, 0x8, 0x8, 0x8, 0xfffffff0, 0x3ff}, {0x1, 0x5, 0x8, 0x7ff, 0x101, 0xffffffff}, {0x12, 0xa7, 0x6, 0x0, 0xc6, 0x4}, {0x4, 0x9, 0x9, 0xa, 0x9}, {0x84d5, 0xfffffffe, 0x7fffffff, 0x5, 0xf}, {0x5, 0x40, 0x8, 0xa, 0x6, 0x2}, {0x4, 0x100, 0x4d90, 0xf, 0xffffffd7, 0xffffffff}, {0x3, 0x10001, 0x2, 0x8, 0x82dc, 0xffff}, {0x6, 0x1, 0x2, 0xfffff402, 0x2}, {0x4, 0x6, 0xca6, 0x6, 0xb, 0xa}, {0xa, 0x4, 0x9, 0x8ec1, 0x1, 0x10000}, {0x2, 0x2, 0x1ff, 0x171a9022, 0xf4, 0x9000000}, {0x313, 0xfffffff8, 0x1, 0x0, 0x2, 0x1}, {0x5841, 0xfffffffb, 0x3, 0x40004, 0x3ff, 0x9f}, {0x10f, 0xca1c, 0x5, 0x8001, 0xa, 0x4}, {0x766, 0x7, 0x7, 0x7, 0x1, 0x5}, {0x7, 0xba, 0xfffffffd, 0x8001, 0x7ffd}, {0x1, 0x23, 0x3, 0x335, 0x4, 0x5}, {0x2, 0xc, 0x9, 0x0, 0x4, 0x8000}, {0x1, 0x8, 0xb7, 0x3, 0x9, 0x4}, {0x3c, 0x4, 0x1000, 0x2, 0xfff, 0x80000001}, {0x24, 0xffff, 0xd513, 0x748, 0x6eea, 0x4}, {0x57, 0x3, 0x40, 0xb, 0x3080d7c0}, {0x5, 0x7, 0x7, 0x48, 0x9}, {0x5, 0xf01, 0x2, 0x80001d, 0x2, 0x7}, {0x7fff, 0x66019165, 0x88, 0x6, 0x4}, {0x22, 0x0, 0x0, 0x168b, 0x9, 0x5}, {0x4, 0x9, 0x3, 0x3, 0x7fffffff, 0x3}, {0x6, 0x7, 0xfffffff5, 0x4, 0x9, 0x9}, {0x4, 0x8, 0x4, 0x8000, 0x8, 0x4}, {0x16, 0x6, 0x7, 0x5, 0xede, 0x5}, {0x9, 0x4, 0x7fffffff, 0x5, 0x7, 0x6125d06a}, {0xfff, 0x9, 0xda1, 0x521, 0x101, 0xd}, {0xdb2b, 0x1, 0x1, 0x9, 0x5, 0x800}, {0x3, 0x200, 0xfffffffe, 0xff, 0xff, 0x2}, {0x2, 0x5, 0x7, 0x62d, 0x5, 0x3ff}, {0x600, 0x4, 0x3, 0xb42f, 0x5, 0x3}, {0x401, 0x9, 0xc44, 0x3, 0x2, 0x6ea9894}, {0x624, 0xecdb, 0x8000, 0x6, 0x1b, 0x7}, {0x9, 0x2, 0x8, 0xf71, 0xfb0, 0x5}, {0x3, 0x4, 0x5908c254, 0x45c8, 0x2, 0x4}, {0x6, 0xff, 0x20000, 0x2, 0x221, 0x30000}, {0x8, 0x59bc, 0x7, 0x4, 0x0, 0x6}, {0xfffff001, 0x80000000, 0x8, 0x4, 0x644, 0x2}, {0x7, 0x2, 0x6, 0x9, 0xe, 0x3}, {0x2, 0x5, 0x101, 0x9199, 0x694, 0x66c}, {0x4, 0x2, 0x7, 0xc2, 0x69, 0xe5}, {0x8, 0x205a52ca, 0xdc, 0x3, 0x5, 0x4}, {0x2, 0x7, 0x7, 0xf47e, 0x8, 0x8}, {0x787, 0x2, 0x9, 0x3fe, 0x7, 0x5}, {0x0, 0x80000000, 0x5, 0x100, 0x6, 0x400}, {0x7, 0x3f8, 0x4, 0x0, 0x7, 0xfffffff9}, {0x7bce, 0xfffffffc, 0xfffffff8, 0x8001, 0x5, 0xf16}, {0xe, 0x3, 0x34b1, 0xb9a, 0x81, 0x800}, {0x101, 0x7, 0x4, 0x10000, 0x68063168, 0x81}], [{0x4, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x4}, {0x86f1faf2efed1208}, {0x4}, {0x2}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x5, 0x1}, {0x4}, {0x4}, {0x1, 0x1}, {0x3}, {0x5, 0x1}, {0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x2}, {0x2, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x2}, {}, {0x4}, {0x2}, {0x4}, {0x4}, {0x2}, {0x4, 0x1}, {0x4}, {0x1, 0x1}, {0x1}, {0x3}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x1}, {0x1, 0x1}, {}, {0x2}, {0x5}, {}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x1}, {}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x4, 0x1}, {0x1, 0x1}, {0x2}, {0x2}, {0x4, 0x1}, {0x0, 0xa22732b51f90c34a}, {0x1, 0x1}, {0x3, 0x1}, {0x2}, {0x6, 0x1}, {0x1, 0xa77fa159ed31b0c3}, {0x2}, {0x4, 0x1}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {}, {0x4}, {0x2}, {0x1}, {0x5}, {0x4}, {0x0, 0x1}, {0x7}, {0x1, 0x1}, {0x2}, {0x4, 0x1}, {0x4}, {0x4}, {0x4, 0x1}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x2}, {0x5, 0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x5}, {0x2}, {0x0, 0x1}, {0x4, 0xa845cf6605cfc9f5}, {0x1, 0x222ada2ec63376b7}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x4012}], 0x2}, 0x5) 10.818805528s ago: executing program 0 (id=6406): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x38}}, 0x0) 10.724436308s ago: executing program 0 (id=6408): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x7e, 0x21, 0x3, 0x60, @ipv4={'\x00', '\xff\xff', @loopback}, @loopback={0x300, 0x460c6}, 0x8000, 0x7, 0x80000000, 0x40}}) 6.599212747s ago: executing program 0 (id=6428): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x426}}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f00000003c0)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="12150001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.553636204s ago: executing program 4 (id=6430): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="240000006800010003001000fdffff7f000000000000000004000200080009"], 0x24}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) 6.414941538s ago: executing program 4 (id=6432): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000c00)={0x44, &(0x7f0000000500)={0x40, 0x14, 0x3, "e501c6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f00000001c0)={0x0, 0x10, 0x3, "61dcd7"}, 0x0, 0x0}) syz_clone3(&(0x7f0000000480)={0x440000000, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = socket$can_raw(0x1d, 0x3, 0x1) dup(r1) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@loopback, 0x0, 0xfffd, 0xffff, 0x1, 0xa}, {0x0, 0x3}, {0x0, 0x3, 0x42}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@empty, 0x0, 0x6c}, 0x0, @in6=@empty, 0x34ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x2}}, 0xe8) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) 6.359715008s ago: executing program 6 (id=6433): r0 = syz_usb_connect(0x0, 0x5d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000b36cec20ca08602058c60102030109024b0e01000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f00000001c0)={0x40, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001e40)={0x44, &(0x7f0000000bc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000001000)={0x1c, &(0x7f0000000800)={0x40, 0x9, 0x5, "840240a21f"}, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000300)={0x2c, &(0x7f0000000100)={0x0, 0x9}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000480)={0x0, 0x10, 0x4, "4972b8f8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.339956469s ago: executing program 5 (id=6439): sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0xffe0}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 5.241211393s ago: executing program 5 (id=6440): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_clone3(0x0, 0x0) 4.037943026s ago: executing program 1 (id=6442): userfaultfd(0x801) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_JITTER64={0xc, 0xb, 0x8000000000000000}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40008c5}, 0x0) 3.874745959s ago: executing program 1 (id=6443): r0 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x5e, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, &(0x7f0000000400)={0x40, 0xa0, 0x4, 0x1ff}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 3.038459262s ago: executing program 6 (id=6444): r0 = socket$unix(0x1, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x100003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_NON_HH_WEIGHT={0x8, 0x7, 0x1}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 2.994757295s ago: executing program 0 (id=6445): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000005c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x5}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x8, 0x8, 0x8, 0xc, 0x3}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}}, 0x4800) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r8 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x5dc}], 0x1}, 0x4) 2.837382573s ago: executing program 6 (id=6446): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000700)=0x8, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0, 0xfffffdef}}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 1.881005831s ago: executing program 6 (id=6447): ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r0, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TIOCSTI(r0, 0x5412, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000280)=0xb3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000001c0)=0xf9) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x5) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000140)=0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000200)=0xe7) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000240)=0x70) 1.522776684s ago: executing program 5 (id=6448): r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(0xffffffffffffffff, &(0x7f00000004c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast1}, 0x4, 0x1}}, 0x1a) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz0\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3f, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x40, 0x4, 0x25cd, 0x1, 0xb4, 0x4a, 0x80a2b9, 0x6, 0xb, 0xe4, 0x6, 0xfc000000, 0x2, 0xbbf, 0x4a732f64, 0x1, 0x3, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x1000, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x1, 0x1, 0x10401, 0xfffffff5, 0x404, 0xa7, 0x81, 0x9, 0x8001, 0x0, 0xff, 0x0, 0x4, 0x9, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x6, 0x8, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x8, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab000e0, 0x5, 0x6, 0x2, 0x1, 0x8003ff, 0x1ff, 0x1, 0x7fff, 0x6, 0x1cb, 0x1, 0x80000004, 0x8, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0x8, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10100a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x5, 0x97f7, 0x3, 0xd, 0x7, 0x603, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xe, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x9, 0x10000, 0xfefffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0x3, 0x1005, 0x1, 0x9, 0x1e, 0x9, 0x81, 0x3, 0x0, 0xd, 0xfffffff7, 0x6, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x98ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7ffc, 0x3, 0x6, 0xf, 0xe, 0x1, 0x269, 0x6, 0x1, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 1.290607678s ago: executing program 5 (id=6449): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x2}) ioctl(r0, 0xffffffff, 0x0) 1.122495864s ago: executing program 5 (id=6450): r0 = socket$inet6(0xa, 0x3, 0x38) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000040)=0xefbe, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x3, @loopback, 0xb}, 0x1c) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xf338}], 0x1) 1.046725085s ago: executing program 6 (id=6451): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x8000, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0x100000001, 0x2040) ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) recvmmsg(r2, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f00000003c0)=[{0x0}], 0x1, &(0x7f00000006c0)=""/199, 0xc7}, 0x2}, {{&(0x7f0000000b00)=@nfc_llcp, 0x80, &(0x7f0000000c00), 0x0, &(0x7f0000000c80)=""/222, 0xde}, 0x8f4edc0f}, {{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000000d80)=""/135, 0x87}, {&(0x7f0000000e40)=""/135, 0x87}, {&(0x7f0000000f00)=""/183, 0xb7}, {&(0x7f0000000fc0)=""/131, 0x83}, {&(0x7f0000001080)=""/90, 0x5a}], 0x5, &(0x7f0000001180)=""/229, 0xe5}, 0x6}], 0x3, 0x40010102, &(0x7f0000001380)={0x77359400}) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi2\x00', 0xaa42, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x10, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0xfffffffe}]}}}]}, 0x3c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) 878.39242ms ago: executing program 5 (id=6452): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x0, 0x5, 0x5, 0x9206, 0x5}, 0x3, 0x4}, [{0xe, 0x7, 0x3, 0x8, 0x3, 0x4df}, {0x8, 0x8, 0x40, 0x8, 0x5, 0x1}, {0x7e12f9c5, 0xffffff61, 0x0, 0x6b5, 0x80000000, 0x101}, {0x9, 0xb1f, 0x3, 0x1, 0x1, 0x2}, {0xfffffe01, 0x5, 0xb91, 0x8, 0x6, 0x4}, {0xfffffffe, 0x0, 0x0, 0xe49, 0x4, 0x15}, {0x1, 0xa, 0xc79, 0x5, 0x401, 0xfffffff4}, {0x7, 0x8c0, 0x5, 0xffffffff, 0x2, 0x10001}, {0xfffffffa, 0x1, 0x7, 0xffffffff, 0x1, 0xffffffff}, {0x1, 0x100, 0x0, 0x80000000, 0x7f6b, 0x1}, {0x154, 0x8, 0xb, 0x2, 0x7fffffff, 0xb3e4}, {0x36, 0x7, 0xffff, 0xfffffff7, 0x10, 0xf7bb}, {0x8, 0x7, 0x401, 0x1, 0x400, 0x8565}, {0x5, 0x4, 0x80000000, 0xc50, 0x7, 0xfffffffd}, {0x4, 0x101, 0x2, 0x6, 0x6, 0x2}, {0x1000, 0x800, 0xe, 0x1, 0x7ff, 0xe}, {0x1, 0x9, 0x7, 0x3, 0xfffffff9, 0x4}, {0x1, 0x200, 0x975f, 0x2, 0x400, 0x3dc4}, {0x100, 0x200, 0x98, 0xf9d6, 0xb}, {0x1, 0x83, 0xf9, 0x5, 0x3}, {0x8000, 0x7, 0x1, 0x9, 0xc9d, 0x2}, {0x81, 0x7fffffff, 0x2, 0x7fff, 0x7, 0x5}, {0x80, 0x4, 0x2, 0x1, 0xf403, 0xfffffff1}, {0xffff, 0xedf, 0xc, 0x8, 0x5, 0x1}, {0x0, 0x4, 0x8000, 0xfa8, 0x6, 0x1}, {0xa7d, 0x6, 0x6, 0x80, 0x3f9, 0x9}, {0x2f, 0xdfb, 0x8, 0x4b, 0x7, 0x1}, {0x9, 0x7ff, 0xa, 0x280000, 0x2, 0x1}, {0x138, 0x51d, 0xf, 0x6, 0x4, 0x7}, {0x1ff, 0x6, 0x8, 0x8, 0x4, 0xb}, {0x4, 0x2be2, 0x79f29323, 0x3ff, 0x2, 0x4}, {0xd4, 0x5, 0x5, 0x7, 0xea4c, 0xa4b1}, {0x993, 0x4, 0xfff, 0x23b06916, 0x6, 0xfffffffc}, {0x6, 0x4a6, 0x3, 0x80, 0x7ff, 0xa}, {0x7, 0xfffffffb, 0x0, 0xffffffff, 0x1, 0xfb3}, {0x5, 0xe6, 0xfff, 0x0, 0x1, 0x400}, {0xfffff1a2, 0xa, 0x7, 0xa1, 0x5, 0x4}, {0xbe, 0x2000, 0xffffffff, 0xfffffc00, 0xe06, 0x6}, {0x100, 0x2, 0x8, 0x4, 0x4, 0x9497}, {0xd, 0x8001, 0xf2b, 0xffffffff, 0x3, 0xfffffff3}, {0x2, 0x80000000, 0x5a, 0x1, 0x5, 0x6}, {0x4, 0xc378, 0x8, 0xf, 0x7, 0x8144}, {0x6, 0x81, 0x5, 0x5, 0x3}, {0x9, 0x8001, 0xe10, 0x783, 0x7, 0x3}, {0x7fff, 0x1, 0xe05, 0xffffad2a, 0x4, 0x99c}, {0x99eb, 0x6, 0x5, 0x2, 0x2, 0x1fe0000}, {0x800, 0x9, 0x2a3b, 0x4, 0x7, 0x9}, {0x2, 0x6, 0x0, 0x9, 0xe, 0xe}, {0x65d, 0x8000, 0x6, 0xfffffffe, 0x400, 0x1}, {0xfffffff8, 0x7, 0x6, 0xd4, 0x1000, 0x4}, {0x0, 0xc, 0x5, 0x3, 0xb9, 0x3}, {0x205, 0xfffffffd, 0x9, 0x4, 0x4, 0x6}, {0x1, 0x0, 0x4, 0x100, 0x9, 0xa}, {0x3, 0x2, 0x10, 0x2, 0x5, 0x3}, {0xfffffff8, 0xe, 0xfd0, 0x9, 0x0, 0x7fff}, {0xb, 0x7ff, 0x7, 0xffffff81, 0x9, 0x3}, {0x4, 0xff, 0x10001, 0x0, 0x3, 0x4}, {0x8, 0x8, 0x3ff, 0xbf, 0x7, 0x10}, {0x2f, 0xfffffe00, 0xc6000000, 0x81, 0x6, 0xffffff01}, {0x5, 0x44bd, 0x3, 0x8, 0x0, 0xffffffff}, {0x800000, 0xd, 0x4737, 0xf0000, 0x8405, 0x3}, {0xa4, 0x7, 0x7, 0x7, 0x6, 0xda73}, {0x9, 0x1, 0x7, 0x8971, 0x8, 0x8}, {0x8, 0x1, 0x6, 0x68, 0x7fff, 0x4}, {0x201, 0xf9c3, 0x5, 0x9, 0x0, 0x6c}, {0x5, 0x6, 0x6, 0x1, 0xf, 0x9}, {0x1, 0xf580, 0x3ff, 0x6, 0x6e, 0x6}, {0xad, 0x9, 0x7fff, 0x6, 0x8}, {0x862, 0x0, 0x2800000, 0x2, 0x8, 0x8}, {0x4, 0x90000, 0x2, 0x8d1, 0x1, 0x4}, {0x200, 0xb, 0x40, 0x9, 0xfffffff9, 0x2}, {0x8, 0xdbb, 0x4, 0x3, 0x7, 0xfff}, {0x7, 0x4, 0xce, 0x9, 0x6, 0x4}, {0x5ae2, 0x8, 0x8, 0x8, 0xfffffff0, 0x3ff}, {0x1, 0x5, 0x8, 0x7ff, 0x101, 0xffffffff}, {0x12, 0xa7, 0x6, 0x0, 0xc6, 0x4}, {0x4, 0x9, 0x9, 0xa, 0x9}, {0x84d5, 0xfffffffe, 0x7fffffff, 0x5, 0xf}, {0x5, 0x40, 0x8, 0xa, 0x6, 0x2}, {0x4, 0x100, 0x4d90, 0xf, 0xffffffd7, 0xffffffff}, {0x3, 0x10001, 0x2, 0x8, 0x82dc, 0xffff}, {0x6, 0x1, 0x2, 0xfffff402, 0x2}, {0x4, 0x6, 0xca6, 0x6, 0xb, 0xa}, {0xa, 0x4, 0x9, 0x8ec1, 0x1, 0x10000}, {0x2, 0x2, 0x1ff, 0x171a9022, 0xf4, 0x9000000}, {0x313, 0xfffffff8, 0x1, 0x0, 0x2, 0x1}, {0x5841, 0xfffffffb, 0x3, 0x40004, 0x3ff, 0x9f}, {0x10f, 0xca1c, 0x5, 0x8001, 0xa, 0x4}, {0x766, 0x7, 0x7, 0x7, 0x1, 0x5}, {0x7, 0xba, 0xfffffffd, 0x8001, 0x7ffd}, {0x1, 0x23, 0x3, 0x335, 0x4, 0x5}, {0x2, 0xc, 0x9, 0x0, 0x4, 0x8000}, {0x1, 0x8, 0xb7, 0x3, 0x9, 0x4}, {0x3c, 0x4, 0x1000, 0x2, 0xfff, 0x80000001}, {0x24, 0xffff, 0xd513, 0x748, 0x6eea, 0x4}, {0x57, 0x3, 0x40, 0xb, 0x3080d7c0}, {0x5, 0x7, 0x7, 0x48, 0x9}, {0x5, 0xf01, 0x2, 0x80001d, 0x2, 0x7}, {0x7fff, 0x66019165, 0x88, 0x6, 0x4}, {0x22, 0x0, 0x0, 0x168b, 0x9, 0x5}, {0x4, 0x9, 0x3, 0x3, 0x7fffffff, 0x3}, {0x6, 0x7, 0xfffffff5, 0x4, 0x9, 0x9}, {0x4, 0x8, 0x4, 0x8000, 0x8, 0x4}, {0x16, 0x6, 0x7, 0x5, 0xede, 0x5}, {0x9, 0x4, 0x7fffffff, 0x5, 0x7, 0x6125d06a}, {0xfff, 0x9, 0xda1, 0x521, 0x101, 0xd}, {0xdb2b, 0x1, 0x1, 0x9, 0x5, 0x800}, {0x3, 0x200, 0xfffffffe, 0xff, 0xff, 0x2}, {0x2, 0x5, 0x7, 0x62d, 0x5, 0x3ff}, {0x600, 0x4, 0x3, 0xb42f, 0x5, 0x3}, {0x401, 0x9, 0xc44, 0x3, 0x2, 0x6ea9894}, {0x624, 0xecdb, 0x8000, 0x6, 0x1b, 0x7}, {0x9, 0x2, 0x8, 0xf71, 0xfb0, 0x5}, {0x3, 0x4, 0x5908c254, 0x45c8, 0x2, 0x4}, {0x6, 0xff, 0x20000, 0x2, 0x221, 0x30000}, {0x8, 0x59bc, 0x7, 0x4, 0x0, 0x6}, {0xfffff001, 0x80000000, 0x8, 0x4, 0x644, 0x2}, {0x7, 0x2, 0x6, 0x9, 0xe, 0x3}, {0x2, 0x5, 0x101, 0x9199, 0x694, 0x66c}, {0x4, 0x2, 0x7, 0xc2, 0x69, 0xe5}, {0x8, 0x205a52ca, 0xdc, 0x3, 0x5, 0x4}, {0x2, 0x7, 0x7, 0xf47e, 0x8, 0x8}, {0x787, 0x2, 0x9, 0x3fe, 0x7, 0x5}, {0x0, 0x80000000, 0x5, 0x100, 0x6, 0x400}, {0x7, 0x3f8, 0x4, 0x0, 0x7, 0xfffffff9}, {0x7bce, 0xfffffffc, 0xfffffff8, 0x8001, 0x5, 0xf16}, {0xe, 0x3, 0x34b1, 0xb9a, 0x81, 0x800}, {0x101, 0x7, 0x4, 0x10000, 0x68063168, 0x81}], [{0x4, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x4}, {0x86f1faf2efed1208}, {0x4}, {0x2}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x5, 0x1}, {0x4}, {0x4}, {0x1, 0x1}, {0x3}, {0x5, 0x1}, {0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x2}, {0x2, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x2}, {}, {0x4}, {0x2}, {0x4}, {0x4}, {0x2}, {0x4, 0x1}, {0x4}, {0x1, 0x1}, {0x1}, {0x3}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x1}, {0x1, 0x1}, {}, {0x2}, {0x5}, {}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x1}, {}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x4, 0x1}, {0x1, 0x1}, {0x2}, {0x2}, {0x4, 0x1}, {0x0, 0xa22732b51f90c34a}, {0x1, 0x1}, {0x3, 0x1}, {0x2}, {0x6, 0x1}, {0x1, 0xa77fa159ed31b0c3}, {0x2}, {0x4, 0x1}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {}, {0x4}, {0x2}, {0x1}, {0x5}, {0x4}, {0x0, 0x1}, {0x7}, {0x1, 0x1}, {0x2}, {0x4, 0x1}, {0x4}, {0x4}, {0x4, 0x1}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x2}, {0x5, 0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x5}, {0x2}, {0x0, 0x1}, {0x4, 0xa845cf6605cfc9f5}, {0x1, 0x222ada2ec63376b7}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x4012}], 0x2}, 0x5) 408.121414ms ago: executing program 1 (id=6453): syz_open_dev$video(&(0x7f0000000440), 0x7, 0x1ebd41) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb2, 0x1c080, 0xa, 0x20002f7}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0x6}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00fea0"], 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x79, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x34d3, 0x16, 0x0, 0x0) 211.178346ms ago: executing program 1 (id=6454): r0 = gettid() timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) listen(r2, 0x2400000) mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x00000000']) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0x541b, &(0x7f0000000040)={0xffffffffffffffff, 0x1}) close_range(r3, 0xffffffffffffffff, 0x0) 103.138576ms ago: executing program 1 (id=6455): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40080) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001400038010"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1.524329ms ago: executing program 1 (id=6456): socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, 0x0, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x40, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x2804}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 6 (id=6457): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000700)=0x8, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r2, 0x0, 0x0, 0x4100, 0x0, 0x0) kernel console output (not intermixed with test programs): ed: No such file or directory [ 1705.347085][ T30] audit: type=1400 audit(1777643979.992:12489): avc: denied { node_bind } for pid=27700 comm="syz.0.5804" saddr=::ffff:0.0.0.0 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1705.564523][T27709] fuse: Bad value for 'fd' [ 1705.752023][ T10] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1705.922425][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 1705.941547][ T10] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1705.969172][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1705.998717][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1706.016294][T27727] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1706.024901][ T10] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1706.024966][ T10] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1706.024987][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1706.286450][ T10] usb 5-1: GET_CAPABILITIES returned 0 [ 1706.294262][ T10] usbtmc 5-1:16.0: can't read capabilities [ 1706.331517][ T13] net_ratelimit: 10 callbacks suppressed [ 1706.331532][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1706.352012][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1706.512908][ T10] usb 5-1: USB disconnect, device number 65 [ 1707.013265][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1707.027639][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1707.177207][T27781] overlayfs: failed to resolve './file1': -2 [ 1707.602227][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1707.616692][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1707.813987][T22634] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 1707.879403][ T30] audit: type=1326 audit(1777643982.378:12490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27817 comm="syz.6.5852" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4979b9cdd9 code=0x0 [ 1707.951330][ T30] audit: type=1400 audit(1777643982.444:12491): avc: denied { create } for pid=27823 comm="syz.4.5854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1708.006840][T22634] usb 6-1: Using ep0 maxpacket: 8 [ 1708.013522][T22634] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1708.025740][T22634] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1708.045141][T22634] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1708.065082][T22634] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1708.083818][T22634] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1708.100932][T22634] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1708.187888][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1708.202351][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1708.328046][ T10] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1708.333626][T22634] usb 6-1: GET_CAPABILITIES returned 0 [ 1708.342544][T22634] usbtmc 6-1:16.0: can't read capabilities [ 1708.499010][ T10] usb 1-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x2C, changing to 0xC [ 1708.510814][ T10] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0xC has invalid wMaxPacketSize 0 [ 1708.520770][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1708.528955][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1708.538195][ T10] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1708.546441][ T10] usb 1-1: Product: syz [ 1708.548050][T27810] 9pnet_fd: p9_fd_create_tcp (27810): problem connecting socket to 127.0.0.1 [ 1708.550620][ T10] usb 1-1: Manufacturer: syz [ 1708.564332][ T10] usb 1-1: SerialNumber: syz [ 1708.566882][T22634] usb 6-1: USB disconnect, device number 90 [ 1708.576356][ T10] usb 1-1: config 0 descriptor?? [ 1708.601535][ T10] usb 1-1: selecting invalid altsetting 0 [ 1708.673326][T27844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1708.687056][T27844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1708.767015][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1708.781474][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1708.823058][ T10] usb 1-1: USB disconnect, device number 118 [ 1709.944000][ T30] audit: type=1326 audit(1777643984.306:12492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27873 comm="syz.5.5872" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8b659cdd9 code=0x0 [ 1710.673538][T27898] binder: 27897:27898 ioctl c0306201 2000000003c0 returned -14 [ 1710.752543][ T30] audit: type=1400 audit(1777643985.055:12493): avc: denied { create } for pid=27899 comm="syz.4.5883" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1710.777145][T27900] netlink: 220 bytes leftover after parsing attributes in process `syz.4.5883'. [ 1710.822227][ T30] audit: type=1400 audit(1777643985.092:12494): avc: denied { write } for pid=27899 comm="syz.4.5883" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1710.867260][ T30] audit: type=1400 audit(1777643985.092:12495): avc: denied { nlmsg_write } for pid=27899 comm="syz.4.5883" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1711.013153][T27917] program syz.0.5890 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1711.093500][T27922] syzkaller1: entered promiscuous mode [ 1711.103559][T27922] syzkaller1: entered allmulticast mode [ 1711.648836][T27947] Bluetooth: (null): Invalid header checksum [ 1712.089838][T17395] net_ratelimit: 10 callbacks suppressed [ 1712.089854][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1712.110404][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1712.622909][T22639] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 1712.668651][T27989] fuse: Bad value for 'fd' [ 1712.708264][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1712.723688][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1712.796627][T22639] usb 1-1: Using ep0 maxpacket: 8 [ 1712.817489][T22639] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1712.836246][T22639] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1712.866439][T22639] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1712.891859][T22639] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1712.908588][T22639] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1712.932839][T22639] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1713.173048][T22639] usb 1-1: GET_CAPABILITIES returned 0 [ 1713.190726][T22639] usbtmc 1-1:16.0: can't read capabilities [ 1713.296150][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1713.310805][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1713.376091][T28005] binder: 28004:28005 ioctl c0306201 2000000003c0 returned -14 [ 1713.415621][T22773] usb 1-1: USB disconnect, device number 119 [ 1713.481240][T28007] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5925'. [ 1713.566396][T28007] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1713.584991][T28015] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 1713.611833][T28016] input: syz0 as /devices/virtual/input/input146 [ 1713.711534][T28020] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5932'. [ 1713.774867][T28007] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1713.919574][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1713.934103][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1714.438295][T28038] binder: BINDER_SET_CONTEXT_MGR already set [ 1714.456836][T28038] binder: 28037:28038 ioctl 4018620d 200000000040 returned -16 [ 1714.514030][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1714.528563][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1714.654926][ T10] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 1714.823902][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 1714.842115][ T10] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 1714.854220][ T10] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1714.864481][ T10] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1714.873750][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1714.888582][ T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1714.914293][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1714.930908][ T10] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1714.941686][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1714.952387][ T10] usb 7-1: config 0 descriptor?? [ 1715.079863][T28056] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5944'. [ 1715.181515][ T10] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 64 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1715.207702][ T10] usb 7-1: USB disconnect, device number 64 [ 1715.229504][ T10] usblp0: removed [ 1715.304773][T22640] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1715.489916][T22640] usb 1-1: Using ep0 maxpacket: 8 [ 1715.507857][T22640] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1715.532259][T22640] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1715.558478][T22640] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1715.587173][T22640] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1715.630373][T22640] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1715.640084][T22640] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1715.763850][ T10] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 1715.883312][T22640] usb 1-1: GET_CAPABILITIES returned 0 [ 1715.900197][T22640] usbtmc 1-1:16.0: can't read capabilities [ 1715.956974][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 1715.972647][ T10] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 1715.997130][ T10] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1716.010182][ T10] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1716.019315][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1716.057734][ T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1716.075122][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1716.089435][ T10] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1716.105682][T22640] usb 1-1: USB disconnect, device number 120 [ 1716.122805][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1716.155235][ T10] usb 7-1: config 0 descriptor?? [ 1716.387694][ T10] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 65 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1716.611177][T23360] usb 7-1: USB disconnect, device number 65 [ 1716.635182][T23360] usblp0: removed [ 1717.224255][T28121] overlayfs: missing 'workdir' [ 1717.357749][T28126] kvm: MWAIT instruction emulated as NOP! [ 1717.954969][ T1168] net_ratelimit: 10 callbacks suppressed [ 1717.954984][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1717.975297][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1718.325434][T28158] overlayfs: missing 'lowerdir' [ 1718.454146][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.482785][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.503994][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.516688][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.529579][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.539452][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1718.553793][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1718.566444][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.612021][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.645533][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.682046][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.703807][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.730410][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.757610][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.784723][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.810485][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.826837][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.848211][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.870344][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.891503][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.913791][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.928490][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.943902][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.956250][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1718.987877][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.009448][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.031987][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.059263][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.069458][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.092495][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.113186][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.131394][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.162496][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1719.176857][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1719.193788][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.208365][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.219586][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.226963][T28182] binder: 28181:28182 ioctl c0306201 200000000080 returned -14 [ 1719.229574][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.273285][T28182] binder: 28181:28182 ioctl c0306201 2000000003c0 returned -14 [ 1719.286635][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.316604][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.347400][T28167] 9pnet_fd: p9_fd_create_tcp (28167): problem connecting socket to 127.0.0.1 [ 1719.474160][T28195] overlayfs: missing 'lowerdir' [ 1719.643304][T22639] usb 7-1: new high-speed USB device number 66 using dummy_hcd [ 1719.772997][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1719.787531][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1719.839713][T22639] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 1719.849024][T22639] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1719.859408][T22639] usb 7-1: config 0 has no interface number 0 [ 1719.867434][T22639] usb 7-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 1719.876602][T22640] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1719.885223][T22639] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1719.893803][T22639] usb 7-1: Product: syz [ 1719.898004][T22639] usb 7-1: Manufacturer: syz [ 1719.903194][T22639] usb 7-1: SerialNumber: syz [ 1719.909698][T22639] usb 7-1: config 0 descriptor?? [ 1719.918235][T22639] ims_pcu 7-1:0.41: Missing CDC union descriptor [ 1719.924757][T22639] ims_pcu 7-1:0.41: probe with driver ims_pcu failed with error -22 [ 1720.049694][T22640] usb 1-1: Using ep0 maxpacket: 8 [ 1720.059167][T22640] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1720.069302][T22640] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1720.079192][T22640] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1720.090261][T22640] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1720.100725][T22640] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1720.114055][T22640] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1720.123259][T22640] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1720.139310][T28189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1720.152126][T28189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1720.163136][T22639] usb 7-1: USB disconnect, device number 66 [ 1720.349248][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1720.363689][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1720.392873][T22640] usb 1-1: GET_CAPABILITIES returned 59 [ 1720.409381][T22640] usbtmc 1-1:16.0: can't read capabilities [ 1720.514452][T28223] xt_hashlimit: size too large, truncated to 1048576 [ 1720.575839][T28225] bridge_slave_0 (unregistering): left promiscuous mode [ 1720.582113][T28228] overlayfs: missing 'lowerdir' [ 1720.600374][T28225] bridge0: port 1(bridge_slave_0) entered disabled state [ 1720.626899][T22773] usb 1-1: USB disconnect, device number 121 [ 1720.935664][T28242] binder: 28241:28242 ioctl c0306201 0 returned -14 [ 1721.088893][T28256] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1721.120641][T28256] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 1721.145652][T28256] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1721.166571][T28258] overlayfs: failed to resolve './file0': -2 [ 1721.398626][T28278] xt_hashlimit: size too large, truncated to 1048576 [ 1721.439349][ T10] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 1721.470819][ T30] audit: type=1326 audit(1777643995.086:12496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28267 comm="syz.0.6027" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f75cb99cdd9 code=0x0 [ 1721.664870][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1721.676675][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1721.687512][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1721.710432][ T10] usb 7-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice= 0.40 [ 1721.730549][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1721.746489][ T10] usb 7-1: Product: syz [ 1721.751286][ T10] usb 7-1: Manufacturer: syz [ 1721.751419][T28292] fuse: Bad value for 'fd' [ 1721.755927][ T10] usb 7-1: SerialNumber: syz [ 1721.990946][ T10] usb 7-1: 0:1 : does not exist [ 1721.997463][ T10] usb 7-1: 0:2 : does not exist [ 1722.027743][ T10] snd_usb_podhd 7-1:1.0: Line 6 POD HD500X found [ 1722.034116][ T10] usb 7-1: selecting invalid altsetting 1 [ 1722.039926][ T10] snd_usb_podhd 7-1:1.0: set_interface failed [ 1722.046142][ T10] snd_usb_podhd 7-1:1.0: Line 6 POD HD500X now disconnected [ 1722.055883][ T10] snd_usb_podhd 7-1:1.0: probe with driver snd_usb_podhd failed with error -22 [ 1722.067341][ T10] usb 7-1: USB disconnect, device number 67 [ 1722.085804][T13068] udevd[13068]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1722.219100][T22773] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1722.389621][T22773] usb 5-1: Using ep0 maxpacket: 8 [ 1722.400781][T22773] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1722.417525][T22773] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1722.428158][T22773] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1722.451313][T22773] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1722.462814][T22773] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1722.476472][T22773] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1722.485643][T28316] xt_hashlimit: size too large, truncated to 1048576 [ 1722.485642][T22773] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1722.717503][T28322] fuse: Bad value for 'fd' [ 1722.723260][T22773] usb 5-1: GET_CAPABILITIES returned 59 [ 1722.738651][T22773] usbtmc 5-1:16.0: can't read capabilities [ 1723.057800][T22773] usb 5-1: USB disconnect, device number 66 [ 1723.268789][T21755] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1723.283179][T21755] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1723.293017][T22640] usb 7-1: new high-speed USB device number 68 using dummy_hcd [ 1723.300749][T21755] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1723.321153][T21755] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1723.330343][T21755] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1723.452169][ T30] audit: type=1400 audit(1777643996.949:12497): avc: denied { append } for pid=28346 comm="syz.5.6055" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1723.522304][T22640] usb 7-1: Using ep0 maxpacket: 32 [ 1723.531513][T22640] usb 7-1: config index 0 descriptor too short (expected 3659, got 75) [ 1723.560876][T22640] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1723.578016][T22634] usb 2-1: USB disconnect, device number 95 [ 1723.604911][T22640] usb 7-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 1723.604941][T22640] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.604961][T22640] usb 7-1: Product: syz [ 1723.604975][T22640] usb 7-1: Manufacturer: syz [ 1723.604991][T22640] usb 7-1: SerialNumber: syz [ 1723.635504][T22640] usb 7-1: config 0 descriptor?? [ 1723.642081][T22640] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 1723.695931][ T13] net_ratelimit: 10 callbacks suppressed [ 1723.695946][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1723.733042][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1724.285002][T22640] gspca_sunplus: reg_r err -32 [ 1724.291763][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1724.291791][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1724.740540][ T3319] bridge_slave_1: left allmulticast mode [ 1724.758278][ T3319] bridge_slave_1: left promiscuous mode [ 1724.775890][ T3319] bridge0: port 2(bridge_slave_1) entered disabled state [ 1724.815946][ T3319] dvmrp6: left allmulticast mode [ 1724.838362][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1724.852723][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1725.017658][ T3319] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 1725.200036][T23172] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1725.345086][ T3319] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1725.354270][ T3319] bond0 (unregistering): Released all slaves [ 1725.360620][T23172] usb 5-1: Using ep0 maxpacket: 8 [ 1725.365066][ T3319] bond1 (unregistering): Released all slaves [ 1725.367796][T23172] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1725.379953][T23172] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1725.393586][T23172] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1725.403767][T23172] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1725.418469][T23172] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1725.446503][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1725.460895][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1725.475713][T22640] sunplus 7-1:0.0: probe with driver sunplus failed with error -32 [ 1725.486042][T23172] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1725.495211][T23172] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1725.506929][T28336] bridge0: port 1(bridge_slave_0) entered blocking state [ 1725.542547][T28336] bridge0: port 1(bridge_slave_0) entered disabled state [ 1725.552658][T17502] Bluetooth: hci4: command tx timeout [ 1725.569811][T28336] bridge_slave_0: entered allmulticast mode [ 1725.600586][T28336] bridge_slave_0: entered promiscuous mode [ 1725.608917][T28336] bridge0: port 2(bridge_slave_1) entered blocking state [ 1725.616189][T28336] bridge0: port 2(bridge_slave_1) entered disabled state [ 1725.616564][ T3319] IPVS: stopping backup sync thread 27557 ... [ 1725.623518][T28336] bridge_slave_1: entered allmulticast mode [ 1725.624924][T28336] bridge_slave_1: entered promiscuous mode [ 1725.635343][T28408] overlayfs: missing 'lowerdir' [ 1725.663237][T28336] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1725.720564][T28336] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1725.739806][T23172] usb 5-1: GET_CAPABILITIES returned 59 [ 1725.763937][T23172] usbtmc 5-1:16.0: can't read capabilities [ 1725.931746][T28336] team0: Port device team_slave_0 added [ 1725.967206][T28336] team0: Port device team_slave_1 added [ 1725.973623][T23360] usb 5-1: USB disconnect, device number 67 [ 1726.060334][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1726.074725][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1726.126568][ T3319] hsr_slave_0: left promiscuous mode [ 1726.154327][ T3319] hsr_slave_1: left promiscuous mode [ 1726.167455][ T3319] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1726.437107][ T3319] team0 (unregistering): Port device team_slave_1 removed [ 1726.449715][ T3319] team0 (unregistering): Port device team_slave_0 removed [ 1726.575419][T22769] usb 7-1: USB disconnect, device number 68 [ 1726.728974][T28336] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1726.736115][T28336] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1726.765217][T28336] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1726.777586][ T5272] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1726.807806][T28436] syzkaller1: entered promiscuous mode [ 1726.813580][T28436] syzkaller1: entered allmulticast mode [ 1726.824746][T28336] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1726.856850][T28336] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1726.911232][T28336] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1727.012908][T28455] overlayfs: missing 'lowerdir' [ 1727.139009][T28336] hsr_slave_0: entered promiscuous mode [ 1727.167315][T28336] hsr_slave_1: entered promiscuous mode [ 1727.182571][T28336] debugfs: 'hsr0' already exists in 'hsr' [ 1727.189268][T28336] Cannot create hsr debugfs directory [ 1727.626042][T22769] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 1727.796948][T17502] Bluetooth: hci4: command tx timeout [ 1727.831151][T22769] usb 7-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 1727.840563][T22769] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1727.860134][T22769] usb 7-1: Product: syz [ 1727.871879][T22769] usb 7-1: Manufacturer: syz [ 1727.881288][T22769] usb 7-1: SerialNumber: syz [ 1727.897110][T22769] usb 7-1: config 0 descriptor?? [ 1728.151129][T22769] mos7840 7-1:0.0: required endpoints missing [ 1728.163878][T22769] usb 7-1: USB disconnect, device number 69 [ 1728.344816][T22634] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1728.525184][T22634] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 1728.533384][T22634] usb 6-1: config 1 has no interface number 0 [ 1728.539859][T22634] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1728.562294][T22634] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1728.585333][T22634] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1728.598700][T22634] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1728.608030][T22634] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1728.616189][T22634] usb 6-1: Product: syz [ 1728.620501][T22634] usb 6-1: Manufacturer: syz [ 1728.625128][T22634] usb 6-1: SerialNumber: syz [ 1728.634316][T28490] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1729.004284][T23360] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 1729.076759][T28490] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1729.166660][T23360] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1729.175686][T23360] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1729.186331][T23360] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1729.195463][T23360] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1729.206646][T23360] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1729.228381][T23360] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1729.237617][T23360] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1729.249066][T23360] usb 7-1: Product: syz [ 1729.253433][T23360] usb 7-1: Manufacturer: syz [ 1729.272112][T23360] cdc_wdm 7-1:1.0: skipping garbage [ 1729.279365][T23360] cdc_wdm 7-1:1.0: skipping garbage [ 1729.295947][T23360] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 1729.301897][T23360] cdc_wdm 7-1:1.0: Unknown control protocol [ 1729.364060][T17395] net_ratelimit: 10 callbacks suppressed [ 1729.364078][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1729.384356][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1729.401609][T22634] usb 6-1: Incompatible driver and firmware versions [ 1729.418518][T22634] usb 6-1: USB disconnect, device number 91 [ 1729.987448][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1730.002178][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1730.003349][T17502] Bluetooth: hci4: command tx timeout [ 1730.076269][T23172] usb 7-1: USB disconnect, device number 70 [ 1730.458767][ T5272] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1730.472504][ T3319] IPVS: stop unused estimator thread 0... [ 1730.564445][T23172] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 1730.576176][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1730.590677][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1730.607241][T22769] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1730.731819][T23172] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 1730.740751][T23172] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1730.755592][T23172] usb 7-1: config 0 has no interface number 0 [ 1730.777491][T23172] usb 7-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 1730.788933][T22769] usb 6-1: Using ep0 maxpacket: 8 [ 1730.792627][T23172] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1730.828690][T23172] usb 7-1: Product: syz [ 1730.838306][T22769] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1730.847936][T23172] usb 7-1: Manufacturer: syz [ 1730.861552][T22769] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1730.871512][T23172] usb 7-1: SerialNumber: syz [ 1730.901284][T22769] usb 6-1: Product: syz [ 1730.908480][T23172] usb 7-1: config 0 descriptor?? [ 1730.910375][T22769] usb 6-1: Manufacturer: syz [ 1730.933235][T22769] usb 6-1: SerialNumber: syz [ 1730.937879][T23172] ims_pcu 7-1:0.41: Missing CDC union descriptor [ 1730.940862][T22769] usb 6-1: config 0 descriptor?? [ 1730.973029][T23172] ims_pcu 7-1:0.41: probe with driver ims_pcu failed with error -22 [ 1731.154598][T28501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1731.163463][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1731.167191][T28501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1731.177871][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1731.190449][T22769] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1731.282681][T23172] usb 7-1: USB disconnect, device number 71 [ 1731.454973][T28536] input: syz0 as /devices/virtual/input/input148 [ 1731.478002][T22769] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1731.535253][T22769] usb 6-1: USB disconnect, device number 92 [ 1731.773222][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1731.787864][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1732.192608][T28575] input: syz0 as /devices/virtual/input/input149 [ 1732.221104][T17502] Bluetooth: hci4: command tx timeout getty: ttyS0: read error: Resource temporarily unavailable [ 1732.811641][T22769] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 1732.990675][T22769] usb 7-1: Using ep0 maxpacket: 8 [ 1733.008722][T22769] usb 7-1: config 0 has an invalid interface number: 33 but max is 1 [ 1733.029166][T22769] usb 7-1: config 0 has no interface number 1 [ 1733.040636][T22769] usb 7-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 1733.060447][T22769] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 1733.092950][T22769] usb 7-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 1733.102486][T22769] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1733.122004][T22769] usb 7-1: Product: syz [ 1733.126245][T22769] usb 7-1: Manufacturer: syz [ 1733.144624][T22769] usb 7-1: SerialNumber: syz [ 1733.161810][T22769] usb 7-1: config 0 descriptor?? [ 1733.178128][T22769] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 1733.599136][T22769] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 1733.607071][ T2354] pvrusb2: Invalid read control endpoint [ 1733.639177][T22769] usb 7-1: USB disconnect, device number 72 [ 1733.647745][ T2354] usb 7-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 1733.672987][ T2354] usb 7-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 1734.245594][T28625] overlayfs: missing 'lowerdir' [ 1735.116821][ T1168] net_ratelimit: 10 callbacks suppressed [ 1735.116839][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1735.136924][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1735.227973][T28336] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1735.236710][T28336] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1735.257725][T28336] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1735.276625][T28336] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1735.309879][T28336] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1735.340921][T28336] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1735.370460][T28336] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1735.390486][T28336] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1735.494130][T28644] 9pnet_fd: p9_fd_create_tcp (28644): problem connecting socket to 127.0.0.1 [ 1735.547570][T28336] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1735.575768][T28336] 8021q: adding VLAN 0 to HW filter on device team0 [ 1735.611895][T12692] bridge0: port 1(bridge_slave_0) entered blocking state [ 1735.619043][T12692] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1735.628650][ T30] audit: type=1400 audit(1777644008.337:12498): avc: denied { create } for pid=28649 comm="syz.4.6125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1735.681184][T12692] bridge0: port 2(bridge_slave_1) entered blocking state [ 1735.688340][T12692] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1735.696046][ T30] audit: type=1400 audit(1777644008.403:12499): avc: denied { associate } for pid=28649 comm="syz.4.6125" name="hugetlb.2MB.rsvd.usage_in_bytes" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1735.697678][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1735.734271][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1736.308136][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1736.322488][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1736.879949][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1736.894316][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1737.460180][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1737.474460][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1737.994562][ T30] audit: type=1400 audit(1777644010.555:12500): avc: denied { connect } for pid=28682 comm="syz.0.6133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1738.039784][ T30] audit: type=1400 audit(1777644010.583:12501): avc: denied { write } for pid=28682 comm="syz.0.6133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1738.468376][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1739.256423][T28704] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1739.267908][T28704] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1739.340246][T28336] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1739.448829][T28336] veth0_vlan: entered promiscuous mode [ 1739.461948][T28336] veth1_vlan: entered promiscuous mode [ 1739.488495][T28336] veth0_macvtap: entered promiscuous mode [ 1739.498338][T28336] veth1_macvtap: entered promiscuous mode [ 1739.516717][T28336] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1739.532910][T28336] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1739.545457][T12692] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1739.561718][T12692] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1739.585359][T12692] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1739.605149][T12692] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1739.669905][T23360] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1739.772460][ T636] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1739.797233][ T636] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1739.832360][T12692] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1739.841104][T12692] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1739.867419][T23360] usb 5-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 1739.881353][T23360] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1739.894277][T23360] usb 5-1: Product: syz [ 1739.903034][T23360] usb 5-1: Manufacturer: syz [ 1739.915843][T23360] usb 5-1: SerialNumber: syz [ 1739.934909][T23360] usb 5-1: config 0 descriptor?? [ 1740.191726][T23360] mos7840 5-1:0.0: required endpoints missing [ 1740.230963][T23360] usb 5-1: USB disconnect, device number 68 [ 1740.499848][T21755] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1740.515209][T21755] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1740.526725][T21755] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1740.544707][T21755] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1740.555299][T21755] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1740.793397][T12692] net_ratelimit: 10 callbacks suppressed [ 1740.793415][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1740.813479][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1740.999756][T28746] syzkaller0: entered promiscuous mode [ 1741.005558][T28746] syzkaller0: entered allmulticast mode [ 1741.389431][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1741.403793][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1741.978917][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1741.993295][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1742.626433][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1742.640988][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1742.827227][T17502] Bluetooth: hci0: command tx timeout [ 1743.072057][T28773] overlayfs: missing 'lowerdir' [ 1743.077304][T23172] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1743.238965][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1743.253342][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1743.273557][T23172] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1743.283140][T23172] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1743.310886][T23172] usb 6-1: Product: syz [ 1743.321376][T23172] usb 6-1: Manufacturer: syz [ 1743.326232][T23172] usb 6-1: SerialNumber: syz [ 1743.349505][T23172] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1743.376739][T22634] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 syzkaller syzkaller login: [ 1744.531316][T22634] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1744.538630][T22634] ath9k_htc: Failed to initialize the device [ 1744.572839][T22634] usb 6-1: ath9k_htc: USB layer deinitialized [ 1744.614142][T23172] usb 6-1: USB disconnect, device number 93 [ 1745.046712][T17502] Bluetooth: hci0: command tx timeout [ 1745.624045][ T30] audit: type=1400 audit(1777644017.695:12502): avc: denied { create } for pid=28820 comm="syz.1.6175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1745.702949][T28724] bridge0: port 1(bridge_slave_0) entered blocking state [ 1745.710167][T28724] bridge0: port 1(bridge_slave_0) entered disabled state [ 1745.717433][T28724] bridge_slave_0: entered allmulticast mode [ 1745.724188][T28724] bridge_slave_0: entered promiscuous mode [ 1745.732129][T28724] bridge0: port 2(bridge_slave_1) entered blocking state [ 1745.740479][T28724] bridge0: port 2(bridge_slave_1) entered disabled state [ 1745.747711][T28724] bridge_slave_1: entered allmulticast mode [ 1745.755002][T28724] bridge_slave_1: entered promiscuous mode [ 1745.806836][T28724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1745.818154][T28724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1745.840340][T28724] team0: Port device team_slave_0 added [ 1745.847438][T28724] team0: Port device team_slave_1 added [ 1745.864898][T28724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1745.866868][ T5713] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1745.872245][T28724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1745.907547][T28724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1745.919775][T28724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1745.926869][T28724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1745.952888][T28724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1745.987868][T28724] hsr_slave_0: entered promiscuous mode [ 1745.994442][T28724] hsr_slave_1: entered promiscuous mode [ 1746.001227][T28724] debugfs: 'hsr0' already exists in 'hsr' [ 1746.007094][T28724] Cannot create hsr debugfs directory [ 1746.037948][T23360] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1746.048166][ T5713] usb 6-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1746.060516][ T5713] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1746.071905][ T5713] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1746.083645][ T5713] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1746.093383][ T5713] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1746.105117][T28823] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1746.151281][T28724] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1746.200131][T23360] usb 2-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1746.211940][T23360] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1746.223744][T23360] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1746.235887][T23360] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1746.245155][T23360] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1746.262801][T28831] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1746.339070][T28724] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1746.425262][T28724] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1746.471333][T28724] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1746.572184][ T3319] net_ratelimit: 10 callbacks suppressed [ 1746.572199][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1746.592300][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1746.712308][ T30] audit: type=1400 audit(1777644018.715:12503): avc: denied { write } for pid=28724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1746.714658][T28724] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1746.734274][ T30] audit: type=1400 audit(1777644018.715:12504): avc: denied { read } for pid=28724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1746.764861][T28724] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1746.772814][T28724] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1746.781385][T28724] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1746.789675][T28724] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1746.798554][T28724] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1746.806272][T28724] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1746.814888][T28724] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1746.860181][T28724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1746.878733][T28724] 8021q: adding VLAN 0 to HW filter on device team0 [ 1746.888804][T17395] bridge0: port 1(bridge_slave_0) entered blocking state [ 1746.895904][T17395] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1746.908892][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 1746.916055][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1747.151413][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1747.165747][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1747.206066][T28724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1747.266707][T17502] Bluetooth: hci0: command tx timeout [ 1747.308635][T28724] veth0_vlan: entered promiscuous mode [ 1747.325465][T28724] veth1_vlan: entered promiscuous mode [ 1747.347476][T28724] veth0_macvtap: entered promiscuous mode [ 1747.355631][T28724] veth1_macvtap: entered promiscuous mode [ 1747.369870][T28724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1747.383246][T28724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1747.396722][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.405465][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.414913][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.423998][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.553776][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1747.567642][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1747.632481][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1747.640391][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1747.737985][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1747.752439][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1748.006247][T28876] fuse: Bad value for 'fd' [ 1748.335475][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1748.349842][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1748.484925][ T804] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1748.645241][ T804] usb 1-1: Using ep0 maxpacket: 32 [ 1748.651672][ T804] usb 1-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1748.662995][ T804] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1748.669777][ T804] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 1748.679282][ T804] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1748.689203][ T804] usb 1-1: config 0 descriptor?? [ 1748.901802][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1748.916224][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1749.294370][T28899] syzkaller0: entered promiscuous mode [ 1749.301885][T28899] syzkaller0: entered allmulticast mode [ 1749.500317][T17502] Bluetooth: hci0: command tx timeout [ 1749.545141][ T804] corsair-cpro 0003:1B1C:0C10.0024: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.0-1/input0 [ 1749.753691][ T804] corsair-cpro 0003:1B1C:0C10.0024: probe with driver corsair-cpro failed with error -5 [ 1749.987030][T23172] usb 1-1: USB disconnect, device number 122 [ 1751.769596][ T5713] aiptek 6-1:17.0: Aiptek using 400 ms programming speed [ 1751.779479][T23360] aiptek 2-1:17.0: Aiptek using 400 ms programming speed [ 1751.788737][ T5713] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:17.0/input/input150 [ 1751.800094][T23360] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input151 [ 1751.895668][ T5713] usb 6-1: USB disconnect, device number 94 [ 1751.901668][ C0] aiptek 6-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1752.020749][T23360] usb 2-1: USB disconnect, device number 96 [ 1752.026798][ C0] aiptek 2-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1752.063186][T28918] fuse: Bad value for 'fd' [ 1752.136903][ T30] audit: type=1326 audit(1777644023.787:12505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28912 comm="syz.5.6199" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8b659cdd9 code=0x0 [ 1752.195684][T17395] net_ratelimit: 10 callbacks suppressed [ 1752.195703][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1752.215663][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1752.322670][T28930] syzkaller0: entered promiscuous mode [ 1752.338423][T28930] syzkaller0: entered allmulticast mode [ 1752.369040][ T30] audit: type=1400 audit(1777644024.012:12506): avc: denied { setattr } for pid=28928 comm="syz.6.6205" name="TIPC" dev="sockfs" ino=158466 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1752.394961][ T30] audit: type=1400 audit(1777644024.031:12507): avc: denied { read } for pid=28928 comm="syz.6.6205" dev="sockfs" ino=158466 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1752.498739][ T30] audit: type=1400 audit(1777644024.134:12508): avc: denied { ioctl } for pid=28937 comm="syz.1.6208" path="socket:[158955]" dev="sockfs" ino=158955 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1752.525156][T28938] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6208'. [ 1752.802145][T23172] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1752.825000][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1752.839362][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1752.866234][T22640] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1752.898626][T22634] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 1752.973212][T23172] usb 5-1: Using ep0 maxpacket: 8 [ 1752.981660][T23172] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1752.991674][T23172] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1753.000492][T23172] usb 5-1: Product: syz [ 1753.004749][T23172] usb 5-1: Manufacturer: syz [ 1753.009494][T23172] usb 5-1: SerialNumber: syz [ 1753.016620][T23172] usb 5-1: config 0 descriptor?? [ 1753.049075][T22640] usb 2-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1753.070576][T22634] usb 1-1: Using ep0 maxpacket: 32 [ 1753.076657][T22640] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1753.096129][T22640] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1753.107832][T22640] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1753.117352][T22640] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1753.125859][T22634] usb 1-1: config index 0 descriptor too short (expected 3659, got 75) [ 1753.135274][T22634] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1753.157119][T28941] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1753.186395][T22634] usb 1-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 1753.208521][T22634] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1753.217607][T22634] usb 1-1: Product: syz [ 1753.223197][T22634] usb 1-1: Manufacturer: syz [ 1753.227833][T22634] usb 1-1: SerialNumber: syz [ 1753.246821][T23172] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1753.256344][T22634] usb 1-1: config 0 descriptor?? [ 1753.281661][T22634] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 1753.390143][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1753.404533][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1753.513873][T23172] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1753.528511][T23172] usb 5-1: USB disconnect, device number 69 [ 1753.966931][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1753.981251][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1754.313472][T28968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6219'. [ 1754.535906][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1754.550535][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1754.640168][T23360] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1754.811845][T23360] usb 5-1: Using ep0 maxpacket: 8 [ 1754.819002][T23360] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1754.827946][T23360] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1754.838179][T23360] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1754.847382][T23360] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1755.209484][T22634] gspca_sunplus: reg_r err -71 [ 1755.215236][T22634] sunplus 1-1:0.0: probe with driver sunplus failed with error -71 [ 1755.229235][T22634] usb 1-1: USB disconnect, device number 123 [ 1755.902816][T22634] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 1756.039965][T23172] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1756.047696][T22634] usb 6-1: device descriptor read/64, error -71 [ 1756.210966][T23172] usb 1-1: Using ep0 maxpacket: 32 [ 1756.217492][T23172] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1756.229452][T23172] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1756.238523][T23172] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1756.247691][T23172] usb 1-1: Product: syz [ 1756.251923][T23172] usb 1-1: Manufacturer: syz [ 1756.256609][T23172] usb 1-1: SerialNumber: syz [ 1756.262864][T23172] usb 1-1: config 0 descriptor?? [ 1756.269390][T28989] raw-gadget.4 gadget.0: fail, usb_ep_enable returned -22 [ 1756.307208][T22634] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 1756.446051][T22634] usb 6-1: device descriptor read/64, error -71 [ 1756.564371][T22634] usb usb6-port1: attempt power cycle [ 1756.642921][T22640] aiptek 2-1:17.0: Aiptek using 400 ms programming speed [ 1756.656935][T22640] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input152 [ 1756.675621][ T30] audit: type=1400 audit(1777644028.036:12509): avc: denied { read } for pid=28988 comm="syz.0.6227" path="socket:[159065]" dev="sockfs" ino=159065 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1756.717514][T22640] usb 2-1: USB disconnect, device number 97 [ 1756.723534][ C1] aiptek 2-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1756.768895][T23360] usb 1-1: USB disconnect, device number 124 [ 1756.928814][T22634] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 1756.949679][T22634] usb 6-1: device descriptor read/8, error -71 [ 1757.204878][T22634] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 1757.240858][T22634] usb 6-1: device descriptor read/8, error -71 [ 1757.367006][T22634] usb usb6-port1: unable to enumerate USB device [ 1757.514680][T23360] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 1757.588465][T22640] usb 5-1: USB disconnect, device number 70 [ 1757.687343][T23360] usb 2-1: config 255 has an invalid interface number: 133 but max is 0 [ 1757.695882][T23360] usb 2-1: config 255 has no interface number 0 [ 1757.702648][T23360] usb 2-1: config 255 interface 133 has no altsetting 0 [ 1757.713398][T23360] usb 2-1: New USB device found, idVendor=1943, idProduct=2255, bcdDevice=d7.fb [ 1757.722710][T23360] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1757.731553][T23360] usb 2-1: Product: syz [ 1757.735839][T23360] usb 2-1: Manufacturer: syz [ 1757.740892][T23360] usb 2-1: SerialNumber: syz [ 1757.846053][ T3319] net_ratelimit: 10 callbacks suppressed [ 1757.846069][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1757.866149][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1757.882368][T29006] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6233'. [ 1757.942775][T29009] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1757.972086][T23360] s2255 2-1:255.133: Could not find bulk-in endpoint [ 1757.984236][T23360] Sensoray 2255 driver load failed: 0xfffffff4 [ 1757.991409][T23360] s2255 2-1:255.133: probe with driver s2255 failed with error -12 [ 1758.001569][T23360] usbhid 2-1:255.133: couldn't find an input interrupt endpoint [ 1758.014730][T23360] usb 2-1: USB disconnect, device number 98 [ 1758.194743][T29015] binder: 29014:29015 ioctl 4018620d 0 returned -22 [ 1758.338861][ T30] audit: type=1400 audit(1777644029.599:12510): avc: denied { read } for pid=29014 comm="syz.6.6237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1758.433691][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1758.448045][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1758.593981][T23360] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 1758.777881][T23360] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1758.809570][T23360] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1758.849555][T23360] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1758.886389][T23360] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1758.896902][T23360] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1758.936248][T29021] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1758.984240][T29032] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6244'. [ 1759.010797][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1759.025591][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1759.171078][ T804] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1759.203913][T22640] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1759.342180][ T804] usb 2-1: device descriptor read/64, error -71 [ 1759.374032][T22640] usb 5-1: Using ep0 maxpacket: 8 [ 1759.385167][T22640] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1759.404363][T22640] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1759.429650][T22640] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1759.446608][T22640] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1759.467780][T22640] usbtmc 5-1:16.0: bulk endpoints not found [ 1759.609329][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1759.610834][ T804] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1759.623716][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1759.769429][ T804] usb 2-1: device descriptor read/64, error -71 [ 1759.898342][ T804] usb usb2-port1: attempt power cycle [ 1760.186343][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1760.200778][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1760.271780][ T804] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1760.304348][ T804] usb 2-1: device descriptor read/8, error -71 [ 1760.509358][ T30] audit: type=1400 audit(1777644031.629:12511): avc: denied { sqpoll } for pid=29056 comm="syz.5.6253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1760.570849][ T804] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1760.592761][ T804] usb 2-1: device descriptor read/8, error -71 [ 1760.710077][ T804] usb usb2-port1: unable to enumerate USB device [ 1760.784612][T22640] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 1760.947535][T22640] usb 6-1: Using ep0 maxpacket: 16 [ 1760.954140][T22640] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1760.964461][T22640] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1760.975050][T22640] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1760.984220][T22640] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1760.992230][T22640] usb 6-1: Product: syz [ 1760.996426][T22640] usb 6-1: Manufacturer: syz [ 1761.001079][T22640] usb 6-1: SerialNumber: syz [ 1761.016234][T22640] usb 6-1: 0:2 : does not exist [ 1761.229640][T22640] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 1761.269219][T22640] usb 6-1: USB disconnect, device number 99 [ 1761.309744][T13068] udevd[13068]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1761.804717][T29064] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6255'. [ 1762.144958][ T804] usb 5-1: USB disconnect, device number 71 [ 1762.302136][T19323] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1762.423428][T23360] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 1762.433258][T23360] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input153 [ 1762.462973][T19323] usb 6-1: Using ep0 maxpacket: 32 [ 1762.472662][T19323] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 1762.481563][T19323] usb 6-1: config 0 has no interface number 0 [ 1762.492355][T19323] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1762.503650][T23360] usb 1-1: USB disconnect, device number 125 [ 1762.509737][ C0] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1762.518693][ T5713] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1762.526422][T19323] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1762.537311][T19323] usb 6-1: Product: syz [ 1762.544200][T19323] usb 6-1: Manufacturer: syz [ 1762.549187][T19323] usb 6-1: SerialNumber: syz [ 1762.563050][T19323] usb 6-1: config 0 descriptor?? [ 1762.574868][T19323] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1762.689408][ T5713] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1762.700434][ T5713] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1762.709545][ T5713] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1762.720817][ T5713] usb 2-1: config 0 descriptor?? [ 1762.794305][T19323] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1762.807535][T19323] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1763.174005][ T5713] keytouch 0003:0926:3333.0025: fixing up Keytouch IEC report descriptor [ 1763.216964][ T5713] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0025/input/input154 [ 1763.238116][T29086] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6266'. [ 1763.461143][ T5713] keytouch 0003:0926:3333.0025: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 1763.500992][ T3319] net_ratelimit: 10 callbacks suppressed [ 1763.501009][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1763.521311][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1763.600496][ C0] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1763.609131][ T5713] usb 6-1: USB disconnect, device number 100 [ 1763.628152][ T5713] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1763.673616][ T5713] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1763.674551][T22640] usb 2-1: USB disconnect, device number 103 [ 1763.704210][ T5713] quatech2 6-1:0.51: device disconnected [ 1763.808794][T23172] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 1763.933543][T29103] fuse: Bad value for 'fd' [ 1763.979696][T19323] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1763.979749][T23172] usb 1-1: Using ep0 maxpacket: 8 [ 1763.995736][T23172] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1764.006505][T23172] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1764.024393][T23172] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 1764.033713][T23172] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1764.041707][T23172] usb 1-1: Product: syz [ 1764.046242][T23172] usb 1-1: Manufacturer: syz [ 1764.051027][T23172] usb 1-1: SerialNumber: syz [ 1764.057867][T23172] usb 1-1: config 0 descriptor?? [ 1764.064942][T23172] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 1764.097391][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1764.112060][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1764.139990][T19323] usb 5-1: Using ep0 maxpacket: 8 [ 1764.147058][T19323] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1764.157734][T19323] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1764.182307][T19323] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1764.204144][T19323] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1764.224596][T19323] usbtmc 5-1:16.0: bulk endpoints not found [ 1764.297117][T23172] usb 1-1: USB disconnect, device number 126 [ 1764.315537][T23172] pvrusb2: Device being rendered inoperable [ 1764.333511][T29112] binder: 29111:29112 ioctl 4018620d 0 returned -22 [ 1764.615684][T29120] block device autoloading is deprecated and will be removed. [ 1764.663902][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1764.678300][T12692] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1764.865953][T29105] 9pnet_fd: p9_fd_create_tcp (29105): problem connecting socket to 127.0.0.1 [ 1765.230699][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1765.245071][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1765.359167][T19323] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 1765.518494][T19323] usb 1-1: Using ep0 maxpacket: 32 [ 1765.524959][T19323] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 1765.533217][T19323] usb 1-1: config 0 has no interface number 0 [ 1765.543435][T19323] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1765.552703][T19323] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1765.560694][T19323] usb 1-1: Product: syz [ 1765.565031][T19323] usb 1-1: Manufacturer: syz [ 1765.569639][T19323] usb 1-1: SerialNumber: syz [ 1765.576778][T19323] usb 1-1: config 0 descriptor?? [ 1765.585875][T19323] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1765.646756][T22634] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1765.787312][T22634] usb 2-1: device descriptor read/64, error -71 [ 1765.802828][T19323] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1765.816534][T19323] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1765.834431][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1765.848859][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1766.074248][T22634] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 1766.213106][T22634] usb 2-1: device descriptor read/64, error -71 [ 1766.315795][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1766.316120][T23172] usb 1-1: USB disconnect, device number 127 [ 1766.332210][T22634] usb usb2-port1: attempt power cycle [ 1766.345183][T23172] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1766.362810][T23172] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1766.375285][T23172] quatech2 1-1:0.51: device disconnected [ 1766.694014][T22634] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1766.715763][T22634] usb 2-1: device descriptor read/8, error -71 [ 1766.945044][T23172] usb 5-1: USB disconnect, device number 72 [ 1766.982658][T22634] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1767.018485][T22634] usb 2-1: device descriptor read/8, error -71 [ 1767.031688][T29165] binder: 29164:29165 ioctl 4018620d 0 returned -22 [ 1767.144602][T29154] 9pnet_fd: p9_fd_create_tcp (29154): problem connecting socket to 127.0.0.1 [ 1767.154103][T22634] usb usb2-port1: unable to enumerate USB device [ 1767.956414][T29179] overlayfs: missing 'lowerdir' [ 1768.104525][ T5713] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1768.243475][T19323] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1768.265051][ T5713] usb 1-1: Using ep0 maxpacket: 8 [ 1768.272072][ T5713] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1768.280706][ T5713] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1768.291825][ T5713] usb 1-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1768.305286][ T5713] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1768.314906][ T5713] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1768.332662][ T5713] usbtmc 1-1:16.0: bulk endpoints not found [ 1768.375746][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.385163][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.394680][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.403826][T19323] usb 5-1: Using ep0 maxpacket: 32 [ 1768.404169][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.410685][T19323] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 1768.420491][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.426629][T19323] usb 5-1: config 0 has no interface number 0 [ 1768.435597][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.443521][T19323] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1768.452739][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.459615][T23360] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1768.475989][T19323] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1768.484820][T19323] usb 5-1: Product: syz [ 1768.485312][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.489041][T19323] usb 5-1: Manufacturer: syz [ 1768.503152][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.512426][T19323] usb 5-1: SerialNumber: syz [ 1768.518335][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.527859][T19323] usb 5-1: config 0 descriptor?? [ 1768.534126][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.544541][T19323] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1768.556224][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.568637][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.578281][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.587947][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.597601][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.608427][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.618757][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.632552][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.644018][T23360] usb 6-1: Using ep0 maxpacket: 8 [ 1768.658846][T23360] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1768.670731][T23360] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1768.683699][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.693465][T23360] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1768.703967][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.704160][T23360] usb 6-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1768.714193][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.726215][T23360] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1768.744029][T23360] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1768.760362][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.761117][T23360] usbtmc 6-1:16.0: bulk endpoints not found [ 1768.781904][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.805017][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.821515][T19323] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1768.829629][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.840818][T19323] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1768.851240][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.885854][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.902819][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.915180][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.925290][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.936692][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.946846][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.957893][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.968108][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.978199][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.988232][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1768.999352][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.009122][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.022386][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.032410][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.043782][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.054421][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.064119][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.073635][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.083369][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.092957][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.102585][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.113021][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.122890][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.131818][ T3319] net_ratelimit: 10 callbacks suppressed [ 1769.131835][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1769.151961][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1769.168096][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.179402][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.189491][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.199044][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.208618][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.218607][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.228314][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.238334][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.248647][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.258327][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.268124][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.278031][T29191] 9pnet_fd: p9_fd_create_tcp (29191): problem connecting socket to 127.0.0.1 [ 1769.459947][T29209] binder: 29208:29209 ioctl 4018620d 0 returned -22 [ 1769.475511][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1769.475822][T22639] usb 5-1: USB disconnect, device number 73 [ 1769.494842][T22639] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1769.512126][T22639] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1769.526701][T22639] quatech2 5-1:0.51: device disconnected [ 1769.718210][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1769.732587][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1769.883120][T29214] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6313'. [ 1770.209895][T22639] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1770.285877][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1770.300248][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1770.391361][T22639] usb 2-1: Using ep0 maxpacket: 8 [ 1770.402837][T22639] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1770.414874][T22639] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1770.437964][T22639] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1770.450418][T22639] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1770.478006][T29229] fuse: Unknown parameter 'group_i00000000000000000000' [ 1770.851181][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1770.865958][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1771.060021][T22639] usb 1-1: USB disconnect, device number 2 [ 1771.418797][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1771.433188][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1771.456655][T23172] usb 6-1: USB disconnect, device number 101 [ 1771.472791][T29255] binder: BINDER_SET_CONTEXT_MGR already set [ 1771.482078][T29255] binder: 29254:29255 ioctl 4018620d 200000004a80 returned -16 [ 1771.522934][T29257] syzkaller0: entered promiscuous mode [ 1771.528937][T29257] syzkaller0: entered allmulticast mode [ 1772.090476][T23360] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1772.250791][T23360] usb 6-1: Using ep0 maxpacket: 8 [ 1772.256969][T23360] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1772.265618][T23360] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1772.277272][T23360] usb 6-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1772.290692][T23360] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1772.299831][T23360] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1772.311174][T23360] usbtmc 6-1:16.0: bulk endpoints not found [ 1772.391036][T29274] fuse: Unknown parameter 'group_id00000000000000000000' [ 1773.141875][T23360] usb 2-1: USB disconnect, device number 108 [ 1773.324990][T29287] syzkaller0: entered promiscuous mode [ 1773.331913][T29287] syzkaller0: entered allmulticast mode [ 1773.522398][T23360] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1773.682683][T23360] usb 2-1: Using ep0 maxpacket: 8 [ 1773.689176][T23360] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1773.699726][T23360] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1773.711453][T23360] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1773.721581][T23360] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1773.734653][T23360] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1773.743842][T23360] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1773.756602][T23360] usbtmc 2-1:16.0: bulk endpoints not found [ 1774.548372][T23172] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1774.708971][T23172] usb 1-1: Using ep0 maxpacket: 32 [ 1774.715694][T23172] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 1774.724403][T23172] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1774.733181][T23172] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1774.742336][T23172] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1774.752098][T23172] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1774.752316][T17395] net_ratelimit: 10 callbacks suppressed [ 1774.752328][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1774.761759][T23172] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1774.761810][T23172] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1774.767544][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1774.781866][T23172] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1774.799312][T23360] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1774.831425][T23172] usb 1-1: config 0 descriptor?? [ 1774.986378][T23360] usb 5-1: Using ep0 maxpacket: 32 [ 1775.009231][T23360] usb 5-1: config index 0 descriptor too short (expected 3659, got 75) [ 1775.018755][T23360] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1775.031856][T23360] usb 5-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 1775.041053][T23360] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1775.056567][T23360] usb 5-1: Product: syz [ 1775.062295][T23360] usb 5-1: Manufacturer: syz [ 1775.063478][T22639] usb 6-1: USB disconnect, device number 102 [ 1775.066971][T23360] usb 5-1: SerialNumber: syz [ 1775.089903][T23172] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1775.112286][T23360] usb 5-1: config 0 descriptor?? [ 1775.117109][T29313] fuse: Unknown parameter 'group_id00000000000000000000' [ 1775.133415][T23172] usb 1-1: USB disconnect, device number 3 [ 1775.144890][T23360] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 1775.152633][T23172] usblp0: removed [ 1775.185226][T29315] 9pnet_fd: p9_fd_create_tcp (29315): problem connecting socket to 127.0.0.1 [ 1775.371100][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1775.385490][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1775.670506][T23172] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1775.841213][T23172] usb 1-1: Using ep0 maxpacket: 32 [ 1775.847779][T23172] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 1775.856438][T23172] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1775.865274][T23172] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1775.874435][T23172] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1775.884107][T23172] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1775.894089][T23172] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1775.907309][T23172] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1775.916615][T23172] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1775.926698][T23172] usb 1-1: config 0 descriptor?? [ 1775.948181][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1775.962706][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1776.184977][T29330] program syz.6.6357 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1776.372151][T23172] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 4 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1776.374934][T29332] netlink: 80 bytes leftover after parsing attributes in process `syz.5.6358'. [ 1776.391372][T23172] usb 1-1: USB disconnect, device number 4 [ 1776.402829][T23172] usblp0: removed [ 1776.452769][T23360] gspca_sunplus: reg_r err -32 [ 1776.465395][ T5699] usb 2-1: USB disconnect, device number 109 [ 1776.514761][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1776.529168][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1777.025172][T29355] fuse: Unknown parameter 'group_id00000000000000000000' [ 1777.070166][ T5699] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 1777.080875][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1777.095292][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1777.230480][ T5699] usb 2-1: Using ep0 maxpacket: 8 [ 1777.236772][ T5699] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1777.245274][ T5699] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1777.255510][ T5699] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1777.268622][ T5699] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1777.277726][ T5699] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1777.291735][ T5699] usbtmc 2-1:16.0: bulk endpoints not found [ 1777.540391][T23360] sunplus 5-1:0.0: probe with driver sunplus failed with error -32 [ 1777.762214][T22639] usb 5-1: USB disconnect, device number 74 [ 1778.203329][T22639] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1778.395244][T22639] usb 6-1: Using ep0 maxpacket: 8 [ 1778.402354][T22639] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1778.413502][T22639] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1778.424783][T22639] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1778.434876][T22639] usb 6-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1778.447813][T22639] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1778.456894][T22639] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1778.469106][T22639] usbtmc 6-1:16.0: bulk endpoints not found [ 1778.475150][T23172] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1778.641314][T23172] usb 1-1: Using ep0 maxpacket: 8 [ 1778.647709][T23172] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1778.658117][T23172] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1778.669156][T23172] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1778.679031][T23172] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1778.693527][T23172] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1778.701430][T23172] usb 1-1: New USB device found, idVendor=056a, idProduct=00f4, bcdDevice= 0.00 [ 1778.710510][T23172] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1778.721174][T23172] usb 1-1: config 0 descriptor?? [ 1778.804048][T29377] syzkaller0: entered promiscuous mode [ 1778.809563][T29377] syzkaller0: entered allmulticast mode [ 1779.169200][T23172] wacom 0003:056A:00F4.0026: ignoring exceeding usage max [ 1779.182982][T23172] hid_parser_main: 470 callbacks suppressed [ 1779.183005][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.196110][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.203139][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.210138][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.217094][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.226492][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.233515][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.241078][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.248011][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.254991][T23172] wacom 0003:056A:00F4.0026: unknown main item tag 0x0 [ 1779.389330][T23172] usb 1-1: USB disconnect, device number 5 [ 1780.023228][T23360] usb 2-1: USB disconnect, device number 110 [ 1780.307994][ T5713] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1780.400358][ T1168] net_ratelimit: 10 callbacks suppressed [ 1780.400377][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1780.420511][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1780.471353][ T5713] usb 1-1: Using ep0 maxpacket: 32 [ 1780.486100][ T5713] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 1780.502395][ T5713] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1780.520683][ T5713] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1780.544098][ T5713] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1780.569675][ T5713] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1780.586653][ T5713] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1780.610104][ T5713] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1780.646488][ T5713] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1780.659051][ T5713] usb 1-1: config 0 descriptor?? [ 1780.911967][ T5713] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1781.004811][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1781.019229][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1781.144119][T29398] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6381'. [ 1781.165523][T23172] usb 1-1: USB disconnect, device number 6 [ 1781.189369][T12496] usb 6-1: USB disconnect, device number 103 [ 1781.218974][T23172] usblp0: removed [ 1781.288858][ T30] audit: type=1400 audit(1777644051.075:12512): avc: denied { remount } for pid=29400 comm="syz.6.6382" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1781.579889][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1781.594320][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1782.178889][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1782.193254][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1782.391955][T12496] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1782.404811][T29419] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6390'. [ 1782.574182][T12496] usb 2-1: Using ep0 maxpacket: 8 [ 1782.582271][T12496] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1782.591820][T12496] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1782.602944][T12496] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1782.612771][T12496] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1782.622732][T12496] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1782.636443][T12496] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1782.645587][T12496] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1782.682053][T12496] usbtmc 2-1:16.0: bulk endpoints not found [ 1782.777138][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1782.791655][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1783.149045][T29427] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6393'. [ 1783.377895][T29441] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=29441 comm=syz.4.6399 [ 1783.481752][T23360] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1783.642091][T23360] usb 6-1: Using ep0 maxpacket: 32 [ 1783.648475][T23360] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1783.657220][T23360] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1783.666213][T23360] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1783.675349][T23360] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1783.685238][T23360] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1783.694983][T23360] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1783.708133][T23360] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1783.717236][T23360] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1783.726738][T23360] usb 6-1: config 0 descriptor?? [ 1783.950506][T23360] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 104 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1784.178478][T22639] usb 6-1: USB disconnect, device number 104 [ 1784.190952][T22639] usblp0: removed [ 1784.419665][T29454] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6404'. [ 1784.592807][T29457] syzkaller0: entered promiscuous mode [ 1784.598444][T29457] syzkaller0: entered allmulticast mode [ 1784.872091][T29469] 9p: Bad value for 'port' [ 1785.282663][T22639] usb 2-1: USB disconnect, device number 111 [ 1785.983347][T29485] netlink: 80 bytes leftover after parsing attributes in process `syz.5.6416'. [ 1786.086015][ T13] net_ratelimit: 10 callbacks suppressed [ 1786.086027][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1786.106206][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1786.687798][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1786.702228][ T13] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1787.254981][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1787.270026][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1787.381055][T29503] 9p: Bad value for 'port' [ 1787.469011][T29509] binder: 29506:29509 ioctl c0306201 200000000080 returned -14 [ 1787.479146][T29509] binder: 29506:29509 ioctl c0306201 2000000003c0 returned -14 [ 1787.873834][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1787.888243][ T1168] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1788.450967][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1788.465433][ T636] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1788.723190][ T30] audit: type=1400 audit(1777644058.028:12513): avc: denied { read } for pid=29518 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 1788.759454][T29512] netlink: 'syz.5.6426': attribute type 14 has an invalid length. [ 1789.113312][T22639] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1789.220167][T12496] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1789.273617][T22639] usb 1-1: Using ep0 maxpacket: 32 [ 1789.283552][T22639] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 1789.294072][T22639] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1789.302648][T22639] usb 1-1: Product: syz [ 1789.307799][T22639] usb 1-1: Manufacturer: syz [ 1789.312470][T22639] usb 1-1: SerialNumber: syz [ 1789.320262][T22639] usb 1-1: config 0 descriptor?? [ 1789.337339][T22639] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 1789.404362][T12496] usb 5-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1789.418552][T12496] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1789.432934][T12496] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1789.444929][T12496] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1789.454117][T12496] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1789.473444][T29530] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 Stopping sshd: stopped /usr/sbin/sshd (pid 5364) OK Stopping crond: stopped /usr/sbin/crond (pid 5347) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 5271) Stopping network: [ 1790.458074][ T30] audit: type=1400 audit(1777644059.647:12514): avc: denied { read write } for pid=29572 comm="ip" path="/dev/console" dev="rootfs" ino=44 scontext=system_u:system_r:ifconfig_t tcontext=system_u:object_r:root_t tclass=chr_file permissive=1 [ 1790.482669][T23360] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1790.643167][T23360] usb 6-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1790.663168][T23360] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1790.685728][T23360] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1790.702822][T23360] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1790.718770][T23360] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1790.729999][T29566] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 OK Stopping iptables: [ 1790.835419][ T30] audit: type=1400 audit(1777644060.003:12515): avc: denied { read write } for pid=29587 comm="iptables" path="/dev/console" dev="rootfs" ino=44 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:root_t tclass=chr_file permissive=1 [ 1790.896252][ T30] audit: type=1400 audit(1777644060.049:12516): avc: denied { search } for pid=29587 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 OK [ 1790.972962][ T30] audit: type=1400 audit(1777644060.096:12517): avc: denied { search } for pid=29587 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1791.020855][ T30] audit: type=1400 audit(1777644060.096:12518): avc: denied { add_name } for pid=29587 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system message bus: [ 1791.080796][ T30] audit: type=1400 audit(1777644060.096:12519): avc: denied { create } for pid=29587 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1791.142974][ T30] audit: type=1400 audit(1777644060.096:12520): avc: denied { read open } for pid=29587 comm="iptables" path="/run/xtables.lock" dev="tmpfs" ino=30454 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1791.197142][ T30] audit: type=1400 audit(1777644060.096:12521): avc: denied { lock } for pid=29587 comm="iptables" path="/run/xtables.lock" dev="tmpfs" ino=30454 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1791.380498][ T30] audit: type=1400 audit(1777644060.499:12522): avc: denied { unlink } for pid=5272 comm="dhcpcd" name="sock" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 [ 1791.436414][T29609] netem: change failed [ 1791.500895][T22639] gspca_ov534_9: sccb_read failed 1 done [ 1791.723371][T22639] gspca_ov534_9: reg_w failed -71 [ 1791.774181][ T3319] net_ratelimit: 10 callbacks suppressed [ 1791.774199][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1791.794302][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1791.810054][ T5699] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1791.981747][T22639] gspca_ov534_9: Unknown sensor 0000 [ 1791.981823][T22639] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 1791.985326][ T5699] usb 2-1: too many configurations: 94, using maximum allowed: 8 [ 1792.001363][T22639] usb 1-1: USB disconnect, device number 7 [ 1792.087449][ T5699] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1792.117465][ T5699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1792.125951][ T5699] usb 2-1: Product: syz [ 1792.133835][ T5699] usb 2-1: Manufacturer: syz [ 1792.138697][ T5699] usb 2-1: SerialNumber: syz Stopping klogd: OK Stopping acpid: [ 1792.361940][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1792.376709][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1792.409370][T29625] syzkaller0: entered promiscuous mode [ 1792.422033][T29625] syzkaller0: entered allmulticast mode [ 1792.623548][ T5699] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1792.636803][ T5699] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1792.971083][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1792.985500][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1793.430989][T23360] aiptek 6-1:17.0: Aiptek using 400 ms programming speed [ 1793.439498][T23360] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:17.0/input/input156 [ 1793.492695][T23360] usb 6-1: USB disconnect, device number 105 [ 1793.492767][ C0] aiptek 6-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 OK [ 1793.540112][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1793.554683][ T3319] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 Stopping syslogd: stopped /sbin/syslogd (pid 4959) OK [ 1794.127264][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a umount: can't remount debugfs read-only [ 1794.382476][ T5699] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1794.419756][ T5699] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1794.456333][ T5699] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 1794.482001][ T5699] usb 2-1: USB disconnect, device number 112 [ 1794.515909][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 1794.515926][ T30] audit: type=1400 audit(1777644063.446:12526): avc: denied { read write } for pid=29649 comm="syz.6.6451" name="comedi2" dev="devtmpfs" ino=1277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1794.554657][ T30] audit: type=1400 audit(1777644063.446:12527): avc: denied { open } for pid=29649 comm="syz.6.6451" path="/dev/comedi2" dev="devtmpfs" ino=1277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1795.088067][ T30] audit: type=1400 audit(1777644063.989:12528): avc: denied { append } for pid=29667 comm="syz.1.6453" name="video7" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1795.136350][ T30] audit: type=1400 audit(1777644064.008:12529): avc: denied { read write } for pid=29667 comm="syz.1.6453" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1795.171923][ T30] audit: type=1400 audit(1777644064.008:12530): avc: denied { open } for pid=29667 comm="syz.1.6453" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1795.257458][T29670] 9pnet_fd: p9_fd_create_tcp (29670): problem connecting socket to 127.0.0.1 umount: sysfs busy - remounted r[ 1795.315085][T29672] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6455'. ead-only umount: can't remount devtmpfs read-only [ 1795.340645][T29672] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6455'. umount: can't remount /dev/root read-only The system is going down NOW! [ 1795.419035][ T30] audit: type=1400 audit(1777644064.289:12531): avc: denied { write } for pid=5595 comm="syz-executor" path="pipe:[3876]" dev="pipefs" ino=3876 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 Sent SIGTERM to all processes Connection to 10.128.0.53 closed by remote host. Sent SIGKILL to all processes Requesting system poweroff [ 1796.921954][T12496] aiptek 5-1:17.0: Aiptek using 400 ms programming speed [ 1796.937266][T12496] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:17.0/input/input155 [ 1796.997773][T12496] usb 5-1: USB disconnect, device number 75 [ 1797.003764][ C1] aiptek 5-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1797.492723][T17395] net_ratelimit: 12 callbacks suppressed [ 1797.492741][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1797.513103][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1797.570018][T29653] bond0: (slave syz_tun): Removing an active aggregator [ 1797.599030][T29653] bond0: (slave syz_tun): Releasing backup interface [ 1797.702201][T29675] smc: removing smcd device lo [ 1797.729776][ T2354] pvrusb2: ***WARNING*** Device fx2 controller firmware seems to be missing. [ 1797.763011][ T2354] pvrusb2: Did you install the pvrusb2 firmware files in their proper location? [ 1797.787906][ T2354] pvrusb2: request_firmware unable to locate fx2 controller file v4l-pvrusb2-29xxx-01.fw [ 1797.797837][ T2354] pvrusb2: Failure uploading firmware1 [ 1797.806386][ T2354] pvrusb2: Device initialization was not successful. [ 1797.813212][ T2354] pvrusb2: Giving up since device microcontroller firmware appears to be missing. [ 1797.823418][ T2354] pvrusb2: Failed to submit write-control URB status=-19 [ 1797.823595][T22769] pvrusb2: Device being rendered inoperable [ 1797.832899][ T2354] usb 7-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 1797.843984][ T1168] bridge_slave_1: left allmulticast mode [ 1797.846206][ T2354] usb 7-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 1797.851184][ T1168] bridge_slave_1: left promiscuous mode [ 1797.860537][ T2354] ------------[ cut here ]------------ [ 1797.865336][ T1168] bridge0: port 2(bridge_slave_1) entered disabled state [ 1797.870590][ T2354] ret [ 1797.870597][ T2354] WARNING: drivers/base/firmware_loader/fallback.c:148 at firmware_fallback_sysfs+0x6d5/0xc20, CPU#1: pvrusb2-context/2354 [ 1797.895110][ T2354] Modules linked in: [ 1797.899431][ T2354] CPU: 1 UID: 0 PID: 2354 Comm: pvrusb2-context Tainted: G L syzkaller #0 PREEMPT(full) [ 1797.910747][ T2354] Tainted: [L]=SOFTLOCKUP [ 1797.915055][ T2354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1797.925130][ T2354] RIP: 0010:firmware_fallback_sysfs+0x6d5/0xc20 [ 1797.931393][ T2354] Code: ff ff e9 87 22 04 fb e8 b9 7b cc fb e8 24 8a 91 fb 31 ff 89 c3 89 c6 e8 59 76 cc fb 85 db 0f 84 0f fb ff ff e8 9c 7b cc fb 90 <0f> 0b 90 48 8b 3c 24 4c 89 e2 48 c7 c6 40 e8 4e 8c e8 05 f2 03 fb [ 1797.951010][ T2354] RSP: 0018:ffffc90007c8f8d0 EFLAGS: 00010293 [ 1797.957051][ T2354] RAX: 0000000000000000 RBX: 00000000fffffff5 RCX: ffffffff863c0ff7 [ 1797.965183][ T2354] RDX: ffff88802ec50000 RSI: ffffffff863c1004 RDI: ffff88802ec50000 [ 1797.973193][ T2354] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 1797.981151][ T2354] R10: 00000000fffffff5 R11: 000000000000756b R12: ffffffff8cb92280 [ 1797.989118][ T2354] R13: ffff88802a504500 R14: 0000000000001770 R15: ffff88802a504510 [ 1797.997214][ T2354] FS: 0000000000000000(0000) GS:ffff888124476000(0000) knlGS:0000000000000000 [ 1798.006229][ T2354] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1798.012803][ T2354] CR2: 00007f105d15cd90 CR3: 00000000344df000 CR4: 00000000003526f0 [ 1798.020772][ T2354] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00007ffffffffff5 [ 1798.028733][ T2354] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1798.036830][ T2354] Call Trace: [ 1798.040096][ T2354] [ 1798.043005][ T2354] ? kfree+0x223/0x6c0 [ 1798.047092][ T2354] _request_firmware+0xfd7/0x13c0 [ 1798.052117][ T2354] ? __pfx__request_firmware+0x10/0x10 [ 1798.057577][ T2354] ? pvr2_send_request_ex+0x13d6/0x1ea0 [ 1798.063102][ T2354] request_firmware+0x35/0x50 [ 1798.067763][ T2354] pvr2_locate_firmware+0x8f/0x330 [ 1798.068280][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1798.072888][ T2354] pvr2_upload_firmware1+0x1ca/0x920 [ 1798.087200][T17395] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1798.092361][ T2354] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1798.092392][ T2354] ? __pfx_pvr2_upload_firmware1+0x10/0x10 [ 1798.118718][ T2354] pvr2_hdw_initialize+0x3e6/0x3710 [ 1798.123924][ T2354] ? pvr2_context_set_notify+0x292/0x2f0 [ 1798.129532][ T2354] ? pvr2_context_set_notify+0x292/0x2f0 [ 1798.135165][ T2354] ? __pfx_pvr2_hdw_initialize+0x10/0x10 [ 1798.140777][ T2354] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1798.146746][ T2354] ? __pfx___schedule+0x10/0x10 [ 1798.151584][ T2354] ? find_held_lock+0x2b/0x80 [ 1798.156270][ T2354] ? schedule+0x2bf/0x390 [ 1798.160589][ T2354] ? kthread+0x13a/0x450 [ 1798.164834][ T2354] pvr2_context_thread_func+0x253/0x920 [ 1798.170357][ T2354] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 1798.176409][ T2354] ? rcu_is_watching+0x12/0xc0 [ 1798.181153][ T2354] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1798.187211][ T2354] ? __kthread_parkme+0x18c/0x230 [ 1798.192210][ T2354] ? kthread+0x13a/0x450 [ 1798.196441][ T2354] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 1798.202484][ T2354] kthread+0x370/0x450 [ 1798.206532][ T2354] ? __pfx_kthread+0x10/0x10 [ 1798.211111][ T2354] ret_from_fork+0x72b/0xd50 [ 1798.215802][ T2354] ? __pfx_ret_from_fork+0x10/0x10 [ 1798.220991][ T2354] ? __switch_to+0x800/0x1100 [ 1798.225674][ T2354] ? __pfx_kthread+0x10/0x10 [ 1798.230281][ T2354] ret_from_fork_asm+0x1a/0x30 [ 1798.235051][ T2354] [ 1798.238064][ T2354] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1798.245327][ T2354] CPU: 1 UID: 0 PID: 2354 Comm: pvrusb2-context Tainted: G L syzkaller #0 PREEMPT(full) [ 1798.256585][ T2354] Tainted: [L]=SOFTLOCKUP [ 1798.260878][ T2354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1798.271168][ T2354] Call Trace: [ 1798.274432][ T2354] [ 1798.277338][ T2354] dump_stack_lvl+0x100/0x190 [ 1798.281992][ T2354] vpanic+0x552/0x970 [ 1798.285944][ T2354] ? __pfx_vpanic+0x10/0x10 [ 1798.290429][ T2354] panic+0xd1/0xe0 [ 1798.294120][ T2354] ? __pfx_panic+0x10/0x10 [ 1798.298510][ T2354] ? check_panic_on_warn+0x1f/0x90 [ 1798.303594][ T2354] check_panic_on_warn.cold+0x19/0x34 [ 1798.308936][ T2354] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 1798.314543][ T2354] __warn.cold+0x191/0x328 [ 1798.318939][ T2354] __report_bug+0x296/0x3d0 [ 1798.323505][ T2354] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 1798.329129][ T2354] ? __pfx___report_bug+0x10/0x10 [ 1798.334125][ T2354] ? do_raw_spin_lock+0x128/0x260 [ 1798.339168][ T2354] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1798.344537][ T2354] ? _raw_spin_lock_irqsave+0x52/0x60 [ 1798.349895][ T2354] ? find_held_lock+0x2b/0x80 [ 1798.354545][ T2354] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 1798.360152][ T2354] report_bug+0xb2/0x220 [ 1798.364367][ T2354] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 1798.369976][ T2354] handle_bug+0x16a/0x2a0 [ 1798.374289][ T2354] exc_invalid_op+0x17/0x50 [ 1798.378765][ T2354] asm_exc_invalid_op+0x1a/0x20 [ 1798.383585][ T2354] RIP: 0010:firmware_fallback_sysfs+0x6d5/0xc20 [ 1798.389817][ T2354] Code: ff ff e9 87 22 04 fb e8 b9 7b cc fb e8 24 8a 91 fb 31 ff 89 c3 89 c6 e8 59 76 cc fb 85 db 0f 84 0f fb ff ff e8 9c 7b cc fb 90 <0f> 0b 90 48 8b 3c 24 4c 89 e2 48 c7 c6 40 e8 4e 8c e8 05 f2 03 fb [ 1798.409399][ T2354] RSP: 0018:ffffc90007c8f8d0 EFLAGS: 00010293 [ 1798.415439][ T2354] RAX: 0000000000000000 RBX: 00000000fffffff5 RCX: ffffffff863c0ff7 [ 1798.423381][ T2354] RDX: ffff88802ec50000 RSI: ffffffff863c1004 RDI: ffff88802ec50000 [ 1798.431335][ T2354] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 1798.439299][ T2354] R10: 00000000fffffff5 R11: 000000000000756b R12: ffffffff8cb92280 [ 1798.447241][ T2354] R13: ffff88802a504500 R14: 0000000000001770 R15: ffff88802a504510 [ 1798.455191][ T2354] ? firmware_fallback_sysfs+0x6c7/0xc20 [ 1798.460805][ T2354] ? firmware_fallback_sysfs+0x6d4/0xc20 [ 1798.466415][ T2354] ? kfree+0x223/0x6c0 [ 1798.470463][ T2354] _request_firmware+0xfd7/0x13c0 [ 1798.475467][ T2354] ? __pfx__request_firmware+0x10/0x10 [ 1798.480902][ T2354] ? pvr2_send_request_ex+0x13d6/0x1ea0 [ 1798.486432][ T2354] request_firmware+0x35/0x50 [ 1798.491084][ T2354] pvr2_locate_firmware+0x8f/0x330 [ 1798.496176][ T2354] pvr2_upload_firmware1+0x1ca/0x920 [ 1798.501435][ T2354] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1798.507389][ T2354] ? __pfx_pvr2_upload_firmware1+0x10/0x10 [ 1798.513172][ T2354] pvr2_hdw_initialize+0x3e6/0x3710 [ 1798.518347][ T2354] ? pvr2_context_set_notify+0x292/0x2f0 [ 1798.523970][ T2354] ? pvr2_context_set_notify+0x292/0x2f0 [ 1798.529578][ T2354] ? __pfx_pvr2_hdw_initialize+0x10/0x10 [ 1798.535186][ T2354] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1798.541177][ T2354] ? __pfx___schedule+0x10/0x10 [ 1798.546006][ T2354] ? find_held_lock+0x2b/0x80 [ 1798.550655][ T2354] ? schedule+0x2bf/0x390 [ 1798.554967][ T2354] ? kthread+0x13a/0x450 [ 1798.559187][ T2354] pvr2_context_thread_func+0x253/0x920 [ 1798.564710][ T2354] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 1798.570758][ T2354] ? rcu_is_watching+0x12/0xc0 [ 1798.575526][ T2354] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1798.581576][ T2354] ? __kthread_parkme+0x18c/0x230 [ 1798.586592][ T2354] ? kthread+0x13a/0x450 [ 1798.590821][ T2354] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 1798.596860][ T2354] kthread+0x370/0x450 [ 1798.600903][ T2354] ? __pfx_kthread+0x10/0x10 [ 1798.605464][ T2354] ret_from_fork+0x72b/0xd50 [ 1798.610030][ T2354] ? __pfx_ret_from_fork+0x10/0x10 [ 1798.615114][ T2354] ? __switch_to+0x800/0x1100 [ 1798.619769][ T2354] ? __pfx_kthread+0x10/0x10 [ 1798.624343][ T2354] ret_from_fork_asm+0x1a/0x30 [ 1798.629111][ T2354] [ 1798.632540][ T2354] Kernel Offset: disabled [ 1798.636841][ T2354] Rebooting in 86400 seconds..