last executing test programs: 19.576692871s ago: executing program 2 (id=122): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x9) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r1, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x24004044) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r3, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x40008000}, 0x48094) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)={0x28, r6, 0x9, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1d}]}]}, 0x28}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r8, @ANYBLOB="010000000000fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002002000000006000100020000000800060003000000080003"], 0x84}}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r8, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) syz_emit_ethernet(0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c2000000ae945581457194dc960694c490bbaeaaaaaaaaaaaa86dd608e570600002e0000000000000000000000ffffac3414aa0f000000000000000000000000000001"], 0x0) r9 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r9, r9, r9}, 0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={'cmac(aes)\x00'}}) 18.735321353s ago: executing program 2 (id=126): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000500)="a4", 0x34000, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_setup(0x5, &(0x7f0000000e80)=0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_submit(r5, 0x0, 0x0) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) r6 = syz_io_uring_setup(0xce1, &(0x7f0000000100)={0x0, 0x8ddc, 0x10310, 0xfffffffe, 0x4a, 0x0, r4}, &(0x7f0000000180)=0x0, &(0x7f0000000340)=0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) io_setup(0x5, &(0x7f00000001c0)) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r6, 0x2ded, 0x4000, 0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000200)="ad00"/13, 0xd) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r10, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000003240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r10, 0xc01064ab, &(0x7f0000000380)={0x0, 0x0, r11}) 15.931952996s ago: executing program 2 (id=130): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0x541b, &(0x7f0000000000)={0xffffffffffffffff}) close_range(r5, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) socket$key(0xf, 0x3, 0x2) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6}]}) close_range(r9, 0xffffffffffffffff, 0x0) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r6, @ANYRES8=r7], 0x0) 15.642902065s ago: executing program 0 (id=131): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) writev(r2, &(0x7f0000002100)=[{&(0x7f0000002140)='K', 0x1}], 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_setup(0x6, &(0x7f0000000540)=0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xe) io_submit(r3, 0x0, &(0x7f0000000040)) socket(0x2, 0x3, 0x6) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56561, 0x4, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x20, 0x4, 0xff, 0x8, 0x0, 0x5, 0x8}}, {0x4}}]}]}, 0x54}}, 0x4040010) 13.652095748s ago: executing program 3 (id=134): r0 = syz_open_dev$dmmidi(&(0x7f00000002c0), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000000)={0x1000000}) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r3, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) r4 = signalfd4(r2, &(0x7f0000000140), 0x8, 0x0) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r5, 0x4) recvmmsg(r5, &(0x7f0000001580)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x140, 0x0) r6 = socket(0x15, 0x5, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r6, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) unshare(0x2a020400) socket(0x35, 0x3, 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b87030b0000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x41) ioctl$PPPIOCSDEBUG(r4, 0x40047440, &(0x7f00000000c0)=0x6) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, 0x0, 0x0) 13.494688321s ago: executing program 0 (id=135): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) creat(0x0, 0x0) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000240), 0x208400, 0x0) ftruncate(0xffffffffffffffff, 0xffff) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = epoll_create1(0x0) sendmsg$xdp(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000810}, 0x6010) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000000)={0xa0000001}) epoll_wait(r6, &(0x7f0000000340)=[{}], 0x1, 0x1000) 13.417051767s ago: executing program 2 (id=137): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) creat(0x0, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) 13.15872236s ago: executing program 3 (id=138): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) truncate(0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r2 = memfd_secret(0x80000) fcntl$setlease(r2, 0x400, 0x0) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000040)="3900000013001118680907070000000f0000ff3f04000000170a001700000000040014001000030001302564aa58b9a64411f6bbf44dc48f57", 0xff4d}], 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x0, 0x0) syz_emit_ethernet(0x106, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, 0x0, 0x2e) 10.489978108s ago: executing program 2 (id=141): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) openat$autofs(0xffffff9c, &(0x7f0000000240), 0x208400, 0x0) ftruncate(0xffffffffffffffff, 0xffff) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = epoll_create1(0x0) sendmsg$xdp(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000810}, 0x6010) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000000)={0xa0000001}) epoll_wait(r6, &(0x7f0000000340)=[{}], 0x1, 0x1000) 10.489320351s ago: executing program 0 (id=142): r0 = socket$inet6(0xa, 0x1, 0x0) io_uring_setup(0x6281, &(0x7f0000000080)={0x0, 0xed74}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r3, 0x0, 0x0, 0x4001c00) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x24048084}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00!'], 0x28}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r6 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r6, &(0x7f0000001fc0)=""/184, 0xb8) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x4) 8.241585513s ago: executing program 2 (id=145): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x101b02) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000106d049cc20000000000010902240001"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000440)='.\x00', 0x12000021) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000a00)=ANY=[@ANYBLOB], 0x478) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) r4 = io_uring_setup(0x70d9, &(0x7f0000000700)={0x0, 0xcff9, 0x2, 0x2, 0x269}) ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, &(0x7f0000000200)={0x3, 0xfffffdff, 0x2}) io_uring_enter(r4, 0x6df6, 0x0, 0xb, 0x0, 0x0) ioctl$VIDIOC_ENUM_DV_TIMINGS(r0, 0xc0405627, &(0x7f0000000040)={0xfffffbe8, 0x0, '\x00', {0x0, @reserved}}) socket$nl_generic(0x10, 0x3, 0x10) 8.241339038s ago: executing program 3 (id=146): syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x101b02) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000106d049cc20000000000010902240001"], 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000440)='.\x00', 0x12000021) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x478) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) r3 = io_uring_setup(0x70d9, &(0x7f0000000700)={0x0, 0xcff9, 0x2, 0x2, 0x269}) ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, &(0x7f0000000200)={0x3, 0xfffffdff, 0x2}) io_uring_enter(r3, 0x6df6, 0x0, 0xb, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010008000900010073797a30000000006c000000090a010400000000000000000100000008000a40000000000900020000087a32000000000900010073797a3000000000080005400000003d300011800b00010074617267657400002000028005000300c400000008000240000000000a00010041"], 0xb4}, 0x1, 0x0, 0x0, 0x890}, 0x0) 8.240074118s ago: executing program 1 (id=155): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) writev(r2, &(0x7f0000002100)=[{&(0x7f0000002140)='K', 0x1}], 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_setup(0x6, &(0x7f0000000540)=0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0xe) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f00000000c0)={0x0, 0x300, 0x0, 0x5, 0x0, r4, 0x0}]) socket(0x2, 0x3, 0x6) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56561, 0x4, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x4}]}, 0x34}}, 0x4040010) 6.011433385s ago: executing program 1 (id=147): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)={@cgroup, 0xffffffffffffffff, 0x19, 0x1, 0xffffffffffffffff, @void, @value}, 0x20) syz_emit_ethernet(0x9c, &(0x7f0000000880)={@local, @multicast, @void, {@ipv4={0x800, @gre={{0x6, 0x4, 0x1, 0x3, 0x8e, 0x66, 0x0, 0x2, 0x2f, 0x0, @rand_addr=0x64010101, @remote, {[@ra={0x94, 0x4, 0x1}]}}, {{0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x3, 0x0]}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x86dd, [0xbe8, 0x8], "acc9af729fc2c7bbf7002d4ce180345cd60278d09bad51c0859e7ea91f909566bde442abe1eba42a9802"}, {0x8, 0x88be, 0x0, {{0x4, 0x1, 0xa6, 0x3, 0x0, 0x1, 0x7, 0x4}, 0x1, {0x4e65}}}, {0x8, 0x22eb, 0x1, {{0x8, 0x2, 0x1b, 0x3, 0x1, 0x0, 0x3, 0xe}, 0x2, {0x40, 0x3, 0x2, 0x1, 0x1, 0x0, 0x0, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.kill\x00', 0x275a, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0xc058560f, &(0x7f0000000040)={0x0, 0x2, 0x80000000}) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x17, 0x0, 0x0, 0x0, 0x1, 0x1c, "fee8a2ab787c179fd1f8a0e91ddaaca7bd6447a4b4e00d9683f6a1af1ea09de2b7fb0a01000000000b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c9b40f45f819e01177d3d458dd4992861ac000000000000000000000000000000002b16", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000000)={[0x4, 0x2, 0x327, 0x0, 0x5, 0x3, 0x4, 0x6, 0x56, 0x4, 0x9, 0x5, 0x9, 0x9, 0x2, 0x7], 0x100000, 0x90}) r2 = syz_open_dev$loop(&(0x7f0000000180), 0x1, 0x8000) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f00000000c0)=0x4, 0x0, 0x4, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x100, 0x800ffffc, 0x0, 0x0, 0x0) r3 = socket(0x15, 0x5, 0x0) io_setup(0x642d, &(0x7f0000000140)=0x0) r5 = mq_open(&(0x7f0000000280)='&&\x00', 0x2, 0x20, &(0x7f00000005c0)={0x6, 0x2, 0x6}) r6 = openat$procfs(0xffffff9c, &(0x7f0000000680)='/proc/asound/seq/timer\x00', 0x0, 0x0) io_cancel(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0xf800, r5, &(0x7f0000000600)="e7999ee28088d3781db3e2a3658d41f4043f83cc165dd284c2531c418d1beb05c3adfa485b6c9cd6a414e0b35bb25e5c277395dbb1f65bba36ae9c743c2c6f3f02926d961ffb2f68c33c33e0c2eaf8b7569ab16272e432275c40201237a02f8d461eadff801f4602a6fecf9d3dfe6f5b81605fedde28e3de5c7a29600c67285e", 0x80, 0x1fe, 0x0, 0x2, r6}, &(0x7f0000000700)) r7 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x4}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@private=0xa010102, 0x4, 0x6c}, 0x2, @in6=@loopback, 0x0, 0x4}}, 0xe8) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x800, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x20902, 0x0) write$sequencer(r8, &(0x7f0000000080)=ANY=[@ANYBLOB="9404"], 0x8) close(r8) connect$l2tp6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x20) getsockname$l2tp6(r3, 0x0, &(0x7f0000000100)) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000480)={r0, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x18, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea80000000000000000000000deff0000000000000000000000000000000800", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "90be8b1c55f96400", [0x800]}}) 6.010442565s ago: executing program 0 (id=158): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f00006c5000/0x1000)=nil, 0x1000) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_setup(0x2af8, 0x0, &(0x7f0000000100), &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_submit(0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f0000018000/0x2000)=nil, 0x2000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) unshare(0x22020600) bind$alg(r2, 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2, @in6=@private1}, {@in, 0x0, 0x32}, @in=@multicast2, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @lifetime_val={0x24}]}, 0x158}}, 0x0) syz_clone(0x5948000, 0x0, 0x0, 0x0, 0x0, 0x0) 5.322042246s ago: executing program 4 (id=149): socket$kcm(0x10, 0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0xfc5e) umount2(&(0x7f00000005c0)='./file0\x00', 0x2) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x29, 0x3, 0x84004, 0x0, 0x0, 0x429, 0x1}}, 0x50) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='dctcp\x00', 0x6) sendto$inet(r3, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000600), 0x4) 4.878139264s ago: executing program 0 (id=150): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) r0 = fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 4.790434506s ago: executing program 1 (id=151): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) syz_open_dev$vbi(&(0x7f0000000380), 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x101, 0x0) write$sequencer(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="8102000000000000000000000000584d"], 0x10) r2 = dup(r0) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x0, 0x0, 0xc3ad}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x0, 0x40, 0x2, 0xd, 0x0, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x7, 0x0, 0x5, 0x7}, 0x0, 0x0) unshare(0x28000600) 4.527162731s ago: executing program 0 (id=152): openat$tun(0xffffffffffffff9c, 0x0, 0x404901, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfa11, 0xffffffff}, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x4) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000240)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(0xffffffffffffffff, 0xc02064cc, &(0x7f0000000280)={0x0, r2, 0x490a, 0x3}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, 0x0, 0x0) set_mempolicy(0x3, 0x0, 0x5) syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f00000003c0), &(0x7f0000000280)) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x20010845, &(0x7f0000b63fe4)={0xa, 0x42, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}}, 0x1c) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000200)={0xc}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) 4.239472877s ago: executing program 3 (id=153): r0 = syz_io_uring_setup(0x24f9, &(0x7f0000000180)={0x0, 0x0, 0x10100, 0x0, 0x1000000}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_FILES_UPDATE={0x14, 0x3, 0x0, 0x0, 0x69, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 3.79527891s ago: executing program 3 (id=154): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) creat(0x0, 0x0) r4 = socket(0x1e, 0x4, 0x0) recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) openat$autofs(0xffffff9c, &(0x7f0000000240), 0x208400, 0x0) ftruncate(0xffffffffffffffff, 0xffff) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = epoll_create1(0x0) sendmsg$xdp(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000810}, 0x6010) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000000)={0xa0000001}) epoll_wait(r6, &(0x7f0000000340)=[{}], 0x1, 0x1000) 3.770698364s ago: executing program 1 (id=156): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) openat$autofs(0xffffff9c, &(0x7f0000000240), 0x208400, 0x0) ftruncate(0xffffffffffffffff, 0xffff) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = epoll_create1(0x0) sendmsg$xdp(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000810}, 0x6010) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000000)={0xa0000001}) epoll_wait(r6, &(0x7f0000000340)=[{}], 0x1, 0x1000) 2.044111455s ago: executing program 4 (id=157): socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet6_udp(0xa, 0x2, 0x0) socket$packet(0x11, 0x4000000000002, 0x300) socket(0xa, 0x801, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x11, 0xa, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="93630100200501001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 1.714606057s ago: executing program 3 (id=159): r0 = socket$inet6(0xa, 0x1, 0x0) io_uring_setup(0x6281, &(0x7f0000000080)={0x0, 0xed74}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r3, 0x0, 0x0, 0x4001c00) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x24048084}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00!'], 0x28}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r6 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r6, &(0x7f0000001fc0)=""/184, 0xb8) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x4) 1.666294113s ago: executing program 4 (id=160): r0 = syz_open_dev$video4linux(&(0x7f0000000240), 0x0, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0x980902}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x10) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000540)={0x0, 0x6}, 0x8) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000380)={0x84, 0x0, &(0x7f0000000600)=[@dead_binder_done, @dead_binder_done, @acquire={0x40046305, 0x3}, @acquire_done={0x40106309, 0x1}, @register_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f00000004c0)={@fd, @fda={0x66646185, 0x1, 0x2, 0x3f}, @ptr={0x70742a85, 0x0, &(0x7f0000000440)=""/105, 0x69, 0x1, 0x23}}, &(0x7f0000000300)={0x0, 0x18, 0x34}}, 0x400}], 0x69, 0x0, &(0x7f00000006c0)="1e96dda80af1ea5752580fae898e0935bd6f4d847509917a393024363b9a85cb3b4eb3e221b9a944a7eaed637772110de901721b3bb5296764e136f5356ce7c58e601c5fa7956acabb3f382193c1c2405093fdfb4e2e81490e6946d202c48ed19f55772a0389f27c5a"}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x3}, &(0x7f0000000180)=0x8) connect$pppl2tp(r3, &(0x7f0000000580)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @empty}, 0x0, 0x1, 0x1, 0x4}}, 0x26) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}, 0x1, 0x3}}, 0x26) 1.552189352s ago: executing program 1 (id=161): r0 = syz_open_dev$dmmidi(&(0x7f00000002c0), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000000)={0x1000000}) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r3, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) r4 = signalfd4(r2, &(0x7f0000000140), 0x8, 0x0) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r5, 0x4) recvmmsg(r5, &(0x7f0000001580)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x140, 0x0) r6 = socket(0x15, 0x5, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r6, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) unshare(0x2a020400) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b87030b0000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x41) ioctl$PPPIOCSDEBUG(r4, 0x40047440, &(0x7f00000000c0)=0x6) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, 0x0, 0x0) 1.387779056s ago: executing program 4 (id=162): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) syz_open_dev$vbi(&(0x7f0000000380), 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x101, 0x0) write$sequencer(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="8102000000000000000000000000584d"], 0x10) r2 = dup(r0) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x0, 0x0, 0xc3ad}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x0, 0x40, 0x2, 0xd, 0x0, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x7, 0x0, 0x5, 0x7}, 0x0, 0x0) 328.510347ms ago: executing program 4 (id=163): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x9) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r1, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x24004044) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r3, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x40008000}, 0x48094) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)={0x28, r6, 0x9, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1d}]}]}, 0x28}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r8, @ANYBLOB="010000000000fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002002000000006000100020000000800060003000000080003"], 0x84}}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r8, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) syz_emit_ethernet(0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c2000000ae945581457194dc960694c490bbaeaaaaaaaaaaaa86dd608e570600002e0000000000000000000000ffffac3414aa0f000000000000000000000000000001"], 0x0) r9 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r9, r9, r9}, 0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={'cmac(aes)\x00'}}) 61.369351ms ago: executing program 1 (id=164): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x10, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x24, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000200)={0x24, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001300)={0x1c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000e80)={0x24, &(0x7f0000000bc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 4 (id=165): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000002c0)='ip_vti0\x00', 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$radio(&(0x7f00000003c0), 0x2, 0x2) socket$alg(0x26, 0x5, 0x0) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x5885}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x4044800) write(r5, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r2, 0x18ba, 0xf7c1, 0x1, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x34, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]]}, 0x34}}, 0x0) read(r1, &(0x7f0000001e80)=""/96, 0x60) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0xb, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x4}]}], {0x14, 0x10}}, 0x7c}}, 0x0) r11 = syz_open_dev$radio(&(0x7f00000003c0), 0x2, 0x2) ioctl$VIDIOC_LOG_STATUS(r11, 0x5646, 0x0) read(r11, &(0x7f0000001e80)=""/96, 0x60) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.15' (ED25519) to the list of known hosts. [ 83.472020][ T5820] cgroup: Unknown subsys name 'net' [ 83.588396][ T5820] cgroup: Unknown subsys name 'cpuset' [ 83.599284][ T5820] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.395909][ T5820] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.217456][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.234600][ T5837] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.246016][ T5837] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.256758][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.264717][ T5838] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.274797][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.284542][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.294229][ T5837] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.305368][ T5838] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.314380][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.323863][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.331076][ T5844] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 88.334072][ T5837] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.347509][ T5844] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.349335][ T5838] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.357429][ T5844] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 88.366493][ T5837] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.375045][ T5844] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.381034][ T5838] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 88.388124][ T5844] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.395993][ T5837] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 88.405369][ T5844] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 88.416540][ T5837] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.425808][ T5846] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 88.439912][ T5844] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 88.450211][ T5837] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.451514][ T5846] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 88.469059][ T5846] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 88.479261][ T5846] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.494004][ T5838] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.986608][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 89.215706][ T5853] chnl_net:caif_netlink_parms(): no params data found [ 89.330105][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.354428][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.363253][ T5847] bridge_slave_0: entered allmulticast mode [ 89.370714][ T5847] bridge_slave_0: entered promiscuous mode [ 89.389799][ T5850] chnl_net:caif_netlink_parms(): no params data found [ 89.425430][ T5849] chnl_net:caif_netlink_parms(): no params data found [ 89.437414][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.447050][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.457944][ T5847] bridge_slave_1: entered allmulticast mode [ 89.466529][ T5847] bridge_slave_1: entered promiscuous mode [ 89.488941][ T5852] chnl_net:caif_netlink_parms(): no params data found [ 89.532457][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.552943][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.663188][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.671552][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.688409][ T5853] bridge_slave_0: entered allmulticast mode [ 89.697330][ T5853] bridge_slave_0: entered promiscuous mode [ 89.747461][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.756000][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.764901][ T5853] bridge_slave_1: entered allmulticast mode [ 89.772218][ T5853] bridge_slave_1: entered promiscuous mode [ 89.806835][ T5847] team0: Port device team_slave_0 added [ 89.878413][ T5847] team0: Port device team_slave_1 added [ 89.934122][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.944248][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.957542][ T5850] bridge_slave_0: entered allmulticast mode [ 89.972730][ T5850] bridge_slave_0: entered promiscuous mode [ 90.044713][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.059855][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.091103][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.099803][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.108187][ T5850] bridge_slave_1: entered allmulticast mode [ 90.117790][ T5850] bridge_slave_1: entered promiscuous mode [ 90.134226][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.145666][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.186114][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.204462][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.214417][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.254794][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.286178][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.295233][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.303132][ T5852] bridge_slave_0: entered allmulticast mode [ 90.311696][ T5852] bridge_slave_0: entered promiscuous mode [ 90.334196][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.342009][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.353670][ T5849] bridge_slave_0: entered allmulticast mode [ 90.364368][ T5849] bridge_slave_0: entered promiscuous mode [ 90.374428][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.383007][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.391187][ T5849] bridge_slave_1: entered allmulticast mode [ 90.400084][ T5849] bridge_slave_1: entered promiscuous mode [ 90.439906][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.448336][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.457447][ T5852] bridge_slave_1: entered allmulticast mode [ 90.465679][ T5852] bridge_slave_1: entered promiscuous mode [ 90.513126][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.524876][ T5832] Bluetooth: hci3: command tx timeout [ 90.524881][ T5142] Bluetooth: hci4: command tx timeout [ 90.525269][ T5832] Bluetooth: hci1: command tx timeout [ 90.531240][ T5142] Bluetooth: hci0: command tx timeout [ 90.560587][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.580104][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.604712][ T5142] Bluetooth: hci2: command tx timeout [ 90.636858][ T5853] team0: Port device team_slave_0 added [ 90.648946][ T5853] team0: Port device team_slave_1 added [ 90.664793][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.764994][ T5849] team0: Port device team_slave_0 added [ 90.779485][ T5850] team0: Port device team_slave_0 added [ 90.789964][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.806070][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.817475][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.828086][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.859458][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.875140][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.884009][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.913842][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.938263][ T5849] team0: Port device team_slave_1 added [ 90.946309][ T5850] team0: Port device team_slave_1 added [ 90.985424][ T5847] hsr_slave_0: entered promiscuous mode [ 90.992620][ T5847] hsr_slave_1: entered promiscuous mode [ 91.038809][ T5852] team0: Port device team_slave_0 added [ 91.046212][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.055386][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.084360][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.110812][ T5852] team0: Port device team_slave_1 added [ 91.119378][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.130539][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.161349][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.193921][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.201985][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.233395][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.305669][ T5853] hsr_slave_0: entered promiscuous mode [ 91.314545][ T5853] hsr_slave_1: entered promiscuous mode [ 91.322313][ T5853] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.330858][ T5853] Cannot create hsr debugfs directory [ 91.338308][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.346545][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.378109][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.440578][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.448945][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.478237][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.491930][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.499919][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.531342][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.660676][ T5850] hsr_slave_0: entered promiscuous mode [ 91.668346][ T5850] hsr_slave_1: entered promiscuous mode [ 91.675345][ T5850] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.683839][ T5850] Cannot create hsr debugfs directory [ 91.694685][ T5849] hsr_slave_0: entered promiscuous mode [ 91.701494][ T5849] hsr_slave_1: entered promiscuous mode [ 91.708388][ T5849] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.739303][ T5849] Cannot create hsr debugfs directory [ 91.817463][ T5852] hsr_slave_0: entered promiscuous mode [ 91.825213][ T5852] hsr_slave_1: entered promiscuous mode [ 91.833232][ T5852] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.841839][ T5852] Cannot create hsr debugfs directory [ 92.201717][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.218853][ T976] cfg80211: failed to load regulatory.db [ 92.257929][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.291960][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.329577][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.364628][ T5853] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 92.381398][ T5853] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.400614][ T5853] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.418154][ T5853] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.488539][ T5850] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.528065][ T5850] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.544341][ T5850] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.580436][ T5850] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.604269][ T5846] Bluetooth: hci1: command tx timeout [ 92.604315][ T5838] Bluetooth: hci3: command tx timeout [ 92.610250][ T5142] Bluetooth: hci0: command tx timeout [ 92.616718][ T5832] Bluetooth: hci4: command tx timeout [ 92.683875][ T5142] Bluetooth: hci2: command tx timeout [ 92.700935][ T5849] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.714154][ T5849] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.726273][ T5849] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.737565][ T5849] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.827316][ T5852] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.860583][ T5852] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.871832][ T5852] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.888230][ T5852] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.028986][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.111183][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.136513][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.164529][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.177204][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.185867][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.239985][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.248268][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.279683][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.307781][ T5853] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.336229][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.359012][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.368155][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.420407][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.429059][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.449380][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.472111][ T5852] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.485376][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.493383][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.520232][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.530326][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.574540][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.582627][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.625740][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.633864][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.660964][ T5849] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.706967][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.739161][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.747983][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.761354][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.769696][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.969191][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.006492][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.030740][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.051952][ T5847] veth0_vlan: entered promiscuous mode [ 94.104888][ T5847] veth1_vlan: entered promiscuous mode [ 94.127440][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.281015][ T5850] veth0_vlan: entered promiscuous mode [ 94.310937][ T5847] veth0_macvtap: entered promiscuous mode [ 94.334438][ T5847] veth1_macvtap: entered promiscuous mode [ 94.362214][ T5853] veth0_vlan: entered promiscuous mode [ 94.410471][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.431175][ T5850] veth1_vlan: entered promiscuous mode [ 94.465457][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.498324][ T5847] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.509498][ T5847] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.521492][ T5847] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.532409][ T5847] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.550229][ T5852] veth0_vlan: entered promiscuous mode [ 94.564574][ T5853] veth1_vlan: entered promiscuous mode [ 94.582483][ T5849] veth0_vlan: entered promiscuous mode [ 94.616129][ T5852] veth1_vlan: entered promiscuous mode [ 94.647999][ T5849] veth1_vlan: entered promiscuous mode [ 94.684638][ T5142] Bluetooth: hci0: command tx timeout [ 94.684691][ T5832] Bluetooth: hci3: command tx timeout [ 94.690535][ T5846] Bluetooth: hci4: command tx timeout [ 94.698810][ T5838] Bluetooth: hci1: command tx timeout [ 94.763620][ T5838] Bluetooth: hci2: command tx timeout [ 94.862146][ T5850] veth0_macvtap: entered promiscuous mode [ 94.890765][ T5852] veth0_macvtap: entered promiscuous mode [ 94.911590][ T5853] veth0_macvtap: entered promiscuous mode [ 94.945401][ T1134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.969802][ T1134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.000927][ T5849] veth0_macvtap: entered promiscuous mode [ 95.026807][ T5852] veth1_macvtap: entered promiscuous mode [ 95.048735][ T5853] veth1_macvtap: entered promiscuous mode [ 95.070004][ T5850] veth1_macvtap: entered promiscuous mode [ 95.106595][ T5849] veth1_macvtap: entered promiscuous mode [ 95.130120][ T5852] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.150302][ T5852] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.166158][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.178426][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.187711][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.207232][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.207419][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.218414][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.241025][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.258377][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.301595][ T5852] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.315515][ T5852] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.365488][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.383960][ T5850] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.408319][ T5850] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.424731][ T5850] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.441018][ T5850] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.458879][ T5850] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.481449][ T5850] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.506450][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.524048][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.538777][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.556953][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.568424][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.596562][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.611632][ T5853] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.628807][ T5853] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.648105][ T5853] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.661698][ T5853] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.700151][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.716424][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.735708][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.751014][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.764499][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.776158][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.787536][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.804062][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.824516][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.849923][ T5850] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.856726][ T5847] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.862880][ T5850] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.895568][ T5850] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.908785][ T5850] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.922689][ T5850] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.940737][ T5850] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.960340][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.007502][ T5852] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.029609][ T5852] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.047334][ T5852] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.067825][ T5852] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.121479][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.141111][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.171226][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.188738][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.203771][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.222989][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.243080][ T5849] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.264935][ T5849] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.286348][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.317212][ T5850] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.337409][ T5850] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.361072][ T5850] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.381356][ T5850] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.430691][ T5849] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.469880][ T5849] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.495432][ T5849] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.532896][ T5849] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766097][ T5838] Bluetooth: hci4: command tx timeout [ 96.779359][ T5832] Bluetooth: hci0: command tx timeout [ 96.781880][ T5846] Bluetooth: hci1: command tx timeout [ 96.798321][ T5838] Bluetooth: hci3: command tx timeout [ 96.843552][ T5838] Bluetooth: hci2: command tx timeout [ 97.082240][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.109068][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.149180][ T1106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.244863][ T1106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.387305][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.435219][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.519613][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.563870][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.619931][ T1106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.638104][ T1106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.924158][ T1106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.926653][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.979713][ T1106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.984824][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.269123][ T1106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.318010][ T1106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.552552][ T5886] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 98.766310][ T5886] usb 2-1: Using ep0 maxpacket: 8 [ 98.926110][ T5906] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 99.233335][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 99.294467][ T5886] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 99.333193][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 99.353629][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 99.392686][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.415315][ T5886] usb 2-1: Product: syz [ 99.419724][ T5886] usb 2-1: Manufacturer: syz [ 99.532699][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 99.534620][ T5886] usb 2-1: SerialNumber: syz [ 99.717383][ T5886] usb 2-1: config 0 descriptor?? [ 99.815034][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 99.892822][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 100.044845][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.114216][ T5886] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 100.359971][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 100.763796][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 101.013276][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 101.713072][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 101.768394][ C0] raw-gadget.1 gadget.0: ignoring, device is not running [ 101.906935][ T9] usb 1-1: device descriptor read/64, error -32 [ 102.279878][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 102.573142][ T5886] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 102.630337][ T5886] usb 2-1: USB disconnect, device number 2 [ 102.960931][ T9] usb 1-1: config 0 has no interfaces? [ 103.174885][ T9] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 103.216707][ T5916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 103.266355][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.352971][ T9] usb 1-1: Product: syz [ 103.357549][ T9] usb 1-1: Manufacturer: syz [ 103.512907][ T9] usb 1-1: SerialNumber: syz [ 103.558346][ T9] usb 1-1: config 0 descriptor?? [ 104.646475][ T5940] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 104.923673][ T25] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 105.124709][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 105.309290][ T25] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.329031][ T25] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.371013][ T25] usb 3-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 105.396113][ T25] usb 3-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 105.417583][ T25] usb 3-1: Product: syz [ 105.422341][ T25] usb 3-1: Manufacturer: syz [ 105.430170][ T25] usb 3-1: SerialNumber: syz [ 105.527516][ T25] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input5 [ 106.386805][ T5897] usb 1-1: USB disconnect, device number 3 [ 107.128586][ T5886] usb 3-1: USB disconnect, device number 2 [ 107.214845][ T5897] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 107.237640][ T5886] appletouch 3-1:1.0: input: appletouch disconnected [ 107.466700][ T5897] usb 1-1: config 0 has no interfaces? [ 107.539418][ T5897] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 107.571849][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.615231][ T5897] usb 1-1: Product: syz [ 107.639862][ T5897] usb 1-1: Manufacturer: syz [ 107.657613][ T5897] usb 1-1: SerialNumber: syz [ 107.689351][ T5897] usb 1-1: config 0 descriptor?? [ 107.709997][ T5954] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15'. [ 107.732503][ T5951] netlink: 88 bytes leftover after parsing attributes in process `syz.4.14'. [ 107.754456][ T5954] tipc: Started in network mode [ 107.759829][ T5954] tipc: Node identity 4, cluster identity 4711 [ 107.794799][ T5954] tipc: Node number set to 4 [ 107.939813][ T5953] veth1_macvtap: left promiscuous mode [ 108.176157][ T5946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 108.192208][ T5946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.227807][ T5946] netlink: 5 bytes leftover after parsing attributes in process `syz.0.12'. [ 108.410336][ T5946] 0猉功D龌: renamed from gretap0 (while UP) [ 108.427760][ T5960] RDS: rds_bind could not find a transport for ::ffff:10.1.1.0, load rds_tcp or rds_rdma? [ 108.636191][ T5886] IPVS: starting estimator thread 0... [ 108.650798][ T5946] 0猉功D龌: entered allmulticast mode [ 108.734138][ T5970] IPVS: using max 29 ests per chain, 69600 per kthread [ 109.143007][ T5889] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 109.429579][ T5889] usb 3-1: Using ep0 maxpacket: 8 [ 109.454344][ T5889] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 109.499525][ T5889] usb 3-1: config 179 has no interface number 0 [ 109.513158][ T5889] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 109.526758][ T5889] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 109.542485][ T5889] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 109.559251][ T5889] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 109.574440][ T5889] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 109.590352][ T5889] usb 3-1: config 179 interface 65 has no altsetting 0 [ 109.598408][ T5889] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 109.609882][ T5889] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.641147][ T5889] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input6 [ 109.741873][ T5189] input input6: unable to receive magic message: -110 [ 110.085288][ T5189] input input6: unable to receive magic message: -32 [ 110.101830][ T5957] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 110.148380][ T5189] input input6: unable to receive magic message: -32 [ 110.200900][ T5979] Zero length message leads to an empty skb [ 110.323512][ T5189] input input6: unable to receive magic message: -32 [ 110.514265][ T5189] input input6: unable to receive magic message: -32 [ 110.629941][ T5889] usb 3-1: USB disconnect, device number 3 [ 110.637145][ C1] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 110.637374][ C1] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 110.678851][ T5889] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 110.874453][ T5886] usb 1-1: USB disconnect, device number 4 [ 111.593349][ T5886] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 111.816615][ T5886] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.895384][ T5886] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 111.907302][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.923192][ T5886] usb 1-1: Product: syz [ 111.927878][ T5886] usb 1-1: Manufacturer: syz [ 111.934027][ T5886] usb 1-1: SerialNumber: syz [ 111.952386][ T5886] usb 1-1: config 0 descriptor?? [ 111.977614][ T5886] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 112.520814][ T5886] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 112.538070][ T5886] usb 1-1: USB disconnect, device number 5 [ 112.745035][ T5884] udevd[5884]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 112.833197][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 113.033983][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 113.062419][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 113.100646][ T9] usb 2-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 113.132346][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.183111][ T9] usb 2-1: Product: syz [ 113.187628][ T9] usb 2-1: Manufacturer: syz [ 113.213061][ T9] usb 2-1: SerialNumber: syz [ 113.255751][ T9] usb 2-1: config 0 descriptor?? [ 113.297270][ T9] smsusb:smsusb_probe: board id=2, interface number 0 [ 113.329941][ T9] smsusb:smsusb_probe: Device initialized with return code -19 [ 115.642942][ T5889] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 115.703659][ T46] usb 2-1: USB disconnect, device number 3 [ 115.846446][ T5889] usb 4-1: config 0 has no interfaces? [ 115.878921][ T5889] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 115.897611][ T5889] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.908110][ T5889] usb 4-1: Product: syz [ 115.922222][ T5889] usb 4-1: Manufacturer: syz [ 115.963238][ T5889] usb 4-1: SerialNumber: syz [ 116.006630][ T5889] usb 4-1: config 0 descriptor?? [ 116.563441][ T6037] block device autoloading is deprecated and will be removed. [ 116.592946][ T5897] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 116.624242][ T6028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.675346][ T6028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.783058][ T5897] usb 1-1: Using ep0 maxpacket: 32 [ 116.810622][ T5897] usb 1-1: config 0 has an invalid interface number: 219 but max is 0 [ 116.888239][ T5897] usb 1-1: config 0 has no interface number 0 [ 116.910742][ T5897] usb 1-1: config 0 interface 219 has no altsetting 0 [ 116.918937][ T5897] usb 1-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice=30.46 [ 116.929291][ T5897] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.943485][ T5897] usb 1-1: config 0 descriptor?? [ 117.853785][ T5897] usb 1-1: string descriptor 0 read error: -71 [ 117.876766][ T5897] usb 1-1: USB disconnect, device number 6 [ 119.848557][ T46] usb 4-1: USB disconnect, device number 2 [ 119.885417][ T6057] netlink: 36 bytes leftover after parsing attributes in process `syz.1.37'. [ 119.965114][ T6057] netlink: 16 bytes leftover after parsing attributes in process `syz.1.37'. [ 120.046215][ T6057] netlink: 36 bytes leftover after parsing attributes in process `syz.1.37'. [ 120.134830][ T6057] netlink: 36 bytes leftover after parsing attributes in process `syz.1.37'. [ 120.628174][ T6064] could not allocate digest TFM handle cmac(aes) [ 121.442829][ T6079] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 121.527086][ T6083] netlink: 4 bytes leftover after parsing attributes in process `syz.2.42'. [ 121.675291][ T6088] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 122.592919][ T46] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 122.955558][ T29] audit: type=1326 audit(1735854932.920:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.068681][ T29] audit: type=1326 audit(1735854932.960:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.080529][ T46] usb 5-1: config 0 has no interfaces? [ 123.141569][ T29] audit: type=1326 audit(1735854932.960:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.310116][ T29] audit: type=1326 audit(1735854932.960:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.380562][ T29] audit: type=1326 audit(1735854933.030:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.618331][ T29] audit: type=1326 audit(1735854933.030:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.804393][ T46] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 123.837807][ T29] audit: type=1326 audit(1735854933.030:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 123.913088][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.991424][ T5886] IPVS: starting estimator thread 0... [ 124.036745][ T46] usb 5-1: Product: syz [ 124.138608][ T46] usb 5-1: Manufacturer: syz [ 124.153305][ T6118] IPVS: using max 28 ests per chain, 67200 per kthread [ 124.174099][ T29] audit: type=1326 audit(1735854933.030:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 124.216235][ T46] usb 5-1: SerialNumber: syz [ 124.256608][ T46] usb 5-1: config 0 descriptor?? [ 124.484535][ T5886] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 124.532610][ T29] audit: type=1326 audit(1735854933.030:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 124.652951][ T5886] usb 1-1: Using ep0 maxpacket: 8 [ 124.679808][ T5886] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 124.694221][ T5886] usb 1-1: config 179 has no interface number 0 [ 124.701759][ T5886] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 124.719292][ T5886] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 124.752536][ T5886] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 7 [ 124.814064][ T5886] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 9272, setting to 1024 [ 124.955081][ T5886] usb 1-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 124.976010][ T5886] usb 1-1: config 179 interface 65 has no altsetting 0 [ 124.990568][ T5886] usb 1-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 125.015542][ T29] audit: type=1326 audit(1735854933.030:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6105 comm="syz.0.46" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 125.104173][ T5886] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.972667][ T5897] usb 1-1: USB disconnect, device number 7 [ 126.415940][ T976] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 126.510359][ T6146] tipc: Enabled bearer , priority 10 [ 126.654736][ T976] usb 4-1: Using ep0 maxpacket: 16 [ 126.690930][ T976] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 126.761134][ T976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 126.840986][ T6148] tipc: Enabled bearer , priority 0 [ 126.875370][ T976] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 126.898944][ T976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 126.924656][ T6153] vlan2: entered promiscuous mode [ 126.933915][ T6153] batman_adv: batadv0: Adding interface: vlan2 [ 126.941326][ T976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 126.957439][ T6153] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 126.987813][ T976] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 127.030203][ T976] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 127.061838][ T976] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 127.082928][ T6153] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 127.109730][ T976] usb 4-1: Manufacturer: syz [ 127.150140][ T976] usb 4-1: config 0 descriptor?? [ 127.336494][ T976] usb 5-1: USB disconnect, device number 2 [ 127.689988][ T976] usb 4-1: USB disconnect, device number 3 [ 127.742047][ T6155] netlink: 79 bytes leftover after parsing attributes in process `syz.2.55'. [ 130.901976][ T29] kauditd_printk_skb: 55 callbacks suppressed [ 130.901992][ T29] audit: type=1326 audit(1735854940.900:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 131.126594][ T29] audit: type=1326 audit(1735854940.900:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 131.337866][ T29] audit: type=1326 audit(1735854940.970:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 131.365289][ T6186] kernel profiling enabled (shift: 0) [ 131.745276][ T29] audit: type=1326 audit(1735854940.970:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 131.945812][ T29] audit: type=1326 audit(1735854940.970:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 132.108988][ T29] audit: type=1326 audit(1735854940.980:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 132.333876][ T29] audit: type=1326 audit(1735854941.010:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 132.443394][ T6192] netlink: 4 bytes leftover after parsing attributes in process `syz.2.64'. [ 132.499554][ T29] audit: type=1326 audit(1735854941.040:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 132.500741][ T6192] bridge_slave_1: left allmulticast mode [ 132.668905][ T29] audit: type=1326 audit(1735854941.040:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 132.721045][ T6192] bridge_slave_1: left promiscuous mode [ 132.790751][ T6192] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.817948][ T6194] netlink: 'syz.2.64': attribute type 11 has an invalid length. [ 132.890524][ T29] audit: type=1326 audit(1735854941.040:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.1.63" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4f579 code=0x7ffc0000 [ 132.986834][ T6194] vivid-000: ================= START STATUS ================= [ 133.039839][ T6192] bridge_slave_0: left allmulticast mode [ 133.051622][ T6194] vivid-000: Radio HW Seek Mode: Bounded [ 133.113643][ T6192] bridge_slave_0: left promiscuous mode [ 133.146319][ T6194] vivid-000: Radio Programmable HW Seek: false [ 133.169265][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.198289][ T6192] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.198354][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.229001][ T6194] vivid-000: RDS Rx I/O Mode: Block I/O [ 133.315796][ T6194] vivid-000: Generate RBDS Instead of RDS: false [ 133.437533][ T6194] vivid-000: RDS Reception: true [ 133.492927][ T6194] vivid-000: RDS Program Type: 0 inactive [ 133.518623][ T6194] vivid-000: RDS PS Name: inactive [ 133.572871][ T6194] vivid-000: RDS Radio Text: inactive [ 133.616854][ T6194] vivid-000: RDS Traffic Announcement: false inactive [ 133.702944][ T6194] vivid-000: RDS Traffic Program: false inactive [ 133.762900][ T6194] vivid-000: RDS Music: false inactive [ 133.769485][ T6194] vivid-000: ================== END STATUS ================== [ 134.222368][ T6186] syz.1.63: vmalloc error: size 738197504, failed to allocated page array size 1441792, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 134.418532][ T6186] CPU: 1 UID: 0 PID: 6186 Comm: syz.1.63 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0 [ 134.431701][ T6186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 134.443388][ T6186] Call Trace: [ 134.447600][ T6186] [ 134.450753][ T6186] dump_stack_lvl+0x241/0x360 [ 134.456642][ T6186] ? __pfx_dump_stack_lvl+0x10/0x10 [ 134.463202][ T6186] ? __pfx__printk+0x10/0x10 [ 134.468402][ T6186] ? cpuset_print_current_mems_allowed+0x1f/0x350 [ 134.475701][ T6186] ? cpuset_print_current_mems_allowed+0x31e/0x350 [ 134.483163][ T6186] warn_alloc+0x278/0x410 [ 134.488336][ T6186] ? __pfx_warn_alloc+0x10/0x10 [ 134.494685][ T6186] ? profile_init+0xb1/0x100 [ 134.500352][ T6186] ? __get_vm_area_node+0x1c8/0x2d0 [ 134.507203][ T6186] ? __get_vm_area_node+0x25c/0x2d0 [ 134.515017][ T6186] __vmalloc_node_range_noprof+0x62f/0x1380 [ 134.522190][ T6186] ? __pfx_lock_release+0x10/0x10 [ 134.528268][ T6186] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 134.536614][ T6186] ? __pfx_sysfs_kf_write+0x10/0x10 [ 134.542749][ T6186] ? __pfx_sysfs_kf_write+0x10/0x10 [ 134.548371][ T6186] ? profile_init+0xb1/0x100 [ 134.554724][ T6186] ? __pfx_sysfs_kf_write+0x10/0x10 [ 134.561498][ T6186] vzalloc_noprof+0x79/0x90 [ 134.566287][ T6186] ? profile_init+0xb1/0x100 [ 134.571187][ T6186] profile_init+0xb1/0x100 [ 134.576745][ T6186] profiling_store+0x6c/0xf0 [ 134.584055][ T6186] kernfs_fop_write_iter+0x3a0/0x500 [ 134.589592][ T6186] iter_file_splice_write+0xbfa/0x1510 [ 134.599069][ T6186] ? __pfx_iter_file_splice_write+0x10/0x10 [ 134.607333][ T6186] ? rcu_read_lock_any_held+0xb7/0x160 [ 134.614673][ T6186] ? __pfx_iter_file_splice_write+0x10/0x10 [ 134.620889][ T6186] direct_splice_actor+0x11b/0x220 [ 134.626474][ T6186] splice_direct_to_actor+0x586/0xc80 [ 134.633042][ T6186] ? __pfx_direct_splice_actor+0x10/0x10 [ 134.639951][ T6186] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 134.647345][ T6186] ? __fget_files+0x2a/0x410 [ 134.654183][ T6186] ? __pfx_lock_release+0x10/0x10 [ 134.659627][ T6186] do_splice_direct+0x289/0x3e0 [ 134.669628][ T6186] ? __pfx_do_splice_direct+0x10/0x10 [ 134.679626][ T6186] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 134.686293][ T6186] ? rw_verify_area+0x1c3/0x6f0 [ 134.691802][ T6186] do_sendfile+0x564/0x8a0 [ 134.696555][ T6186] ? __pfx_do_sendfile+0x10/0x10 [ 134.702567][ T6186] __se_compat_sys_sendfile+0x194/0x1f0 [ 134.709398][ T6186] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 134.719720][ T6186] ? __pfx___se_compat_sys_sendfile+0x10/0x10 [ 134.726752][ T6186] ? __secure_computing+0x125/0x370 [ 134.733007][ T6186] __do_fast_syscall_32+0xb4/0x110 [ 134.738742][ T6186] ? exc_page_fault+0x590/0x8b0 [ 134.745376][ T6186] do_fast_syscall_32+0x34/0x80 [ 134.750997][ T6186] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.758650][ T6186] RIP: 0023:0xf7f4f579 [ 134.762780][ T6186] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 134.786922][ T6186] RSP: 002b:00000000f50a655c EFLAGS: 00000206 ORIG_RAX: 00000000000000bb [ 134.796193][ T6186] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000000000009 [ 134.805504][ T6186] RDX: 0000000000000000 RSI: 00000000000000c3 RDI: 0000000000000000 [ 134.814846][ T6186] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.824206][ T6186] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 134.832868][ T6186] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.841271][ T6186] [ 134.993538][ T6186] Mem-Info: [ 135.003135][ T6186] active_anon:22569 inactive_anon:0 isolated_anon:0 [ 135.003135][ T6186] active_file:9583 inactive_file:38234 isolated_file:0 [ 135.003135][ T6186] unevictable:768 dirty:358 writeback:0 [ 135.003135][ T6186] slab_reclaimable:9809 slab_unreclaimable:98387 [ 135.003135][ T6186] mapped:38584 shmem:19310 pagetables:806 [ 135.003135][ T6186] sec_pagetables:0 bounce:0 [ 135.003135][ T6186] kernel_misc_reclaimable:0 [ 135.003135][ T6186] free:1287233 free_pcp:5321 free_cma:0 [ 135.162922][ T6186] Node 0 active_anon:85876kB inactive_anon:0kB active_file:41232kB inactive_file:152860kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:157136kB dirty:1428kB writeback:0kB shmem:71604kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11164kB pagetables:3224kB sec_pagetables:0kB all_unreclaimable? no [ 135.224579][ T6186] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:76kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 135.292968][ T6186] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 135.351760][ T6186] lowmem_reserve[]: 0 2465 2466 0 0 [ 135.408150][ T6186] Node 0 DMA32 free:1255812kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB active_anon:82524kB inactive_anon:0kB active_file:42368kB inactive_file:152036kB unevictable:1536kB writepending:1504kB present:3129332kB managed:2552776kB mlocked:0kB bounce:0kB free_pcp:1360kB local_pcp:732kB free_cma:0kB [ 135.455637][ T6209] syz.0.68 uses obsolete (PF_INET,SOCK_PACKET) [ 135.531895][ T6186] lowmem_reserve[]: 0 0 0 0 0 [ 135.540998][ T6186] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048580kB managed:876kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 135.739845][ T6186] lowmem_reserve[]: 0 0 0 0 0 [ 135.755758][ T6186] Node 1 Normal free:3896440kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:76kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:6532kB local_pcp:6532kB free_cma:0kB [ 135.796743][ T5897] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 135.912974][ T6186] lowmem_reserve[]: 0 0 0 0 0 [ 135.973225][ T6186] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 136.007828][ T5897] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 136.023823][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.2.70'. [ 136.063945][ T5897] usb 1-1: config 0 has no interface number 0 [ 136.090111][ T5897] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 136.102931][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.113801][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.2.70'. [ 136.114413][ T5897] usb 1-1: Product: syz [ 136.154412][ T6186] Node 0 DMA32: 4*4kB (UME) 9*8kB (UME) 2*16kB (UE) 34*32kB (UME) 18*64kB (UE) 15*128kB (ME) 1*256kB (M) 4*512kB (UME) 5*1024kB (UME) 2*2048kB (UE) 299*4096kB (ME) = 1240504kB [ 136.193809][ T5897] usb 1-1: Manufacturer: syz [ 136.211188][ T5897] usb 1-1: SerialNumber: syz [ 136.291400][ T5897] usb 1-1: config 0 descriptor?? [ 136.359706][ T6186] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 136.499820][ T6186] Node 1 Normal: 221*4kB (UM) 79*8kB (UME) 42*16kB (UME) 237*32kB (UME) 102*64kB (UME) 32*128kB (UME) 15*256kB (UME) 9*512kB (UM) 3*1024kB (UME) 1*2048kB (U) 943*4096kB (M) = 3896492kB [ 136.549727][ T5897] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 136.624507][ T6186] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 136.655895][ T5897] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 136.687904][ T5897] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 136.699798][ T6186] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 136.759057][ T6186] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 136.813386][ T6186] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 136.824648][ T29] kauditd_printk_skb: 55 callbacks suppressed [ 136.824707][ T29] audit: type=1326 audit(1735854946.770:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6208 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 136.869916][ T5897] usb 1-1: media controller created [ 136.939716][ T6186] 66140 total pagecache pages [ 136.949033][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 136.977485][ T6186] 0 pages in swap cache [ 137.004782][ T29] audit: type=1326 audit(1735854946.770:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6208 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 137.043297][ T5897] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 137.082702][ T29] audit: type=1326 audit(1735854946.770:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6208 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=40000003 syscall=13 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 137.111224][ T6186] Free swap = 124800kB [ 137.121301][ T6186] Total swap = 124996kB [ 137.130671][ T6186] 2097051 pages RAM [ 137.155835][ T6186] 0 pages HighMem/MovableOnly [ 137.213954][ T6186] 427007 pages reserved [ 137.236236][ T6228] process 'syz.4.72' launched './file0' with NULL argv: empty string added [ 137.256403][ T6186] 0 pages cma reserved [ 137.264571][ T5897] usb 1-1: USB disconnect, device number 8 [ 137.296892][ T29] audit: type=1326 audit(1735854946.770:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6208 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 137.451541][ T29] audit: type=1326 audit(1735854946.770:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6208 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fd579 code=0x7ffc0000 [ 137.511441][ T6233] syz.3.74 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 137.610346][ T6233] : renamed from bond0 (while UP) [ 138.556780][ T5886] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 138.761436][ T5886] usb 3-1: Using ep0 maxpacket: 16 [ 138.805477][ T5886] usb 3-1: New USB device found, idVendor=1b80, idProduct=c161, bcdDevice=ce.43 [ 138.889994][ T5886] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.029700][ T5886] usb 3-1: Product: syz [ 139.073006][ T5886] usb 3-1: Manufacturer: syz [ 139.092900][ T5886] usb 3-1: SerialNumber: syz [ 139.136880][ T5886] usb 3-1: config 0 descriptor?? [ 141.030570][ T6249] dvmrp0: entered allmulticast mode [ 141.114137][ T5886] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 141.140369][ T5886] dvb_usb_af9015 3-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 141.409404][ T6265] netlink: 4 bytes leftover after parsing attributes in process `syz.4.81'. [ 141.512301][ T6266] netlink: 4 bytes leftover after parsing attributes in process `syz.4.81'. [ 141.603657][ T5889] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 141.613064][ T5886] usb 3-1: USB disconnect, device number 4 [ 142.102948][ T5889] usb 4-1: Using ep0 maxpacket: 16 [ 142.393020][ T5889] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 142.466646][ T5889] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 142.703294][ T5889] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 142.778615][ T6266] bond0: (slave bond_slave_0): Releasing backup interface [ 142.808814][ T5889] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.849552][ T5889] usb 4-1: config 0 descriptor?? [ 142.892487][ T8] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 142.950744][ T5889] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 143.089726][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 143.161861][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.204002][ T976] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 143.213354][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.237398][ T8] usb 3-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 143.336155][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.454997][ T8] usb 3-1: config 0 descriptor?? [ 143.660346][ T976] usb 1-1: config 0 has no interfaces? [ 143.796422][ T976] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 143.877110][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.021423][ T976] usb 1-1: Product: syz [ 144.040230][ T976] usb 1-1: Manufacturer: syz [ 144.167885][ T976] usb 1-1: SerialNumber: syz [ 144.242660][ T976] usb 1-1: config 0 descriptor?? [ 144.931646][ T6285] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.955716][ T6285] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.088269][ T6285] netlink: 5 bytes leftover after parsing attributes in process `syz.0.84'. [ 145.122216][ T6285] 1猉功D龌: renamed from 00猉功D龌 (while UP) [ 145.396139][ T8] usbhid 3-1:0.0: can't add hid device: -71 [ 145.453372][ T8] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 145.521020][ T8] usb 3-1: USB disconnect, device number 5 [ 145.893131][ T5889] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 146.255406][ T5889] usb 5-1: config 0 has no interfaces? [ 146.365249][ T5889] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 146.442212][ T5889] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.489909][ T5889] usb 5-1: Product: syz [ 146.508975][ T8] usb 4-1: USB disconnect, device number 4 [ 146.590541][ T5889] usb 5-1: Manufacturer: syz [ 146.627041][ T5889] usb 5-1: SerialNumber: syz [ 146.759949][ T5889] usb 5-1: config 0 descriptor?? [ 147.313061][ T8] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 147.570355][ T8] usb 4-1: config 0 has no interfaces? [ 147.624182][ T8] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 147.654213][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.685286][ T8] usb 4-1: Product: syz [ 147.690127][ T8] usb 4-1: Manufacturer: syz [ 147.732277][ T5889] usb 1-1: USB disconnect, device number 9 [ 147.792512][ T8] usb 4-1: SerialNumber: syz [ 147.837242][ T8] usb 4-1: config 0 descriptor?? [ 150.133229][ T46] usb 5-1: USB disconnect, device number 3 [ 151.130553][ T5897] usb 4-1: USB disconnect, device number 5 [ 151.697339][ T5838] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 151.712924][ T5838] CPU: 1 UID: 0 PID: 5838 Comm: kworker/u9:5 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0 [ 151.726034][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 151.742079][ T5838] Workqueue: hci0 hci_rx_work [ 151.747787][ T5838] Call Trace: [ 151.756192][ T5838] [ 151.760507][ T5838] dump_stack_lvl+0x241/0x360 [ 151.765591][ T5838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 151.771929][ T5838] ? __pfx__printk+0x10/0x10 [ 151.779828][ T5838] ? __kmalloc_cache_noprof+0x243/0x390 [ 151.787216][ T5838] ? sysfs_create_dir_ns+0x28a/0x3a0 [ 151.796866][ T5838] sysfs_create_dir_ns+0x2ce/0x3a0 [ 151.803773][ T5838] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 151.810610][ T5838] kobject_add_internal+0x435/0x8d0 [ 151.819232][ T5838] kobject_add+0x152/0x220 [ 151.824751][ T5838] ? do_raw_spin_unlock+0x13c/0x8b0 [ 151.830736][ T5838] ? device_add+0x3e7/0xbf0 [ 151.836637][ T5838] ? __pfx_kobject_add+0x10/0x10 [ 151.842818][ T5838] ? _raw_spin_unlock+0x28/0x50 [ 151.848567][ T5838] ? get_device_parent+0x165/0x410 [ 151.854503][ T5838] device_add+0x4e5/0xbf0 [ 151.859005][ T5838] hci_conn_add_sysfs+0xe8/0x200 [ 151.864467][ T5838] le_conn_complete_evt+0xc9f/0x12e0 [ 151.870666][ T5838] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 151.878815][ T5838] ? __mutex_unlock_slowpath+0x21e/0x790 [ 151.885038][ T5838] ? __pfx___mutex_lock+0x10/0x10 [ 151.890573][ T5838] ? skb_pull_data+0x112/0x230 [ 151.895891][ T5838] hci_le_enh_conn_complete_evt+0x185/0x420 [ 151.903311][ T5838] hci_event_packet+0xa55/0x1540 [ 151.909365][ T5838] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 151.916185][ T5838] ? __pfx_hci_event_packet+0x10/0x10 [ 151.922910][ T5838] ? do_raw_spin_unlock+0x13c/0x8b0 [ 151.929640][ T5838] ? hci_send_to_monitor+0xd8/0x7f0 [ 151.935920][ T5838] ? kcov_remote_start+0x97/0x7d0 [ 151.942387][ T5838] hci_rx_work+0x3f3/0xdb0 [ 151.947134][ T5838] ? process_scheduled_works+0x976/0x1840 [ 151.953929][ T5838] process_scheduled_works+0xa66/0x1840 [ 151.961292][ T5838] ? __pfx_process_scheduled_works+0x10/0x10 [ 151.970496][ T5838] ? assign_work+0x364/0x3d0 [ 151.976476][ T5838] worker_thread+0x870/0xd30 [ 151.982728][ T5838] ? __kthread_parkme+0x169/0x1d0 [ 151.988669][ T5838] ? __pfx_worker_thread+0x10/0x10 [ 151.994362][ T5838] kthread+0x2f0/0x390 [ 151.999608][ T5838] ? __pfx_worker_thread+0x10/0x10 [ 152.005295][ T5838] ? __pfx_kthread+0x10/0x10 [ 152.010285][ T5838] ret_from_fork+0x4b/0x80 [ 152.016121][ T5838] ? __pfx_kthread+0x10/0x10 [ 152.022067][ T5838] ret_from_fork_asm+0x1a/0x30 [ 152.027370][ T5838] [ 152.043203][ T5838] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 152.059117][ T5838] Bluetooth: hci0: failed to register connection device [ 152.459431][ T6327] netlink: 'syz.3.93': attribute type 4 has an invalid length. [ 152.502489][ T6327] netlink: 132 bytes leftover after parsing attributes in process `syz.3.93'. [ 152.783430][ T8] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 153.032985][ T8] usb 5-1: Using ep0 maxpacket: 32 [ 153.214535][ T8] usb 5-1: unable to get BOS descriptor or descriptor too short [ 153.267985][ T6337] netlink: 24 bytes leftover after parsing attributes in process `syz.2.96'. [ 153.323830][ T8] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 153.380824][ T8] usb 5-1: can't read configurations, error -71 [ 154.138224][ T5832] Bluetooth: hci0: command tx timeout [ 155.087700][ T5897] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 155.254711][ T5897] usb 4-1: Using ep0 maxpacket: 32 [ 155.308975][ T5897] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 155.338295][ T5897] usb 4-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 155.381265][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.407760][ T5897] usb 4-1: Product: syz [ 155.428295][ T5897] usb 4-1: Manufacturer: syz [ 155.475764][ T5897] usb 4-1: SerialNumber: syz [ 155.509266][ T5897] usb 4-1: config 0 descriptor?? [ 155.545230][ T6353] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 155.625586][ T5897] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 155.692956][ T46] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 155.934013][ T46] usb 1-1: Using ep0 maxpacket: 8 [ 155.974179][ T46] usb 1-1: New USB device found, idVendor=0711, idProduct=0210, bcdDevice=ba.13 [ 156.032966][ T976] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 156.048284][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.163100][ T46] usb 1-1: Product: syz [ 156.183503][ T46] usb 1-1: Manufacturer: syz [ 156.244830][ T46] usb 1-1: SerialNumber: syz [ 156.259547][ T976] usb 2-1: Using ep0 maxpacket: 8 [ 156.322709][ T976] usb 2-1: config 0 has an invalid interface number: 237 but max is 0 [ 156.380585][ T46] usb 1-1: config 0 descriptor?? [ 156.446428][ T46] mct_u232 1-1:0.0: MCT U232 converter detected [ 156.476949][ T976] usb 2-1: config 0 has no interface number 0 [ 156.500366][ T46] mct_u232 ttyUSB0: expected endpoint missing [ 156.569583][ T976] usb 2-1: New USB device found, idVendor=093a, idProduct=2460, bcdDevice=2a.87 [ 156.626892][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.715469][ T976] usb 2-1: Product: syz [ 156.804493][ T976] usb 2-1: Manufacturer: syz [ 156.841414][ T976] usb 2-1: SerialNumber: syz [ 156.937368][ T976] usb 2-1: config 0 descriptor?? [ 157.805926][ T8] usb 4-1: USB disconnect, device number 6 [ 157.939854][ T6363] binder: 6362:6363 ioctl 4008af20 20000380 returned -22 [ 158.168261][ T976] gspca_main: pac207-2.14.0 probing 093a:2460 [ 158.256801][ T976] gspca_pac207: Failed to read a register (index 0x0000, error -71) [ 158.307554][ T976] usb 2-1: USB disconnect, device number 4 [ 158.990666][ T976] usb 1-1: USB disconnect, device number 10 [ 159.048895][ T976] mct_u232 1-1:0.0: device disconnected [ 159.302917][ T46] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 159.673019][ T46] usb 4-1: Using ep0 maxpacket: 16 [ 159.727454][ T46] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 159.769791][ T46] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 159.872977][ T46] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 159.955347][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.032102][ T46] usb 4-1: config 0 descriptor?? [ 160.953245][ T6394] netlink: 36 bytes leftover after parsing attributes in process `syz.0.108'. [ 160.983170][ T6394] netlink: 16 bytes leftover after parsing attributes in process `syz.0.108'. [ 161.020324][ T6394] netlink: 36 bytes leftover after parsing attributes in process `syz.0.108'. [ 161.049090][ T6394] netlink: 36 bytes leftover after parsing attributes in process `syz.0.108'. [ 161.286109][ T6378] mmap: syz.3.104 (6378) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 162.129638][ T6405] JFS: charset not found [ 163.727456][ T46] usb 4-1: USB disconnect, device number 7 [ 165.643191][ T5897] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 165.853080][ T5897] usb 5-1: Using ep0 maxpacket: 8 [ 165.884015][ T5897] usb 5-1: config 0 has an invalid interface number: 237 but max is 0 [ 165.952973][ T5897] usb 5-1: config 0 has no interface number 0 [ 165.981641][ T5897] usb 5-1: New USB device found, idVendor=093a, idProduct=2460, bcdDevice=2a.87 [ 166.025601][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.070542][ T5897] usb 5-1: Product: syz [ 166.104690][ T5897] usb 5-1: Manufacturer: syz [ 166.117426][ T5897] usb 5-1: SerialNumber: syz [ 166.167361][ T5897] usb 5-1: config 0 descriptor?? [ 166.562968][ T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 166.858097][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 166.971527][ T6437] binder: 6436:6437 ioctl 4008af20 20000380 returned -22 [ 167.101947][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 167.183663][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 167.203614][ T5897] gspca_main: pac207-2.14.0 probing 093a:2460 [ 167.215715][ T5897] gspca_pac207: Failed to read a register (index 0x0000, error -71) [ 167.228442][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 167.238953][ T9] usb 4-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 167.259992][ T9] usb 4-1: Product: syz [ 167.280353][ T5897] usb 5-1: USB disconnect, device number 6 [ 167.332851][ T9] usb 4-1: Manufacturer: syz [ 167.347826][ T9] usb 4-1: SerialNumber: syz [ 167.388914][ T9] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input9 [ 167.635702][ C1] appletouch 4-1:1.0: atp_complete: usb_submit_urb failed with result -1 [ 167.659447][ T9] usb 4-1: USB disconnect, device number 8 [ 167.752118][ T9] appletouch 4-1:1.0: input: appletouch disconnected [ 168.200473][ T6467] netlink: 36 bytes leftover after parsing attributes in process `syz.2.122'. [ 168.213031][ T6467] netlink: 16 bytes leftover after parsing attributes in process `syz.2.122'. [ 168.239588][ T6467] netlink: 36 bytes leftover after parsing attributes in process `syz.2.122'. [ 168.271061][ T6467] netlink: 36 bytes leftover after parsing attributes in process `syz.2.122'. [ 169.152900][ T25] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 169.435974][ T25] usb 2-1: Using ep0 maxpacket: 16 [ 169.511078][ T25] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.640470][ T25] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 169.732019][ T25] usb 2-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 169.845030][ T6490] warning: `syz.3.128' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 169.869215][ T25] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.013265][ T25] usb 2-1: config 0 descriptor?? [ 172.853113][ T25] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 173.702694][ T5897] usb 2-1: USB disconnect, device number 5 [ 175.365062][ T29] audit: type=1326 audit(1735854985.370:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6518 comm="syz.4.136" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f54579 code=0x7fc00000 [ 175.443214][ T5897] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 175.713445][ T5897] usb 4-1: config 0 has no interfaces? [ 175.735039][ T5897] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 175.751660][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.770160][ T5897] usb 4-1: Product: syz [ 175.786490][ T5897] usb 4-1: Manufacturer: syz [ 175.843668][ T5897] usb 4-1: SerialNumber: syz [ 175.894595][ T5897] usb 4-1: config 0 descriptor?? [ 176.389101][ T6538] netlink: 5 bytes leftover after parsing attributes in process `syz.3.138'. [ 176.414238][ T6538] 0猉功D龌: renamed from gretap0 (while UP) [ 176.510157][ T6538] 0猉功D龌: entered allmulticast mode [ 176.702986][ T46] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 176.932942][ T46] usb 5-1: Using ep0 maxpacket: 32 [ 176.968295][ T46] usb 5-1: config 0 has an invalid interface number: 219 but max is 0 [ 177.003162][ T46] usb 5-1: config 0 has no interface number 0 [ 177.012151][ T46] usb 5-1: config 0 interface 219 has no altsetting 0 [ 177.054415][ T46] usb 5-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice=30.46 [ 177.127515][ T46] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.195432][ T46] usb 5-1: config 0 descriptor?? [ 177.536255][ T6552] can: request_module (can-proto-3) failed. [ 178.210639][ T6560] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 178.285472][ T6560] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 178.567589][ T46] usb 5-1: string descriptor 0 read error: -71 [ 178.638892][ T46] usb 5-1: USB disconnect, device number 7 [ 178.835739][ T9] usb 4-1: USB disconnect, device number 9 [ 179.742983][ T976] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 179.782938][ T46] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 179.923011][ T976] usb 4-1: Using ep0 maxpacket: 16 [ 180.014778][ T46] usb 3-1: Using ep0 maxpacket: 16 [ 180.045829][ T976] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.100966][ T46] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.267755][ T976] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 180.277315][ T46] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 180.306214][ T46] usb 3-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 180.316320][ T976] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 180.339497][ T976] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.349242][ T46] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.371287][ T976] usb 4-1: config 0 descriptor?? [ 180.385712][ T46] usb 3-1: config 0 descriptor?? [ 183.145879][ T5897] usb 4-1: USB disconnect, device number 10 [ 187.131127][ T6646] netlink: 36 bytes leftover after parsing attributes in process `syz.4.163'. [ 187.142933][ T6646] netlink: 16 bytes leftover after parsing attributes in process `syz.4.163'. [ 187.153433][ T6646] netlink: 36 bytes leftover after parsing attributes in process `syz.4.163'. [ 187.172989][ T6646] netlink: 36 bytes leftover after parsing attributes in process `syz.4.163'. [ 187.435128][ C1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 187.447838][ C1] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 187.456376][ C1] CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0 [ 187.466986][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 187.477504][ C1] RIP: 0010:put_page+0x23/0x260 [ 187.483028][ C1] Code: 90 90 90 90 90 90 90 55 41 57 41 56 53 49 89 fe 48 bd 00 00 00 00 00 fc ff df e8 18 2c 12 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 ff 93 78 f8 48 8b 1b 48 89 de 48 83 [ 187.503280][ C1] RSP: 0018:ffffc900001e6b90 EFLAGS: 00010202 [ 187.509658][ C1] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88801cee8000 [ 187.518331][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 187.526579][ C1] RBP: dffffc0000000000 R08: ffffffff898cdaed R09: 1ffff1100dd7c26c [ 187.535291][ C1] R10: dffffc0000000000 R11: ffffed100dd7c26d R12: 0000000000000007 [ 187.544155][ C1] R13: ffff88806ebe1342 R14: 0000000000000000 R15: 0000000000000000 [ 187.552327][ C1] FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 [ 187.561704][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 187.569229][ C1] CR2: 00000000f70dad60 CR3: 000000005c3b4000 CR4: 00000000003526f0 [ 187.578890][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 187.586891][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 187.595079][ C1] Call Trace: [ 187.598370][ C1] [ 187.601332][ C1] ? __die_body+0x5f/0xb0 [ 187.605688][ C1] ? die_addr+0xb0/0xe0 [ 187.609874][ C1] ? exc_general_protection+0x3dd/0x5d0 [ 187.615438][ C1] ? __lock_acquire+0x1397/0x2100 [ 187.620476][ C1] ? asm_exc_general_protection+0x26/0x30 [ 187.626224][ C1] ? skb_release_data+0x46d/0x8a0 [ 187.631326][ C1] ? put_page+0x23/0x260 [ 187.635587][ C1] skb_release_data+0x483/0x8a0 [ 187.640451][ C1] __kfree_skb+0x55/0x70 [ 187.644695][ C1] tcp_ack+0x2442/0x6bc0 [ 187.648972][ C1] ? __pfx_tcp_ack+0x10/0x10 [ 187.653569][ C1] ? __lock_acquire+0x1397/0x2100 [ 187.658609][ C1] tcp_rcv_state_process+0x8eb/0x44e0 [ 187.663989][ C1] ? __pfx_tcp_rcv_state_process+0x10/0x10 [ 187.669828][ C1] ? sk_filter_trim_cap+0x5bf/0xa80 [ 187.675092][ C1] ? do_raw_spin_lock+0x14f/0x370 [ 187.680245][ C1] ? __pfx_tcp_inbound_hash+0x10/0x10 [ 187.685673][ C1] tcp_v4_do_rcv+0x77d/0xc70 [ 187.690425][ C1] tcp_v4_rcv+0x2dc0/0x37f0 [ 187.695063][ C1] ? __pfx_tcp_v4_rcv+0x10/0x10 [ 187.699941][ C1] ? __pfx_tcp_v4_rcv+0x10/0x10 [ 187.704817][ C1] ? __pfx_tcp_v4_rcv+0x10/0x10 [ 187.709791][ C1] ip_protocol_deliver_rcu+0x22e/0x440 [ 187.715262][ C1] ? ip_local_deliver_finish+0x230/0x5f0 [ 187.720902][ C1] ip_local_deliver_finish+0x341/0x5f0 [ 187.726546][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 187.732569][ C1] NF_HOOK+0x3a4/0x450 [ 187.736661][ C1] ? NF_HOOK+0x9a/0x450 [ 187.740854][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 187.745468][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 187.751461][ C1] ? ip_rcv_finish+0x406/0x560 [ 187.756260][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 187.761508][ C1] NF_HOOK+0x3a4/0x450 [ 187.765909][ C1] ? __lock_acquire+0x1397/0x2100 [ 187.771432][ C1] ? NF_HOOK+0x9a/0x450 [ 187.775976][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 187.780794][ C1] ? ip_rcv_core+0x801/0xd10 [ 187.785487][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 187.790725][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 187.795451][ C1] __netif_receive_skb+0x2bf/0x650 [ 187.800685][ C1] ? __pfx_lock_acquire+0x10/0x10 [ 187.806714][ C1] ? __pfx___netif_receive_skb+0x10/0x10 [ 187.812640][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 187.818810][ C1] ? __pfx_lock_release+0x10/0x10 [ 187.823870][ C1] ? _raw_spin_lock_irq+0xdf/0x120 [ 187.829035][ C1] process_backlog+0x662/0x15b0 [ 187.833974][ C1] ? process_backlog+0x33b/0x15b0 [ 187.839030][ C1] ? __pfx_process_backlog+0x10/0x10 [ 187.844391][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 187.850498][ C1] ? __lock_acquire+0x1397/0x2100 [ 187.855551][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 187.862080][ C1] __napi_poll+0xcb/0x490 [ 187.866500][ C1] net_rx_action+0x89b/0x1240 [ 187.871291][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 187.876549][ C1] ? sched_clock+0x4a/0x70 [ 187.881002][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 187.887412][ C1] ? __schedule+0x1858/0x4c30 [ 187.892850][ C1] handle_softirqs+0x2d4/0x9b0 [ 187.897859][ C1] ? run_ksoftirqd+0xca/0x130 [ 187.902759][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 187.908246][ C1] run_ksoftirqd+0xca/0x130 [ 187.912814][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 187.918039][ C1] ? __pfx_ksoftirqd_should_run+0x10/0x10 [ 187.923876][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 187.929087][ C1] smpboot_thread_fn+0x544/0xa30 [ 187.934330][ C1] ? smpboot_thread_fn+0x4e/0xa30 [ 187.939630][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 187.945240][ C1] kthread+0x2f0/0x390 [ 187.949380][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 187.954935][ C1] ? __pfx_kthread+0x10/0x10 [ 187.959559][ C1] ret_from_fork+0x4b/0x80 [ 187.964030][ C1] ? __pfx_kthread+0x10/0x10 [ 187.968765][ C1] ret_from_fork_asm+0x1a/0x30 [ 187.973547][ C1] [ 187.976677][ C1] Modules linked in: [ 187.980849][ C1] ---[ end trace 0000000000000000 ]--- [ 187.986423][ C1] RIP: 0010:put_page+0x23/0x260 [ 187.991312][ C1] Code: 90 90 90 90 90 90 90 55 41 57 41 56 53 49 89 fe 48 bd 00 00 00 00 00 fc ff df e8 18 2c 12 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 ff 93 78 f8 48 8b 1b 48 89 de 48 83 [ 188.011035][ C1] RSP: 0018:ffffc900001e6b90 EFLAGS: 00010202 [ 188.017251][ C1] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88801cee8000 [ 188.025390][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 188.033608][ C1] RBP: dffffc0000000000 R08: ffffffff898cdaed R09: 1ffff1100dd7c26c [ 188.041627][ C1] R10: dffffc0000000000 R11: ffffed100dd7c26d R12: 0000000000000007 [ 188.049682][ C1] R13: ffff88806ebe1342 R14: 0000000000000000 R15: 0000000000000000 [ 188.057718][ C1] FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 [ 188.066687][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 188.073330][ C1] CR2: 00000000f70dad60 CR3: 000000005c3b4000 CR4: 00000000003526f0 [ 188.081343][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 188.089375][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 188.097396][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 188.104940][ C1] Kernel Offset: disabled [ 188.109280][ C1] Rebooting in 86400 seconds..