last executing test programs: 4m38.085512443s ago: executing program 3 (id=1322): memfd_create(&(0x7f0000000100)='\x91\x7f\x00$\x00\x00\x00\x00\x00\xb8\xc9\x84*\xc0\xfeR\x01\x95\xceSc(\xa0\v\xde\x1b\xc4\xda\xb8q\xa2\xff\x15\xa59\x0e\xdf\xed\x00l\xba\x18\x13\x833_\xb8\xc9\xf3C\x88u5\x94\x95\x00yh\x9cE\xd0$)\x8eT\x8e\xe5\x00H\xab\x0e\x01!\x19^\xd8Z\t\x00\xef\xea:\x8c\x19\x833\x15\xc0\xcd\xa8', 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r0, &(0x7f0000000780)}, 0x20) 4m37.950041539s ago: executing program 3 (id=1323): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="60005080110001004abee339084eeef16f162471f4000000080003000cac0f00050002"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 4m37.661702943s ago: executing program 3 (id=1324): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x7}, @hci_rp_read_enc_key_size={{0x3}, {0xff, 0xc8, 0x9d}}}}, 0xa) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000240)=0x1) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000280)={0xffffe8d3, 0x1, 0x83, "ac9b94aaad0b79ae3a00000000000000dcfa577900", 0x31324d59}) sendmmsg$sock(r3, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 4m37.55879963s ago: executing program 3 (id=1325): socket$packet(0x11, 0x2, 0x300) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 4m37.319976658s ago: executing program 3 (id=1326): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(0xffffffffffffffff, &(0x7f0000002540)={0x2020}, 0x2020) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x0, 0xffffffff, @local, 0x9}, 0x1c) writev(r6, &(0x7f00000002c0), 0x0) 4m37.13063879s ago: executing program 3 (id=1327): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan1\x00'}) sendmsg$NL802154_CMD_SET_CHANNEL(r1, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), r3) sendmsg$IEEE802154_ASSOCIATE_REQ(r2, 0x0, 0x4008804) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) mount$tmpfs(0x0, &(0x7f0000004f80)='.\x00', &(0x7f0000000080), 0x4481, &(0x7f0000000040)=ANY=[@ANYBLOB="67727071756f74615f69da72d841"]) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102400, 0x19000) setxattr$incfs_metadata(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x0, 0x0, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r6 = dup2(r5, r5) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x3, 0x40000000, 0x10}) 2m46.004976816s ago: executing program 4 (id=1747): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001640)=@newqdisc={0x70, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfc, {0x60, 0x0, 0x0, r2, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_RATE64={0xc, 0x4, 0xb78fea3163f663ab}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0xfffa, 0x9, 0x9, 0x4}, {0x71, 0x2, 0x4, 0x8, 0x7, 0x101}, 0x0, 0x7, 0x1aa2}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xf0cda79ea301acfa}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0xc5}, 0xc010) 2m45.533000196s ago: executing program 4 (id=1752): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r3) syz_genetlink_get_family_id$nl802154(0x0, r3) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}}, 0x40080) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4040445}, 0x4808) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) keyctl$unlink(0x9, 0x0, 0xfffffffffffffffd) lseek(r4, 0x851, 0x1) 2m44.282552625s ago: executing program 4 (id=1757): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1000, 0x1, 0x400, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000000000006b0afcff0000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000bfa200000000000007020000fcffffff8500000001000000150007000000000007000000cc0f0000bf01000000000000b702000004000000b703000000000000b704000000000000b705000000000000850000001c000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m42.89469549s ago: executing program 4 (id=1764): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000003380), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r0, &(0x7f0000003540)={0x0, 0x0, &(0x7f0000003500)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 2m42.729776643s ago: executing program 4 (id=1765): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af"], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 2m42.59753658s ago: executing program 4 (id=1766): prlimit64(0x0, 0xe, &(0x7f0000000780)={0x60, 0x887}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e23, 0x3, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 2m26.289641029s ago: executing program 32 (id=1766): prlimit64(0x0, 0xe, &(0x7f0000000780)={0x60, 0x887}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e23, 0x3, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 59.806866995s ago: executing program 1 (id=1995): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) close(0x3) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r2, r2, &(0x7f0000000000)=0x1, 0x4) 56.140933658s ago: executing program 1 (id=2002): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r3) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}}, 0x40080) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4) lseek(r4, 0x851, 0x1) 54.788415676s ago: executing program 1 (id=2005): openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='net/rt6_stats\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r1, 0x0, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xe) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e22, 0x3, 'none\x00', 0x1e, 0x4, 0x6a}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x3b, @rand_addr=0x64010101, 0x4e21, 0x3, 'lc\x00', 0x11, 0x3240, 0x3d}, {@loopback, 0x4e23, 0x10000, 0x8628, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f0000000140)={'8255\x00', [0x3, 0xfffffffc, 0x5, 0x4, 0x2f, 0xfffffff7, 0x8001, 0xa22, 0xfffffff8, 0x2, 0xfffffffc, 0xc3, 0x5006, 0x1000007, 0x1, 0x10003, 0x801000, 0x7fffffff, 0x1ff, 0x3ff, 0x1001010, 0x1ff, 0x8, 0x3, 0x8001, 0x7, 0x3ff, 0x5, 0x404, 0x3, 0xfffd]}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000000c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004840}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a00001400028010000b800c0011"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$inet_udp(0x2, 0x2, 0x0) 54.165160539s ago: executing program 1 (id=2009): sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000040)=@in={0x2, 0xb, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000002c0)=[{&(0x7f00000000c0)='l', 0x1}], 0x1, &(0x7f0000000280)=[@init={0x18, 0x84, 0x0, {0x7ff, 0x0, 0x3}}], 0x18, 0x14001}], 0x1, 0x4044040) 53.63540671s ago: executing program 1 (id=2012): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xf) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000240)="64bbbe", 0x3}], 0x1) 53.073801867s ago: executing program 1 (id=2014): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), r0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0x44, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x83}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x667}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0xfffe}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x4814) 37.836069773s ago: executing program 33 (id=2014): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), r0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0x44, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x83}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x667}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0xfffe}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x4814) 5.489651955s ago: executing program 2 (id=2154): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x40, r1, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x40}}, 0x4040814) 5.298203151s ago: executing program 2 (id=2156): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000005880)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_procfs(r0, &(0x7f0000000200)='auxv\x00') sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r3) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000180)={0x0, 0x60, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, r4, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x8, 0x81ff, 0xfffffff3, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x40018}, 0x20004000) 4.857774019s ago: executing program 0 (id=2157): sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f7308515e21ee2d9a221658eda52b462cba9c87101382f1fc285084a45f005faf7e7545c8f70c301a2ee39383a63c8bcbba1925ac63053c22", 0xae}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d628ced4c78d9b5c1ccd2d96def83371b57cca466809f3d18f2f89d2143f6f299a66199559bf226314c0afdd622ed4bdc24c62ec00063477ae87a942c5760b768eb7d7960b1e7f98b48a4edb606df447aeeea5341a88d4c6347a1f45610e3602fc776a53b1204588e2b98309", 0xbc}, {&(0x7f0000000380)="0efb18e617048dae506fb6119eb0536e7984081783e7584cd5d8d27033ed437c6246b2b94a22bd62d589a8e3886d9977523fd3e8fd174d51cd86a159d2ef88ab0632d7eb46c792f365df9d56fdd2299f44da364e2ef035705a084bbf2d3fdbeea8f05b35502c909a69f9be0405607e6eed6bcfb3acbf182ba4a2016e207bdacb6f240adf181a764f79d7dd3c93fc3e74f5c0985587deb47eec917dab82f4a194a186cb5515e0133dbdea3633abe499b978e798c2a5a64913d677d3b99927638735b214566ae0f4ca2ec80d1dd27f3249f9f6dd0b7a5ba70c0e7ad0be90ef56c6dc2ef3f445cae39675ff73fffb3aaccbb5f823bd80d94e112b970b266f9e380432314c39fe589e3174bc10b87f3e8f221d46ee42a2544e4b0c26e947fe2667555001e5beefe950450ee8d41080e6fbba3effec8484de4a6f1314e5aaf19d40296a986bc0500f0d731d8bd1f6fa147ba791d1eff8a5d68ece936cc6336ede0e8686c34d3e9f8d12249ef52a61171be50635d5aaf7bc6140128b65220f88aac07fce9ce944f875b7255cbfd1e401a32217573adf2304c47e7c8c9bacfdc2b3ba7b9450c8bb8b44c4b39292f09240d6d3d47f7d421286c1e0e78cde078f74f3c2b53544ca683aa1a8ef31342d09a85e09687dd043df25f595c6a4b941c6f7166654c013be7b347702e2a27d50b2ef78212defab03bb82e1260063a39551f72eab61477f3e8bc673abdd41b5692066dec8d26a4cc6a6f821bcb2f2239972e753fb526e7f33ee49d6cbfcd2b669afbe099cf50d2798f1dd6e8104d05cc4357d742daaa9e333060c59a47fe9335a46b9289f3da0d5ec1ce19597f02ca09442714e2989a3a9b707fc3284de3d4a7d65e3c24c880b8fdad025f7dae7fd70655e4f5b98484de78ff51a7ac3159c3449aa7d222113bea285e75c46c784abfd19a4d4894f284a2e2625eb97b8e35b2af2a9d0eb53fe55ca9ef7acc1b51fbcdd521ed21bc57bc4dbb3923e175c49e04ae30df0f361af2105f7772753cd4d9233a24e858229798d88af5bfa9b450e9d81f5d4c2358a5c1559684659e8f6ef741f29d2a7910cc2b3ba01189c951ee3eb9ad7403590e82448e041e4310f878255156e0247c966fd857fa23086ecebeb7bff416bf21a9df5494c8bae4af0e3da77a274f99e15d07924011cddbbc004f704445cbf6f2940e2a2cca1b3e05b6bcf16f459cae5f12cd26eed0eea757fc60bac3d591380017046d091ec5a5b4b7d910527927b8b4b179c89f04ecab9753de8d0d280e5444b15d647396c13d365e9d72a81df3a48bd4c8bab2a62d6f669b9e40f7df414", 0x3ac}], 0x3}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3.779659856s ago: executing program 0 (id=2158): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) rmdir(&(0x7f0000000340)='./config/usb_gadget/g1/functions/phonet.usb0\x00') 3.609094859s ago: executing program 0 (id=2159): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='maps\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet_sctp(r4, &(0x7f0000000500)=[{&(0x7f0000000040)=@in={0x2, 0xb, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000002c0)=[{&(0x7f00000000c0)='l', 0x1}], 0x1, &(0x7f0000000280)=[@init={0x18, 0x84, 0x0, {0x7ff, 0x0, 0x3}}], 0x18, 0x14001}], 0x1, 0x4044040) setresuid(0x0, 0xee01, 0xffffffffffffffff) setreuid(0xee01, 0xee00) socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001840)={'gre0\x00', 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-224\x00'}, 0x58) lseek(r0, 0xffffffff, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) 2.514808987s ago: executing program 2 (id=2160): sched_setscheduler(0x0, 0x2, 0x0) socket(0x1e, 0x4, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@migrate={0xbc, 0x21, 0x1, 0xffffffff, 0xfffffffe, {{@in6=@local, @in6=@loopback, 0xfffe, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in=@multicast2=0xfc020000, @in6=@mcast1, @in6=@mcast2, @in=@local, 0x6c, 0x1, 0x0, 0x0, 0xa, 0xa}]}, @encap={0x1c, 0x4, {0x0, 0x4e20, 0x4e20, @in=@initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r5, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r5, 0x5b) keyctl$revoke(0x3, r4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) preadv(0xffffffffffffffff, &(0x7f00000014c0), 0x0, 0x8, 0xfffffffe) 2.15798224s ago: executing program 0 (id=2161): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c") write(r0, &(0x7f0000000138)="0000000000000000008000000000000000000000000000007468696e2d706f6f6c00000000000000373a3020373a31203132382030", 0x35) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e01000038010000010000000000000000000000000000000000000000000000000000006d79706f") 1.331779559s ago: executing program 0 (id=2162): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ptrace$ARCH_GET_GS(0x1e, r1, 0x0, 0x1004) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) timer_create(0x3, 0x0, &(0x7f0000000080)=0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) timer_getoverrun(r4) 1.221709085s ago: executing program 2 (id=2163): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x40, r1, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x40}}, 0x4040814) 1.070974743s ago: executing program 2 (id=2164): bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map, 0xffffffffffffffff, 0x26}, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb3", 0x42}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d628ced4c78d9b5c1ccd2d96def83371b57cca466809f3d18f2f89d2143f6f299a66199559bf226314c0afdd622ed4bdc24c62ec00063477ae87a942c5760b768eb7d7960b1e7f98b48a4edb", 0x9c}, {&(0x7f0000000380)="0efb18e617048dae506fb6119eb0536e7984081783e7584cd5d8d27033ed437c6246b2b94a22bd62d589a8e3886d9977523fd3e8fd174d51cd86a159d2ef88ab0632d7eb46c792f365df9d56fdd2299f44da364e2ef035705a084bbf2d3fdbeea8f05b35502c909a69f9be0405607e6eed6bcfb3acbf182ba4a2016e207bdacb6f240adf181a764f79d7dd3c93fc3e74f5c0985587deb47eec917dab82f4a194a186cb5515e0133dbdea3633abe499b978e798c2a5a64913d677d3b99927638735b214566ae0f4ca2ec80d1dd27f3249f9f6dd0b7a5ba70c0e7ad0be90ef56c6dc2ef3f445cae39675ff73fffb3aaccbb5f823bd80d94e112b970b266f9e380432314c39fe589e3174bc10b87f3e8f221d46ee42a2544e4b0c26e947fe2667555001e5beefe950450ee8d41080e6fbba3effec8484de4a6f1314e5aaf19d40296a986bc0500f0d731d8bd1f6fa147ba791d1eff8a5d68ece936cc6336ede0e8686c34d3e9f8d12249ef52a61171be50635d5aaf7bc6140128b65220f88aac07fce9ce944f875b7255cbfd1e401a32217573adf2304c47e7c8c9bacfdc2b3ba7b9450c8bb8b44c4b39292f09240d6d3d47f7d421286c1e0e78cde078f74f3c2b53544ca683aa1a8ef31342d09a85e09687dd043df25f595c6a4b941c6f7166654c013be7b347702e2a27d50b2ef78212defab03bb82e1260063a39551f72eab61477f3e8bc673abdd41b5692066dec8d26a4cc6a6f821bcb2f2239972e753fb526e7f33ee49d6cbfcd2b669afbe099cf50d2798f1dd6e8104d05cc4357d742daaa9e333060c59a47fe9335a46b9289f3da0d5ec1ce19597f02ca09442714e2989a3a9b707fc3284de3d4a7d65e3c24c880b8fdad025f7dae7fd70655e4f5b98484de78ff51a7ac3159c3449aa7d222113bea285e75c46c784abfd19a4d4894f284a2e2625eb97b8e35b2af2a9d0eb53fe55ca9ef7acc1b51fbcdd521ed21bc57bc4dbb3923e175c49e04ae30df0f361af2105f7772753cd4d9233a24e858229798d88af5bfa9b450e9d81f5d4c2358a5c1559684659e8f6ef741f29d2a7910cc2b3ba01189c951ee3eb9ad7403590e82448e041e4310f878255156e0247c966fd857fa23086ecebeb7bff416bf21a9df5494c8bae4af0e3da77a274f99e15d07924011cddbbc004f704445cbf6f2940e2a2cca1b3e05b6bcf16f459cae5f12cd26eed0eea757fc60bac3d591380017046d091ec5a5b4b7d910527927b8b4b179c89f04ecab9753de8d0d280e5444b15d647396c13d365e9d72a81df3a48bd4c8bab2a62d6f669b9e40f7df414b84f30e1fa3a27cbfc79664c4f225e6087de72d9c2a2093e84bee55314e73f6a3ab722fa516ed370f47e2ae7ae025a6cb7b072304c0a4af0ecdf782a0c6318a4f2a79a81b36cabb4207817d2aa497fb7887db11facdd14f38a1e9c898264b26aa97a658c40f5cc88d97c7cabc2f2294c34f8461e6913487c86d9ffb8b6821e16615131e4cec85ec7261bb390a4bcc63982596e5e0908c8bf264dd38557c7556372c042bf2427bd9fbee1c1689a9a9553ed1b8b8861e15767278b39ac858014bfa9aec3961e3493070c3232b92f45b040677c54dfc6047f353027474f476fd75085274125c421e12b393a790e449407fd5a72f6beba7a40786c77e4d20a85c89863e8faec609747436c8e5ae585a4bf6662e1d9d38ab24123fd8058a497cd874122d4677d689d732e365ea6e3c479458fc5d20070e2e064edeab794c61bf8add78ed8c331d2d1f2a636b36324282607ec2d41cfe5b0da91974cd85c73fd9cf34fa3db7b06ea4bd4c1b43f3e5967d48384866ef62a67f4880a9f35c55df6a5ff1a3f95a76723618a70cf532691ec59d1a3998bcabe6c7e2359636c2a50129a90896f0cb584b7714e22a81d3c47a4819afdf57e83f579263f5935ddc5ac0372dbcbe4d63fd468a3c68977ae0d8ec1f3835c890fab4916c16419f4f81dadb871b1a25a05729d2c51b2ca261401bef2bc69756555a16527e1ff9cec3d327e52a15377279b54988b5b2e20d3d747fbc7634fad898fba69da6f82bcc333990623deb84067d328aa65760c9d6e7b125dcc2948128c3a70f06db6672ca3734676b5455f89dbdba947aa4ef33753d48fbf47fb32f594da646f5b34a7e910ef9873a11c3ac03c5e22ca1fd7a58d10b224ac955bfd7b2e16b43da9f38958809a935240a63ebd3ca96847993a647d89c91d745f5012b6cab1c6f4726d51774f477e33f504fdc34b340c7e2a183243d17a3ed59a91521806202b6261cc65d94145a6bfac56ec43775b0bc3eb46ae19d6b188879e2cbe0fc32bf4a9e7b11f4c627667c411e00ae4adbaf37a1175898b35a788c26a7faa33fcc9637ba5f411d917f99959864820db36a815c58de480be7dada6cc18e8f54192b323b67ae2c355ac0d84cc7bdc23f85b4d26d99d6d778eeff5ecc94cd31f1fbdbbb2eeaee5ac3dc4b6ca5acda37ace3acd6034124fe1a0671d828b0abd42bafbd19a64c2eac660af37a699440f9396de8fc7c507a27814776ad51d1761839ca21532ad7c61fba30e6957bb791c9d204f95931cdb1d21c0b7267d57cc853604903c1a4a28fd284f351d90396c0d27a08f8ee298c56513882bb36ba659fdf02b051b19bc59bcaf7e1c2dee3b718de1f6f4822715ae358d1a197f9f0d9330db72b16e8572b774504e4e9b0f7e2d9e46fda56b93180a7221efa08908531de284a36f78795ff835ceecf75ff89a5dfa081940b24d1bedf416baf654413edb2045155ab99d8feccd3db59c4259a93ff3b4d918d2878c59406c3a03b99b46c0fe38ac0807963d9a02876b860ca2a53afe767a242f59de4061afd251c675bd173619e024db33871512ebcdde999bd42d5e346a55506925c0f00b9a38f7336efd94bd1c2598f8a134895f3b471171f8fbcfa2ea70cabf972488ff6a1e21c723e4c22f295bbf8601d34249c534fe9c339c2c0f11df3984c4991c357b23c4ddd7349f03bc7bf3fd3ecd6d4e2377c3260dc293bd2d8a28e53994fe4ac03140d983966f09100ca8c0d108378e0db4acd2dfb4d2ee171c1ab51ead1cf1da176c106ecf3f5511af6b5f05855be971361ebcfd571ba6cfd77bf7a4772b79a0673535922baf130f3a6b14afe753cd57009d13ee95c763bd70657d89d59ae6136724caf8d6fd0377050c7b6f3d798cceb16b7ead26cae2e667fc82a8b2238dbc130ecf0c24e532724388abfed2523ac7cbeb1ffc0537114f883aa1c06b95d0697b8566b4bd22a0c71d7906e4088346b7a7bcc3ae4a218c19694c72960fac184e3033dabecc1aef5fa622b96e7cd0c6c420e97b94c65f9069f7bbf49950b4e3b1e2b68aa7f0dfe70be37a9e46af607ce4b3ca5d21e7c735e14c43b805e14682c68e4de03e6f46306042bcd5619b8fa2582988fb53a0338f58a69fc59bee2af8463432049f65ebd67e543665de1cd56b26f8a8a57c7cf7e0e4a09104256b99e31424a2c416fa4847abeaf138506027aa95cd5571a6200da507916181c2e5756de6d79faaa71e713a152bf5d835fd26e835af76a3f8961dfaa8e3982486e15e682c58babe9b90ab6e525fe15b7ade8010851c0ba92c072dfe722591a398f3e90d311c0d2afa1c4b4d6c0826c98d8ea94b6cacd42ea5a871fbb899a505602474be4a71430384ac82ce952100890c9996179e5bd3d815bd4294138fff01facf2ca3178a96a692cadf3fb5442b4209ab3c82c24b7e8bb706244a3d5b4d9f5e37bafab5dbe6385bb5a5e35b7a45e5ed8e4081c9d70046dc0d1130a02a0254faea9af9c079f0ace015cf5dea182ca199de38ef2c45d066a1cb74fdb6b8d8fafefa51518febd580d91c7fb35cd89ed0d193b9bd5bd74aaf87aab875d1d3cf2acc4faae7dbd6a7d90816291db1b0513389fa74832293a97f5f790c89562fe1148551ef0000a2c0e57337eb2fa914439eaae2cacf9f4b15b815b7367a45ce5685d3a6582077bb519dd5dc1b3c39de3a418aebc0400dce30fbc0c28009bdd185af9f2875bdb29176cc05a2abe900c5151442d9b04370b5eff0294e8f693591a3a83b3027522bad2be0fcfaefb5d89b3afed44c09f46f03aa92accadc2fc8efe5ecae9f7ca6fd47b13248d9a7ec68b66231a7e27d72a2729f94827c42be4da8ecdbf499a68fb2fcb2be13f7fc71d7c3e470d1cbb05e1aaaf584723fa63955a60cc6f24ec1e9d1e2cf785681b27fe030561faa5e7735055a49f667a15260ffa091a3b117157f4ca9b8881fcdda18b88ea931c55bf1031064d1fb793ca581c35176ed21b3f3bab7549748e44a508add8c94bf305bbd16f8a8473c616a18d0cf3b18680943c6dff3410f2bb35effe1653706a6e6fa50eeeecc2cf8bee28223ce9b5ffc260059a717ad79d71931fc9534b3a9baadc511aa6d29356f63229d53cc99ea9cf5a142dd9b2b738b81d4bce1c817ed1e87bc40ac6f365658e829f962da6a3ed3f1bd593b117c2da5aff8174837eeb9737a57ebe952d27657dbb9d560860dbcc2551ca0c8e4e6752341054ad8df4d31f8758ab145eb85d4c87c558c1000d7c5de3ffe6ec8e9b051884f527f5c7e80e816722fd08334506e877e7bcbf0db2dcfb45665592c11eb92a4ac0d85adda45857e31f299de574cf0949630fe7b43bae3a31c6055b27d0010b2114999909af0f30fcb5aa21f0088ba391459470642b68792ba82ad4d01cd292159e01d74a96d0be9fcc30122b73ef197d66bd3d0b43562d2f691e12bc496a5340ee7ff34d31fcee9f79b837b3ac12cd85125ba53c416c82f0c9dc6124c2d0ea8a74f5147671037957ec071e129b1e38943b74f02b01e9cc0c4dfddb867c0d42c340366334014acc9bfb2fe67094177ed672f01d51abd9d589bef159d7bc99f7bfa86a3d6259b21fe9c065f117ed3d79f72d16f806982f66d299cdddcf21666d1c36b0b65ac3bd69a2b49f3ddcb9343fe522b81474b636d97b5efd5cecbe683b660256733a63d5e7796d4d7fc9fb1801521efcbd256c6207a18d8814bdb0a0b038c92a2d63f272bb46fccbe6f5c728583f2b882ef36a6b6e65d8d437402cf0011bac7d9283699d532f131b8b2a74bc490c2ab411d153a10bc0111434dcb6fc71064b084", 0xe3a}], 0x3}, 0x8841) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 68.30671ms ago: executing program 0 (id=2165): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=@getnexthop={0x20, 0x6a, 0x401, 0x70bd2b, 0x25dfdbfb, {}, [@NHA_ID={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x240000c0}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000002) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000280)={0x8, 0xa0dc5f062db176b9, "30a97fa1a3ec5e7a9c6d9ddfee4a4d3e4baecc655ff98118c5af4321d059366bb7680afa5c150b3bb3c0bce753bc7ecea567c3495d43d5bcd1788227f7551a77288e1cedc52ce819e69b811139312ba9d52e957f15ddf83bb740bf81050be5e88e4efb8b8b96a7d3425932bc779ed0531d134b1ae3e578788bf5b5d95f09f71900bb285353b52fa75b61c8434c8145e876e8db4572c6d5710aaa4ec69d81b2d6670ac7f40a5b32c02caabbc2959d9764bda3ec5b80e9f75daac6786eb3c66d0d997be307763c45ef0aa7d85aa3df398c7b75d1aaf1db8a4fc8534c48bbf482ca29c00246f7e0db5eb382a0652896970c3c34c14241e541b2015b8139542e7c22"}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) 0s ago: executing program 2 (id=2166): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280), 0x0) write(r0, &(0x7f00000002c0)='\n', 0x1) close(r0) rmdir(&(0x7f0000000340)='./config/usb_gadget/g1/functions/phonet.usb0\x00') kernel console output (not intermixed with test programs): 0 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 190.460665][ T7285] RSP: 002b:00007f7522d65028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 190.460683][ T7285] RAX: ffffffffffffffda RBX: 00007f7524db6090 RCX: 00007f7524b2e0d9 [ 190.460696][ T7285] RDX: 0000000000002800 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 190.460708][ T7285] RBP: 00007f7522d65090 R08: 0000000000000000 R09: 0000000000000000 [ 190.460719][ T7285] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 190.460729][ T7285] R13: 00007f7524db6128 R14: 00007f7524db6090 R15: 00007ffd67a666f8 [ 190.460754][ T7285] [ 190.762099][ T1001] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 190.763251][ T22] MTRR: CPU 0: Writing MSR 202 to d0000002:0 failed [ 190.763296][ T27] MTRR: CPU 1: Writing MSR 202 to d0000002:0 failed [ 190.852099][ T5691] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 190.917225][ T1001] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 190.917391][ T1001] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 190.917421][ T1001] usb 2-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 190.921413][ T1001] usb 2-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 190.921450][ T1001] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.921473][ T1001] usb 2-1: Product: syz [ 190.921491][ T1001] usb 2-1: Manufacturer: syz [ 190.921509][ T1001] usb 2-1: SerialNumber: syz [ 191.080839][ T5691] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 191.080872][ T5691] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 191.199725][ T5691] usb 5-1: New USB device found, idVendor=3344, idProduct=1122, bcdDevice= 0.00 [ 191.200008][ T5691] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.200034][ T5691] usb 5-1: Product: syz [ 191.200051][ T5691] usb 5-1: SerialNumber: syz [ 191.299170][ T7278] syz.0.590 (7278) used greatest stack depth: 18304 bytes left [ 191.374531][ T1001] snd-usb-caiaq 2-1:1.0: invalid EPs [ 191.374573][ T1001] usb 2-1: unable to init card! (ret=-22) [ 191.378456][ T1001] snd-usb-caiaq 2-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 191.404506][ T4895] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 191.482343][ T4895] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 191.482565][ T4895] Bluetooth: hci2: Injecting HCI hardware error event [ 191.490619][ T5583] Bluetooth: hci2: hardware error 0x00 [ 191.520528][ T7284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.521381][ T7284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.565022][ T5591] usb 5-1: USB disconnect, device number 7 [ 191.967106][ T5691] usb 2-1: USB disconnect, device number 6 [ 192.541463][ T7309] openvswitch: netlink: IP tunnel dst address not specified [ 192.580233][ T7318] FAULT_INJECTION: forcing a failure. [ 192.580233][ T7318] name failslab, interval 1, probability 0, space 0, times 0 [ 192.580283][ T7318] CPU: 0 UID: 0 PID: 7318 Comm: syz.3.605 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 192.580311][ T7318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 192.580325][ T7318] Call Trace: [ 192.580335][ T7318] [ 192.580345][ T7318] dump_stack_lvl+0xe8/0x150 [ 192.580408][ T7318] should_fail_ex+0x467/0x600 [ 192.580449][ T7318] should_failslab+0xa8/0x100 [ 192.580478][ T7318] kmem_cache_alloc_node_noprof+0xae/0x670 [ 192.580519][ T7318] ? __alloc_skb+0x1d7/0x7a0 [ 192.580542][ T7318] ? __alloc_skb+0x1d7/0x7a0 [ 192.580573][ T7318] __alloc_skb+0x1d7/0x7a0 [ 192.580603][ T7318] tcp_stream_alloc_skb+0x3f/0x5c0 [ 192.580638][ T7318] tcp_sendmsg_locked+0x143d/0x55c0 [ 192.580694][ T7318] ? __lock_acquire+0x683/0x2ce0 [ 192.580747][ T7318] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 192.580788][ T7318] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 192.580816][ T7318] ? lockdep_hardirqs_on+0x7a/0x110 [ 192.580854][ T7318] tcp_sendmsg+0x2f/0x50 [ 192.580883][ T7318] ? __pfx_inet_sendmsg+0x10/0x10 [ 192.580905][ T7318] sock_sendmsg_nosec+0x10e/0x180 [ 192.580945][ T7318] __sys_sendto+0x41e/0x5d0 [ 192.580977][ T7318] ? __pfx___sys_sendto+0x10/0x10 [ 192.581032][ T7318] ? __pfx_ksys_write+0x10/0x10 [ 192.581068][ T7318] __x64_sys_sendto+0xde/0x100 [ 192.581094][ T7318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.581121][ T7318] do_syscall_64+0x174/0x580 [ 192.581153][ T7318] ? trace_irq_disable+0x3b/0x140 [ 192.581187][ T7318] ? clear_bhb_loop+0x70/0xc0 [ 192.581216][ T7318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.581240][ T7318] RIP: 0033:0x7f7524b2e0d9 [ 192.581270][ T7318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.581289][ T7318] RSP: 002b:00007f7522d86028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 192.581313][ T7318] RAX: ffffffffffffffda RBX: 00007f7524db5fa0 RCX: 00007f7524b2e0d9 [ 192.581330][ T7318] RDX: 994b6e03113064ae RSI: 0000200000000700 RDI: 0000000000000003 [ 192.581346][ T7318] RBP: 00007f7522d86090 R08: 0000000000000000 R09: 0000000000000000 [ 192.581360][ T7318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 192.581373][ T7318] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 192.581408][ T7318] [ 193.482498][ T5691] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 193.602224][ T5699] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 193.638302][ T5691] usb 5-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 193.638341][ T5691] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.638368][ T5691] usb 5-1: Product: syz [ 193.638385][ T5691] usb 5-1: Manufacturer: syz [ 193.638404][ T5691] usb 5-1: SerialNumber: syz [ 193.688310][ T5691] usb 5-1: config 0 descriptor?? [ 193.821683][ T5699] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 193.821815][ T5699] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 193.821848][ T5699] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 193.842218][ T5591] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 193.867491][ T5699] usb 3-1: New USB device found, idVendor=04d9, idProduct=a070, bcdDevice= 0.00 [ 193.867526][ T5699] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.888837][ T5583] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 193.904870][ T5699] usb 3-1: config 0 descriptor?? [ 193.909815][ T7333] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 194.082182][ T5591] usb 2-1: not running at top speed; connect to a high speed hub [ 194.083795][ T5591] usb 2-1: config 13 has an invalid interface number: 218 but max is 3 [ 194.083826][ T5591] usb 2-1: config 13 has an invalid interface number: 140 but max is 3 [ 194.083851][ T5591] usb 2-1: config 13 has an invalid interface number: 97 but max is 3 [ 194.083875][ T5591] usb 2-1: config 13 has an invalid interface number: 181 but max is 3 [ 194.083898][ T5591] usb 2-1: config 13 has no interface number 0 [ 194.083917][ T5591] usb 2-1: config 13 has no interface number 1 [ 194.083937][ T5591] usb 2-1: config 13 has no interface number 2 [ 194.083956][ T5591] usb 2-1: config 13 has no interface number 3 [ 194.084042][ T5591] usb 2-1: config 13 interface 218 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 194.084068][ T5591] usb 2-1: config 13 interface 218 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 194.084095][ T5591] usb 2-1: config 13 interface 218 altsetting 2 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 194.084128][ T5591] usb 2-1: config 13 interface 218 altsetting 2 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 194.084211][ T5591] usb 2-1: config 13 interface 140 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 194.084239][ T5591] usb 2-1: config 13 interface 140 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 194.084281][ T5591] usb 2-1: config 13 interface 97 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 194.084307][ T5591] usb 2-1: config 13 interface 97 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 194.084335][ T5591] usb 2-1: config 13 interface 218 has no altsetting 0 [ 194.084357][ T5591] usb 2-1: config 13 interface 140 has no altsetting 0 [ 194.084378][ T5591] usb 2-1: config 13 interface 97 has no altsetting 0 [ 194.084399][ T5591] usb 2-1: config 13 interface 181 has no altsetting 0 [ 194.086990][ T5591] usb 2-1: New USB device found, idVendor=0bb4, idProduct=0a7b, bcdDevice=c9.14 [ 194.087017][ T5591] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.087037][ T5591] usb 2-1: Product: 莛韙鳤ඓㅹ笥ﮠǽᶃ◼転ꋂ⸣졢칓铂㋹䁁ꪚ貏ꗳ︻겭⮱쓽銆౟쒾薀ᢉꏹ欙鯸᭣뿝烈얱䄲혛瞻熟禟演脖閌꼾瑊㦡鑾嶀Ž쒒鸟Ī垙鞈酾꺇 [ 194.087060][ T5591] usb 2-1: Manufacturer: 闝׮㒛䵍䁴搆鐸 [ 194.087076][ T5591] usb 2-1: SerialNumber: 홙ἰߋ䳵똤ᡣ↞躇궠䠁⤰嚽⸟꧶蚺◵☙翤麔鑎ᕽᓼᖺ䌹껢直踑쎣胷禿艀驷竾ዹճ䰄⽳ꓽ嗙☨ [ 194.448385][ T5591] hub 2-1:13.218: Invalid hub with more than one config or interface [ 194.448431][ T5591] hub 2-1:13.218: probe with driver hub failed with error -22 [ 194.540827][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.540894][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.568248][ T5591] hub 2-1:13.140: Invalid hub with more than one config or interface [ 194.568284][ T5591] hub 2-1:13.140: probe with driver hub failed with error -22 [ 194.637233][ T5699] hid_parser_main: 19 callbacks suppressed [ 194.637261][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x2 [ 194.637354][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637380][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637406][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637433][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637516][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637541][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637569][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637596][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.637682][ T5699] holtek_mouse 0003:04D9:A070.0003: unknown main item tag 0x0 [ 194.773571][ T5699] holtek_mouse 0003:04D9:A070.0003: hidraw0: USB HID v0.01 Device [HID 04d9:a070] on usb-dummy_hcd.2-1/input0 [ 194.820455][ T5691] cx82310_eth 5-1:0.0: probe with driver cx82310_eth failed with error -22 [ 194.865639][ T5691] cxacru 5-1:0.0: usbatm_usb_probe: bind failed: -19! [ 194.944445][ T5691] usb 5-1: USB disconnect, device number 8 [ 194.971753][ T5591] hub 2-1:13.97: Invalid hub with more than one config or interface [ 194.971798][ T5591] hub 2-1:13.97: probe with driver hub failed with error -22 [ 195.073862][ T5591] hub 2-1:13.181: Invalid hub with more than one config or interface [ 195.073909][ T5591] hub 2-1:13.181: probe with driver hub failed with error -22 [ 195.262492][ T5591] usb 2-1: USB disconnect, device number 7 [ 195.294460][ T7333] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 195.761038][ T5691] usb 3-1: USB disconnect, device number 9 [ 195.872787][ T7366] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 195.954682][ T7370] FAULT_INJECTION: forcing a failure. [ 195.954682][ T7370] name failslab, interval 1, probability 0, space 0, times 0 [ 195.954723][ T7370] CPU: 1 UID: 0 PID: 7370 Comm: syz.3.626 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 195.954751][ T7370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 195.954765][ T7370] Call Trace: [ 195.954774][ T7370] [ 195.954784][ T7370] dump_stack_lvl+0xe8/0x150 [ 195.954825][ T7370] should_fail_ex+0x467/0x600 [ 195.954894][ T7370] should_failslab+0xa8/0x100 [ 195.954930][ T7370] __kvmalloc_node_noprof+0x17a/0x8a0 [ 195.954961][ T7370] ? traverse+0xf1/0x620 [ 195.954992][ T7370] ? traverse+0xf1/0x620 [ 195.955042][ T7370] traverse+0xf1/0x620 [ 195.955079][ T7370] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 195.955117][ T7370] ? seq_read_iter+0xa5/0xcb0 [ 195.955153][ T7370] seq_read_iter+0xb6b/0xcb0 [ 195.955204][ T7370] seq_read+0x36a/0x490 [ 195.955235][ T7370] ? kstrtoull+0x12f/0x1d0 [ 195.955277][ T7370] ? __pfx_seq_read+0x10/0x10 [ 195.955317][ T7370] ? __import_iovec+0x5d7/0x7e0 [ 195.955354][ T7370] ? __pfx_seq_read+0x10/0x10 [ 195.955383][ T7370] proc_reg_read+0x1f6/0x2f0 [ 195.955417][ T7370] vfs_readv+0x588/0x850 [ 195.955456][ T7370] ? __pfx_proc_reg_read+0x10/0x10 [ 195.955484][ T7370] ? __pfx_vfs_readv+0x10/0x10 [ 195.955523][ T7370] ? __fget_files+0x2a/0x420 [ 195.955547][ T7370] ? __fget_files+0x3a8/0x420 [ 195.955563][ T7370] ? __fget_files+0x2a/0x420 [ 195.955589][ T7370] __x64_sys_preadv+0x19f/0x2c0 [ 195.955617][ T7370] ? __pfx___x64_sys_preadv+0x10/0x10 [ 195.955653][ T7370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.955674][ T7370] do_syscall_64+0x174/0x580 [ 195.955705][ T7370] ? trace_irq_disable+0x3b/0x140 [ 195.955735][ T7370] ? clear_bhb_loop+0x70/0xc0 [ 195.955776][ T7370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.955794][ T7370] RIP: 0033:0x7f7524b2e0d9 [ 195.955813][ T7370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.955828][ T7370] RSP: 002b:00007f7522d86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 195.955849][ T7370] RAX: ffffffffffffffda RBX: 00007f7524db5fa0 RCX: 00007f7524b2e0d9 [ 195.955863][ T7370] RDX: 0000000000000001 RSI: 0000200000000100 RDI: 0000000000000003 [ 195.955875][ T7370] RBP: 00007f7522d86090 R08: 0000000000000004 R09: 0000000000000000 [ 195.955888][ T7370] R10: 0000000000008001 R11: 0000000000000246 R12: 0000000000000001 [ 195.955899][ T7370] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 195.955935][ T7370] [ 196.387532][ T7379] FAULT_INJECTION: forcing a failure. [ 196.387532][ T7379] name failslab, interval 1, probability 0, space 0, times 0 [ 196.387573][ T7379] CPU: 1 UID: 0 PID: 7379 Comm: syz.3.629 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 196.387602][ T7379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 196.387617][ T7379] Call Trace: [ 196.387626][ T7379] [ 196.387636][ T7379] dump_stack_lvl+0xe8/0x150 [ 196.387677][ T7379] should_fail_ex+0x467/0x600 [ 196.387719][ T7379] should_failslab+0xa8/0x100 [ 196.387749][ T7379] __kmalloc_noprof+0xfe/0x780 [ 196.387771][ T7379] ? rcu_is_watching+0x15/0xb0 [ 196.387801][ T7379] ? tomoyo_realpath_from_path+0xef/0x640 [ 196.387831][ T7379] ? tomoyo_realpath_from_path+0xef/0x640 [ 196.387871][ T7379] tomoyo_realpath_from_path+0xef/0x640 [ 196.387913][ T7379] ? tomoyo_path_number_perm+0x219/0x5f0 [ 196.387953][ T7379] tomoyo_path_number_perm+0x246/0x5f0 [ 196.387996][ T7379] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 196.388034][ T7379] ? __lock_acquire+0x683/0x2ce0 [ 196.388075][ T7379] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 196.388109][ T7379] ? hook_file_ioctl+0x1f3/0x600 [ 196.388143][ T7379] ? lockdep_hardirqs_on+0x7a/0x110 [ 196.388202][ T7379] ? __fget_files+0x2a/0x420 [ 196.388230][ T7379] ? __fget_files+0x2a/0x420 [ 196.388252][ T7379] ? __fget_files+0x3a8/0x420 [ 196.388273][ T7379] ? __fget_files+0x2a/0x420 [ 196.388300][ T7379] security_file_ioctl+0xc3/0x2a0 [ 196.388327][ T7379] __se_sys_ioctl+0x47/0x170 [ 196.388359][ T7379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.388384][ T7379] do_syscall_64+0x174/0x580 [ 196.388414][ T7379] ? trace_irq_disable+0x3b/0x140 [ 196.388452][ T7379] ? clear_bhb_loop+0x70/0xc0 [ 196.388483][ T7379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.388518][ T7379] RIP: 0033:0x7f7524b2e0d9 [ 196.388540][ T7379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.388559][ T7379] RSP: 002b:00007f7522d86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 196.388584][ T7379] RAX: ffffffffffffffda RBX: 00007f7524db5fa0 RCX: 00007f7524b2e0d9 [ 196.388601][ T7379] RDX: 00002000000002c0 RSI: 000000004068aea3 RDI: 0000000000000004 [ 196.388617][ T7379] RBP: 00007f7522d86090 R08: 0000000000000000 R09: 0000000000000000 [ 196.388632][ T7379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.388646][ T7379] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 196.388685][ T7379] [ 196.388727][ T7379] ERROR: Out of memory at tomoyo_realpath_from_path. [ 196.970965][ T7385] FAULT_INJECTION: forcing a failure. [ 196.970965][ T7385] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 196.971000][ T7385] CPU: 1 UID: 0 PID: 7385 Comm: syz.3.632 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 196.971020][ T7385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 196.971031][ T7385] Call Trace: [ 196.971038][ T7385] [ 196.971046][ T7385] dump_stack_lvl+0xe8/0x150 [ 196.971078][ T7385] should_fail_ex+0x467/0x600 [ 196.971109][ T7385] _copy_to_user+0x31/0xb0 [ 196.971131][ T7385] simple_read_from_buffer+0xe1/0x170 [ 196.971153][ T7385] proc_fail_nth_read+0x1be/0x230 [ 196.971176][ T7385] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.971198][ T7385] ? rw_verify_area+0x250/0x4d0 [ 196.971221][ T7385] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.971239][ T7385] vfs_read+0x219/0xa90 [ 196.971267][ T7385] ? __pfx_vfs_read+0x10/0x10 [ 196.971290][ T7385] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 196.971317][ T7385] ? lockdep_hardirqs_on+0x7a/0x110 [ 196.971342][ T7385] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 196.971368][ T7385] ? mutex_lock_nested+0x152/0x1d0 [ 196.971386][ T7385] ? fdget_pos+0x252/0x320 [ 196.971412][ T7385] ksys_read+0x156/0x270 [ 196.971450][ T7385] ? __pfx_ksys_read+0x10/0x10 [ 196.971479][ T7385] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.971500][ T7385] do_syscall_64+0x174/0x580 [ 196.971526][ T7385] ? trace_irq_disable+0x3b/0x140 [ 196.971555][ T7385] ? clear_bhb_loop+0x70/0xc0 [ 196.971578][ T7385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.971599][ T7385] RIP: 0033:0x7f7524aee90e [ 196.971619][ T7385] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 196.971634][ T7385] RSP: 002b:00007f7522d85fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 196.971653][ T7385] RAX: ffffffffffffffda RBX: 00007f7522d866c0 RCX: 00007f7524aee90e [ 196.971666][ T7385] RDX: 000000000000000f RSI: 00007f7522d860a0 RDI: 0000000000000004 [ 196.971677][ T7385] RBP: 00007f7522d86090 R08: 0000000000000000 R09: 0000000000000000 [ 196.971688][ T7385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.971698][ T7385] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 196.971725][ T7385] [ 197.471850][ T7381] team0 (unregistering): Port device team_slave_0 removed [ 197.645466][ T7381] team0 (unregistering): Port device team_slave_1 removed [ 197.792155][ T5699] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 197.967697][ T5699] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 197.967736][ T5699] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 197.967766][ T5699] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 197.967792][ T5699] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 197.967840][ T5699] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 197.967877][ T5699] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.063770][ T5699] usb 1-1: config 0 descriptor?? [ 198.317236][ T7416] FAULT_INJECTION: forcing a failure. [ 198.317236][ T7416] name failslab, interval 1, probability 0, space 0, times 0 [ 198.317274][ T7416] CPU: 1 UID: 0 PID: 7416 Comm: syz.1.645 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 198.317302][ T7416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 198.317316][ T7416] Call Trace: [ 198.317325][ T7416] [ 198.317338][ T7416] dump_stack_lvl+0xe8/0x150 [ 198.317379][ T7416] should_fail_ex+0x467/0x600 [ 198.317418][ T7416] should_failslab+0xa8/0x100 [ 198.317448][ T7416] __kvmalloc_node_noprof+0x17a/0x8a0 [ 198.317479][ T7416] ? seq_read_iter+0x1eb/0xcb0 [ 198.317511][ T7416] ? seq_read_iter+0x1eb/0xcb0 [ 198.317543][ T7416] ? seq_read_iter+0xa5/0xcb0 [ 198.317580][ T7416] seq_read_iter+0x1eb/0xcb0 [ 198.317631][ T7416] seq_read+0x36a/0x490 [ 198.317670][ T7416] ? __pfx_seq_read+0x10/0x10 [ 198.317703][ T7416] ? __lock_acquire+0x683/0x2ce0 [ 198.317729][ T7416] ? lockdep_hardirqs_on+0x7a/0x110 [ 198.317770][ T7416] ? __pfx_seq_read+0x10/0x10 [ 198.317797][ T7416] proc_reg_read+0x1f6/0x2f0 [ 198.317837][ T7416] ? __pfx_proc_reg_read+0x10/0x10 [ 198.317866][ T7416] vfs_read+0x219/0xa90 [ 198.317902][ T7416] ? __pfx_vfs_read+0x10/0x10 [ 198.317931][ T7416] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 198.317963][ T7416] ? lockdep_hardirqs_on+0x7a/0x110 [ 198.317994][ T7416] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 198.318026][ T7416] ? mutex_lock_nested+0x152/0x1d0 [ 198.318048][ T7416] ? fdget_pos+0x252/0x320 [ 198.318081][ T7416] ksys_read+0x156/0x270 [ 198.318111][ T7416] ? __pfx_ksys_read+0x10/0x10 [ 198.318141][ T7416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.318160][ T7416] do_syscall_64+0x174/0x580 [ 198.318186][ T7416] ? trace_irq_disable+0x3b/0x140 [ 198.318213][ T7416] ? clear_bhb_loop+0x70/0xc0 [ 198.318235][ T7416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.318253][ T7416] RIP: 0033:0x7fa62f6fe0d9 [ 198.318270][ T7416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 198.318285][ T7416] RSP: 002b:00007fa62d956028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 198.318304][ T7416] RAX: ffffffffffffffda RBX: 00007fa62f985fa0 RCX: 00007fa62f6fe0d9 [ 198.318317][ T7416] RDX: 000000000000ffe8 RSI: 0000200000006200 RDI: 0000000000000004 [ 198.318331][ T7416] RBP: 00007fa62d956090 R08: 0000000000000000 R09: 0000000000000000 [ 198.318342][ T7416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.318352][ T7416] R13: 00007fa62f986038 R14: 00007fa62f985fa0 R15: 00007ffc32c16a78 [ 198.318379][ T7416] [ 198.663192][ T5699] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 198.761012][ T199] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 198.866723][ T7423] netlink: 'syz.1.648': attribute type 1 has an invalid length. [ 198.866746][ T7423] netlink: 5120 bytes leftover after parsing attributes in process `syz.1.648'. [ 198.924058][ T199] usb 5-1: not running at top speed; connect to a high speed hub [ 198.954897][ T199] usb 5-1: config 1 interface 0 has no altsetting 0 [ 198.973673][ T199] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1c08, bcdDevice= 0.40 [ 198.973708][ T199] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.973724][ T199] usb 5-1: Product: syz [ 198.973735][ T199] usb 5-1: Manufacturer: syz [ 198.973746][ T199] usb 5-1: SerialNumber: syz [ 199.381381][ T199] usbhid 5-1:1.0: can't add hid device: -71 [ 199.381538][ T199] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 199.431419][ T199] usb 5-1: USB disconnect, device number 9 [ 199.668267][ T7441] FAULT_INJECTION: forcing a failure. [ 199.668267][ T7441] name failslab, interval 1, probability 0, space 0, times 0 [ 199.668304][ T7441] CPU: 0 UID: 0 PID: 7441 Comm: syz.3.654 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 199.668330][ T7441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 199.668345][ T7441] Call Trace: [ 199.668354][ T7441] [ 199.668364][ T7441] dump_stack_lvl+0xe8/0x150 [ 199.668403][ T7441] should_fail_ex+0x467/0x600 [ 199.668444][ T7441] should_failslab+0xa8/0x100 [ 199.668471][ T7441] __kmalloc_noprof+0xfe/0x780 [ 199.668492][ T7441] ? rcu_is_watching+0x15/0xb0 [ 199.668520][ T7441] ? tomoyo_realpath_from_path+0xef/0x640 [ 199.668548][ T7441] ? tomoyo_realpath_from_path+0xef/0x640 [ 199.668583][ T7441] tomoyo_realpath_from_path+0xef/0x640 [ 199.668617][ T7441] ? tomoyo_path_number_perm+0x219/0x5f0 [ 199.668648][ T7441] tomoyo_path_number_perm+0x246/0x5f0 [ 199.668681][ T7441] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 199.668712][ T7441] ? __lock_acquire+0x683/0x2ce0 [ 199.668751][ T7441] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 199.668778][ T7441] ? hook_file_ioctl+0x1f3/0x600 [ 199.668808][ T7441] ? lockdep_hardirqs_on+0x7a/0x110 [ 199.668850][ T7441] ? __fget_files+0x2a/0x420 [ 199.668871][ T7441] ? __fget_files+0x2a/0x420 [ 199.668887][ T7441] ? __fget_files+0x3a8/0x420 [ 199.668904][ T7441] ? __fget_files+0x2a/0x420 [ 199.668924][ T7441] security_file_ioctl+0xc3/0x2a0 [ 199.668945][ T7441] __se_sys_ioctl+0x47/0x170 [ 199.668969][ T7441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.668990][ T7441] do_syscall_64+0x174/0x580 [ 199.669016][ T7441] ? trace_irq_disable+0x3b/0x140 [ 199.669045][ T7441] ? clear_bhb_loop+0x70/0xc0 [ 199.669068][ T7441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.669087][ T7441] RIP: 0033:0x7f7524b2e0d9 [ 199.669104][ T7441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.669121][ T7441] RSP: 002b:00007f7522d86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 199.669141][ T7441] RAX: ffffffffffffffda RBX: 00007f7524db5fa0 RCX: 00007f7524b2e0d9 [ 199.669156][ T7441] RDX: 0000200000000240 RSI: 000000004068aea3 RDI: 0000000000000004 [ 199.669168][ T7441] RBP: 00007f7522d86090 R08: 0000000000000000 R09: 0000000000000000 [ 199.669180][ T7441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.669191][ T7441] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 199.669228][ T7441] [ 199.669316][ T7441] ERROR: Out of memory at tomoyo_realpath_from_path. [ 200.622313][ T5763] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 200.789017][ T5763] usb 2-1: config index 0 descriptor too short (expected 69, got 51) [ 200.789100][ T5763] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.789134][ T5763] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.827249][ T5763] usb 2-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 1.00 [ 200.827285][ T5763] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.827310][ T5763] usb 2-1: Product: syz [ 200.827326][ T5763] usb 2-1: Manufacturer: syz [ 200.827344][ T5763] usb 2-1: SerialNumber: syz [ 200.991295][ T5763] usb 2-1: Focusrite Scarlett Gen 2 Mixer Driver enabled (pid=0x8201); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 201.106445][ T5763] usb 2-1: Error initialising Scarlett Gen 2 Mixer Driver: -90 [ 201.308685][ T7452] netlink: 12 bytes leftover after parsing attributes in process `syz.1.659'. [ 201.505638][ T5691] usb 1-1: USB disconnect, device number 8 [ 201.668973][ T7484] netlink: 'syz.0.672': attribute type 13 has an invalid length. [ 201.668997][ T7484] netlink: 8 bytes leftover after parsing attributes in process `syz.0.672'. [ 201.669024][ T7484] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 202.152739][ T7500] netlink: 8 bytes leftover after parsing attributes in process `syz.1.677'. [ 202.179313][ T7473] FAULT_INJECTION: forcing a failure. [ 202.179313][ T7473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 202.179356][ T7473] CPU: 0 UID: 0 PID: 7473 Comm: syz.4.667 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 202.179396][ T7473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 202.179412][ T7473] Call Trace: [ 202.179422][ T7473] [ 202.179432][ T7473] dump_stack_lvl+0xe8/0x150 [ 202.179475][ T7473] should_fail_ex+0x467/0x600 [ 202.179517][ T7473] _copy_to_user+0x31/0xb0 [ 202.179547][ T7473] simple_read_from_buffer+0xe1/0x170 [ 202.179580][ T7473] proc_fail_nth_read+0x1be/0x230 [ 202.179612][ T7473] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 202.179647][ T7473] ? rw_verify_area+0x250/0x4d0 [ 202.179677][ T7473] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 202.179703][ T7473] vfs_read+0x219/0xa90 [ 202.179740][ T7473] ? __pfx_vfs_read+0x10/0x10 [ 202.179771][ T7473] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 202.179806][ T7473] ? lockdep_hardirqs_on+0x7a/0x110 [ 202.179838][ T7473] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 202.179872][ T7473] ? mutex_lock_nested+0x152/0x1d0 [ 202.179897][ T7473] ? fdget_pos+0x252/0x320 [ 202.179931][ T7473] ksys_read+0x156/0x270 [ 202.179962][ T7473] ? __pfx_ksys_read+0x10/0x10 [ 202.180001][ T7473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.180027][ T7473] do_syscall_64+0x174/0x580 [ 202.180062][ T7473] ? trace_irq_disable+0x3b/0x140 [ 202.180102][ T7473] ? clear_bhb_loop+0x70/0xc0 [ 202.180133][ T7473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.180159][ T7473] RIP: 0033:0x7f22a41ce90e [ 202.180200][ T7473] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 202.180221][ T7473] RSP: 002b:00007f22a2444fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 202.180246][ T7473] RAX: ffffffffffffffda RBX: 00007f22a24456c0 RCX: 00007f22a41ce90e [ 202.180264][ T7473] RDX: 000000000000000f RSI: 00007f22a24450a0 RDI: 0000000000000003 [ 202.180279][ T7473] RBP: 00007f22a2445090 R08: 0000000000000000 R09: 0000000000000000 [ 202.180295][ T7473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 202.180309][ T7473] R13: 00007f22a4496128 R14: 00007f22a4496090 R15: 00007ffea3a730d8 [ 202.180347][ T7473] [ 202.267269][ T7490] openvswitch: netlink: IP tunnel dst address not specified [ 202.451693][ T5763] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -90 [ 202.498242][ T5763] usb 2-1: USB disconnect, device number 8 [ 202.614903][ T5774] udevd[5774]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 202.866657][ T7512] netlink: 'syz.0.680': attribute type 4 has an invalid length. [ 203.047893][ T7516] netlink: 'syz.0.680': attribute type 4 has an invalid length. [ 205.072067][ T5698] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 205.227189][ T5698] usb 1-1: not running at top speed; connect to a high speed hub [ 205.230050][ T5698] usb 1-1: config 13 has an invalid interface number: 218 but max is 3 [ 205.230085][ T5698] usb 1-1: config 13 has an invalid interface number: 140 but max is 3 [ 205.230109][ T5698] usb 1-1: config 13 has an invalid interface number: 97 but max is 3 [ 205.230134][ T5698] usb 1-1: config 13 has an invalid interface number: 181 but max is 3 [ 205.230157][ T5698] usb 1-1: config 13 has no interface number 0 [ 205.230175][ T5698] usb 1-1: config 13 has no interface number 1 [ 205.230194][ T5698] usb 1-1: config 13 has no interface number 2 [ 205.230212][ T5698] usb 1-1: config 13 has no interface number 3 [ 205.230295][ T5698] usb 1-1: config 13 interface 218 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 205.230319][ T5698] usb 1-1: config 13 interface 218 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 205.230344][ T5698] usb 1-1: config 13 interface 218 altsetting 2 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 205.230375][ T5698] usb 1-1: config 13 interface 218 altsetting 2 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 205.230420][ T5698] usb 1-1: config 13 interface 140 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 205.230445][ T5698] usb 1-1: config 13 interface 140 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 205.230483][ T5698] usb 1-1: config 13 interface 97 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 205.230508][ T5698] usb 1-1: config 13 interface 97 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 205.230535][ T5698] usb 1-1: config 13 interface 218 has no altsetting 0 [ 205.230556][ T5698] usb 1-1: config 13 interface 140 has no altsetting 0 [ 205.230576][ T5698] usb 1-1: config 13 interface 97 has no altsetting 0 [ 205.230595][ T5698] usb 1-1: config 13 interface 181 has no altsetting 0 [ 205.415120][ T5698] usb 1-1: New USB device found, idVendor=0bb4, idProduct=0a7b, bcdDevice=c9.14 [ 205.415151][ T5698] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.415173][ T5698] usb 1-1: Product: 莛韙鳤ඓㅹ笥ﮠǽᶃ◼転ꋂ⸣졢칓铂㋹䁁ꪚ貏ꗳ︻겭⮱쓽銆౟쒾薀ᢉꏹ欙鯸᭣뿝烈얱䄲혛瞻熟禟演脖閌꼾瑊㦡鑾嶀Ž쒒鸟Ī垙鞈酾꺇 [ 205.415198][ T5698] usb 1-1: Manufacturer: 闝׮㒛䵍䁴搆鐸 [ 205.415215][ T5698] usb 1-1: SerialNumber: 홙ἰߋ䳵똤ᡣ↞躇궠䠁⤰嚽⸟꧶蚺◵☙翤麔鑎ᕽᓼᖺ䌹껢直踑쎣胷禿艀驷竾ዹճ䰄⽳ꓽ嗙☨ [ 205.778397][ T5698] hub 1-1:13.218: Invalid hub with more than one config or interface [ 205.778439][ T5698] hub 1-1:13.218: probe with driver hub failed with error -22 [ 205.832137][ T5699] usb 3-1: new low-speed USB device number 10 using dummy_hcd [ 205.867514][ T5698] hub 1-1:13.140: Invalid hub with more than one config or interface [ 205.867559][ T5698] hub 1-1:13.140: probe with driver hub failed with error -22 [ 205.916131][ T5698] hub 1-1:13.97: Invalid hub with more than one config or interface [ 205.916178][ T5698] hub 1-1:13.97: probe with driver hub failed with error -22 [ 205.994965][ T5699] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 205.995029][ T5699] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 205.995060][ T5699] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 205.995103][ T5699] usb 3-1: New USB device found, idVendor=04d9, idProduct=a070, bcdDevice= 0.00 [ 205.995129][ T5699] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.996683][ T5698] hub 1-1:13.181: Invalid hub with more than one config or interface [ 205.996724][ T5698] hub 1-1:13.181: probe with driver hub failed with error -22 [ 206.080044][ T5699] usb 3-1: config 0 descriptor?? [ 206.081638][ T7575] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 206.174541][ T5698] usb 1-1: USB disconnect, device number 9 [ 206.584497][ T5699] hid_parser_main: 28 callbacks suppressed [ 206.584523][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x2 [ 206.584559][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584592][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584623][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584654][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584686][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584717][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584748][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584779][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.584810][ T5699] holtek_mouse 0003:04D9:A070.0005: unknown main item tag 0x0 [ 206.725309][ T5699] holtek_mouse 0003:04D9:A070.0005: hidraw0: USB HID v0.01 Device [HID 04d9:a070] on usb-dummy_hcd.2-1/input0 [ 206.849656][ T7575] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 207.195778][ T5699] usb 3-1: USB disconnect, device number 10 [ 207.320294][ T37] audit: type=1326 audit(1786181007.893:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7612 comm="syz.0.722" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f82ca88e0d9 code=0x0 [ 207.599291][ T7624] netlink: 164 bytes leftover after parsing attributes in process `syz.1.725'. [ 208.257889][ T7651] netlink: 120 bytes leftover after parsing attributes in process `syz.4.737'. [ 208.425089][ T7659] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 208.426228][ T7659] netlink: 12 bytes leftover after parsing attributes in process `syz.2.742'. [ 208.571013][ T7665] netlink: 4 bytes leftover after parsing attributes in process `syz.2.744'. [ 209.099748][ T7688] netlink: 120 bytes leftover after parsing attributes in process `syz.0.753'. [ 209.386907][ T7700] FAULT_INJECTION: forcing a failure. [ 209.386907][ T7700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 209.386947][ T7700] CPU: 1 UID: 0 PID: 7700 Comm: syz.3.756 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 209.386973][ T7700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.386988][ T7700] Call Trace: [ 209.386996][ T7700] [ 209.387006][ T7700] dump_stack_lvl+0xe8/0x150 [ 209.387045][ T7700] should_fail_ex+0x467/0x600 [ 209.387084][ T7700] _copy_from_user+0x2d/0xb0 [ 209.387109][ T7700] get_timespec64+0x96/0x1b0 [ 209.387135][ T7700] ? __pfx_get_timespec64+0x10/0x10 [ 209.387171][ T7700] __x64_sys_clock_settime+0x1dc/0x2a0 [ 209.387202][ T7700] ? __pfx___x64_sys_clock_settime+0x10/0x10 [ 209.387248][ T7700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.387274][ T7700] do_syscall_64+0x174/0x580 [ 209.387306][ T7700] ? trace_irq_disable+0x3b/0x140 [ 209.387341][ T7700] ? clear_bhb_loop+0x70/0xc0 [ 209.387369][ T7700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.387393][ T7700] RIP: 0033:0x7f7524b2e0d9 [ 209.387420][ T7700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.387441][ T7700] RSP: 002b:00007f7522d86028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 [ 209.387464][ T7700] RAX: ffffffffffffffda RBX: 00007f7524db5fa0 RCX: 00007f7524b2e0d9 [ 209.387480][ T7700] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000000 [ 209.387495][ T7700] RBP: 00007f7522d86090 R08: 0000000000000000 R09: 0000000000000000 [ 209.387510][ T7700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 209.387524][ T7700] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 209.387559][ T7700] [ 210.129078][ T7724] FAULT_INJECTION: forcing a failure. [ 210.129078][ T7724] name fail_futex, interval 1, probability 0, space 0, times 1 [ 210.129119][ T7724] CPU: 1 UID: 0 PID: 7724 Comm: syz.1.767 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 210.129148][ T7724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 210.129162][ T7724] Call Trace: [ 210.129170][ T7724] [ 210.129180][ T7724] dump_stack_lvl+0xe8/0x150 [ 210.129220][ T7724] should_fail_ex+0x467/0x600 [ 210.129260][ T7724] __se_sys_futex+0x180/0x450 [ 210.129293][ T7724] ? ksys_write+0x248/0x270 [ 210.129322][ T7724] ? __pfx___se_sys_futex+0x10/0x10 [ 210.129357][ T7724] ? __pfx_ksys_write+0x10/0x10 [ 210.129390][ T7724] ? __x64_sys_futex+0x21/0xf0 [ 210.129416][ T7724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.129442][ T7724] do_syscall_64+0x174/0x580 [ 210.129476][ T7724] ? trace_irq_disable+0x3b/0x140 [ 210.129512][ T7724] ? clear_bhb_loop+0x70/0xc0 [ 210.129541][ T7724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.129565][ T7724] RIP: 0033:0x7fa62f6fe0d9 [ 210.129587][ T7724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.129612][ T7724] RSP: 002b:00007fa62d956028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 210.129638][ T7724] RAX: ffffffffffffffda RBX: 00007fa62f985fa0 RCX: 00007fa62f6fe0d9 [ 210.129655][ T7724] RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000000 [ 210.129669][ T7724] RBP: 00007fa62d956090 R08: 0000000000000000 R09: 0000000000000000 [ 210.129685][ T7724] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 210.129701][ T7724] R13: 00007fa62f986038 R14: 00007fa62f985fa0 R15: 00007ffc32c16a78 [ 210.129738][ T7724] [ 211.342130][ T199] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 211.497652][ T199] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 211.497692][ T199] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 211.497721][ T199] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 211.497747][ T199] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 211.497809][ T199] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 211.497835][ T199] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.570586][ T199] usb 1-1: config 0 descriptor?? [ 211.739402][ T7763] FAULT_INJECTION: forcing a failure. [ 211.739402][ T7763] name failslab, interval 1, probability 0, space 0, times 0 [ 211.739441][ T7763] CPU: 1 UID: 0 PID: 7763 Comm: syz.3.782 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 211.739468][ T7763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 211.739483][ T7763] Call Trace: [ 211.739491][ T7763] [ 211.739502][ T7763] dump_stack_lvl+0xe8/0x150 [ 211.739543][ T7763] should_fail_ex+0x467/0x600 [ 211.739582][ T7763] should_failslab+0xa8/0x100 [ 211.739609][ T7763] __kmalloc_noprof+0xfe/0x780 [ 211.739630][ T7763] ? rcu_is_watching+0x15/0xb0 [ 211.739656][ T7763] ? tomoyo_realpath_from_path+0xef/0x640 [ 211.739684][ T7763] ? tomoyo_realpath_from_path+0xef/0x640 [ 211.739721][ T7763] tomoyo_realpath_from_path+0xef/0x640 [ 211.739757][ T7763] ? tomoyo_path_number_perm+0x219/0x5f0 [ 211.739794][ T7763] tomoyo_path_number_perm+0x246/0x5f0 [ 211.739835][ T7763] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 211.739873][ T7763] ? __lock_acquire+0x683/0x2ce0 [ 211.739910][ T7763] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 211.739939][ T7763] ? hook_file_ioctl+0x1f3/0x600 [ 211.739967][ T7763] ? lockdep_hardirqs_on+0x7a/0x110 [ 211.740031][ T7763] ? __fget_files+0x2a/0x420 [ 211.740062][ T7763] ? __fget_files+0x2a/0x420 [ 211.740083][ T7763] ? __fget_files+0x3a8/0x420 [ 211.740101][ T7763] ? __fget_files+0x2a/0x420 [ 211.740125][ T7763] security_file_ioctl+0xc3/0x2a0 [ 211.740150][ T7763] __se_sys_ioctl+0x47/0x170 [ 211.740180][ T7763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.740206][ T7763] do_syscall_64+0x174/0x580 [ 211.740239][ T7763] ? trace_irq_disable+0x3b/0x140 [ 211.740273][ T7763] ? clear_bhb_loop+0x70/0xc0 [ 211.740300][ T7763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.740322][ T7763] RIP: 0033:0x7f7524b2e0d9 [ 211.740342][ T7763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.740363][ T7763] RSP: 002b:00007f7522d86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 211.740387][ T7763] RAX: ffffffffffffffda RBX: 00007f7524db5fa0 RCX: 00007f7524b2e0d9 [ 211.740404][ T7763] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 211.740418][ T7763] RBP: 00007f7522d86090 R08: 0000000000000000 R09: 0000000000000000 [ 211.740433][ T7763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 211.740447][ T7763] R13: 00007f7524db6038 R14: 00007f7524db5fa0 R15: 00007ffd67a666f8 [ 211.740483][ T7763] [ 211.749375][ T7763] ERROR: Out of memory at tomoyo_realpath_from_path. [ 212.224562][ T199] hid_parser_main: 18 callbacks suppressed [ 212.224590][ T199] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 212.224639][ T199] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 212.224670][ T199] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 212.224701][ T199] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 212.224730][ T199] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 212.322152][ T199] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 213.164376][ T7793] netlink: 5120 bytes leftover after parsing attributes in process `syz.4.793'. [ 213.594477][ T37] audit: type=1326 audit(1786181014.163:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22a420e0d9 code=0x7ffc0000 [ 213.595341][ T37] audit: type=1326 audit(1786181014.173:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22a420e0d9 code=0x7ffc0000 [ 213.595397][ T37] audit: type=1326 audit(1786181014.173:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f22a41ce90e code=0x7ffc0000 [ 213.596871][ T37] audit: type=1326 audit(1786181014.173:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f22a41ce90e code=0x7ffc0000 [ 213.596929][ T37] audit: type=1326 audit(1786181014.173:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22a420e0d9 code=0x7ffc0000 [ 213.597181][ T7810] FAULT_INJECTION: forcing a failure. [ 213.597181][ T7810] name failslab, interval 1, probability 0, space 0, times 0 [ 213.597216][ T7810] CPU: 1 UID: 0 PID: 7810 Comm: syz.4.800 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 213.597245][ T7810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 213.597261][ T7810] Call Trace: [ 213.597270][ T7810] [ 213.597280][ T7810] dump_stack_lvl+0xe8/0x150 [ 213.597325][ T7810] should_fail_ex+0x467/0x600 [ 213.597367][ T7810] should_failslab+0xa8/0x100 [ 213.597396][ T7810] kmem_cache_alloc_noprof+0xa4/0x650 [ 213.597435][ T7810] ? audit_log_start+0x108/0xa30 [ 213.597463][ T7810] ? audit_log_start+0x108/0xa30 [ 213.597507][ T7810] audit_log_start+0x108/0xa30 [ 213.597544][ T7810] ? __pfx_audit_log_start+0x10/0x10 [ 213.597577][ T7810] ? get_pid_task+0x20/0x1f0 [ 213.597610][ T7810] ? get_pid_task+0x20/0x1f0 [ 213.597642][ T7810] ? get_pid_task+0x20/0x1f0 [ 213.597686][ T7810] audit_seccomp+0x63/0x190 [ 213.597721][ T7810] __seccomp_filter+0xd14/0x1e00 [ 213.597763][ T7810] ? __pfx___seccomp_filter+0x10/0x10 [ 213.597790][ T7810] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 213.597826][ T7810] ? rt_mutex_slowunlock+0x219/0x460 [ 213.597854][ T7810] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 213.597889][ T7810] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 213.597929][ T7810] ? fput+0xa0/0xd0 [ 213.597982][ T7810] ? __secure_computing+0xe7/0x2b0 [ 213.598010][ T7810] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.598038][ T7810] do_syscall_64+0x10e/0x580 [ 213.598079][ T7810] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.598105][ T7810] ? clear_bhb_loop+0x70/0xc0 [ 213.598137][ T7810] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.598163][ T7810] RIP: 0033:0x7f22a420e0d9 [ 213.598191][ T7810] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.598212][ T7810] RSP: 002b:00007f22a2466028 EFLAGS: 00000246 ORIG_RAX: 0000000000000122 [ 213.598239][ T7810] RAX: ffffffffffffffda RBX: 00007f22a4495fa0 RCX: 00007f22a420e0d9 [ 213.598258][ T7810] RDX: 0000000000000000 RSI: 0000000000080800 RDI: 0000000000000002 [ 213.598274][ T7810] RBP: 00007f22a2466090 R08: 0000000000000000 R09: 0000000000000000 [ 213.598289][ T7810] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.598304][ T7810] R13: 00007f22a4496038 R14: 00007f22a4495fa0 R15: 00007ffea3a730d8 [ 213.598343][ T7810] [ 213.598468][ T7810] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 213.598488][ T7810] audit: out of memory in audit_log_start [ 213.598870][ T37] audit: type=1326 audit(1786181014.173:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f22a41ce90e code=0x7ffc0000 [ 213.599171][ T37] audit: type=1326 audit(1786181014.173:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f22a41ce90e code=0x7ffc0000 [ 213.599466][ T37] audit: type=1326 audit(1786181014.173:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7808 comm="syz.4.800" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f22a41ce90e code=0x7ffc0000 [ 214.844566][ T5583] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 215.055529][ T5763] usb 1-1: USB disconnect, device number 10 [ 215.925829][ T7867] syzkaller0: entered promiscuous mode [ 215.925859][ T7867] syzkaller0: entered allmulticast mode [ 218.495645][ C1] vcan0: j1939_tp_rxtimer: 0xffff88803ae61400: rx timeout, send abort [ 218.635157][ T7898] ftl_cs: FTL header not found. [ 218.705764][ T7898] block2mtd: mtd1: [/dev/loop0] erase_size = 4KiB [4096] [ 218.996314][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806070f800: rx timeout, send abort [ 219.273833][ T7930] netlink: 'syz.1.839': attribute type 4 has an invalid length. [ 219.273859][ T7930] netlink: 152 bytes leftover after parsing attributes in process `syz.1.839'. [ 219.496822][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806070f800: abort rx timeout. Force session deactivation [ 220.019616][ T7930] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 220.528576][ T7948] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 222.462375][ T5763] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 222.632011][ T5763] usb 1-1: Using ep0 maxpacket: 32 [ 222.639429][ T5763] usb 1-1: unable to get BOS descriptor or descriptor too short [ 222.649924][ T5763] usb 1-1: config 12 has an invalid interface number: 183 but max is 1 [ 222.650000][ T5763] usb 1-1: config 12 has an invalid interface number: 229 but max is 1 [ 222.650072][ T5763] usb 1-1: config 12 has no interface number 0 [ 222.650131][ T5763] usb 1-1: config 12 has no interface number 1 [ 222.650235][ T5763] usb 1-1: config 12 interface 183 has no altsetting 0 [ 222.698301][ T5763] usb 1-1: New USB device found, idVendor=1415, idProduct=2000, bcdDevice=2b.98 [ 222.698335][ T5763] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.698358][ T5763] usb 1-1: Product: syz [ 222.698375][ T5763] usb 1-1: Manufacturer: syz [ 222.698391][ T5763] usb 1-1: SerialNumber: syz [ 223.023385][ T5763] usb 1-1: USB disconnect, device number 11 [ 223.694637][ T7989] comedi comedi2: unsupported base address 0x71 [ 223.699682][ T7989] comedi comedi2: comedi_config --init_data is deprecated [ 225.222049][ T8005] IPVS: set_ctl: invalid protocol: 59 100.1.1.1:20001 [ 225.230758][ T5591] IPVS: starting estimator thread 0... [ 225.343150][ T8007] IPVS: using max 7 ests per chain, 16800 per kthread [ 229.222105][ T36] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 229.383144][ T36] usb 1-1: Using ep0 maxpacket: 32 [ 229.407006][ T36] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 229.407048][ T36] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 229.443002][ T36] usb 1-1: string descriptor 0 read error: -22 [ 229.443193][ T36] usb 1-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 229.443223][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.480965][ T8045] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 229.583703][ T36] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 229.583800][ T36] usb 1-1: MIDIStreaming interface descriptor not found [ 229.665369][ T5583] Bluetooth: hci3: command 0x0406 tx timeout [ 231.020711][ T8077] loop2: detected capacity change from 0 to 7 [ 231.115674][ T36] usb 1-1: USB disconnect, device number 12 [ 231.155599][ T8077] Dev loop2: unable to read RDB block 7 [ 231.155644][ T8077] loop2: unable to read partition table [ 231.155825][ T8077] loop2: partition table beyond EOD, truncated [ 231.156853][ T8077] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 235.695317][ T8108] pim6reg: entered allmulticast mode [ 235.774281][ T8104] pim6reg: left allmulticast mode [ 237.615947][ T1001] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 237.784141][ T1001] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 237.784170][ T1001] usb 2-1: config 0 has no interface number 0 [ 237.784210][ T1001] usb 2-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 237.784240][ T1001] usb 2-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 237.784264][ T1001] usb 2-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 237.784294][ T1001] usb 2-1: config 0 interface 1 has no altsetting 0 [ 237.785973][ T1001] usb 2-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 237.786007][ T1001] usb 2-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 237.786032][ T1001] usb 2-1: Manufacturer: syz [ 237.887916][ T1001] usb 2-1: config 0 descriptor?? [ 238.361336][ T8115] kexec: Could not allocate control_code_buffer [ 238.526486][ T1001] uclogic 0003:145F:0212.0007: pen parameters not found [ 238.526540][ T1001] uclogic 0003:145F:0212.0007: interface is invalid, ignoring [ 238.736557][ T1001] usb 2-1: USB disconnect, device number 9 [ 240.569775][ T8152] tmpfs: Unknown parameter 'grpquota_irA' [ 241.721666][ T13] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.268490][ T5763] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 243.660064][ T5763] usb 1-1: Using ep0 maxpacket: 32 [ 243.911223][ T5763] usb 1-1: config index 0 descriptor too short (expected 3659, got 75) [ 243.911259][ T5763] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.190598][ T5763] usb 1-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 244.190635][ T5763] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.190659][ T5763] usb 1-1: Product: syz [ 244.190683][ T5763] usb 1-1: Manufacturer: syz [ 244.190700][ T5763] usb 1-1: SerialNumber: syz [ 246.234649][ T5763] usb 1-1: config 0 descriptor?? [ 246.384019][ T5763] usb 1-1: can't set config #0, error -71 [ 246.405494][ T5763] usb 1-1: USB disconnect, device number 13 [ 248.761703][ T8244] tipc: Enabling of bearer rejected, failed to enable media [ 251.829437][ T37] kauditd_printk_skb: 93 callbacks suppressed [ 251.829461][ T37] audit: type=1800 audit(1786181052.333:106): pid=8283 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.968" name="alua_access_type" dev="configfs" ino=17706 res=0 errno=0 [ 253.323932][ T8313] lo: entered allmulticast mode [ 253.326996][ T8313] lo: left allmulticast mode [ 254.550002][ T1001] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 254.708153][ T1001] usb 3-1: Using ep0 maxpacket: 32 [ 255.238104][ T1001] usb 3-1: unable to get BOS descriptor or descriptor too short [ 255.240052][ T1001] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 255.240081][ T1001] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 255.609755][ T1001] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 255.609780][ T1001] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.609795][ T1001] usb 3-1: Product: syz [ 255.609806][ T1001] usb 3-1: Manufacturer: syz [ 255.609817][ T1001] usb 3-1: SerialNumber: syz [ 255.968218][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.968293][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.098213][ T1001] usb 3-1: unit 0 not found! [ 256.166587][ T5591] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 256.351530][ T1001] usb 3-1: USB disconnect, device number 11 [ 256.409579][ T5591] usb 2-1: unable to get BOS descriptor or descriptor too short [ 256.410600][ T5591] usb 2-1: config 12 has an invalid interface number: 99 but max is 0 [ 256.410621][ T5591] usb 2-1: config 12 has no interface number 0 [ 256.410655][ T5591] usb 2-1: config 12 interface 99 altsetting 14 endpoint 0xD has invalid maxpacket 552, setting to 64 [ 256.410677][ T5591] usb 2-1: config 12 interface 99 has no altsetting 0 [ 256.434760][ T5591] usb 2-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 256.434851][ T5591] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.434916][ T5591] usb 2-1: Product: syz [ 256.434968][ T5591] usb 2-1: Manufacturer: syz [ 256.435013][ T5591] usb 2-1: SerialNumber: syz [ 256.935049][ T5591] usb 2-1: no audio or video endpoints found [ 256.949036][ T5591] usb 2-1: USB disconnect, device number 10 [ 257.851958][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 257.871974][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 257.881987][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 257.891964][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 257.901968][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 257.911965][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 258.303078][ T8350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.995'. [ 258.547609][ T8360] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 258.553085][ T8360] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 258.588693][ T8360] vhci_hcd vhci_hcd.0: Device attached [ 258.833921][ T8364] vhci_hcd: connection closed [ 258.994429][ T146] vhci_hcd vhci_hcd.0: stop threads [ 259.014504][ T146] vhci_hcd vhci_hcd.0: release socket [ 259.134111][ T146] vhci_hcd vhci_hcd.0: disconnect device [ 263.622425][ T8378] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.1004'. [ 279.922023][ T5591] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 280.074716][ T5591] usb 3-1: Using ep0 maxpacket: 16 [ 280.077127][ T5591] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 280.077158][ T5591] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 280.085259][ T5591] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 280.085300][ T5591] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.085322][ T5591] usb 3-1: Product: syz [ 280.085338][ T5591] usb 3-1: Manufacturer: syz [ 280.085354][ T5591] usb 3-1: SerialNumber: syz [ 280.268571][ T5591] usb 3-1: 0:2 : does not exist [ 280.314040][ T8524] capability: warning: `syz.0.1051' uses 32-bit capabilities (legacy support in use) [ 280.422851][ T5591] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 280.863750][ T5591] usb 3-1: USB disconnect, device number 12 [ 281.132695][ T5774] udevd[5774]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 281.559678][ T8553] netlink: 'syz.0.1064': attribute type 4 has an invalid length. [ 281.616962][ T8554] netlink: 'syz.0.1064': attribute type 4 has an invalid length. [ 281.739674][ T8548] input: syz0 as /devices/virtual/input/input10 [ 281.981587][ T8553] netlink: 'syz.0.1064': attribute type 4 has an invalid length. [ 283.705603][ T8579] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1072'. [ 283.944188][ T8598] blktrace: Concurrent blktraces are not allowed on loop0 [ 283.980801][ T37] audit: type=1800 audit(1786181084.553:107): pid=8591 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.1076" name="alua_access_type" dev="configfs" ino=18179 res=0 errno=0 [ 284.023398][ T8591] Unable to extract alua_access_type [ 284.496723][ T8615] Illegal XDP return value 4294967274 on prog (id 26) dev syz_tun, expect packet loss! [ 284.806646][ T8625] lo: entered allmulticast mode [ 284.807914][ T8625] lo: left allmulticast mode [ 284.926428][ T8629] tmpfs: Unknown parameter 'grpquota_irA' [ 286.271945][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 286.451968][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 286.591950][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 286.701984][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 287.705941][ T8654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1099'. [ 289.925982][ T8687] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1113'. [ 290.137923][ T8696] tmpfs: Unknown parameter 'grpquota_irA' [ 291.906101][ T8711] syzkaller0: entered promiscuous mode [ 291.906135][ T8711] syzkaller0: entered allmulticast mode [ 292.921525][ T8705] syz.1.1121 (8705) used greatest stack depth: 17440 bytes left [ 293.304818][ T8729] hub 8-0:1.0: USB hub found [ 293.318462][ T8729] hub 8-0:1.0: 1 port detected [ 295.198851][ T8736] tmpfs: Unknown parameter 'grpquota_irA' [ 299.731972][ T8798] tmpfs: Unknown parameter 'grpquota_irA' [ 302.618755][ T8837] netlink: 'syz.4.1167': attribute type 1 has an invalid length. [ 302.779805][ T8837] 8021q: adding VLAN 0 to HW filter on device bond1 [ 302.943538][ T8841] bond1: (slave geneve2): making interface the new active one [ 302.992169][ T8322] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 303.942630][ T8322] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 303.942701][ T8322] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 221, changing to 7 [ 303.942774][ T8322] usb 2-1: config 1 interface 2 has no altsetting 0 [ 304.248596][ T8322] usb 2-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice= 0.40 [ 304.248631][ T8322] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.248654][ T8322] usb 2-1: Product: syz [ 304.248671][ T8322] usb 2-1: Manufacturer: syz [ 304.248687][ T8322] usb 2-1: SerialNumber: syz [ 304.425407][ T8841] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 304.544164][ T8322] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 304.944105][ T8322] usb 2-1: USB disconnect, device number 11 [ 306.719238][ T8857] udevd[8857]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 307.074999][ T8883] syzkaller0: entered promiscuous mode [ 307.075028][ T8883] syzkaller0: entered allmulticast mode [ 308.687931][ T8906] syz.4.1190 uses obsolete (PF_INET,SOCK_PACKET) [ 313.184184][ T37] audit: type=1800 audit(1786181113.763:108): pid=8958 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.1211" name="bus" dev="tmpfs" ino=847 res=0 errno=0 [ 313.900661][ T8969] fuse: Bad value for 'fd' [ 315.266268][ T8974] tmpfs: Unknown parameter 'grpquota_irA' [ 315.289011][ T8974] blktrace: Concurrent blktraces are not allowed on loop8 [ 317.406718][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.406791][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.429646][ T9007] tmpfs: Unknown parameter 'grpquota_irA' [ 328.977500][ T9135] fuse: Bad value for 'fd' [ 329.231124][ T9141] syzkaller0: entered promiscuous mode [ 329.231156][ T9141] syzkaller0: entered allmulticast mode [ 330.309442][ T5591] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 331.482115][ T5591] usb 3-1: Using ep0 maxpacket: 32 [ 331.498326][ T5591] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.498358][ T5591] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 331.524504][ T5591] usb 3-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 331.524626][ T5591] usb 3-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 331.524692][ T5591] usb 3-1: Product: syz [ 331.524709][ T5591] usb 3-1: Manufacturer: syz [ 331.557509][ T5591] usb 3-1: config 0 descriptor?? [ 331.646760][ T9203] tmpfs: Unknown parameter 'grpquota_irA' [ 331.662316][ T5591] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 333.472256][ T5591] usb 3-1: USB disconnect, device number 13 [ 335.157236][ T9236] jffs2: notice: (9236) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 335.230240][ T9242] tmpfs: Unknown parameter 'grpquota_irA' [ 335.256088][ T9242] blktrace: Concurrent blktraces are not allowed on loop2 [ 336.082045][ T5865] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 336.254066][ T5865] usb 2-1: Using ep0 maxpacket: 32 [ 336.258067][ T5865] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 336.258102][ T5865] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 336.260345][ T5865] usb 2-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 336.260378][ T5865] usb 2-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 336.260403][ T5865] usb 2-1: Product: syz [ 336.260419][ T5865] usb 2-1: Manufacturer: syz [ 336.326596][ T5865] usb 2-1: config 0 descriptor?? [ 336.393944][ T5865] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 337.282744][ T5713] usb 2-1: USB disconnect, device number 12 [ 337.340354][ T5583] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 337.390518][ T5583] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 337.400721][ T5583] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 337.432423][ T5583] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 337.435698][ T5583] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 339.739383][ T4895] Bluetooth: hci5: command tx timeout [ 340.753901][ T9330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1344'. [ 340.972145][ T36] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 341.122022][ T36] usb 2-1: Using ep0 maxpacket: 32 [ 341.124425][ T36] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 341.124458][ T36] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 341.126852][ T36] usb 2-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 341.126884][ T36] usb 2-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 341.126908][ T36] usb 2-1: Product: syz [ 341.126925][ T36] usb 2-1: Manufacturer: syz [ 341.200582][ T36] usb 2-1: config 0 descriptor?? [ 341.224937][ T36] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 342.184756][ T4895] Bluetooth: hci5: command tx timeout [ 342.564142][ T8322] usb 2-1: USB disconnect, device number 13 [ 342.710369][ T9330] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.202056][ T4895] Bluetooth: hci5: command tx timeout [ 346.563984][ T4895] Bluetooth: hci5: command tx timeout [ 346.927654][ T8820] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.966620][ T9389] tmpfs: Unknown parameter 'grpquota_irA' [ 347.188289][ T9389] blktrace: Concurrent blktraces are not allowed on loop4 [ 347.750295][ T9391] fuse: Bad value for 'fd' [ 349.562065][ T8322] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 349.732033][ T8322] usb 1-1: Using ep0 maxpacket: 32 [ 349.739346][ T8322] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 349.739381][ T8322] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 349.784765][ T8322] usb 1-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 349.784796][ T8322] usb 1-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 349.784818][ T8322] usb 1-1: Product: syz [ 349.784831][ T8322] usb 1-1: Manufacturer: syz [ 349.827602][ T8322] usb 1-1: config 0 descriptor?? [ 349.894836][ T8322] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 350.050361][ T8820] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.094658][ T36] usb 1-1: USB disconnect, device number 14 [ 351.151260][ T9428] fuse: Bad value for 'fd' [ 351.603000][ T8820] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.822801][ T5591] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 354.394610][ T5591] usb 3-1: Using ep0 maxpacket: 32 [ 354.494812][ T9467] fuse: Bad value for 'fd' [ 355.204036][ T5591] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 355.204072][ T5591] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 355.208754][ T5591] usb 3-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 355.208788][ T5591] usb 3-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 355.208813][ T5591] usb 3-1: Product: syz [ 355.208829][ T5591] usb 3-1: Manufacturer: syz [ 355.268938][ T5591] usb 3-1: config 0 descriptor?? [ 355.287404][ T5591] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 355.579472][ T36] usb 3-1: USB disconnect, device number 14 [ 355.667649][ T8820] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.173053][ T9505] tipc: Enabling of bearer rejected, failed to enable media [ 358.622720][ T9531] fuse: Bad value for 'fd' [ 359.243477][ T5591] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 359.389382][ T9519] syzkaller0: entered promiscuous mode [ 359.389413][ T9519] syzkaller0: entered allmulticast mode [ 359.408358][ T5591] usb 2-1: Using ep0 maxpacket: 32 [ 359.464316][ T5591] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 359.464350][ T5591] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 359.507006][ T5591] usb 2-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 359.507042][ T5591] usb 2-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 359.507068][ T5591] usb 2-1: Product: syz [ 359.507084][ T5591] usb 2-1: Manufacturer: syz [ 359.624285][ T5591] usb 2-1: config 0 descriptor?? [ 359.659898][ T5591] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 360.638907][ T5591] usb 2-1: USB disconnect, device number 14 [ 361.050862][ T9557] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1417'. [ 362.389815][ T9277] bridge0: port 1(bridge_slave_0) entered blocking state [ 362.389957][ T9277] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.390201][ T9277] bridge_slave_0: entered allmulticast mode [ 362.397938][ T9277] bridge_slave_0: entered promiscuous mode [ 362.576437][ T9277] bridge0: port 2(bridge_slave_1) entered blocking state [ 362.576571][ T9277] bridge0: port 2(bridge_slave_1) entered disabled state [ 362.576818][ T9277] bridge_slave_1: entered allmulticast mode [ 362.660931][ T9277] bridge_slave_1: entered promiscuous mode [ 362.700025][ T9573] MTD: Couldn't look up './dev/mtdblock0': -2 [ 363.175836][ T8820] bridge_slave_1: left allmulticast mode [ 363.176128][ T8820] bridge_slave_1: left promiscuous mode [ 363.357240][ T8820] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.700468][ T8820] bridge_slave_0: left allmulticast mode [ 363.700507][ T8820] bridge_slave_0: left promiscuous mode [ 363.713594][ T8820] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.074891][ T9608] usbcore.quirks: string doesn't fit in 127 chars. [ 367.874471][ T37] audit: type=1800 audit(1786181168.443:109): pid=9646 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.1452" name="alua_access_type" dev="configfs" ino=22332 res=0 errno=0 [ 367.876284][ T9646] Unable to extract alua_access_type [ 370.414500][ T9670] hub 8-0:1.0: USB hub found [ 370.435527][ T9670] hub 8-0:1.0: 1 port detected [ 370.655363][ T8820] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.805933][ T8820] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.863949][ T8820] bond0 (unregistering): Released all slaves [ 370.926005][ T9277] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 371.507995][ T9277] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 373.215253][ T9277] team0: Port device team_slave_0 added [ 373.910050][ T9708] blktrace: Concurrent blktraces are not allowed on loop2 [ 374.504043][ T9277] team0: Port device team_slave_1 added [ 375.105263][ T164] wlan1: Trigger new scan to find an IBSS to join [ 376.202042][ T8322] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 376.352134][ T8322] usb 1-1: device descriptor read/64, error -71 [ 376.756234][ T8322] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 377.592050][ T8322] usb 1-1: device descriptor read/64, error -71 [ 377.704088][ T8322] usb usb1-port1: attempt power cycle [ 377.824360][ T9738] blktrace: Concurrent blktraces are not allowed on loop2 [ 378.849072][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.849150][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.012036][ T8322] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 379.536508][ T8322] usb 1-1: device not accepting address 17, error -71 [ 379.693770][ T43] wlan1: Creating new IBSS network, BSSID 42:81:2f:90:db:82 [ 380.375288][ T9277] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 380.375307][ T9277] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 380.375339][ T9277] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 380.666276][ T9277] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 380.666295][ T9277] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 380.666329][ T9277] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 381.295318][ T9277] hsr_slave_0: entered promiscuous mode [ 381.300042][ T9277] hsr_slave_1: entered promiscuous mode [ 381.311505][ T9277] debugfs: 'hsr0' already exists in 'hsr' [ 381.311581][ T9277] Cannot create hsr debugfs directory [ 382.847589][ T9804] CIFS: iocharset name too long [ 383.083526][ T9808] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1505'. [ 383.184923][ T5241] 8021q: adding VLAN 0 to HW filter on device eth1 [ 383.836281][ T8820] hsr_slave_0: left promiscuous mode [ 383.872058][ T8820] hsr_slave_1: left promiscuous mode [ 383.873379][ T8820] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 383.929049][ T8820] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 384.087355][ T8820] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 384.087384][ T8820] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 384.398093][ T8820] veth1_macvtap: left promiscuous mode [ 384.431140][ T8820] veth0_macvtap: left promiscuous mode [ 384.431490][ T8820] veth1_vlan: left promiscuous mode [ 384.448319][ T8820] veth0_vlan: left promiscuous mode [ 389.457576][ T8820] team0 (unregistering): Port device team_slave_1 removed [ 389.594130][ T8820] team0 (unregistering): Port device team_slave_0 removed [ 391.480829][ T9909] fuse: Bad value for 'fd' [ 395.280685][ T5241] 8021q: adding VLAN 0 to HW filter on device eth2 [ 397.476922][ T5586] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 397.523560][ T5586] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 397.532206][ T5586] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 397.569796][ T5586] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 397.587059][ T5586] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 397.738826][ T4895] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 399.624622][T10022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1570'. [ 400.132121][ T5586] Bluetooth: hci6: command tx timeout [ 402.201962][ T5586] Bluetooth: hci6: command tx timeout [ 405.002058][ T5586] Bluetooth: hci6: command tx timeout [ 405.604883][T10097] binder: BINDER_SET_CONTEXT_MGR already set [ 405.604901][T10097] binder: 10096:10097 ioctl 4018620d 200000000040 returned -16 [ 406.586768][ T1021] bridge_slave_1: left allmulticast mode [ 406.586805][ T1021] bridge_slave_1: left promiscuous mode [ 406.587068][ T1021] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.802132][ T8322] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 406.940048][ T1021] bridge_slave_0: left allmulticast mode [ 406.940087][ T1021] bridge_slave_0: left promiscuous mode [ 406.952698][ T8322] usb 2-1: Using ep0 maxpacket: 32 [ 406.973452][ T1021] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.014038][ T8322] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 407.014074][ T8322] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 407.018420][ T8322] usb 2-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 407.018455][ T8322] usb 2-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 407.018480][ T8322] usb 2-1: Product: syz [ 407.018496][ T8322] usb 2-1: Manufacturer: syz [ 407.083488][ T5586] Bluetooth: hci6: command tx timeout [ 407.086555][ T8322] usb 2-1: config 0 descriptor?? [ 407.171243][ T8322] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 407.470123][ T5713] usb 2-1: USB disconnect, device number 15 [ 407.682172][T10128] tmpfs: Unknown parameter 'grpquota_irA' [ 407.855448][T10128] blktrace: Concurrent blktraces are not allowed on loop8 [ 409.729925][ T8820] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 411.478001][ T1021] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 411.679079][ T1021] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 411.770239][ T1021] bond0 (unregistering): Released all slaves [ 412.701657][T10164] tmpfs: Unknown parameter 'grpquota_irA' [ 413.681987][ T5865] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 413.842098][ T5865] usb 1-1: Using ep0 maxpacket: 32 [ 413.844951][ T5865] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 413.844985][ T5865] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 413.849151][ T5865] usb 1-1: New USB device found, idVendor=e273, idProduct=4537, bcdDevice=d7.a6 [ 413.849184][ T5865] usb 1-1: New USB device strings: Mfr=191, Product=192, SerialNumber=0 [ 413.849207][ T5865] usb 1-1: Product: syz [ 413.849222][ T5865] usb 1-1: Manufacturer: syz [ 413.948025][ T5865] usb 1-1: config 0 descriptor?? [ 413.979847][ T5865] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 415.057860][ T36] usb 1-1: USB disconnect, device number 19 [ 415.565881][ T1021] hsr_slave_0: left promiscuous mode [ 415.606636][ T1021] hsr_slave_1: left promiscuous mode [ 416.438064][ T1021] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 416.631297][T10199] tmpfs: Unknown parameter 'grpquota_irA' [ 417.630695][T10198] blktrace: Concurrent blktraces are not allowed on loop8 [ 417.841567][ T1021] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.771161][T10230] tmpfs: Unknown parameter 'grpquota_irA' [ 419.813716][T10230] blktrace: Concurrent blktraces are not allowed on loop8 [ 421.142030][ T5844] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 421.807788][T10255] tmpfs: Unknown parameter 'grpquota_irA' [ 422.358900][T10255] blktrace: Concurrent blktraces are not allowed on loop8 [ 423.469490][ T1021] team0 (unregistering): Port device team_slave_1 removed [ 423.532050][ T5844] usb 2-1: Using ep0 maxpacket: 32 [ 424.377233][ T1021] team0 (unregistering): Port device team_slave_0 removed [ 424.418041][ T5844] usb 2-1: device descriptor read/all, error -71 [ 424.781788][T10267] fuse: Bad value for 'fd' [ 426.073950][T10285] tmpfs: Unknown parameter 'grpquota_irA' [ 426.141641][T10286] blktrace: Concurrent blktraces are not allowed on loop8 [ 428.166909][T10323] fuse: Bad value for 'fd' [ 429.192631][T10329] tmpfs: Unknown parameter 'grpquota_irA' [ 429.276674][T10334] blktrace: Concurrent blktraces are not allowed on loop4 [ 429.295910][ T9985] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.296045][ T9985] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.296260][ T9985] bridge_slave_0: entered allmulticast mode [ 429.300046][ T9985] bridge_slave_0: entered promiscuous mode [ 429.418630][ T9985] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.418764][ T9985] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.432429][ T9985] bridge_slave_1: entered allmulticast mode [ 429.457263][ T9985] bridge_slave_1: entered promiscuous mode [ 429.994166][ T9985] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.017563][ T9985] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 431.397095][T10358] fuse: Bad value for 'fd' [ 431.891559][ T37] audit: type=1800 audit(1786181232.463:110): pid=10360 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.1672" name="alua_access_type" dev="configfs" ino=24607 res=0 errno=0 [ 432.005285][ T9985] team0: Port device team_slave_0 added [ 432.021469][ T9985] team0: Port device team_slave_1 added [ 432.324690][ T9985] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 432.324709][ T9985] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.324741][ T9985] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 432.331454][ T9985] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 432.331473][ T9985] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.331505][ T9985] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 432.828074][ T9985] hsr_slave_0: entered promiscuous mode [ 432.831503][ T9985] hsr_slave_1: entered promiscuous mode [ 432.833599][ T9985] debugfs: 'hsr0' already exists in 'hsr' [ 432.833667][ T9985] Cannot create hsr debugfs directory [ 433.400934][ T37] audit: type=1800 audit(1786181233.973:111): pid=10384 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.1685" name="alua_access_type" dev="configfs" ino=23352 res=0 errno=0 [ 433.834068][T10388] fuse: Bad value for 'fd' [ 435.485995][T10413] tmpfs: Unknown parameter 'grpquota_irA' [ 439.718389][ T9985] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 439.739360][T10456] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1710'. [ 439.843886][ T9985] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 440.053594][T10457] ip6erspan0: entered promiscuous mode [ 440.127605][ T9985] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 440.286250][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.286325][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.374624][ T9985] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 440.377609][ T9985] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 440.407266][ T9985] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 440.534659][ T9985] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 440.734351][ T9985] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 441.779311][ T146] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 442.501615][ T9985] 8021q: adding VLAN 0 to HW filter on device bond0 [ 442.650217][ T9985] 8021q: adding VLAN 0 to HW filter on device team0 [ 442.697382][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.698375][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 442.933423][ T817] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.935895][ T817] bridge0: port 2(bridge_slave_1) entered forwarding state [ 442.979148][T10497] kAFS: unable to lookup cell 'sy1' [ 445.876221][T10528] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1737'. [ 447.503623][T10555] usb usb7: usbfs: process 10555 (syz.1.1743) did not claim interface 0 before use [ 447.997617][T10566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1748'. [ 449.370470][ T9985] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 449.874949][ T9985] veth0_vlan: entered promiscuous mode [ 450.463769][T10597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1759'. [ 450.642404][ T9985] veth1_vlan: entered promiscuous mode [ 451.223300][ T9985] veth0_macvtap: entered promiscuous mode [ 451.248054][ T9985] veth1_macvtap: entered promiscuous mode [ 454.309338][ T9985] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 454.444567][ T9985] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 456.088110][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.088316][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.875343][T10664] random: crng reseeded on system resumption [ 459.896960][T10664] Restarting kernel threads ... [ 459.898611][T10664] Done restarting kernel threads. [ 464.092440][ T8742] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.636161][ T5583] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 464.684518][ T5583] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 464.705243][ T5583] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 464.706973][ T5583] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 464.751832][ T5583] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 472.457420][ T5583] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 473.467490][ T5583] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 473.470706][ T5583] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 474.432366][ T5583] Bluetooth: hci3: command tx timeout [ 474.472283][ T8742] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 474.476422][ T5583] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 474.484234][ T5583] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 475.518732][ T1184] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.678435][T10726] loop5: detected capacity change from 0 to 7 [ 476.912828][ T5583] Bluetooth: hci3: command tx timeout [ 477.434122][ T5583] Bluetooth: hci5: command tx timeout [ 477.773661][T10729] could not allocate digest TFM handle sha1-neon [ 478.309430][ T5865] libceph: connect (1)[c::]:6789 error -101 [ 478.358783][ T5865] libceph: mon0 (1)[c::]:6789 connect error [ 478.419494][T10732] ceph: No mds server is up or the cluster is laggy [ 478.499478][ T5865] libceph: connect (1)[c::]:6789 error -101 [ 478.499678][ T5865] libceph: mon0 (1)[c::]:6789 connect error [ 478.951424][T10726] Dev loop5: unable to read RDB block 7 [ 478.951466][T10726] loop5: unable to read partition table [ 478.951613][T10726] loop5: partition table beyond EOD, truncated [ 478.951668][T10726] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 478.956256][ T5583] Bluetooth: hci3: command tx timeout [ 478.983355][T10730] loop5: detected capacity change from 7 to 0 [ 479.512057][ T5583] Bluetooth: hci5: command tx timeout [ 480.034330][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.002612][ T5583] Bluetooth: hci3: command tx timeout [ 481.425983][T10693] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.426119][T10693] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.426357][T10693] bridge_slave_0: entered allmulticast mode [ 481.429855][T10693] bridge_slave_0: entered promiscuous mode [ 481.442701][T10693] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.442928][T10693] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.443131][T10693] bridge_slave_1: entered allmulticast mode [ 481.446367][T10693] bridge_slave_1: entered promiscuous mode [ 481.578867][ T5583] Bluetooth: hci5: command tx timeout [ 481.894148][T10795] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1812'. [ 482.668492][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.674411][T10799] jffs2: notice: (10799) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 482.911475][T10693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 483.016748][T10693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 483.277627][T10815] random: crng reseeded on system resumption [ 483.473402][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.642354][ T5583] Bluetooth: hci5: command tx timeout [ 483.762961][T10693] team0: Port device team_slave_0 added [ 483.788686][T10693] team0: Port device team_slave_1 added [ 483.918749][T10693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 483.918767][T10693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 483.918792][T10693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 483.999462][T10824] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 484.045841][T10693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 484.045860][T10693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 484.045892][T10693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 485.741361][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.768599][T10849] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 487.197750][T10856] device-mapper: table: 248:0: thin-pool: Error opening metadata block device (-EBUSY) [ 487.197781][T10856] device-mapper: ioctl: error adding target to table [ 487.438311][T10693] hsr_slave_0: entered promiscuous mode [ 487.441370][T10693] hsr_slave_1: entered promiscuous mode [ 487.451316][T10693] debugfs: 'hsr0' already exists in 'hsr' [ 487.451345][T10693] Cannot create hsr debugfs directory [ 487.526793][T10864] tmpfs: Unknown parameter 'grpquota_irA' [ 487.628476][T10866] blktrace: Concurrent blktraces are not allowed on loop2 [ 489.426356][T10874] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1840'. [ 489.431642][T10874] unsupported nlmsg_type 40 [ 490.901907][T10885] overlayfs: upper fs does not support file handles, falling back to index=off. [ 492.396267][T10904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1847'. [ 492.433897][ T12] bridge_slave_1: left allmulticast mode [ 492.433934][ T12] bridge_slave_1: left promiscuous mode [ 492.434208][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.468721][T10906] tmpfs: Unknown parameter 'grpquota_irA' [ 492.565116][T10909] blktrace: Concurrent blktraces are not allowed on loop4 [ 494.284836][ T12] bridge_slave_0: left allmulticast mode [ 494.284882][ T12] bridge_slave_0: left promiscuous mode [ 494.287666][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.632941][ T12] bond1 (unregistering): (slave geneve2): Releasing active interface [ 495.872765][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 495.952645][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 495.994299][ T12] bond0 (unregistering): Released all slaves [ 496.010323][ T12] bond1 (unregistering): Released all slaves [ 496.079074][T10903] bridge0: port 2(bridge_slave_1) entered disabled state [ 496.079472][T10903] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.203369][T10903] bridge0: port 2(bridge_slave_1) entered blocking state [ 496.203529][T10903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 496.203888][T10903] bridge0: port 1(bridge_slave_0) entered blocking state [ 496.204048][T10903] bridge0: port 1(bridge_slave_0) entered forwarding state [ 496.248812][T10903] team0: Port device bridge0 added [ 497.951360][T10939] tmpfs: Unknown parameter 'grpquota_irA' [ 500.618611][T10939] blktrace: Concurrent blktraces are not allowed on loop2 [ 501.309687][T10693] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.391252][T10948] jffs2: notice: (10948) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 501.845058][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.845155][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.469977][T10955] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1861'. [ 502.656975][T10964] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1865'. [ 502.875598][T10971] tmpfs: Unknown parameter 'grpquota_irA' [ 503.076345][T10975] blktrace: Concurrent blktraces are not allowed on loop0 [ 505.474685][T10957] sch_tbf: burst 1520 is lower than device lo mtu (65550) ! [ 506.346236][T10989] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1871'. [ 506.886151][T11005] tmpfs: Unknown parameter 'grpquota_irA' [ 508.189519][ T1021] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 508.363018][T11007] blktrace: Concurrent blktraces are not allowed on loop2 [ 509.311274][T10693] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.694441][T11017] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1882'. [ 510.370951][T10707] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.371301][T10707] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.371547][T10707] bridge_slave_0: entered allmulticast mode [ 510.404851][T10707] bridge_slave_0: entered promiscuous mode [ 510.438030][T11030] device-mapper: table: 248:0: zero-length target [ 510.438047][T11030] device-mapper: ioctl: error adding target to table [ 518.075632][ T5586] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 518.128478][ T5586] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 518.146108][ T5586] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 518.147461][ T5586] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 518.150707][ T5586] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 518.706147][T10707] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.706377][T10707] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.706618][T10707] bridge_slave_1: entered allmulticast mode [ 518.734291][T10707] bridge_slave_1: entered promiscuous mode [ 519.005797][T10693] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.333710][T11075] device-mapper: table: 248:0: zero-length target [ 519.333728][T11075] device-mapper: ioctl: error adding target to table [ 519.752745][T11059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1894'. [ 519.752769][T11059] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1894'. [ 520.193540][T11059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1894'. [ 520.193566][T11059] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1894'. [ 520.362004][ T5583] Bluetooth: hci2: command tx timeout [ 521.359443][T10707] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 522.442425][ T5583] Bluetooth: hci2: command tx timeout [ 523.717349][T10693] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.539457][ T5583] Bluetooth: hci2: command tx timeout [ 525.311226][T10707] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 525.601918][ T12] hsr_slave_0: left promiscuous mode [ 525.632309][ T12] hsr_slave_1: left promiscuous mode [ 525.633892][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 525.633920][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 525.694414][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 525.694444][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 525.847496][ T12] veth1_macvtap: left promiscuous mode [ 525.847605][ T12] veth0_macvtap: left promiscuous mode [ 525.847859][ T12] veth1_vlan: left promiscuous mode [ 525.848047][ T12] veth0_vlan: left promiscuous mode [ 526.602599][ T5583] Bluetooth: hci2: command tx timeout [ 531.049404][T11203] jffs2: notice: (11203) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 531.172681][ T5586] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 531.545880][ T5586] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 531.570757][ T5586] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 531.578734][ T5586] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 531.581580][ T5586] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 533.661309][ T5586] Bluetooth: hci6: command tx timeout [ 535.645832][ T13] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 535.647370][ T5799] netdevsim netdevsim4 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 535.647513][ T5799] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 535.647555][ T5799] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 535.722025][ T5586] Bluetooth: hci6: command tx timeout [ 537.821873][ T5586] Bluetooth: hci6: command tx timeout [ 540.090176][ T5586] Bluetooth: hci6: command tx timeout [ 540.426555][ T13] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 542.026742][T11297] hub 1-0:1.0: USB hub found [ 542.132041][T11297] hub 1-0:1.0: 1 port detected [ 543.394629][ T5241] 8021q: adding VLAN 0 to HW filter on device eth1 [ 543.460224][ T12] IPVS: stop unused estimator thread 0... [ 545.142679][ T12] bridge_slave_1: left allmulticast mode [ 545.142720][ T12] bridge_slave_1: left promiscuous mode [ 545.143002][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.219819][ T12] bridge_slave_0: left allmulticast mode [ 546.219856][ T12] bridge_slave_0: left promiscuous mode [ 546.220158][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 548.283921][ T12] bridge_slave_1: left allmulticast mode [ 548.283958][ T12] bridge_slave_1: left promiscuous mode [ 548.284209][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 548.453975][ T12] bridge_slave_0: left allmulticast mode [ 548.454015][ T12] bridge_slave_0: left promiscuous mode [ 548.454288][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 548.764019][ T12] bridge_slave_1: left allmulticast mode [ 548.764057][ T12] bridge_slave_1: left promiscuous mode [ 548.764310][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.183635][ T12] bridge_slave_0: left allmulticast mode [ 550.183675][ T12] bridge_slave_0: left promiscuous mode [ 550.183943][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 553.943826][T11398] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1995'. [ 554.086740][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 554.185146][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 554.244005][ T12] bond0 (unregistering): Released all slaves [ 554.472638][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 554.552749][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 554.614406][ T12] bond0 (unregistering): Released all slaves [ 556.482772][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 556.542858][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 556.565258][ T12] bond0 (unregistering): Released all slaves [ 557.578014][T11045] bridge0: port 1(bridge_slave_0) entered blocking state [ 557.578175][T11045] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.603340][T11045] bridge_slave_0: entered allmulticast mode [ 557.606962][T11045] bridge_slave_0: entered promiscuous mode [ 557.729003][T11045] bridge0: port 2(bridge_slave_1) entered blocking state [ 557.730140][T11045] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.730397][T11045] bridge_slave_1: entered allmulticast mode [ 557.763373][T11045] bridge_slave_1: entered promiscuous mode [ 558.944981][T11045] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 558.963821][T11045] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 559.252762][ T31] IPVS: starting estimator thread 0... [ 559.283002][T11427] IPVS: set_ctl: invalid protocol: 59 100.1.1.1:20001 [ 559.339537][T11427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 559.352218][T11045] team0: Port device team_slave_0 added [ 559.364124][T11431] IPVS: using max 8 ests per chain, 19200 per kthread [ 559.442473][T11045] team0: Port device team_slave_1 added [ 559.733767][T11045] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 559.733784][T11045] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 559.733815][T11045] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 559.764244][T11045] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 559.764262][T11045] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 559.764292][T11045] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 559.926822][T11445] device-mapper: ioctl: Invalid ioctl structure: name m, dev f801 [ 560.242465][ T12] hsr_slave_0: left promiscuous mode [ 560.312935][ T12] hsr_slave_1: left promiscuous mode [ 560.319118][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 560.420396][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 562.592063][ T12] hsr_slave_0: left promiscuous mode [ 562.632033][ T12] hsr_slave_1: left promiscuous mode [ 562.633094][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 562.633121][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 563.361037][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.377426][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.697414][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 563.697443][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 564.038257][ T12] veth1_macvtap: left promiscuous mode [ 564.038363][ T12] veth0_macvtap: left promiscuous mode [ 564.066670][ T12] veth1_vlan: left promiscuous mode [ 564.066924][ T12] veth0_vlan: left promiscuous mode [ 567.054123][ T12] team0 (unregistering): Port device team_slave_1 removed [ 567.312670][ T12] team0 (unregistering): Port device team_slave_0 removed [ 568.613312][T11534] random: crng reseeded on system resumption [ 568.739741][T11534] Restarting kernel threads ... [ 568.754735][T11534] Done restarting kernel threads. [ 570.883649][T11543] fuse: Bad value for 'fd' [ 572.264968][ T12] team0 (unregistering): Port device team_slave_1 removed [ 572.352589][ T12] team0 (unregistering): Port device team_slave_0 removed [ 573.360741][ T8820] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 573.848772][T11571] loop8: detected capacity change from 0 to 7 [ 574.430093][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.430276][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.437028][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.456961][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.457049][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.457394][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.457470][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.459430][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.459518][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.459786][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.459856][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.460084][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.460154][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.460295][T11571] ldm_validate_partition_table(): Disk read failed. [ 574.460390][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.460462][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.460697][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.460767][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.460989][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 1 [ 574.461058][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.461436][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 574.461584][T11571] Dev loop8: unable to read RDB block 0 [ 574.484380][T11571] loop8: unable to read partition table [ 574.484611][T11571] loop8: partition table beyond EOD, truncated [ 574.484654][T11571] loop_reread_partitions: partition scan of loop8 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 576.157338][ T5241] 8021q: adding VLAN 0 to HW filter on device eth2 [ 576.251168][ T5583] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 576.295746][ T5583] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 576.299975][ T5583] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 576.320362][ T5583] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 576.330163][ T5583] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 576.476167][T11045] hsr_slave_0: entered promiscuous mode [ 576.494180][T11045] hsr_slave_1: entered promiscuous mode [ 576.518288][T11045] debugfs: 'hsr0' already exists in 'hsr' [ 576.518311][T11045] Cannot create hsr debugfs directory [ 578.873811][ T5583] Bluetooth: hci3: command tx timeout [ 582.237893][T10717] Bluetooth: hci3: command tx timeout [ 582.596588][ T5583] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 582.697560][ T5583] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 582.717021][ T5583] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 582.749343][ T5583] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 582.759551][ T5583] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 583.585975][T11198] bridge0: port 1(bridge_slave_0) entered blocking state [ 583.591072][T11198] bridge0: port 1(bridge_slave_0) entered disabled state [ 583.591340][T11198] bridge_slave_0: entered allmulticast mode [ 583.631099][T11198] bridge_slave_0: entered promiscuous mode [ 583.652526][T11198] bridge0: port 2(bridge_slave_1) entered blocking state [ 583.652665][T11198] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.652887][T11198] bridge_slave_1: entered allmulticast mode [ 583.655964][T11198] bridge_slave_1: entered promiscuous mode [ 583.813161][T11198] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 583.816793][T11198] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 584.281952][ T5586] Bluetooth: hci3: command tx timeout [ 585.476327][ T5586] Bluetooth: hci0: command tx timeout [ 585.735282][ T5241] 8021q: adding VLAN 0 to HW filter on device eth3 [ 585.840524][T11198] team0: Port device team_slave_0 added [ 586.388409][ T5586] Bluetooth: hci3: command tx timeout [ 587.300350][T11198] team0: Port device team_slave_1 added [ 587.482059][ T5586] Bluetooth: hci0: command tx timeout [ 587.640152][T11198] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 587.640166][T11198] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.640187][T11198] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 587.729998][T11198] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 587.730018][T11198] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.730050][T11198] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 587.731969][ T8322] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 587.987123][ T8322] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 587.987160][ T8322] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 587.987189][ T8322] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 587.987212][ T8322] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 587.987270][ T8322] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 587.987291][ T8322] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.071375][ T8322] usb 1-1: config 0 descriptor?? [ 588.347653][T11198] hsr_slave_0: entered promiscuous mode [ 588.354710][T11198] hsr_slave_1: entered promiscuous mode [ 588.379503][T11198] debugfs: 'hsr0' already exists in 'hsr' [ 588.379530][T11198] Cannot create hsr debugfs directory [ 588.495795][ T8322] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 588.495840][ T8322] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 588.495869][ T8322] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 588.495899][ T8322] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 588.495928][ T8322] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 588.938670][ T8322] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 589.561955][ T5586] Bluetooth: hci0: command tx timeout [ 589.639592][ T5583] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 589.715392][ T5583] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 589.721713][ T5583] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 589.774261][ T5583] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 590.047428][ T5583] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 590.970052][ T5241] 8021q: adding VLAN 0 to HW filter on device eth4 [ 591.037507][ T8322] usb 1-1: USB disconnect, device number 20 [ 591.758787][ T5586] Bluetooth: hci0: command tx timeout [ 592.603516][ T5586] Bluetooth: hci2: command tx timeout [ 594.549764][T11576] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.549923][T11576] bridge0: port 1(bridge_slave_0) entered disabled state [ 594.551476][T11576] bridge_slave_0: entered allmulticast mode [ 594.570350][T11576] bridge_slave_0: entered promiscuous mode [ 594.664668][T11576] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.665459][T11576] bridge0: port 2(bridge_slave_1) entered disabled state [ 594.665621][T11576] bridge_slave_1: entered allmulticast mode [ 594.686075][ T5586] Bluetooth: hci2: command tx timeout [ 594.688664][T11576] bridge_slave_1: entered promiscuous mode [ 594.855473][ T12] bridge_slave_1: left allmulticast mode [ 594.855511][ T12] bridge_slave_1: left promiscuous mode [ 594.855763][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 594.984379][ T12] bridge_slave_0: left allmulticast mode [ 594.984418][ T12] bridge_slave_0: left promiscuous mode [ 594.984696][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.057541][T11776] random: crng reseeded on system resumption [ 595.098657][T11776] Restarting kernel threads ... [ 595.107986][T11776] Done restarting kernel threads. [ 595.282943][ T12] bridge_slave_1: left allmulticast mode [ 595.282982][ T12] bridge_slave_1: left promiscuous mode [ 595.283344][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.426815][ T12] bridge_slave_0: left allmulticast mode [ 595.426844][ T12] bridge_slave_0: left promiscuous mode [ 595.427071][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.863078][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 595.952767][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 596.038139][ T12] bond0 (unregistering): Released all slaves [ 596.282904][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 596.382925][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 596.449163][ T12] bond0 (unregistering): Released all slaves [ 596.538108][T11769] syz_tun: entered allmulticast mode [ 596.767354][ T5586] Bluetooth: hci2: command tx timeout [ 596.767572][T11777] syz_tun: left allmulticast mode [ 596.877290][T11576] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 597.014927][T11576] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.143553][T11621] bridge0: port 1(bridge_slave_0) entered blocking state [ 597.143693][T11621] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.143919][T11621] bridge_slave_0: entered allmulticast mode [ 597.228140][T11621] bridge_slave_0: entered promiscuous mode [ 597.312239][T11621] bridge0: port 2(bridge_slave_1) entered blocking state [ 597.312469][T11621] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.312730][T11621] bridge_slave_1: entered allmulticast mode [ 597.315543][T11621] bridge_slave_1: entered promiscuous mode [ 597.431961][T11576] team0: Port device team_slave_0 added [ 597.621124][T11576] team0: Port device team_slave_1 added [ 597.851692][T11814] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.2105'. [ 597.895226][T11621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 598.023327][ T12] hsr_slave_0: left promiscuous mode [ 598.062095][ T12] hsr_slave_1: left promiscuous mode [ 598.063127][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 598.096831][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 598.182173][ T12] hsr_slave_0: left promiscuous mode [ 598.222068][ T12] hsr_slave_1: left promiscuous mode [ 598.224245][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 598.274399][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 598.669293][ T12] team0 (unregistering): Port device team_slave_1 removed [ 598.722741][ T12] team0 (unregistering): Port device team_slave_0 removed [ 598.842347][ T5586] Bluetooth: hci2: command tx timeout [ 598.979580][T11847] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.2116' sets config #0 [ 598.980104][T11847] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.2116' sets config #1 [ 599.333211][ T12] team0 (unregistering): Port device team_slave_1 removed [ 599.392785][ T12] team0 (unregistering): Port device team_slave_0 removed [ 599.616353][T11621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 599.681342][T11576] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 599.681361][T11576] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 599.681392][T11576] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 599.771636][T11576] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 599.771656][T11576] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 599.771688][T11576] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 599.861702][T11621] team0: Port device team_slave_0 added [ 599.913344][T11621] team0: Port device team_slave_1 added [ 600.044504][T11621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 600.044523][T11621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.044557][T11621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 600.142255][T11621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 600.142274][T11621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.142307][T11621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 600.210753][T11576] hsr_slave_0: entered promiscuous mode [ 600.216844][T11576] hsr_slave_1: entered promiscuous mode [ 600.219340][T11576] debugfs: 'hsr0' already exists in 'hsr' [ 600.219408][T11576] Cannot create hsr debugfs directory [ 600.907999][T11871] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.2124'. [ 601.393614][T11621] hsr_slave_0: entered promiscuous mode [ 601.396544][T11621] hsr_slave_1: entered promiscuous mode [ 601.399110][T11621] debugfs: 'hsr0' already exists in 'hsr' [ 601.399137][T11621] Cannot create hsr debugfs directory [ 601.410687][T11882] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.2127' sets config #0 [ 601.429698][T11882] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.2127' sets config #1 [ 602.266465][T11894] ip6erspan0: entered promiscuous mode [ 602.714135][T11700] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.714319][T11700] bridge0: port 1(bridge_slave_0) entered disabled state [ 602.714552][T11700] bridge_slave_0: entered allmulticast mode [ 602.747506][T11700] bridge_slave_0: entered promiscuous mode [ 602.858993][T11700] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.859174][T11700] bridge0: port 2(bridge_slave_1) entered disabled state [ 602.859737][T11700] bridge_slave_1: entered allmulticast mode [ 602.889221][T11700] bridge_slave_1: entered promiscuous mode [ 603.352796][T11700] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.410195][T11919] hub 1-0:1.0: USB hub found [ 603.414905][T11919] hub 1-0:1.0: 1 port detected [ 603.675392][T11700] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 604.075615][T11700] team0: Port device team_slave_0 added [ 604.104059][T11700] team0: Port device team_slave_1 added [ 604.578991][T11700] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 604.579005][T11700] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.579027][T11700] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 605.854461][T11700] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 605.854481][T11700] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 605.854516][T11700] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 606.128766][ T8742] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 606.343961][T11576] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 606.485226][T11947] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2148'. [ 606.661439][T11576] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 606.746983][T11576] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 607.026031][T11576] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 607.076231][T11700] hsr_slave_0: entered promiscuous mode [ 607.077395][T11700] hsr_slave_1: entered promiscuous mode [ 607.078109][T11700] debugfs: 'hsr0' already exists in 'hsr' [ 607.078128][T11700] Cannot create hsr debugfs directory [ 607.688422][T11576] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 608.045314][T11576] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 608.246015][T11969] Bluetooth: MGMT ver 1.23 [ 608.354150][T11576] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 608.487678][T11576] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 609.920724][T11621] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 610.002515][T11621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 610.075853][T11621] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 610.114318][T11621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 611.215226][T11621] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 612.216042][T11621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 612.416706][T11621] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 612.532402][T11621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 614.077900][T12019] ================================================================== [ 614.077918][T12019] BUG: KASAN: slab-use-after-free in configfs_dirent_is_ready+0x6d/0x70 [ 614.078054][T12019] Read of size 4 at addr ffff88802c94c5b8 by task syz.2.2166/12019 [ 614.078071][T12019] [ 614.078097][T12019] CPU: 0 UID: 0 PID: 12019 Comm: syz.2.2166 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 614.078132][T12019] Tainted: [L]=SOFTLOCKUP [ 614.078139][T12019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 614.078163][T12019] Call Trace: [ 614.078171][T12019] [ 614.078180][T12019] dump_stack_lvl+0xe8/0x150 [ 614.078233][T12019] print_address_description+0x55/0x1e0 [ 614.078267][T12019] ? configfs_dirent_is_ready+0x6d/0x70 [ 614.078325][T12019] print_report+0x58/0x70 [ 614.078348][T12019] kasan_report+0x117/0x150 [ 614.078417][T12019] ? configfs_dirent_is_ready+0x6d/0x70 [ 614.078443][T12019] configfs_dirent_is_ready+0x6d/0x70 [ 614.078467][T12019] configfs_symlink+0x616/0x1030 [ 614.078499][T12019] ? __pfx_configfs_symlink+0x10/0x10 [ 614.078526][T12019] ? bpf_lsm_inode_symlink+0x9/0x20 [ 614.078591][T12019] vfs_symlink+0x18b/0x330 [ 614.078657][T12019] ? security_path_symlink+0xfd/0x360 [ 614.078738][T12019] filename_symlinkat+0x1cd/0x420 [ 614.078768][T12019] ? __pfx_filename_symlinkat+0x10/0x10 [ 614.078798][T12019] ? do_getname+0x151/0x250 [ 614.078853][T12019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.078895][T12019] __se_sys_symlinkat+0x4e/0x2b0 [ 614.078926][T12019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.078944][T12019] do_syscall_64+0x174/0x580 [ 614.079113][T12019] ? trace_irq_disable+0x3b/0x140 [ 614.079194][T12019] ? clear_bhb_loop+0x70/0xc0 [ 614.079218][T12019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.079242][T12019] RIP: 0033:0x7fd7b959e0d9 [ 614.079261][T12019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 614.079279][T12019] RSP: 002b:00007fd7b77f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 614.079301][T12019] RAX: ffffffffffffffda RBX: 00007fd7b9825fa0 RCX: 00007fd7b959e0d9 [ 614.079316][T12019] RDX: 0000200000000200 RSI: ffffffffffffff9c RDI: 00002000000001c0 [ 614.079331][T12019] RBP: 00007fd7b9635024 R08: 0000000000000000 R09: 0000000000000000 [ 614.079346][T12019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 614.079359][T12019] R13: 00007fd7b9826038 R14: 00007fd7b9825fa0 R15: 00007ffdbe3f8348 [ 614.079384][T12019] [ 614.079392][T12019] [ 614.079398][T12019] Allocated by task 12019: [ 614.079408][T12019] kasan_save_track+0x3e/0x80 [ 614.079470][T12019] __kasan_slab_alloc+0x6c/0x80 [ 614.079488][T12019] kmem_cache_alloc_noprof+0x355/0x650 [ 614.079546][T12019] configfs_new_dirent+0x59/0x470 [ 614.079570][T12019] configfs_attach_item+0xa1/0xd60 [ 614.079601][T12019] configfs_attach_group+0x2a/0x370 [ 614.079626][T12019] configfs_mkdir+0x6f0/0x9e0 [ 614.079648][T12019] vfs_mkdir+0x402/0x620 [ 614.079671][T12019] filename_mkdirat+0x289/0x520 [ 614.079699][T12019] __se_sys_mkdirat+0x35/0x150 [ 614.079728][T12019] do_syscall_64+0x174/0x580 [ 614.079758][T12019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.079777][T12019] [ 614.079781][T12019] Freed by task 12022: [ 614.079791][T12019] kasan_save_track+0x3e/0x80 [ 614.079817][T12019] kasan_save_free_info+0x40/0x50 [ 614.079879][T12019] __kasan_slab_free+0x5c/0x80 [ 614.079895][T12019] kmem_cache_free+0x187/0x6c0 [ 614.079944][T12019] configfs_d_iput+0x209/0x270 [ 614.079965][T12019] vfs_rmdir+0x24a/0x6b0 [ 614.079987][T12019] filename_rmdir+0x292/0x520 [ 614.080012][T12019] __se_sys_rmdir+0x2e/0x140 [ 614.080036][T12019] do_syscall_64+0x174/0x580 [ 614.080061][T12019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.080089][T12019] [ 614.080094][T12019] The buggy address belongs to the object at ffff88802c94c580 [ 614.080094][T12019] which belongs to the cache configfs_dir_cache of size 96 [ 614.080114][T12019] The buggy address is located 56 bytes inside of [ 614.080114][T12019] freed 96-byte region [ffff88802c94c580, ffff88802c94c5e0) [ 614.080136][T12019] [ 614.080141][T12019] The buggy address belongs to the physical page: [ 614.080169][T12019] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802c94c800 pfn:0x2c94c [ 614.080192][T12019] flags: 0x80000000000200(workingset|node=0|zone=1) [ 614.080214][T12019] page_type: f5(slab) [ 614.080234][T12019] raw: 0080000000000200 ffff88801c294b40 ffff88801e2de688 ffff88801e2de688 [ 614.080253][T12019] raw: ffff88802c94c800 0000000800200010 00000000f5000000 0000000000000000 [ 614.080265][T12019] page dumped because: kasan: bad access detected [ 614.080279][T12019] page_owner tracks the page as allocated [ 614.080286][T12019] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12019, tgid 12018 (syz.2.2166), ts 613761576664, free_ts 613755226724 [ 614.080321][T12019] post_alloc_hook+0x1f9/0x250 [ 614.080419][T12019] get_page_from_freelist+0x262a/0x26a0 [ 614.080442][T12019] __alloc_frozen_pages_noprof+0x18d/0x380 [ 614.080461][T12019] allocate_slab+0x79/0x5e0 [ 614.080482][T12019] refill_objects+0x2d8/0x350 [ 614.080505][T12019] __pcs_replace_empty_main+0x330/0x690 [ 614.080528][T12019] kmem_cache_alloc_noprof+0x452/0x650 [ 614.080557][T12019] configfs_new_dirent+0x59/0x470 [ 614.080579][T12019] configfs_attach_item+0xa1/0xd60 [ 614.080604][T12019] configfs_attach_group+0x2a/0x370 [ 614.080629][T12019] configfs_mkdir+0x6f0/0x9e0 [ 614.080651][T12019] vfs_mkdir+0x402/0x620 [ 614.080673][T12019] filename_mkdirat+0x289/0x520 [ 614.080697][T12019] __se_sys_mkdirat+0x35/0x150 [ 614.080721][T12019] do_syscall_64+0x174/0x580 [ 614.080749][T12019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.080770][T12019] page last free pid 20 tgid 20 stack trace: [ 614.080784][T12019] __free_frozen_pages+0x10e7/0x11c0 [ 614.080815][T12019] rcu_cpu_kthread+0x950/0x1480 [ 614.080876][T12019] smpboot_thread_fn+0x57c/0xa80 [ 614.080945][T12019] kthread+0x388/0x470 [ 614.080991][T12019] ret_from_fork+0x514/0xb70 [ 614.081069][T12019] ret_from_fork_asm+0x1a/0x30 [ 614.081106][T12019] [ 614.081112][T12019] Memory state around the buggy address: [ 614.081123][T12019] ffff88802c94c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 614.081137][T12019] ffff88802c94c500: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 614.081152][T12019] >ffff88802c94c580: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 614.081163][T12019] ^ [ 614.081175][T12019] ffff88802c94c600: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 614.081189][T12019] ffff88802c94c680: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 614.081200][T12019] ================================================================== [ 614.091254][T12019] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 614.091327][T12019] CPU: 0 UID: 0 PID: 12019 Comm: syz.2.2166 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 614.091423][T12019] Tainted: [L]=SOFTLOCKUP [ 614.091452][T12019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 614.091487][T12019] Call Trace: [ 614.091509][T12019] [ 614.091540][T12019] vpanic+0x56c/0xa60 [ 614.091631][T12019] ? __pfx_vpanic+0x10/0x10 [ 614.091739][T12019] ? __pfx___schedule+0x10/0x10 [ 614.091920][T12019] panic+0xc5/0xd0 [ 614.092007][T12019] ? __pfx_panic+0x10/0x10 [ 614.092122][T12019] ? preempt_schedule_common+0x82/0xd0 [ 614.092208][T12019] ? configfs_dirent_is_ready+0x6d/0x70 [ 614.092292][T12019] check_panic_on_warn+0x89/0xb0 [ 614.092431][T12019] ? configfs_dirent_is_ready+0x6d/0x70 [ 614.092500][T12019] end_report+0x73/0x170 [ 614.092575][T12019] ? configfs_dirent_is_ready+0x6d/0x70 [ 614.092637][T12019] kasan_report+0x128/0x150 [ 614.092702][T12019] ? configfs_dirent_is_ready+0x6d/0x70 [ 614.092789][T12019] configfs_dirent_is_ready+0x6d/0x70 [ 614.092849][T12019] configfs_symlink+0x616/0x1030 [ 614.092888][T12019] ? __pfx_configfs_symlink+0x10/0x10 [ 614.092920][T12019] ? bpf_lsm_inode_symlink+0x9/0x20 [ 614.092950][T12019] vfs_symlink+0x18b/0x330 [ 614.092981][T12019] ? security_path_symlink+0xfd/0x360 [ 614.093016][T12019] filename_symlinkat+0x1cd/0x420 [ 614.093050][T12019] ? __pfx_filename_symlinkat+0x10/0x10 [ 614.093091][T12019] ? do_getname+0x151/0x250 [ 614.093123][T12019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.093146][T12019] __se_sys_symlinkat+0x4e/0x2b0 [ 614.093178][T12019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.093202][T12019] do_syscall_64+0x174/0x580 [ 614.093235][T12019] ? trace_irq_disable+0x3b/0x140 [ 614.093270][T12019] ? clear_bhb_loop+0x70/0xc0 [ 614.093296][T12019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.093319][T12019] RIP: 0033:0x7fd7b959e0d9 [ 614.093339][T12019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 614.093360][T12019] RSP: 002b:00007fd7b77f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 614.093385][T12019] RAX: ffffffffffffffda RBX: 00007fd7b9825fa0 RCX: 00007fd7b959e0d9 [ 614.093403][T12019] RDX: 0000200000000200 RSI: ffffffffffffff9c RDI: 00002000000001c0 [ 614.093420][T12019] RBP: 00007fd7b9635024 R08: 0000000000000000 R09: 0000000000000000 [ 614.093434][T12019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 614.093449][T12019] R13: 00007fd7b9826038 R14: 00007fd7b9825fa0 R15: 00007ffdbe3f8348 [ 614.093475][T12019] [ 614.094107][T12019] Kernel Offset: disabled