last executing test programs: 2m36.380320293s ago: executing program 0 (id=385): r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$md_new_array(r0, 0x0, 0x0) r1 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f00000000c0)={'/sys/block/md', @num=0x0, '/md/', @array='level\x00'}, 0x1, 0x0) write$md_sysfs(r1, &(0x7f0000000100)=@str='raid1', 0x5) r2 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000140)={'/sys/block/md', @num=0x0, '/md/', @array='raid_disks\x00'}, 0x1, 0x0) write$md_sysfs(r2, &(0x7f0000000180)=@str='2', 0x1) r3 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000240)={'/sys/block/md', @num=0x0, '/md/', @array='new_dev\x00'}, 0x1, 0x0) write$md_sysfs(r3, &(0x7f0000000280)=@dev={'1:', 0x0}, 0x16) write$md_sysfs(r3, &(0x7f00000002c0)=@dev={'1:', 0x1}, 0x16) openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000300)={'/sys/block/md', @num=0x0, '/md/', @rdev={@rd='rd1/', 'slot\x00'}}, 0x1, 0x0) r4 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000380)={'/sys/block/md', @num=0x0, '/md/', @rdev={@ram={'dev-ram', 0x1}, 'slot\x00'}}, 0x1, 0x0) write$md_sysfs(r4, &(0x7f00000003c0)=@str='1', 0x1) write$md_new_array(r0, 0x0, 0x0) r5 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000400)={'/sys/block/md', @num=0x0, '/md/', @array='array_state\x00'}, 0x1, 0x0) write$md_sysfs(r5, &(0x7f0000000440)=@str='active', 0x6) close(0xffffffffffffffff) write$md_sysfs(r5, &(0x7f0000000500)=@str='clear', 0x5) 2m35.184898245s ago: executing program 0 (id=387): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@nested_vmlaunch={0x12f, 0x18}], 0x18}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2m34.163852088s ago: executing program 0 (id=395): syz_emit_ethernet(0x5a, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00631dda01aef2b0bad477a11d13ec0c19456795dd9b2620df1c0f624854ea3dd5a00bd6df44035f5c3ae796fec6d633a0ffad0569794acfef7da01767fd4175f2cd82df769aa2ee7bfe3640554507d24c60c9f9e222a72e1e3e71145c480657d2864e5e276f028d64701ae31cde0ceaf408fdb05c0f4142da00e9000001001d0149e6d308cbe315789f4baffe39bbced9b1d4db174c6121d2e290e9fc561a62225f002ee310e1fa7321000000000000d6231001a4b2d467825f3abb0c167e129cf1fa0e7854103f4bf2d3a0194983bc86cbd3d75ccef3c8ac4516dac10222664bbc980b4e99027c53ae2c6cc05d3be246e5837cbf286225d43e8c1d2e3fda86b86906b79fdedae7f3bbe362e8ad7f2b370442013de1788be93a3d553c2e1f5b559393d964df51bf393f52ecbe6f832b222231fbb9fee9e0343c2d3d567f7cff6d0b25303bcbcc99c879d3bc622b336c622a91291a63f9644964e5a679ea1b5005b9d987d6094ed4e1af157499d5fb2850161224a441240ea52dda516bc06ff3ade3c08c653108720c3e34727b0ae3db5da52511edb4325a2dd02b05f06a9e39764a8fbe0eb4eee5b51895703128cade291bc5c1acfae9ec5d34e71f75d8b5046aafd108b487be169a7bd49de322163858ae595e084074253c72d65f402752618d636a30c7800d77cbe196c326ca4d210f12f442868cba3ea9a0cbca8f59b1054675e2b1e898305a7245aae76525aaf2460152e5647f", @ANYRES64], 0x1, 0x2aa, &(0x7f0000000600)="$eJzs3c9OE10Yx/EfpS/wgjBVFAVjPNGNbiZQr6AhkBibaJAa/yQmg0y16dCSToOpMcLOrWsvgbh0Z2K8ATZegQt3bFyyMI7pdIACQ4IEmYLfz+Y8nTNPc06eM81p0pmuP3y3UC76dtGpK9VllJYGtCFllFK3WrqiNhXGPWq3opvD+W9X7j96fCeXz0/NGDOdm72VNcYMXf388vWHa1/qAw8+Dn3q1Vrm6fqP7Pe1kbXR9V+zL0q+KfmmUq0bx8xVq3VnznPNfMkv28bc81zHd02p4ru1Hf1Fr7q42DBOZX6wf7Hm+r5xKg1TdhumXjX1WsM4z51Sxdi2bQb7haa+/btSxzkOJKVWyzmTksb29BRWExkQAABIVMz+f+Uw+/909Jr9/0lSWJ2ZcXJJjwJHyNp7qLn/fxL7dY/9PwAAAAAAAAAAAAAAAAAAAAAAJ8FGEFhBEFjNdvP+gB5JQXT8f0n9kgYknZE0KGkous0gI+mspHOShiWdl3RB0oiki5IuSRpte6+Ep4oY7fVvtv9F9e+m/v+E/eq/6/oPHyJB/U+fA9af6/+UantwT5+08HapsFRota3+XFEleXI1Lks/w1pGWvH07fzUuAlldHlhOcpfXip078yfkNVcMHH5E618szO/N1x3W/lZWc0FFpefjc3v043rbfm2LH19pqo8zYdrcjv/zYQxk3fzu/LHwvN26zne8vx1ttkSWz/b3q+/lX+A9RGMx9YnrbF0snOH5DdelR3Pc2sEBJ0XjHTGMA4dvO+MYRwmSPqTCcdhu+hJjwQAAAAAAAAAAAAAAAAA8CeO5jeDm/8UFn9OwlMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCP3wEAAP//t8JUVA==") socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000008c0)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000900)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000940)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000009c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a40), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000a80), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000ac0)=0x6) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r3 = fsopen(0x0, 0x0) r4 = fsmount(r3, 0x0, 0xa) fchdir(r4) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000c40)=[0xee00]) socket$nl_route(0x10, 0x3, 0x0) setregid(r5, r5) mkdirat(0xffffffffffffff9c, 0x0, 0x1) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000d00), 0x0, 0x0, 0x0) 2m33.121653834s ago: executing program 0 (id=399): ioctl$BINDER_VERSION(0xffffffffffffffff, 0xc0046209, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x28181) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000180)="94", 0xf000}, {0x0}], 0x2) ioctl$BTRFS_IOC_FS_INFO(r0, 0x8400941f, 0x0) socket$inet_tcp(0x2, 0x1, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys_sec\x00', 0x16e) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mount(0x0, &(0x7f0000000280)='./sys_sec\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r2, 0x0, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000380), 0x60240) write$proc_mixer(0xffffffffffffffff, 0x0, 0x2a) close(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0xc0a85320, &(0x7f00000023c0)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) readv(r3, &(0x7f0000002480)=[{0x0}], 0x1) close(r3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002500), 0xbf, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0xc1a81, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xce4}, 0x38) 2m31.124405927s ago: executing program 0 (id=406): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fdd000/0x18000)=nil, 0x0, 0x0, 0x1, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 2m31.010942289s ago: executing program 0 (id=407): r0 = socket$inet(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x480, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) unshare(0x6a060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x800ffff, @mcast2}}}, 0x32) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000001040)={0x0, {0x2, 0x0, @dev}, {0x2, 0x4e24, @remote}, {0x2, 0x0, @multicast1}, 0xaf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200}) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8005d}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r4, 0x6, 0xd, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0xb, 0x0, &(0x7f0000000240)) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x6, 0xfffffffffffffffc}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2e}, {0x8, 0x0, 0x100000001, 0x0, 0x0, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x0, 0xffffffffffffffff}, 0xfffffffe}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x20, 0x0, 0x87}, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x4}}}, 0xb8}}, 0x2c000010) 2m15.790081294s ago: executing program 32 (id=407): r0 = socket$inet(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x480, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) unshare(0x6a060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x800ffff, @mcast2}}}, 0x32) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000001040)={0x0, {0x2, 0x0, @dev}, {0x2, 0x4e24, @remote}, {0x2, 0x0, @multicast1}, 0xaf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200}) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8005d}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r4, 0x6, 0xd, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0xb, 0x0, &(0x7f0000000240)) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x6, 0xfffffffffffffffc}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2e}, {0x8, 0x0, 0x100000001, 0x0, 0x0, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x0, 0xffffffffffffffff}, 0xfffffffe}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x20, 0x0, 0x87}, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x4}}}, 0xb8}}, 0x2c000010) 23.161964461s ago: executing program 5 (id=1563): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000003, 0x204031, 0xffffffffffffffff, 0xb80a7000) bpf$PROG_LOAD(0x5, &(0x7f0000001640)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @cgroup_sock_addr=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) 23.106323826s ago: executing program 5 (id=1564): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000580)=0x1, 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000005c0)={0x0, 0x8, 0x0, 0x0, @vifc_lcl_ifindex=0x1, @empty}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, &(0x7f0000000600)="340000001a000100000000000000000002202000000000000000000008000100e001020308000200ac1414bb0800030001000000", 0x34) close(0x4) 23.020132795s ago: executing program 5 (id=1565): ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dbg/bluetooth/l2cap\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/1024, 0x400) 22.926743184s ago: executing program 5 (id=1566): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1400c, &(0x7f0000000080)={[{@bh}, {@mblk_io_submit}, {@usrquota}]}, 0x3, 0x470, &(0x7f00000000c0)="$eJzs3M1vG0UbAPBn13H65k0hoZSvlo9AQVQIkqYt0AMHQCBxKBISHOBoJaEqTQtqgkSrSKQcygkhJO6II/8CJ7ggxAmJK9xRpQr1QsvJaL27iZ3YTtPYcYt/P8ntM/vhmce7Y8/u2AlgaE1l/yQReyPi94iYyIutG0zl/12/tjJ349rKXBL1+tt/JY3t/r62MlduWu433lyIJA62qXfpwsUztcXFhfNFeWb57EczSxcuPnf6bO3UwqmFc0dPnDh+bPbFF44+35M8xyMtojfe++rNk1+05L8hjx6Z6rbyqXq9x9UN1l1N8cgA28H2VIrjVW30/4moNB29iXj9s7XCpwNqINA39Xq9Pt559Wod+A9LorWsy8OwKD/oy+vfdtfBL/dt9DF4V1/JL4CyvK8Xj3zNyNodg+qG69temoqId1f/+SZ7RH/uQwAAtPghG/88m412Vuayscf6+CON+5u2u7uYG5qMiHsiYl9E3BvnYn9E3BfR2PaBiHhwm/U3TZI0hpmbxz/plVtO7iZk47+Xirmt1vFfOfqLyUqjdCEvRDV5//TiwpHiNTkc1T1ZebZLHT++9tuXndY1j/+yR1Z/ORYs2nFlZE/rPvO15dqtZ9zq6qWIAyPt8k/WZgKSiHgoIg60e4J06zpOP/Pdw53WbZ1/Fz2YaKp/G/F0fvxXY0P+paT7/OTM/2Jx4chMeVZs9suvl9/qVP+O8u+B7Pj/v+35v5b/ZNI8X7u0/Tou//F5x2uaqWoRbOP8X60t10aTdxrxaLHsk9ry8vnZiNHkZN7o5uVH1/cty+X2Wf6HD7Xv//ti/ZU4GBHZSfxIRDwaEY8Vx+7xiHgiIg51yf/nV5/8YOOysTL/2+D4z2/r+K8Ho9G6JG2zTRZUzvz0fUulk+thkf+N7u9/xxvR4WLJzbz/bW5F+2Cnrx8AAADcCdKI2BtJOr0Wp+n0dP4d/v351Hfm43Pz+W8EJqOalne6Jpruh84Wl/V5+VJE5F8tKNcfi7Rx3/jrylijPD334eL8QDMHxjv0/8yflUG3Dug7P9iC4aX/w/Dq2v+ru9cOYPdt6v9d+/yevrYF2F1tPv/HBtEOYPe1G//7ez8wHDb0f9N+METc/4fhpf/D8NL/YSgtjcXWP5LvGpTPdIu7bxVMROy0hYMJonpbNKNvQaR9r2K0v6dW34LkDmzzpmBw70kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC99G8AAAD//1KFzjw=") syz_mount_image$fuse(0x0, &(0x7f0000000540)='./bus\x00', 0x42, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000600)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 22.736217024s ago: executing program 5 (id=1567): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x8, &(0x7f0000000340)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}]}, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r3}, &(0x7f00000004c0), 0x0}, 0x20) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x2, 0xfffffffc, 0x6}, 0x10) sendmsg$nl_generic(r4, 0x0, 0x20008000) socket$nl_route(0x10, 0x3, 0x0) 22.239008904s ago: executing program 5 (id=1571): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40800000000000073112d00000000e101f1a300000000b700000000895c8da95edfe035b37421180000009500c20300"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000000020a0101000000000000000000000006400000001a0a010100000000000000000500000a0900010073797a310000000008000240000000030900010073797a30000000000900010073797a300000000020000000160a01010000000000000000000000090900020073797a300000000034000000140a010e0000000000000000020000060900010073797a30000000000900020073797a3200000000080003400000000814000000090a0104"], 0xe4}, 0x1, 0x0, 0x0, 0x4000800}, 0x20008000) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f00000005c0)={0x2, 0x4e24, @local}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000840)="9c", 0x1}], 0x1}, 0x4008010) syz_open_procfs$namespace(r2, &(0x7f0000000040)='ns/pid\x00') 22.162334232s ago: executing program 33 (id=1571): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40800000000000073112d00000000e101f1a300000000b700000000895c8da95edfe035b37421180000009500c20300"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000000020a0101000000000000000000000006400000001a0a010100000000000000000500000a0900010073797a310000000008000240000000030900010073797a30000000000900010073797a300000000020000000160a01010000000000000000000000090900020073797a300000000034000000140a010e0000000000000000020000060900010073797a30000000000900020073797a3200000000080003400000000814000000090a0104"], 0xe4}, 0x1, 0x0, 0x0, 0x4000800}, 0x20008000) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f00000005c0)={0x2, 0x4e24, @local}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000840)="9c", 0x1}], 0x1}, 0x4008010) syz_open_procfs$namespace(r2, &(0x7f0000000040)='ns/pid\x00') 7.532338816s ago: executing program 4 (id=1640): r0 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x8182) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000080)={0x710, 0x3631564e, 0xf00, 0x820870, 0x2, @discrete={0xb, 0x7}}) 7.429161567s ago: executing program 4 (id=1641): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000700)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000740), 0x56) sendmsg$kcm(r5, &(0x7f0000001780)={&(0x7f0000001880)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001940)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 6.852203165s ago: executing program 1 (id=1646): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e22, 0x96, @local, 0xffffffff}, 0x1c) r3 = socket(0x28, 0x5, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="040e0c052f20"], 0xf) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={0x0, 0x200}, 0x8) socket(0x2, 0x80805, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x8c4) setrlimit(0xb, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1600100004"], 0x50) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x3}, @TCA_SKBEDIT_PARMS={0x18}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x68}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@gettaction={0xf0, 0x32, 0xe72c5f922f23cad9, 0x70bd2a, 0x25dfdbf7}, 0xf0}, 0x1, 0x0, 0x0, 0x8080}, 0x10000084) 5.82484395s ago: executing program 4 (id=1648): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="580100001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000000000003001128009000100766c616e000000002001028006000100000000001c0004800c00010032d10000ffff00000c000100ae021d009e000000700004800c00010009000000010000e29b5d2a0008000000010100000c000100f8ffffff080000000c00010006000000040000000c00010007000000010000800c00010005000000060000000c00010001000000000000000c000100910a00000d0000000c0001000e00000032000000880003800c002100060000000c0000000c00010003000000400000000c00010004000000ffffffff0c00010002000000110000000c00010001000000020000000c0001000b000000270000000c000100ffff00005f0200000c000100ffffffff030000000c00010001000000030000000c000108000000001a8000000c0001000900000008ffffe208000500", @ANYRES8=r0], 0x158}, 0x1, 0xba01, 0x0, 0x10}, 0x2000a080) 5.163542857s ago: executing program 2 (id=1649): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0000}, 0x0) 5.042959489s ago: executing program 4 (id=1650): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000580)='syz_tun\x00', 0xff7b) bind$inet6(r0, &(0x7f00000005c0)={0xa, 0x4e22, 0x9, @local}, 0x1c) 4.985998395s ago: executing program 1 (id=1651): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18, 0x1}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) sched_setattr(0x0, 0x0, 0x0) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000003c0)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcc}]}) r5 = socket$alg(0x26, 0x5, 0x0) accept4$alg(r5, 0x0, 0x0, 0x0) r6 = syz_open_dev$radio(&(0x7f0000000180), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205647, &(0x7f00000001c0)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x98f903, 0x0, '\x00', @string=0x0}}) 4.748275328s ago: executing program 4 (id=1653): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000280)={[{@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x7}}, {}, {@nomblk_io_submit}, {@data_err_ignore}, {@usrjquota}]}, 0xfe, 0x469, &(0x7f0000002480)="$eJzs3MtvVFUYAPDv3r54tyo+QNAqJhIfLS3PhRuMJi40MdEFxlVtC0EGqrQmQkhAF7g0JO6NSxP/Ale6MerKxMSV7g0JMWxEE5Mx9869nXE6Uzt0YID5/ZIL58w9wznfnHPmPs5cAuhb49kfScSWiPg1IjbUsv8tMF7768b1C7N/Xb8wm0S1+sYfSV7uz+sXZsui5fs21zLVapEfaVHv5bcjZiqV+bNFfnLp9HuTi+fOP3/y9MyJ+RPzZ6aPHDmwf/fwoemDXYlzNGvrSCzs2vHKW1demz125Z0fvsrau6XY3xhHt4zXPt2VBrpdU+9tbUgngz1sCB3JhmLWXUP5/B+Ngdi4vG80Xv64p40DbqlqtVptdXwuXKoC97Aket0CoDfKA312/Vtut+nU445w7WjE+4dr8d8ottqewUiLMkNN17fdNB4Rxy79/Xm2xS26DwEA0OiboxHxXKvzvzQeaii3rVhDGYuI+yLi/oh4ICK2R8SDEXnZhyPikQ7rb14hWXn+k169qcDWKDv/e6FY21o+//unmsdfGBsoclvz+IeS4ycr8/uKz2RvDI1k+alV6vj2pZ8/bbev8fwv27L6y3PBmvTqYNMNurmZpZl1hr3s2kcROweb4s8lUS7jJBGxIyJ2dvQv168wTj7z5a52perxb4yIVvGvogvrTNUvIp6u9f+laIq/lLRdn5w6fGj64OSGqMzvmyxHxUo//nT59Xb1/3//31pZ/29qHv/13ruYDflkQ8TiufOn8vXaxc7ruPzbJy2vaTatY/wPJ2/m6eHitQ9nlpbOTkUMJ6+ufH26/t4yX5bP4t+7p9X4T/PvuCj6/9GIyAbx7oh4LCIeL9r+REQ8GRF7Von/+xeferfdvvbxr3JXvouy+Oda9H/D+B/LUvX+7zwxcOq7rzuPv5T1/4E8tbd4ZS3ff2tt4Ho+OwAAALhbpPlv4JN0YjmdphMTtd/wb49NaWVhcenZ4wsfnJmr/VZ+LIbS8k7XaMP90Kni3nCZn27K7y/uG382sDHPT8wuVOZ6HTz0uc1t5n/m93vwORWgiee1oH+Z/9C/zH/oX/X5f6in7QBuP8d/6F+t5v/FHrQDuP0c/6F/mf/Qv8x/6F/mP/Slts/Gp+t65P+uTfyy7Y5oxl2QiLTzdw1GL9s83NPabzoxuOb/zOImEyMtd/X6mwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA7/g0AAP//hh/x1w==") mknodat$dm(0xffffffffffffff9c, &(0x7f0000000b80)='./dm0\x00', 0x6180, 0x0) 4.747974139s ago: executing program 2 (id=1655): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f00000001c0)=@framed, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20) syz_emit_ethernet(0x4e, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500182c00fe8000000087b3701ca6f4108030ffffff8d"], 0x0) 4.650483309s ago: executing program 1 (id=1656): socket(0x2, 0x80805, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) ptrace$ARCH_MAP_VDSO_64(0x1e, r0, 0x100000000, 0x2003) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) 4.625395781s ago: executing program 2 (id=1657): setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000cdd000/0x3000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000451000/0x2000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000dd6000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000f78000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f000071a000/0x2000)=nil, 0x0}, 0x68) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}}, 0x24}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r0, 0x80047210, &(0x7f0000000040)) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e1c}, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$video(&(0x7f0000000380), 0x4, 0x802) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000500)={0x1, @pix={0x280, 0x1e0, 0x42474752, 0x1, 0x280, 0x4b000, 0x8}}) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000600)={0x2, 0x1, 0x1}) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000640)=0x1) 3.718771473s ago: executing program 1 (id=1659): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="580100001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000000000003001128009000100766c616e000000002001028006000100000000001c0004800c00010032d10000ffff00000c000100ae021d009e000000700004800c00010009000000010000e29b5d2a0008000000010100000c000100f8ffffff080000000c00010006000000040000000c00010007000000010000800c00010005000000060000000c00010001000000000000000c000100910a00000d0000000c0001000e00000032000000880003800c002100060000000c0000000c00010003000000400000000c00010004000000ffffffff0c00010002000000110000000c00010001000000020000000c0001000b000000270000000c000100ffff00005f0200000c000100ffffffff030000000c00010001000000030000000c000108000000001a8000000c0001000900000008ffffe208000500", @ANYRES8=r0], 0x158}, 0x1, 0xba01, 0x0, 0x10}, 0x2000a080) 3.642333831s ago: executing program 3 (id=1660): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0xf, &(0x7f0000000380)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000440)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) 3.488370026s ago: executing program 2 (id=1661): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x5) accept4$inet6(r0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000280)='X', 0x1, 0x30008000, &(0x7f00000002c0)={0xa, 0x4e23, 0x89, @loopback}, 0x1c) 3.488273736s ago: executing program 3 (id=1662): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000440)={0x2, {0x2, 0xa00, 0x0, 0x101, 0x100}}) 3.468529689s ago: executing program 1 (id=1663): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) setresgid(0x0, 0x0, 0x0) 3.438892641s ago: executing program 3 (id=1664): syz_emit_vhci(&(0x7f0000006b40)=ANY=[@ANYBLOB="040e04023920"], 0x7) 3.26021327s ago: executing program 2 (id=1665): ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f00000001c0)) syz_usb_connect(0x6, 0x371, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) read$usbfs(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write(r1, &(0x7f00000003c0), 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f0000000700), 0x0) 1.372335741s ago: executing program 3 (id=1666): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18, 0x1}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) sched_setattr(0x0, 0x0, 0x0) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) accept4$alg(r5, 0x0, 0x0, 0x0) r6 = syz_open_dev$radio(&(0x7f0000000180), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205647, &(0x7f00000001c0)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x98f903, 0x0, '\x00', @string=0x0}}) 1.363978342s ago: executing program 4 (id=1667): r0 = syz_open_dev$dvb_demux(&(0x7f0000000900), 0x0, 0x2000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = gettid() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000000040)=0xffffffffffffffff) readv(r3, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/255, 0xff}], 0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setsig(r2, 0xa, 0x12) dup2(r2, r3) fcntl$setown(r3, 0x8, r1) r4 = gettid() tkill(r4, 0x13) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000000280)={0xffff, {"0d5c766600fd000008ff002884000100", "3dfab043e15fad27a639f105c45b24fd", "12b700000804b200f300"}, 0x5, 0x5}) 1.198001639s ago: executing program 1 (id=1668): socket$inet(0x2, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000001c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r3) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r3) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x18, r4, 0x1, 0xffffffff, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x18}}, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./proc\x00', 0x4, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x1) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000500)) write(r5, &(0x7f0000000540)='1', 0x1) 1.140458335s ago: executing program 3 (id=1669): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000d80)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001180)={&(0x7f00000011c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001280)={&(0x7f00000012c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r3, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f00000001c0), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000200)=0x2) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000380)=0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000400)={0x1f, @any, 0x6}, 0xa) r7 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r7, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@remote, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x40000, 0x1000000000004, 0x2, 0xa78a}, 0xfffffffe, 0x6e6bbb, 0x2, 0x0, 0x3, 0x1}, {{@in=@empty, 0xffffffff, 0x33}, 0x0, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x3506, 0x4, 0x2, 0x2}}, 0xe8) sendto$inet6(r0, &(0x7f0000001000)='X', 0x34000, 0xe0, &(0x7f0000001040)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 11.798959ms ago: executing program 2 (id=1670): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@enum={0x3, 0x0, 0x0, 0xf, 0x4000000}]}, {0x0, [0x0, 0x0, 0x2e]}}, 0x0, 0x29, 0x0, 0x1}, 0x28) 0s ago: executing program 3 (id=1671): openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x1, 0x0) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="043ef50d", @ANYRESDEC], 0xf8) kernel console output (not intermixed with test programs): sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 71.632909][ T4253] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 71.710584][ T4253] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 71.779409][ T4253] usb 2-1: media controller created [ 71.863279][ T4253] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 72.334732][ T4406] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 72.395800][ T4408] Set syz0 is full, maxelem 0 reached [ 72.475346][ T4409] mmap: syz.3.33 (4409) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 72.810476][ T4253] zl10353_read_register: readreg error (reg=127, ret==0) [ 73.032662][ T4253] usb 2-1: USB disconnect, device number 2 [ 73.240421][ T4194] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 73.673301][ T4194] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 73.711535][ T4194] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 73.759803][ T4194] usb 5-1: config 0 interface 0 has no altsetting 0 [ 73.991611][ T4194] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 74.056192][ T4262] rxe_eth0 speed is unknown, defaulting to 1000 [ 74.070457][ T4194] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 74.078795][ T4194] usb 5-1: Product: syz [ 74.176814][ T4452] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 74.210717][ T4194] usb 5-1: Manufacturer: syz [ 74.210760][ T4194] usb 5-1: SerialNumber: syz [ 74.241061][ T4194] usb 5-1: config 0 descriptor?? [ 74.281563][ T4194] hub 5-1:0.0: bad descriptor, ignoring hub [ 74.281611][ T4194] hub: probe of 5-1:0.0 failed with error -5 [ 74.335201][ T4194] usb 5-1: selecting invalid altsetting 0 [ 74.648531][ T4463] netlink: 52 bytes leftover after parsing attributes in process `syz.3.44'. [ 74.728383][ T1325] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 74.729163][ T1325] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 74.947086][ T4262] usb 5-1: USB disconnect, device number 2 [ 75.236719][ T4482] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.923195][ T4502] netlink: 20 bytes leftover after parsing attributes in process `syz.4.52'. [ 77.611682][ T4554] ip_tables: iptables: counters copy to user failed while replacing table [ 77.781838][ T4560] ip_tables: iptables: counters copy to user failed while replacing table [ 80.229086][ T4594] loop2: detected capacity change from 0 to 128 [ 80.296716][ T4594] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 80.812243][ T4605] loop4: detected capacity change from 0 to 128 [ 81.096376][ T4608] attempt to access beyond end of device [ 81.096376][ T4608] loop4: rw=2049, want=929, limit=128 [ 81.118591][ T145] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 81.280365][ T4194] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 81.311572][ T4276] attempt to access beyond end of device [ 81.311572][ T4276] loop4: rw=1, want=1041, limit=128 [ 81.501310][ T1108] cfg80211: failed to load regulatory.db [ 81.700591][ T4194] usb 4-1: too many endpoints for config 0 interface 0 altsetting 8: 130, using maximum allowed: 30 [ 81.718197][ T4194] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 81.730618][ T4194] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 81.741958][ T4194] usb 4-1: config 0 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 130 [ 81.755672][ T4194] usb 4-1: config 0 interface 0 has no altsetting 0 [ 81.765469][ T4194] usb 4-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00 [ 81.788687][ T4194] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.812003][ T4194] usb 4-1: config 0 descriptor?? [ 81.840698][ T4609] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 82.014567][ T4635] netlink: 16 bytes leftover after parsing attributes in process `syz.2.85'. [ 82.109659][ T4636] netlink: 'syz.2.85': attribute type 10 has an invalid length. [ 82.180409][ T4194] usbhid 4-1:0.0: can't add hid device: -71 [ 82.190520][ T4194] usbhid: probe of 4-1:0.0 failed with error -71 [ 82.205698][ T4636] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 82.300946][ T4194] usb 4-1: USB disconnect, device number 2 [ 82.655721][ T4646] Set syz0 is full, maxelem 0 reached [ 82.712003][ T4649] netlink: 'syz.3.90': attribute type 10 has an invalid length. [ 82.812629][ T4649] device macvlan0 entered promiscuous mode [ 82.943459][ T4649] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 82.983075][ T4651] netlink: 'syz.3.90': attribute type 4 has an invalid length. [ 83.020916][ T4651] netlink: 156 bytes leftover after parsing attributes in process `syz.3.90'. [ 83.180614][ T4314] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 83.191907][ T4651] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 83.590632][ T4314] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 83.598785][ T4314] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 83.692874][ T4314] usb 5-1: config 0 interface 0 has no altsetting 0 [ 83.931023][ T4314] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 83.972755][ T4314] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 84.053170][ T4314] usb 5-1: Product: syz [ 84.094379][ T4314] usb 5-1: Manufacturer: syz [ 84.101548][ T4314] usb 5-1: SerialNumber: syz [ 84.182372][ T4314] usb 5-1: config 0 descriptor?? [ 84.273813][ T4314] hub 5-1:0.0: bad descriptor, ignoring hub [ 84.297595][ T4314] hub: probe of 5-1:0.0 failed with error -5 [ 84.347892][ T4314] usb 5-1: selecting invalid altsetting 0 [ 84.774208][ T4314] usb 5-1: USB disconnect, device number 3 [ 84.927205][ T4695] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.405808][ T4712] loop2: detected capacity change from 0 to 128 [ 86.411651][ T4723] attempt to access beyond end of device [ 86.411651][ T4723] loop2: rw=2049, want=297, limit=128 [ 88.378346][ T4751] rxe_eth0 speed is unknown, defaulting to 1000 [ 88.650431][ T4262] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 88.683263][ T4771] loop0: detected capacity change from 0 to 128 [ 88.837319][ T4771] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 88.940496][ T4262] usb 5-1: Using ep0 maxpacket: 8 [ 89.130554][ T4262] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 89.171060][ T4262] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 89.248755][ T4780] rxe_eth0 speed is unknown, defaulting to 1000 [ 89.323401][ T4262] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 89.691320][ T4262] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 89.759703][ T4262] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.857492][ T4262] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 89.914014][ T4262] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.050764][ T4276] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 90.300561][ T4262] usb 5-1: GET_CAPABILITIES returned 0 [ 90.306308][ T4262] usbtmc 5-1:16.0: can't read capabilities [ 90.387638][ T4805] netlink: 152 bytes leftover after parsing attributes in process `syz.3.131'. [ 90.707662][ T4177] usb 5-1: USB disconnect, device number 4 [ 90.980249][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #102!!! [ 92.080933][ T4262] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 92.101946][ T4833] netlink: 'syz.1.136': attribute type 10 has an invalid length. [ 92.241345][ T4833] team0: Port device dummy0 added [ 92.283531][ T4842] device bridge1 entered promiscuous mode [ 92.294467][ T4844] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 92.358301][ T4844] set match dimension is over the limit! [ 92.386136][ T4848] netlink: 36 bytes leftover after parsing attributes in process `syz.4.141'. [ 92.510452][ T4262] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.582957][ T4262] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 92.651766][ T4854] rxe_eth0 speed is unknown, defaulting to 1000 [ 92.690652][ T4262] usb 4-1: config 0 interface 0 has no altsetting 0 [ 92.697299][ T4262] usb 4-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 92.810473][ T4262] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.880342][ T4851] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 92.891606][ T4262] usb 4-1: config 0 descriptor?? [ 93.230453][ T1108] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 93.320531][ T4851] usb 1-1: unable to get BOS descriptor or descriptor too short [ 93.390568][ T4851] usb 1-1: not running at top speed; connect to a high speed hub [ 93.423046][ T4262] logitech 0003:046D:CA04.0003: unbalanced collection at end of report description [ 93.480405][ T1108] usb 3-1: Using ep0 maxpacket: 8 [ 93.491044][ T4262] logitech 0003:046D:CA04.0003: parse failed [ 93.549196][ T4262] logitech: probe of 0003:046D:CA04.0003 failed with error -22 [ 93.560551][ T4851] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.600461][ T1108] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.660401][ T1108] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 93.730943][ T4262] usb 4-1: USB disconnect, device number 3 [ 93.780917][ T4851] usb 1-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 93.803197][ T4851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.900444][ T4851] usb 1-1: Product: syz [ 93.900660][ T1108] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 93.925283][ T4851] usb 1-1: Manufacturer: syz [ 93.955708][ T1108] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.974971][ T4851] usb 1-1: SerialNumber: syz [ 94.037507][ T1108] usb 3-1: Product: syz [ 94.067690][ T1108] usb 3-1: Manufacturer: syz [ 94.095711][ T1108] usb 3-1: SerialNumber: syz [ 94.293173][ T4851] peak_usb 1-1:1.0 can0: sending cmd f=0x6 n=0x1 failure: -22 [ 94.380580][ T4314] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 95.224271][ T4851] peak_usb 1-1:1.0: unable to read PCAN-USB serial number (err -22) [ 95.390347][ T4314] usb 5-1: Using ep0 maxpacket: 8 [ 95.464287][ T4885] loop3: detected capacity change from 0 to 128 [ 95.510500][ T4314] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 95.554375][ T4314] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 95.635192][ T4314] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.679102][ T4888] attempt to access beyond end of device [ 95.679102][ T4888] loop3: rw=2049, want=513, limit=128 [ 95.686823][ T4314] usb 5-1: config 0 descriptor?? [ 95.752064][ T4314] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 95.898035][ T4892] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 95.923822][ T4892] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 96.155257][ T4851] peak_usb: probe of 1-1:1.0 failed with error -22 [ 96.203735][ T4851] usb 1-1: USB disconnect, device number 2 [ 96.244037][ T1325] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 96.254717][ T1108] usb 3-1: USB disconnect, device number 2 [ 96.372321][ T4903] udc-core: couldn't find an available UDC or it's busy [ 96.394433][ T4903] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 96.533471][ T4905] netlink: 4 bytes leftover after parsing attributes in process `syz.0.158'. [ 96.542756][ T1325] usb 4-1: Using ep0 maxpacket: 8 [ 96.606877][ T4905] bond0: (slave bond_slave_1): Releasing backup interface [ 96.691344][ T1325] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 96.699570][ T1325] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 96.710596][ T1325] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 96.741269][ T1325] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 96.755542][ T1325] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.772077][ T1325] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 96.805659][ T1325] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.130454][ T1325] usb 4-1: GET_CAPABILITIES returned 0 [ 97.817165][ T1108] usb 5-1: USB disconnect, device number 5 [ 97.847016][ T1325] usbtmc 4-1:16.0: can't read capabilities [ 97.859495][ T1325] usb 4-1: USB disconnect, device number 4 [ 98.009707][ T4926] Set syz0 is full, maxelem 0 reached [ 98.168129][ T4934] md: personality for level is not loaded! [ 98.265798][ T4938] md: md3 stopped. [ 98.328261][ T4942] netlink: 'syz.2.170': attribute type 4 has an invalid length. [ 98.361840][ T4942] netlink: 'syz.2.170': attribute type 4 has an invalid length. [ 98.430533][ T4262] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 98.460945][ T4942] syz.2.170 (4942) used greatest stack depth: 20976 bytes left [ 98.800891][ T4262] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 98.848564][ T4262] usb 1-1: config 1 has no interface number 0 [ 99.074032][ T4262] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 99.102588][ T4959] Set syz0 is full, maxelem 0 reached [ 99.132887][ T4262] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.240164][ T4262] usb 1-1: Product: syz [ 99.293313][ T4262] usb 1-1: Manufacturer: syz [ 99.353879][ T4962] loop2: detected capacity change from 0 to 128 [ 99.374184][ T4962] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 99.375480][ T4262] usb 1-1: SerialNumber: syz [ 99.635953][ T4969] rxe_eth0 speed is unknown, defaulting to 1000 [ 99.990502][ T4262] usb 1-1: 3:0 : does not exist [ 99.996606][ T4262] usb 1-1: 3:0 : does not exist [ 100.052327][ T4262] usb 1-1: USB disconnect, device number 3 [ 100.111773][ T4180] udevd[4180]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 100.245126][ T4591] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 100.475293][ T4999] netlink: 152 bytes leftover after parsing attributes in process `syz.3.189'. [ 101.356003][ T4987] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 101.608253][ T5021] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 101.689962][ T5021] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 101.718599][ T5029] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.736473][ T5031] loop2: detected capacity change from 0 to 128 [ 101.820766][ T4194] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 101.874724][ T5031] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 102.560274][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #102!!! [ 102.570287][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #102!!! [ 102.580269][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #102!!! [ 102.590261][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #102!!! [ 102.600267][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 102.610274][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 102.620266][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 102.630274][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 102.640266][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 102.670860][ T4920] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 102.860734][ T4194] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.903207][ T4194] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 102.938792][ T4194] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.002567][ T4194] usb 1-1: config 0 descriptor?? [ 103.055575][ T5048] loop3: detected capacity change from 0 to 128 [ 103.400416][ T4194] usbhid 1-1:0.0: can't add hid device: -71 [ 103.421384][ T4194] usbhid: probe of 1-1:0.0 failed with error -71 [ 103.433388][ T5055] attempt to access beyond end of device [ 103.433388][ T5055] loop3: rw=2049, want=673, limit=128 [ 103.456281][ T4194] usb 1-1: USB disconnect, device number 4 [ 103.750530][ T1108] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 103.842139][ T5064] device syzkaller0 entered promiscuous mode [ 103.940430][ T4194] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 104.133342][ T1108] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.167236][ T1108] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 104.212612][ T1108] usb 2-1: config 0 interface 0 has no altsetting 0 [ 104.240323][ T1108] usb 2-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 104.248269][ T5071] input: syz0 as /devices/virtual/input/input8 [ 104.270193][ T1108] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.312971][ T1108] usb 2-1: config 0 descriptor?? [ 104.360592][ T4194] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.360643][ T4194] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 104.360668][ T4194] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.362312][ T4194] usb 1-1: config 0 descriptor?? [ 104.550520][ T4194] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 104.648974][ T4194] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input9 [ 104.813038][ T1108] logitech 0003:046D:CA04.0004: unbalanced collection at end of report description [ 104.813463][ T1108] logitech 0003:046D:CA04.0004: parse failed [ 104.813521][ T1108] logitech: probe of 0003:046D:CA04.0004 failed with error -22 [ 104.842284][ T4194] usb 1-1: USB disconnect, device number 5 [ 104.860347][ C0] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 105.015039][ T1108] usb 2-1: USB disconnect, device number 3 [ 105.552368][ T5079] loop4: detected capacity change from 0 to 128 [ 105.607157][ T5079] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 106.485578][ T4467] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 106.725949][ T5089] rxe_eth0 speed is unknown, defaulting to 1000 [ 106.788392][ T5099] loop1: detected capacity change from 0 to 128 [ 107.462064][ T9] attempt to access beyond end of device [ 107.462064][ T9] loop1: rw=1, want=585, limit=128 [ 107.761219][ T5113] device syzkaller0 entered promiscuous mode [ 107.840477][ T21] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 107.986544][ T5118] netlink: 152 bytes leftover after parsing attributes in process `syz.1.222'. [ 108.073045][ T5121] loop4: detected capacity change from 0 to 128 [ 108.129637][ T5121] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 108.210994][ T21] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.240398][ T21] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.330889][ T21] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.351007][ T21] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 108.397331][ T21] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 108.505584][ T21] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.705352][ T21] usb 1-1: config 0 descriptor?? [ 108.962343][ T4467] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 109.042821][ T4262] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 109.150570][ T4314] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 109.242602][ T5133] tipc: Started in network mode [ 109.268433][ T5133] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 109.282088][ T5133] tipc: Enabled bearer , priority 0 [ 109.382452][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.405897][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.434769][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.465293][ T4262] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.476329][ T4314] usb 4-1: Using ep0 maxpacket: 8 [ 109.488040][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.505897][ T4262] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 109.528938][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.568246][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.591987][ T4262] usb 2-1: config 0 interface 0 has no altsetting 0 [ 109.609726][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.620579][ T4314] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 109.636046][ T4262] usb 2-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 109.649342][ T4314] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 109.660387][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.674938][ T4262] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.683360][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.690963][ T4314] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.717563][ T4262] usb 2-1: config 0 descriptor?? [ 109.723444][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.733547][ T4314] usb 4-1: config 0 descriptor?? [ 109.738812][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.747912][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.767731][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.806169][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.845288][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.878365][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.907426][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.946890][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.987238][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 109.997744][ T4314] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 110.026071][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 110.062193][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 110.103732][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 110.144960][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 110.174540][ T21] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 110.203296][ T4262] logitech 0003:046D:CA04.0006: unbalanced collection at end of report description [ 110.236034][ T4262] logitech 0003:046D:CA04.0006: parse failed [ 110.248392][ T21] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 110.272421][ T4262] logitech: probe of 0003:046D:CA04.0006 failed with error -22 [ 110.329993][ T21] plantronics 0003:047F:FFFF.0005: hiddev1,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 110.411112][ T4194] tipc: Node number set to 43690 [ 110.504935][ T21] usb 1-1: USB disconnect, device number 6 [ 110.620325][ T5147] device syzkaller0 entered promiscuous mode [ 110.666383][ T5145] fido_id[5145]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 111.249016][ T21] usb 2-1: USB disconnect, device number 4 [ 111.297497][ T5156] loop4: detected capacity change from 0 to 128 [ 111.340537][ T5156] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 111.468434][ T1325] usb 4-1: USB disconnect, device number 5 [ 112.188844][ T4264] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 112.264383][ T5173] Set syz0 is full, maxelem 0 reached [ 112.342010][ T5176] netlink: 72 bytes leftover after parsing attributes in process `syz.4.240'. [ 112.415990][ T5179] device syzkaller0 entered promiscuous mode [ 112.577902][ T5181] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 112.887559][ T5190] netlink: 'syz.4.247': attribute type 1 has an invalid length. [ 113.089493][ T5192] md: personality for level is not loaded! [ 113.223171][ T5203] md: md3 stopped. [ 113.237484][ T5201] md: md0 stopped. [ 114.349023][ T5215] device syzkaller0 entered promiscuous mode [ 114.371810][ T5212] rxe_eth0 speed is unknown, defaulting to 1000 [ 114.515715][ T5229] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 114.546487][ T5229] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 114.903916][ T5240] md: personality for level is not loaded! [ 115.088192][ T5243] md: md3 stopped. [ 115.195905][ T5251] Set syz0 is full, maxelem 0 reached [ 116.081881][ T5250] rxe_eth0 speed is unknown, defaulting to 1000 [ 116.162051][ T5260] device syzkaller0 entered promiscuous mode [ 116.763144][ T5289] md: personality for level is not loaded! [ 116.857482][ T5292] md: md1 stopped. [ 116.880347][ T4194] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 117.310858][ T4194] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.310901][ T4194] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 117.311054][ T4194] usb 1-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 117.311160][ T4194] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.976528][ T4194] idmouse 1-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 118.028372][ T5299] Set syz0 is full, maxelem 0 reached [ 118.030180][ T5301] device syzkaller0 entered promiscuous mode [ 118.239860][ T5307] rxe_eth0 speed is unknown, defaulting to 1000 [ 118.449718][ T5319] usb 1-1: USB disconnect, device number 7 [ 118.522358][ T5319] idmouse 1-1:1.0: disconnected [ 119.060461][ T4194] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 119.798141][ T26] audit: type=1326 audit(1794017048.508:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 119.919242][ T26] audit: type=1326 audit(1794017048.508:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.038576][ T26] audit: type=1326 audit(1794017048.508:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.059577][ T5337] Set syz0 is full, maxelem 0 reached [ 120.128689][ T5339] device syzkaller0 entered promiscuous mode [ 120.159926][ T26] audit: type=1326 audit(1794017048.508:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.265555][ T4194] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.286023][ T26] audit: type=1326 audit(1794017048.508:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.400344][ T26] audit: type=1326 audit(1794017048.508:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.400369][ T26] audit: type=1326 audit(1794017048.508:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.400387][ T26] audit: type=1326 audit(1794017048.508:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.400405][ T26] audit: type=1326 audit(1794017048.508:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.400422][ T26] audit: type=1326 audit(1794017048.508:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.2.287" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x7fc00000 [ 120.460573][ T4194] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 120.460607][ T4194] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 120.460629][ T4194] usb 2-1: Product: syz [ 120.460644][ T4194] usb 2-1: Manufacturer: syz [ 120.526534][ T4194] usb 2-1: selecting invalid altsetting 1 [ 120.527395][ T4194] dvb_ttusb_budget: ttusb_init_controller: error [ 120.527410][ T4194] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 120.614303][ T5354] rxe_eth0 speed is unknown, defaulting to 1000 [ 120.781376][ T4194] DVB: Unable to find symbol cx22700_attach() [ 122.067188][ T5381] netlink: 152 bytes leftover after parsing attributes in process `syz.2.306'. [ 122.097811][ T4194] DVB: Unable to find symbol tda10046_attach() [ 122.108955][ T4194] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 122.139872][ T5382] Set syz0 is full, maxelem 0 reached [ 122.159953][ T5386] device syzkaller0 entered promiscuous mode [ 122.188157][ T5383] rxe_eth0 speed is unknown, defaulting to 1000 [ 122.237194][ T4194] usb 2-1: USB disconnect, device number 5 [ 122.280909][ T5390] loop0: detected capacity change from 0 to 128 [ 122.410305][ T1325] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 122.500282][ T4177] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 122.810583][ T1325] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.830826][ T1325] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 122.850622][ T1325] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 122.859696][ T1325] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.910586][ T4177] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.931773][ T4177] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 122.946395][ T1325] idmouse 5-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 122.964531][ T4177] usb 3-1: config 0 interface 0 has no altsetting 0 [ 122.986061][ T4177] usb 3-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 123.019842][ T4177] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.075525][ T4177] usb 3-1: config 0 descriptor?? [ 123.859038][ T4177] usbhid 3-1:0.0: can't add hid device: -71 [ 123.937838][ T4177] usbhid: probe of 3-1:0.0 failed with error -71 [ 123.956656][ T4177] usb 3-1: USB disconnect, device number 3 [ 124.056458][ T5422] netlink: 144 bytes leftover after parsing attributes in process `syz.0.316'. [ 124.123941][ T5422] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 124.133566][ T5428] Set syz0 is full, maxelem 0 reached [ 124.202552][ T5431] device syzkaller0 entered promiscuous mode [ 124.815840][ T4262] usb 5-1: USB disconnect, device number 6 [ 125.206178][ T4262] idmouse 5-1:1.0: disconnected [ 125.364519][ T5455] ip_tables: iptables: counters copy to user failed while replacing table [ 125.373094][ T5439] rxe_eth0 speed is unknown, defaulting to 1000 [ 125.858278][ T5472] Set syz0 is full, maxelem 0 reached [ 126.020427][ T1325] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 126.044335][ T5475] device syzkaller0 entered promiscuous mode [ 126.440482][ T1325] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 126.465363][ T1325] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 126.500092][ T1325] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 126.553793][ T1325] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 126.613099][ T1325] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.544480][ T5487] netlink: 12 bytes leftover after parsing attributes in process `syz.1.338'. [ 127.681280][ T1325] usb 5-1: invalid MIDI out EP 0 [ 127.764552][ T5502] Set syz0 is full, maxelem 0 reached [ 128.001512][ T5511] device syzkaller0 entered promiscuous mode [ 128.194661][ T5519] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 128.296681][ T1325] snd-usb-audio: probe of 5-1:27.0 failed with error -22 [ 128.389646][ T4182] udevd[4182]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 128.431623][ T1325] usb 5-1: USB disconnect, device number 7 [ 129.518596][ T5530] rxe_eth0 speed is unknown, defaulting to 1000 [ 130.060920][ T4194] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 131.091797][ T5568] device syzkaller0 entered promiscuous mode [ 131.190430][ T4194] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 131.228557][ T4194] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 131.500563][ T4194] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 131.530144][ T4194] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.590288][ T4194] usb 2-1: Product: syz [ 131.646600][ T4194] usb 2-1: Manufacturer: syz [ 131.697339][ T4194] usb 2-1: SerialNumber: syz [ 132.615977][ T4194] usb 2-1: config 0 descriptor?? [ 132.695736][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.702335][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.750363][ T4194] usb 2-1: can't set config #0, error -71 [ 132.810389][ T4194] usb 2-1: USB disconnect, device number 6 [ 134.085571][ T5608] Device name cannot be null; rc = [-22] [ 134.123391][ T5610] device syzkaller0 entered promiscuous mode [ 134.820320][ T5399] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 135.100387][ T5399] usb 3-1: Using ep0 maxpacket: 8 [ 135.911727][ T5399] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 136.898662][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 136.947075][ T5399] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 137.095990][ T5399] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 137.177120][ T5399] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 137.315855][ T5655] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 137.492703][ T5399] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 137.877628][ T5399] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.905578][ T5667] device syzkaller0 entered promiscuous mode [ 137.982110][ T5666] tipc: Enabled bearer , priority 0 [ 138.020423][ T5399] usb 3-1: can't set config #16, error -71 [ 138.054554][ T5670] tipc: Resetting bearer [ 138.077839][ T5399] usb 3-1: USB disconnect, device number 4 [ 138.099996][ T5672] loop0: detected capacity change from 0 to 128 [ 138.198850][ T5669] device syzkaller0 entered promiscuous mode [ 138.216567][ T5669] IPv6: ADDRCONF(NETDEV_CHANGE): syzkaller0: link becomes ready [ 138.396811][ T5672] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 138.469423][ T5665] tipc: Resetting bearer [ 138.522967][ T5665] tipc: Disabling bearer [ 140.777408][ T5709] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 141.317596][ T5723] netlink: 152 bytes leftover after parsing attributes in process `syz.4.408'. [ 141.378284][ T5721] rxe_eth0 speed is unknown, defaulting to 1000 [ 141.840331][ T4194] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 141.985994][ T5728] device wlan0 entered promiscuous mode [ 142.220598][ T4194] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.208644][ T5728] syz.3.410 (5728) used greatest stack depth: 20208 bytes left [ 143.221394][ T4194] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 143.348498][ T4194] usb 5-1: config 0 interface 0 has no altsetting 0 [ 143.399313][ T4194] usb 5-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 143.485627][ T4194] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.586240][ T4194] usb 5-1: config 0 descriptor?? [ 144.758733][ T5761] netlink: 24 bytes leftover after parsing attributes in process `syz.3.415'. [ 145.460951][ T5779] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 145.900478][ T4194] usbhid 5-1:0.0: can't add hid device: -71 [ 145.907164][ T4194] usbhid: probe of 5-1:0.0 failed with error -71 [ 146.000177][ T4194] usb 5-1: USB disconnect, device number 8 [ 148.794530][ T5830] netlink: 152 bytes leftover after parsing attributes in process `syz.2.435'. [ 149.150457][ T5399] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 149.510475][ T5399] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 149.510510][ T5399] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 149.510525][ T5399] usb 3-1: config 0 interface 0 has no altsetting 0 [ 149.510545][ T5399] usb 3-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 149.510564][ T5399] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.512728][ T5399] usb 3-1: config 0 descriptor?? [ 149.992820][ T5399] logitech 0003:046D:CA04.0007: unbalanced collection at end of report description [ 149.993082][ T5399] logitech 0003:046D:CA04.0007: parse failed [ 149.993113][ T5399] logitech: probe of 0003:046D:CA04.0007 failed with error -22 [ 150.205853][ T5403] usb 3-1: USB disconnect, device number 5 [ 150.739580][ T5849] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 152.940551][ T5892] netlink: 152 bytes leftover after parsing attributes in process `syz.4.453'. [ 153.007608][ T5891] tipc: Started in network mode [ 153.079115][ T5897] process 'syz.2.452' launched '/dev/fd/5' with NULL argv: empty string added [ 153.172690][ T5891] tipc: Node identity 1001001, cluster identity 4711 [ 153.224894][ T5891] tipc: Node number set to 16781313 [ 153.310844][ T4251] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 153.541662][ T5886] tipc: Enabled bearer , priority 0 [ 153.710473][ T4251] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 153.772439][ T4251] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 153.860320][ T4251] usb 5-1: config 0 interface 0 has no altsetting 0 [ 153.913614][ T4251] usb 5-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 154.771519][ T4251] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.782167][ T4251] usb 5-1: config 0 descriptor?? [ 155.032297][ T5916] netlink: 128 bytes leftover after parsing attributes in process `syz.3.459'. [ 155.272137][ T4251] logitech 0003:046D:CA04.0008: unbalanced collection at end of report description [ 155.272543][ T4251] logitech 0003:046D:CA04.0008: parse failed [ 155.272603][ T4251] logitech: probe of 0003:046D:CA04.0008 failed with error -22 [ 155.509895][ T5403] usb 5-1: USB disconnect, device number 9 [ 156.822177][ T5945] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 158.818474][ T5951] rxe_eth0 speed is unknown, defaulting to 1000 [ 159.638752][ T5970] ip_tables: iptables: counters copy to user failed while replacing table [ 159.728440][ T5951] chnl_net:caif_netlink_parms(): no params data found [ 160.133421][ T5951] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.176754][ T5951] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.256224][ T5951] device bridge_slave_0 entered promiscuous mode [ 160.422950][ T6002] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 161.972367][ T4262] Bluetooth: hci5: command 0x0409 tx timeout [ 162.200314][ T5951] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.342339][ T5951] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.343467][ T5951] device bridge_slave_1 entered promiscuous mode [ 162.504001][ T5951] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 162.506164][ T5951] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 162.638541][ T5951] team0: Port device team_slave_0 added [ 162.668413][ T5951] team0: Port device team_slave_1 added [ 162.746480][ T5951] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 162.746498][ T5951] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 162.746522][ T5951] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 162.766746][ T5951] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 162.766759][ T5951] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 162.766774][ T5951] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 162.920641][ T5951] device hsr_slave_0 entered promiscuous mode [ 162.925948][ T5951] device hsr_slave_1 entered promiscuous mode [ 162.926506][ T5951] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 162.926587][ T5951] Cannot create hsr debugfs directory [ 163.433614][ T6026] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 164.057859][ T5951] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 164.066096][ T4314] Bluetooth: hci5: command 0x041b tx timeout [ 164.277320][ T6057] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 165.924472][ T5951] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 165.951911][ T5951] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 166.019963][ T5951] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 166.130390][ T21] Bluetooth: hci5: command 0x040f tx timeout [ 166.213482][ T4542] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.351193][ T5951] 8021q: adding VLAN 0 to HW filter on device bond0 [ 166.424644][ T4542] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.521809][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 166.543196][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 166.880411][ T5951] 8021q: adding VLAN 0 to HW filter on device team0 [ 166.954203][ T4542] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.975684][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 167.014850][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 167.015458][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.015537][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.108257][ T4542] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.114945][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 167.115660][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 167.116278][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 167.116719][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.116753][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 167.117131][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 167.117953][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 167.135112][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 167.136194][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 167.137534][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 167.138681][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 167.139061][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 167.139410][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 167.141466][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 167.144980][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 167.145374][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 167.185642][ T5951] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 167.610578][ T5399] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 167.716918][ T5951] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 167.717301][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 167.717393][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 167.850388][ T5399] usb 4-1: Using ep0 maxpacket: 8 [ 167.936828][ T6124] md: md2 stopped. [ 167.970764][ T5399] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 168.221352][ T4177] Bluetooth: hci5: command 0x0419 tx timeout [ 168.625349][ T6147] netlink: 'syz.4.525': attribute type 3 has an invalid length. [ 168.700671][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 168.735410][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 168.812003][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 168.828152][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 168.850364][ T5399] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 168.875001][ T5951] device veth0_vlan entered promiscuous mode [ 168.893587][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 168.912248][ T5399] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.939683][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 168.999570][ T5399] usb 4-1: config 0 descriptor?? [ 169.062698][ T5951] device veth1_vlan entered promiscuous mode [ 169.082927][ T5399] iowarrior 4-1:0.0: no interrupt-in endpoint found [ 169.100863][ T6156] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 169.182119][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 169.215338][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 169.443447][ T5951] device veth0_macvtap entered promiscuous mode [ 169.531625][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 169.557850][ T6174] md: md4 stopped. [ 169.580099][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 169.584302][ T5951] device veth1_macvtap entered promiscuous mode [ 169.590710][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 169.591411][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 169.691393][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.691414][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.691425][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.691437][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.691446][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.691458][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.691467][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.691479][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.691491][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.691513][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.692629][ T5951] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 170.092624][ T6183] udc-core: couldn't find an available UDC or it's busy [ 170.092638][ T6183] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 170.514824][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 170.565016][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 170.627187][ T6178] netlink: 152 bytes leftover after parsing attributes in process `syz.4.534'. [ 170.663484][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.705344][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.775197][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.810292][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.858866][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.894920][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.957928][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.993341][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.067472][ T5951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.130381][ T5951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.144979][ T4194] usb 4-1: USB disconnect, device number 6 [ 171.215985][ T5951] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.335842][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 171.384527][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 171.536625][ T5951] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.583010][ T5951] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.636262][ T5951] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.699485][ T5951] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.297395][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.326611][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.420304][ T4542] IPVS: stopping master sync thread 4386 ... [ 172.470343][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 172.590532][ T145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.665733][ T145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.828483][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 173.443951][ T6245] netlink: 152 bytes leftover after parsing attributes in process `syz.5.548'. [ 174.080925][ T4542] device hsr_slave_0 left promiscuous mode [ 174.181421][ T4542] device hsr_slave_1 left promiscuous mode [ 174.195666][ T4542] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 174.300507][ T4542] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 174.353249][ T4542] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 174.378170][ T4542] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 174.417081][ T4542] device bridge_slave_1 left promiscuous mode [ 174.479390][ T4542] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.596973][ T4542] device bridge_slave_0 left promiscuous mode [ 174.621563][ T4542] bridge0: port 1(bridge_slave_0) entered disabled state [ 174.753135][ T4542] device veth1_macvtap left promiscuous mode [ 174.778678][ T4542] device veth0_macvtap left promiscuous mode [ 174.834752][ T4542] device veth1_vlan left promiscuous mode [ 174.897407][ T4542] device veth0_vlan left promiscuous mode [ 175.808934][ T6335] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 175.863775][ T6335] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 176.871226][ T4542] team0 (unregistering): Port device team_slave_1 removed [ 176.926806][ T4542] team0 (unregistering): Port device team_slave_0 removed [ 176.998973][ T4542] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 177.850135][ T4542] bond0 (unregistering): Released all slaves [ 178.026511][ T6276] device syzkaller0 entered promiscuous mode [ 178.032249][ T6321] netlink: 152 bytes leftover after parsing attributes in process `syz.1.568'. [ 180.211021][ T6380] netlink: 72 bytes leftover after parsing attributes in process `syz.5.582'. [ 180.388202][ T6387] Set syz0 is full, maxelem 0 reached [ 180.405065][ T6384] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 181.456180][ T6414] netlink: 152 bytes leftover after parsing attributes in process `syz.5.590'. [ 182.080007][ T6439] Set syz0 is full, maxelem 0 reached [ 182.170410][ T13] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 182.540440][ T13] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 182.540477][ T13] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 182.540506][ T13] usb 6-1: config 0 interface 0 has no altsetting 0 [ 182.540538][ T13] usb 6-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 182.540563][ T13] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.542340][ T13] usb 6-1: config 0 descriptor?? [ 183.052213][ T13] logitech 0003:046D:CA04.0009: unbalanced collection at end of report description [ 183.052650][ T13] logitech 0003:046D:CA04.0009: parse failed [ 183.052761][ T13] logitech: probe of 0003:046D:CA04.0009 failed with error -22 [ 183.258405][ T13] usb 6-1: USB disconnect, device number 2 [ 183.494908][ T6491] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 183.494939][ T6491] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 183.566928][ T6492] device syzkaller0 entered promiscuous mode [ 183.861417][ T6494] Set syz0 is full, maxelem 0 reached [ 184.451607][ T6522] device syzkaller0 entered promiscuous mode [ 184.548218][ T6529] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 184.604800][ T6529] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 184.735611][ T6530] rxe_eth0 speed is unknown, defaulting to 1000 [ 184.777985][ T6537] Set syz0 is full, maxelem 0 reached [ 184.908979][ T6543] netlink: 152 bytes leftover after parsing attributes in process `syz.5.624'. [ 185.300325][ T13] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 185.721145][ T13] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 185.823671][ T13] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 185.948379][ T13] usb 6-1: config 0 interface 0 has no altsetting 0 [ 185.970449][ T4177] Bluetooth: hci3: command 0x0406 tx timeout [ 185.976647][ T4177] Bluetooth: hci1: command 0x0406 tx timeout [ 186.030475][ T13] usb 6-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 186.096013][ T4177] Bluetooth: hci2: command 0x0406 tx timeout [ 186.152839][ T13] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.264400][ T5399] Bluetooth: hci4: command 0x0406 tx timeout [ 186.279696][ T13] usb 6-1: config 0 descriptor?? [ 186.527827][ T6577] device syzkaller0 entered promiscuous mode [ 186.700658][ T6581] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 186.811591][ T13] logitech 0003:046D:CA04.000A: unbalanced collection at end of report description [ 186.957911][ T6581] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 186.970909][ T13] logitech 0003:046D:CA04.000A: parse failed [ 187.010402][ T13] logitech: probe of 0003:046D:CA04.000A failed with error -22 [ 187.156217][ T5401] usb 6-1: USB disconnect, device number 3 [ 187.275337][ T6585] Set syz0 is full, maxelem 0 reached [ 188.180594][ T6623] Set syz0 is full, maxelem 0 reached [ 188.320516][ T6630] device syzkaller0 entered promiscuous mode [ 188.344172][ T6633] netlink: 'syz.3.651': attribute type 2 has an invalid length. [ 188.451935][ T6633] netlink: 'syz.3.651': attribute type 2 has an invalid length. [ 188.489830][ T6635] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 188.547983][ T6613] md/raid1:md1: active with 1 out of 2 mirrors [ 188.568169][ T6635] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 188.647510][ T6633] netlink: 'syz.3.651': attribute type 1 has an invalid length. [ 188.757665][ T6633] netlink: 100 bytes leftover after parsing attributes in process `syz.3.651'. [ 188.826250][ T6622] md: md1 stopped. [ 189.124090][ T6651] netlink: 152 bytes leftover after parsing attributes in process `syz.1.656'. [ 189.500397][ T4194] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 189.910485][ T4194] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 189.982476][ T4194] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 190.165228][ T6685] Set syz0 is full, maxelem 0 reached [ 190.223061][ T4194] usb 2-1: config 0 interface 0 has no altsetting 0 [ 190.274999][ T4194] usb 2-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 190.324774][ T4194] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.390937][ T4194] usb 2-1: config 0 descriptor?? [ 190.642174][ T6690] device syzkaller0 entered promiscuous mode [ 190.882375][ T4194] logitech 0003:046D:CA04.000B: unbalanced collection at end of report description [ 190.950764][ T4194] logitech 0003:046D:CA04.000B: parse failed [ 190.981610][ T4194] logitech: probe of 0003:046D:CA04.000B failed with error -22 [ 191.091667][ T4194] usb 2-1: USB disconnect, device number 7 [ 191.104751][ T6696] md: pers->run() failed ... [ 191.338199][ T6697] md: md5 stopped. [ 191.621215][ T6701] input: syz0 as /devices/virtual/input/input10 [ 192.007021][ T6726] Set syz0 is full, maxelem 0 reached [ 192.366668][ T6742] device syzkaller0 entered promiscuous mode [ 192.951592][ T6767] ip_tables: iptables: counters copy to user failed while replacing table [ 193.117849][ T6775] Set syz0 is full, maxelem 0 reached [ 193.159207][ T6761] md: pers->run() failed ... [ 193.314886][ T6768] md: md1 stopped. [ 193.563475][ T6788] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 193.616520][ T6788] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 193.779857][ T6800] device syzkaller0 entered promiscuous mode [ 194.135179][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.143820][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.349285][ T6822] Set syz0 is full, maxelem 0 reached [ 194.621261][ T6828] md: md2 stopped. [ 195.036741][ T6845] device syzkaller0 entered promiscuous mode [ 195.863323][ T6871] Set syz0 is full, maxelem 0 reached [ 195.927747][ T6869] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 196.010458][ T6869] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 196.032762][ T6878] ip_tables: iptables: counters copy to user failed while replacing table [ 196.419766][ T6880] md: pers->run() failed ... [ 196.662952][ T6888] md: md3 stopped. [ 197.252124][ T6916] device syzkaller0 entered promiscuous mode [ 197.684449][ T6932] Set syz0 is full, maxelem 0 reached [ 197.867874][ T6939] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 197.867890][ T6939] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 199.329778][ T6991] Set syz0 is full, maxelem 0 reached [ 200.053322][ T7011] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 200.053339][ T7011] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 202.193714][ T7077] tipc: Started in network mode [ 202.194890][ T7077] tipc: Node identity fe5616a7b3d6, cluster identity 4711 [ 202.195018][ T7077] tipc: Enabled bearer , priority 0 [ 202.197708][ T7071] device syzkaller0 entered promiscuous mode [ 202.212065][ T7071] tipc: Resetting bearer [ 202.266988][ T7069] tipc: Resetting bearer [ 202.270507][ T4314] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 202.284386][ T7069] tipc: Disabling bearer [ 202.603125][ T7087] device syzkaller0 entered promiscuous mode [ 202.632600][ T4314] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 202.632619][ T4314] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 202.632640][ T4314] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 202.632654][ T4314] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.673859][ T4314] idmouse 5-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 203.402592][ T7110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.765'. [ 203.502588][ T7110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.765'. [ 203.762604][ T7118] netlink: 'syz.5.769': attribute type 17 has an invalid length. [ 203.833859][ T7118] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 203.916573][ T7118] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 204.036412][ T7118] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 204.560519][ T13] usb 5-1: USB disconnect, device number 10 [ 204.625706][ T13] idmouse 5-1:1.0: disconnected [ 206.663661][ T7187] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 206.725343][ T7187] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 206.870378][ T1108] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 207.240635][ T1108] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 207.380575][ T1108] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 207.491515][ T1108] usb 3-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 207.491555][ T1108] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.292244][ T1108] idmouse 3-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 209.581829][ T5401] usb 3-1: USB disconnect, device number 6 [ 209.607205][ T5401] idmouse 3-1:1.0: disconnected [ 210.196404][ T7238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.797'. [ 210.660369][ T5401] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 211.100510][ T5401] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 211.180251][ T5401] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 211.190045][ T5401] usb 6-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 211.390536][ T5401] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.453494][ T5401] idmouse 6-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 214.345449][ T4857] usb 6-1: USB disconnect, device number 4 [ 214.425281][ T4857] idmouse 6-1:1.0: disconnected [ 214.616685][ T7311] fuse: Bad value for 'fd' [ 214.887695][ T7321] netlink: 124 bytes leftover after parsing attributes in process `syz.4.821'. [ 218.547211][ T7408] netlink: set zone limit has 8 unknown bytes [ 219.792045][ T7449] tun0: tun_chr_ioctl cmd 2147767521 [ 220.322663][ T7457] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 223.884587][ T7528] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 225.902943][ T7535] Set syz0 is full, maxelem 0 reached [ 226.005141][ T7540] netlink: 'syz.2.882': attribute type 21 has an invalid length. [ 226.058606][ T7540] netlink: 176 bytes leftover after parsing attributes in process `syz.2.882'. [ 226.113978][ T7543] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 226.633169][ T7569] Set syz0 is full, maxelem 0 reached [ 227.234082][ T7597] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 229.164842][ T7607] netlink: 64 bytes leftover after parsing attributes in process `syz.3.903'. [ 229.257146][ T7613] fuse: Bad value for 'fd' [ 229.266868][ T7614] Set syz0 is full, maxelem 0 reached [ 231.435780][ T7738] fuse: Bad value for 'fd' [ 232.943925][ T7789] fuse: Bad value for 'fd' [ 234.485178][ T7833] ip_tables: iptables: counters copy to user failed while replacing table [ 234.682996][ T7847] Set syz0 is full, maxelem 0 reached [ 235.227450][ T7869] ip_tables: iptables: counters copy to user failed while replacing table [ 235.473429][ T7888] Set syz0 is full, maxelem 0 reached [ 235.720635][ T7902] netlink: 144 bytes leftover after parsing attributes in process `syz.3.988'. [ 236.148492][ T7921] Set syz0 is full, maxelem 0 reached [ 236.773435][ T7941] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1003'. [ 236.836286][ T7943] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1005'. [ 236.939073][ T7953] Set syz0 is full, maxelem 0 reached [ 237.520501][ T7989] Set syz0 is full, maxelem 0 reached [ 237.980706][ T8017] sctp: [Deprecated]: syz.5.1030 (pid 8017) Use of int in max_burst socket option deprecated. [ 237.980706][ T8017] Use struct sctp_assoc_value instead [ 238.090784][ T8025] Set syz0 is full, maxelem 0 reached [ 238.323209][ T8038] Device name cannot be null; rc = [-22] [ 238.502916][ T8035] fuse: root generation should be zero [ 238.634580][ T5403] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 238.807780][ T8058] Set syz0 is full, maxelem 0 reached [ 239.006179][ T5403] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 239.026704][ T5403] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 239.042744][ T5403] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 239.053269][ T5403] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.117850][ T5403] idmouse 5-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 239.204221][ T8084] Device name cannot be null; rc = [-22] [ 239.616965][ T8105] Set syz0 is full, maxelem 0 reached [ 240.335479][ T8139] Device name cannot be null; rc = [-22] [ 240.511731][ T8146] Set syz0 is full, maxelem 0 reached [ 240.985206][ T8175] Device name cannot be null; rc = [-22] [ 241.124825][ T8183] netlink: 164 bytes leftover after parsing attributes in process `syz.2.1078'. [ 241.137069][ T23] usb 5-1: USB disconnect, device number 11 [ 241.152196][ T23] idmouse 5-1:1.0: disconnected [ 241.191216][ T8185] Set syz0 is full, maxelem 0 reached [ 241.721305][ T8217] Set syz0 is full, maxelem 0 reached [ 241.751976][ T8214] Device name cannot be null; rc = [-22] [ 242.133304][ T8244] Set syz0 is full, maxelem 0 reached [ 242.244475][ T8252] Device name cannot be null; rc = [-22] [ 242.350286][ T4857] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 242.434632][ T8268] netlink: 'syz.5.1110': attribute type 29 has an invalid length. [ 242.443618][ T8268] netlink: 'syz.5.1110': attribute type 29 has an invalid length. [ 242.454016][ T8268] netlink: 'syz.5.1110': attribute type 29 has an invalid length. [ 242.508094][ T8274] Set syz0 is full, maxelem 0 reached [ 242.545352][ T8276] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1115'. [ 242.556988][ T8272] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 242.570400][ T8272] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 242.710563][ T4857] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 242.720932][ T4857] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 242.731659][ T4857] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 242.741727][ T4857] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 242.792971][ T4857] idmouse 5-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 243.559616][ T8306] netlink: 'syz.2.1123': attribute type 32 has an invalid length. [ 243.569550][ T8307] Device name cannot be null; rc = [-22] [ 243.659304][ T8315] Set syz0 is full, maxelem 0 reached [ 243.941196][ T8342] netlink: 188 bytes leftover after parsing attributes in process `syz.5.1136'. [ 244.020798][ T8349] Set syz0 is full, maxelem 0 reached [ 244.206844][ T8355] Device name cannot be null; rc = [-22] [ 244.804653][ T5403] usb 5-1: USB disconnect, device number 12 [ 244.833815][ T5403] idmouse 5-1:1.0: disconnected [ 245.145404][ T8390] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1157'. [ 245.204294][ T8396] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1159'. [ 245.227533][ T8396] netlink: 'syz.1.1159': attribute type 1 has an invalid length. [ 245.246775][ T8403] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1162'. [ 245.261850][ T8396] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1159'. [ 245.301758][ T8406] Device name cannot be null; rc = [-22] [ 245.920379][ T5403] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 246.301500][ T8450] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1179'. [ 246.345728][ T5403] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 246.345759][ T5403] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 246.345797][ T5403] usb 4-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 246.345823][ T5403] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.416587][ T5403] idmouse 4-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 246.716843][ T8478] netlink: 140 bytes leftover after parsing attributes in process `syz.5.1188'. [ 246.790126][ T8484] netlink: 'syz.2.1190': attribute type 29 has an invalid length. [ 246.800680][ T8484] netlink: 'syz.2.1190': attribute type 29 has an invalid length. [ 246.809659][ T8484] netlink: 'syz.2.1190': attribute type 29 has an invalid length. [ 247.409479][ T8521] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1204'. [ 247.420616][ T8521] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1204'. [ 247.734404][ T8536] netlink: 'syz.4.1209': attribute type 1 has an invalid length. [ 247.748031][ T8536] netlink: 'syz.4.1209': attribute type 4 has an invalid length. [ 247.756932][ T8536] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.1209'. [ 248.113734][ T8563] netlink: 124 bytes leftover after parsing attributes in process `syz.2.1221'. [ 248.266032][ T8576] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 248.348386][ T8582] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1229'. [ 248.362999][ T8582] netlink: 312 bytes leftover after parsing attributes in process `syz.2.1229'. [ 248.378267][ T8582] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1229'. [ 248.415051][ T1108] usb 4-1: USB disconnect, device number 7 [ 248.433149][ T1108] idmouse 4-1:1.0: disconnected [ 249.121233][ T8632] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1251'. [ 249.150013][ T8634] netlink: 'syz.4.1252': attribute type 1 has an invalid length. [ 249.414111][ T8662] netlink: 'syz.3.1264': attribute type 19 has an invalid length. [ 249.426131][ T8662] netlink: 'syz.3.1264': attribute type 28 has an invalid length. [ 249.640347][ T4857] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 250.020542][ T4857] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 250.051358][ T4857] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 250.075746][ T8720] netlink: 'syz.2.1288': attribute type 29 has an invalid length. [ 250.094616][ T4857] usb 6-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 250.101925][ T8720] netlink: 'syz.2.1288': attribute type 29 has an invalid length. [ 250.125337][ T4857] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.136090][ T8720] netlink: 'syz.2.1288': attribute type 29 has an invalid length. [ 250.171782][ T8720] netlink: 'syz.2.1288': attribute type 29 has an invalid length. [ 250.197823][ T4857] idmouse 6-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 252.256547][ T4194] usb 6-1: USB disconnect, device number 5 [ 252.277003][ T4194] idmouse 6-1:1.0: disconnected [ 252.293294][ T8740] __nla_validate_parse: 3 callbacks suppressed [ 252.293315][ T8740] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1297'. [ 252.371762][ T8748] tmpfs: Unknown parameter 'seclabel' [ 252.414494][ T8754] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1303'. [ 252.497921][ T8761] tap0: tun_chr_ioctl cmd 1074025677 [ 252.506149][ T8761] tap0: linktype set to 776 [ 252.843939][ T8804] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1324'. [ 253.012867][ T8822] netlink: 'syz.5.1331': attribute type 10 has an invalid length. [ 253.021171][ T8822] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1331'. [ 253.039127][ T8822] device dummy0 entered promiscuous mode [ 253.085343][ T8822] IPv6: ADDRCONF(NETDEV_CHANGE): dummy0: link becomes ready [ 253.122049][ T8822] bridge0: port 3(dummy0) entered blocking state [ 253.140601][ T8822] bridge0: port 3(dummy0) entered disabled state [ 253.156784][ T8822] bridge0: port 3(dummy0) entered blocking state [ 253.163789][ T8822] bridge0: port 3(dummy0) entered forwarding state [ 253.189089][ T8822] IPv6: ADDRCONF(NETDEV_CHANGE): dummy0: link becomes ready [ 253.321755][ T8845] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1335'. [ 253.344302][ T8845] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1335'. [ 253.395913][ T8833] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1335'. [ 253.433048][ T8839] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1335'. [ 253.607995][ T8873] raw_sendmsg: syz.5.1352 forgot to set AF_INET. Fix it! [ 253.839591][ T8894] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.1360'. [ 253.854952][ T8889] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.1360'. [ 253.964506][ T8910] netlink: 'syz.3.1369': attribute type 8 has an invalid length. [ 254.147489][ T8929] netlink: 'syz.5.1377': attribute type 10 has an invalid length. [ 254.304940][ T8929] bridge0: port 3(dummy0) entered disabled state [ 254.341118][ T8929] device dummy0 left promiscuous mode [ 254.348644][ T8929] bridge0: port 3(dummy0) entered disabled state [ 254.362398][ T8929] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 254.645953][ T8958] netlink: 'syz.2.1390': attribute type 10 has an invalid length. [ 254.741847][ T8959] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 254.749295][ T8959] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 254.867305][ T8983] hsr0: VLAN not yet supported [ 254.876144][ T8984] netlink: 'syz.4.1398': attribute type 10 has an invalid length. [ 254.923256][ T8984] device syz_tun entered promiscuous mode [ 255.234923][ T9009] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.444420][ T9031] netlink: 'syz.2.1420': attribute type 46 has an invalid length. [ 255.573892][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.580354][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.995217][ T9079] netlink: 'syz.2.1441': attribute type 27 has an invalid length. [ 256.024342][ T9081] netlink: 'syz.2.1442': attribute type 21 has an invalid length. [ 256.115272][ T9088] netlink: 'syz.2.1445': attribute type 27 has an invalid length. [ 256.123701][ T9088] netlink: 'syz.2.1445': attribute type 25 has an invalid length. [ 256.712348][ T9120] Dead loop on virtual device ip6_vti0, fix it urgently! [ 256.719865][ T9116] Device name cannot be null; rc = [-22] [ 257.057396][ T9137] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.071134][ T9137] team0: Port device batadv0 added [ 257.317896][ T9143] fuse: Unknown parameter '0x0000000000000003' [ 257.421906][ T9146] loop1: detected capacity change from 0 to 256 [ 257.476914][ T9146] FAT-fs (loop1): Unrecognized mount option "shortname=Nžréd" or missing value [ 257.754860][ T9150] Device name cannot be null; rc = [-22] [ 258.342858][ T9167] validate_nla: 6 callbacks suppressed [ 258.342874][ T9167] netlink: 'syz.1.1475': attribute type 10 has an invalid length. [ 258.358331][ T9167] __nla_validate_parse: 12 callbacks suppressed [ 258.358349][ T9167] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1475'. [ 258.407638][ T9167] team0: Port device dummy0 removed [ 258.413566][ T9167] bridge0: port 3(dummy0) entered blocking state [ 258.420124][ T9167] bridge0: port 3(dummy0) entered disabled state [ 258.431674][ T9167] device dummy0 entered promiscuous mode [ 258.578636][ T9182] 9pnet: Unknown protocol version 9p2000.â [ 258.593062][ T9182] vivid-001: ================= START STATUS ================= [ 258.609574][ T9184] Device name cannot be null; rc = [-22] [ 258.616898][ T9182] vivid-001: Enable Output Cropping: true [ 258.665492][ T9182] vivid-001: Enable Output Composing: true [ 258.744135][ T9182] vivid-001: Enable Output Scaler: true [ 258.877971][ T9182] vivid-001: Tx RGB Quantization Range: Automatic [ 259.027895][ T9182] vivid-001: Transmit Mode: HDMI [ 259.134665][ T9182] vivid-001: Display Present: true inactive [ 259.254440][ T9182] vivid-001: Hotplug Present: 0x00000001 [ 259.312523][ T9182] vivid-001: RxSense Present: 0x00000001 [ 259.318264][ T9182] vivid-001: EDID Present: 0x00000001 [ 259.323795][ T9182] vivid-001: ================== END STATUS ================== [ 259.474873][ T9194] netlink: 209852 bytes leftover after parsing attributes in process `syz.5.1484'. [ 259.498067][ T9198] FAULT_INJECTION: forcing a failure. [ 259.498067][ T9198] name failslab, interval 1, probability 0, space 0, times 1 [ 259.559205][ T9198] CPU: 0 PID: 9198 Comm: syz.4.1485 Not tainted syzkaller #0 [ 259.566624][ T9198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 259.576723][ T9198] Call Trace: [ 259.580012][ T9198] [ 259.582962][ T9198] dump_stack_lvl+0x188/0x250 [ 259.587721][ T9198] ? show_regs_print_info+0x20/0x20 [ 259.592921][ T9198] ? load_image+0x410/0x410 [ 259.597422][ T9198] ? __might_sleep+0xf0/0xf0 [ 259.602049][ T9198] ? __lock_acquire+0x7d40/0x7d40 [ 259.607097][ T9198] should_fail+0x383/0x4b0 [ 259.611546][ T9198] should_failslab+0x5/0x20 [ 259.616072][ T9198] slab_pre_alloc_hook+0x51/0xc0 [ 259.621003][ T9198] ? __kernfs_new_node+0xe3/0x6b0 [ 259.626062][ T9198] kmem_cache_alloc+0x3d/0x280 [ 259.630824][ T9198] __kernfs_new_node+0xe3/0x6b0 [ 259.635672][ T9198] ? __lock_acquire+0x7d40/0x7d40 [ 259.640699][ T9198] ? kernfs_new_node+0x250/0x250 [ 259.645643][ T9198] ? kernfs_activate+0x1eb/0x210 [ 259.650577][ T9198] kernfs_new_node+0x148/0x250 [ 259.655340][ T9198] __kernfs_create_file+0x47/0x2e0 [ 259.660530][ T9198] sysfs_add_file_mode_ns+0x2d2/0x390 [ 259.665912][ T9198] internal_create_group+0x492/0xd00 [ 259.671200][ T9198] ? sysfs_create_group+0x20/0x20 [ 259.676219][ T9198] ? kernfs_add_one+0x564/0x6c0 [ 259.681069][ T9198] sysfs_create_groups+0x55/0x120 [ 259.686090][ T9198] device_add_attrs+0x12f/0x690 [ 259.690977][ T9198] device_add+0x677/0x1050 [ 259.695389][ T9198] netdev_register_kobject+0x184/0x320 [ 259.700885][ T9198] register_netdevice+0x10e8/0x1720 [ 259.706107][ T9198] ? netif_stacked_transfer_operstate+0x200/0x200 [ 259.712522][ T9198] ? local_bh_enable+0x20/0x20 [ 259.717511][ T9198] wg_newlink+0x4b6/0x750 [ 259.721977][ T9198] ? wg_setup+0x380/0x380 [ 259.726312][ T9198] rtnl_newlink+0x139e/0x1920 [ 259.730994][ T9198] ? __skb_flow_dissect+0x5a0d/0x61d0 [ 259.736378][ T9198] ? rtnl_setlink+0x500/0x500 [ 259.741045][ T9198] ? mark_lock+0x94/0x320 [ 259.745371][ T9198] ? __lock_acquire+0x13b3/0x7d40 [ 259.750727][ T9198] ? rtnetlink_rcv_msg+0x79f/0xf10 [ 259.755858][ T9198] ? rtnl_setlink+0x500/0x500 [ 259.760525][ T9198] rtnetlink_rcv_msg+0x7f1/0xf10 [ 259.765462][ T9198] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 259.771438][ T9198] ? rtnetlink_bind+0x80/0x80 [ 259.776108][ T9198] ? __local_bh_enable_ip+0x136/0x1c0 [ 259.781480][ T9198] ? lockdep_hardirqs_on+0x94/0x140 [ 259.786679][ T9198] ? __local_bh_enable_ip+0x136/0x1c0 [ 259.792050][ T9198] ? _local_bh_enable+0xa0/0xa0 [ 259.796916][ T9198] ? __dev_queue_xmit+0x1b64/0x2e50 [ 259.802123][ T9198] ? dev_queue_xmit+0x20/0x20 [ 259.806793][ T9198] ? __copy_skb_header+0x3ba/0x4f0 [ 259.811908][ T9198] ? memcpy+0x3c/0x60 [ 259.815911][ T9198] ? __copy_skb_header+0x3ba/0x4f0 [ 259.821016][ T9198] ? __skb_clone+0x446/0x6c0 [ 259.825613][ T9198] netlink_rcv_skb+0x1e9/0x430 [ 259.830398][ T9198] ? rtnetlink_bind+0x80/0x80 [ 259.835080][ T9198] ? netlink_ack+0xb10/0xb10 [ 259.839673][ T9198] netlink_unicast+0x804/0x9e0 [ 259.844442][ T9198] netlink_sendmsg+0x8ba/0xbe0 [ 259.849226][ T9198] ? netlink_getsockopt+0x570/0x570 [ 259.854418][ T9198] ? aa_sock_msg_perm+0x94/0x150 [ 259.859375][ T9198] ? apparmor_socket_sendmsg+0x88/0x230 [ 259.864914][ T9198] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 259.870225][ T9198] ? security_socket_sendmsg+0x7c/0xa0 [ 259.875682][ T9198] ? netlink_getsockopt+0x570/0x570 [ 259.880885][ T9198] ____sys_sendmsg+0x5be/0x8f0 [ 259.885649][ T9198] ? __sys_sendmsg_sock+0x30/0x30 [ 259.890675][ T9198] ? import_iovec+0x6f/0xa0 [ 259.895175][ T9198] ___sys_sendmsg+0x236/0x2e0 [ 259.899855][ T9198] ? __sys_sendmsg+0x290/0x290 [ 259.904643][ T9198] __se_sys_sendmsg+0x1b7/0x2a0 [ 259.909490][ T9198] ? __x64_sys_sendmsg+0x80/0x80 [ 259.914604][ T9198] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 259.920688][ T9198] ? lockdep_hardirqs_on+0x94/0x140 [ 259.925896][ T9198] do_syscall_64+0x4c/0xa0 [ 259.930341][ T9198] ? clear_bhb_loop+0x30/0x80 [ 259.935039][ T9198] ? clear_bhb_loop+0x30/0x80 [ 259.939714][ T9198] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 259.945615][ T9198] RIP: 0033:0x7fcfffde3b19 [ 259.950027][ T9198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.969806][ T9198] RSP: 002b:00007fcffe03a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 259.978214][ T9198] RAX: ffffffffffffffda RBX: 00007fd000069fa0 RCX: 00007fcfffde3b19 [ 259.986262][ T9198] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 0000000000000004 [ 259.994235][ T9198] RBP: 00007fcfffe7bb70 R08: 0000000000000000 R09: 0000000000000000 [ 260.002197][ T9198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 260.010158][ T9198] R13: 00007fd00006a038 R14: 00007fd000069fa0 R15: 00007ffec72a1808 [ 260.018139][ T9198] [ 260.583992][ T9227] Device name cannot be null; rc = [-22] [ 261.032753][ T9238] capability: warning: `syz.5.1497' uses deprecated v2 capabilities in a way that may be insecure [ 261.097569][ T9238] loop5: detected capacity change from 0 to 1024 [ 261.804959][ T9242] loop1: detected capacity change from 0 to 128 [ 262.717217][ T9256] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1505'. [ 262.727847][ T9256] Set syz0 is full, maxelem 0 reached [ 262.803807][ T9259] Device name cannot be null; rc = [-22] [ 262.855328][ T26] kauditd_printk_skb: 56 callbacks suppressed [ 262.855343][ T26] audit: type=1326 audit(1794017191.568:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9263 comm="syz.1.1507" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33527b3b19 code=0x7ffc0000 [ 262.887791][ T26] audit: type=1326 audit(1794017191.598:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9263 comm="syz.1.1507" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33527b3b19 code=0x7ffc0000 [ 262.922902][ T26] audit: type=1326 audit(1794017191.598:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9263 comm="syz.1.1507" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f33527b3b19 code=0x7ffc0000 [ 262.947842][ T26] audit: type=1326 audit(1794017191.598:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9263 comm="syz.1.1507" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33527b3b19 code=0x7ffc0000 [ 262.961661][ T9270] netlink: 'syz.5.1509': attribute type 29 has an invalid length. [ 262.973237][ T26] audit: type=1326 audit(1794017191.598:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9263 comm="syz.1.1507" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33527b3b19 code=0x7ffc0000 [ 262.990411][ T9270] netlink: 'syz.5.1509': attribute type 29 has an invalid length. [ 263.018027][ T9271] netlink: 'syz.5.1509': attribute type 29 has an invalid length. [ 263.053905][ T9270] netlink: 'syz.5.1509': attribute type 29 has an invalid length. [ 263.077146][ T9270] netlink: 'syz.5.1509': attribute type 29 has an invalid length. [ 263.092163][ T9273] bond0: invalid ARP target specified [ 263.192610][ T9279] device-mapper: table: 248:1: cache: Error opening metadata device [ 263.209782][ T9279] device-mapper: ioctl: error adding target to table [ 263.427896][ T9288] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1516'. [ 264.174126][ T4591] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 264.381561][ T9320] device-mapper: verity: blake2b-256 using implementation "blake2b-256-generic" [ 264.425747][ T9320] device-mapper: table: 248:2: verity: Invalid root digest [ 264.470506][ T9320] device-mapper: ioctl: error adding target to table [ 264.698737][ T9338] loop1: detected capacity change from 0 to 4096 [ 265.142542][ T9338] EXT4-fs (loop1): Ignoring removed orlov option [ 265.382705][ T9338] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,max_dir_size_kb=0x000000004f2040d2,auto_da_alloc,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 265.649443][ T9345] device vlan0 entered promiscuous mode [ 265.844141][ T9345] team0: Port device vlan0 added [ 266.092642][ T9356] FAULT_INJECTION: forcing a failure. [ 266.092642][ T9356] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 266.107386][ T9356] CPU: 0 PID: 9356 Comm: syz.2.1535 Not tainted syzkaller #0 [ 266.114781][ T9356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 266.124856][ T9356] Call Trace: [ 266.128147][ T9356] [ 266.131119][ T9356] dump_stack_lvl+0x188/0x250 [ 266.135823][ T9356] ? show_regs_print_info+0x20/0x20 [ 266.138202][ T9358] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1534'. [ 266.141036][ T9356] ? load_image+0x410/0x410 [ 266.141400][ T9356] ? uncharge_page+0x490/0x490 [ 266.160265][ T9356] should_fail+0x383/0x4b0 [ 266.164707][ T9356] prepare_alloc_pages+0x1e3/0x5b0 [ 266.169850][ T9356] __alloc_pages+0x11b/0x480 [ 266.174510][ T9356] ? zone_statistics+0x170/0x170 [ 266.179471][ T9356] ? rcu_lock_acquire+0x30/0x30 [ 266.184353][ T9356] ? alloc_pages+0x452/0x560 [ 266.188963][ T9356] __get_free_pages+0x8/0x30 [ 266.193551][ T9356] __tlb_remove_page_size+0x1f2/0x3f0 [ 266.199028][ T9356] unmap_page_range+0xfcf/0x2410 [ 266.203986][ T9356] unmap_vmas+0x131/0x250 [ 266.208322][ T9356] ? unmap_page_range+0x2410/0x2410 [ 266.213527][ T9356] ? __mutex_lock_common+0x435/0x2400 [ 266.218901][ T9356] ? exit_mm_release+0x16/0x30 [ 266.223666][ T9356] exit_mmap+0x3b9/0x640 [ 266.227901][ T9356] ? vm_brk+0x20/0x20 [ 266.231886][ T9356] ? uprobe_clear_state+0x2f6/0x460 [ 266.237163][ T9356] __mmput+0x115/0x390 [ 266.241223][ T9356] exit_mm+0x632/0x7b0 [ 266.245281][ T9356] ? perf_pmu_migrate_context+0xb70/0xb70 [ 266.250989][ T9356] ? do_exit+0x2100/0x2100 [ 266.255388][ T9356] ? __ia32_sys_timer_delete+0x40/0x40 [ 266.260832][ T9356] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 266.266285][ T9356] ? tty_audit_exit+0x149/0x1f0 [ 266.271171][ T9356] do_exit+0x5b8/0x2100 [ 266.275317][ T9356] ? put_task_struct+0x80/0x80 [ 266.280080][ T9356] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 266.286073][ T9356] ? _raw_spin_lock_irq+0xb7/0xf0 [ 266.291113][ T9356] do_group_exit+0x12c/0x2f0 [ 266.295726][ T9356] ? lockdep_hardirqs_on+0x94/0x140 [ 266.301031][ T9356] get_signal+0x7eb/0x12e0 [ 266.305475][ T9356] arch_do_signal_or_restart+0xe6/0x12a0 [ 266.311136][ T9356] ? __lock_acquire+0x7d40/0x7d40 [ 266.316161][ T9356] ? futex_exit_release+0x1c0/0x1c0 [ 266.321364][ T9356] ? get_sigframe_size+0x10/0x10 [ 266.326295][ T9356] ? __context_tracking_exit+0x4c/0x80 [ 266.331760][ T9356] ? exit_to_user_mode_loop+0x3b/0x130 [ 266.337206][ T9356] exit_to_user_mode_loop+0x9e/0x130 [ 266.342499][ T9356] exit_to_user_mode_prepare+0xee/0x180 [ 266.348033][ T9356] syscall_exit_to_user_mode+0x16/0x40 [ 266.353486][ T9356] do_syscall_64+0x58/0xa0 [ 266.357890][ T9356] ? clear_bhb_loop+0x30/0x80 [ 266.362555][ T9356] ? clear_bhb_loop+0x30/0x80 [ 266.367221][ T9356] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 266.373103][ T9356] RIP: 0033:0x7ff761c15b19 [ 266.377507][ T9356] Code: Unable to access opcode bytes at RIP 0x7ff761c15aef. [ 266.384874][ T9356] RSP: 002b:00007ff75fe6c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 266.393274][ T9356] RAX: 0000000000000001 RBX: 00007ff761e9bfa8 RCX: 00007ff761c15b19 [ 266.401235][ T9356] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff761e9bfac [ 266.409192][ T9356] RBP: 00007ff761e9bfa0 R08: 0003884946703be0 R09: 0000000000000000 [ 266.417151][ T9356] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 266.425293][ T9356] R13: 00007ff761e9c038 R14: 00007ffcf9081540 R15: 00007ffcf9081628 [ 266.433266][ T9356] [ 266.918220][ T9377] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1542'. [ 266.928145][ T9377] block nbd0: Unsupported socket: shutdown callout must be supported. [ 267.724478][ T9391] device syzkaller0 entered promiscuous mode [ 267.972626][ T9403] bridge0: port 3(syz_tun) entered blocking state [ 267.982003][ T9403] bridge0: port 3(syz_tun) entered disabled state [ 267.991682][ T9403] device syz_tun entered promiscuous mode [ 268.162847][ T9403] bridge0: port 3(syz_tun) entered blocking state [ 268.169418][ T9403] bridge0: port 3(syz_tun) entered forwarding state [ 268.726137][ T9409] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1554'. [ 269.247694][ T9436] loop5: detected capacity change from 0 to 512 [ 269.269670][ T9436] EXT4-fs (loop5): Ignoring removed bh option [ 269.269724][ T9436] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 269.269749][ T9436] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 269.269762][ T9436] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 269.313969][ T9436] EXT4-fs error (device loop5): ext4_orphan_get:1436: comm syz.5.1566: bad orphan inode 131083 [ 269.334753][ T9436] EXT4-fs (loop5): mounted filesystem without journal. Opts: bh,mblk_io_submit,usrquota,,errors=continue. Quota mode: writeback. [ 269.389797][ T9436] overlayfs: upper fs needs to support d_type. [ 269.456601][ T5951] EXT4-fs error (device loop5): ext4_readdir:263: inode #2: block 13: comm syz-executor: path /229/bus: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 269.542808][ T5951] bridge0: port 3(syz_tun) entered disabled state [ 269.567239][ T5951] device syz_tun left promiscuous mode [ 269.567286][ T5951] bridge0: port 3(syz_tun) entered disabled state [ 269.844634][ T26] audit: type=1326 audit(1794017198.558:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 269.844812][ T26] audit: type=1326 audit(1794017198.558:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 269.845070][ T26] audit: type=1326 audit(1794017198.558:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 269.845345][ T26] audit: type=1326 audit(1794017198.558:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 269.964956][ T26] audit: type=1326 audit(1794017198.578:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 269.989661][ T26] audit: type=1326 audit(1794017198.578:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 270.019326][ T26] audit: type=1326 audit(1794017198.578:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 270.047222][ T26] audit: type=1326 audit(1794017198.578:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 270.073130][ T26] audit: type=1326 audit(1794017198.578:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 270.097937][ T26] audit: type=1326 audit(1794017198.578:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9444 comm="syz.2.1570" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff761c15b19 code=0x50000 [ 270.316770][ T9452] rxe_eth0 speed is unknown, defaulting to 1000 [ 271.018070][ T9452] chnl_net:caif_netlink_parms(): no params data found [ 271.100608][ T9464] loop1: detected capacity change from 0 to 4096 [ 271.146600][ T9464] EXT4-fs (loop1): Test dummy encryption mode enabled [ 271.153632][ T9464] EXT4-fs (loop1): inline encryption not supported [ 271.160215][ T9464] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 271.230534][ T9464] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0002] [ 271.238757][ T9464] System zones: 0-5 [ 271.244915][ T9464] EXT4-fs (loop1): mounted filesystem without journal. Opts: debug,test_dummy_encryption=v1,inlinecrypt,user_xattr,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000008,. Quota mode: writeback. [ 271.274894][ T9452] bridge0: port 1(bridge_slave_0) entered blocking state [ 271.299276][ T9452] bridge0: port 1(bridge_slave_0) entered disabled state [ 271.310752][ T9452] device bridge_slave_0 entered promiscuous mode [ 271.321342][ T9452] bridge0: port 2(bridge_slave_1) entered blocking state [ 271.333517][ T9452] bridge0: port 2(bridge_slave_1) entered disabled state [ 271.343620][ T9452] device bridge_slave_1 entered promiscuous mode [ 271.486552][ T9481] Set syz0 is full, maxelem 0 reached [ 271.538639][ T9452] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 271.572294][ T9479] overlayfs: './file0' not a directory [ 271.632471][ T9489] loop4: detected capacity change from 0 to 256 [ 271.642902][ T9452] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 272.034675][ T9452] team0: Port device team_slave_0 added [ 272.064868][ T9452] team0: Port device team_slave_1 added [ 272.917464][ T9452] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 272.918732][ T4857] Bluetooth: hci0: command 0x0409 tx timeout [ 272.944217][ T9452] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 273.133076][ T9452] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 273.221754][ T9] bond0: (slave bond_slave_0): interface is now down [ 273.221974][ T9452] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 273.229610][ T9] bond0: (slave bond_slave_1): interface is now down [ 273.320904][ T9452] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 273.412440][ T4591] bond0: (slave bond_slave_0): interface is now down [ 273.457700][ T9520] Set syz0 is full, maxelem 0 reached [ 273.467304][ T4591] bond0: (slave bond_slave_1): interface is now down [ 273.491363][ T9452] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 273.541674][ T4591] bond0: (slave bond_slave_0): interface is now down [ 273.556164][ T9519] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1590'. [ 273.612536][ T4591] bond0: (slave bond_slave_1): interface is now down [ 273.680325][ T4591] bond0: (slave bond_slave_0): interface is now down [ 273.728095][ T4591] bond0: (slave bond_slave_1): interface is now down [ 273.909908][ T4591] bond0: (slave bond_slave_0): interface is now down [ 273.938603][ T9452] device hsr_slave_0 entered promiscuous mode [ 273.960259][ T4591] bond0: (slave bond_slave_1): interface is now down [ 274.029218][ T9533] loop1: detected capacity change from 0 to 256 [ 274.260815][ T4920] bond0: (slave bond_slave_0): interface is now down [ 274.316387][ T4920] bond0: (slave bond_slave_1): interface is now down [ 274.584954][ T9452] device hsr_slave_1 entered promiscuous mode [ 274.600983][ T4920] bond0: (slave bond_slave_0): interface is now down [ 274.651226][ T4920] bond0: (slave bond_slave_1): interface is now down [ 274.721429][ T4920] bond0: (slave bond_slave_0): interface is now down [ 274.795798][ T4920] bond0: (slave bond_slave_1): interface is now down [ 274.820397][ T4920] bond0: (slave bond_slave_0): interface is now down [ 274.830257][ T4920] bond0: (slave bond_slave_1): interface is now down [ 274.865530][ T9535] block device autoloading is deprecated and will be removed. [ 274.880475][ T4920] bond0: (slave bond_slave_0): interface is now down [ 274.908387][ T4920] bond0: (slave bond_slave_1): interface is now down [ 274.952233][ T4920] bond0: (slave bond_slave_0): interface is now down [ 274.994621][ T4920] bond0: (slave bond_slave_1): interface is now down [ 275.010319][ T4177] Bluetooth: hci0: command 0x041b tx timeout [ 275.080610][ T155] bond0: (slave bond_slave_0): interface is now down [ 275.119757][ T155] bond0: (slave bond_slave_1): interface is now down [ 275.210310][ T155] bond0: (slave bond_slave_0): interface is now down [ 275.233723][ T155] bond0: (slave bond_slave_1): interface is now down [ 275.351354][ T155] bond0: now running without any active interface! [ 276.566322][ T9554] Set syz0 is full, maxelem 0 reached [ 276.575813][ T9452] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 276.666964][ T9452] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 276.755946][ T9452] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 277.557632][ T9566] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 277.852677][ T4251] Bluetooth: hci0: command 0x040f tx timeout [ 277.988004][ T9452] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 277.989199][ T9570] FAULT_INJECTION: forcing a failure. [ 277.989199][ T9570] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 278.118665][ T9577] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1604'. [ 278.138272][ T9570] CPU: 1 PID: 9570 Comm: syz.2.1604 Not tainted syzkaller #0 [ 278.139113][ T9578] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.145689][ T9570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 278.145707][ T9570] Call Trace: [ 278.145717][ T9570] [ 278.145725][ T9570] dump_stack_lvl+0x188/0x250 [ 278.145759][ T9570] ? show_regs_print_info+0x20/0x20 [ 278.145782][ T9570] ? load_image+0x410/0x410 [ 278.145808][ T9570] ? __lock_acquire+0x7d40/0x7d40 [ 278.145832][ T9570] ? __vmalloc_node_range+0x2dd/0x8b0 [ 278.145851][ T9570] ? vzalloc+0x75/0x80 [ 278.145871][ T9570] should_fail+0x383/0x4b0 [ 278.205746][ T9570] prepare_alloc_pages+0x1e3/0x5b0 [ 278.210867][ T9570] __alloc_pages+0x11b/0x480 [ 278.215481][ T9570] ? zone_statistics+0x170/0x170 [ 278.220436][ T9570] ? alloc_pages+0x452/0x560 [ 278.225024][ T9570] __vmalloc_node_range+0x4b1/0x8b0 [ 278.230244][ T9570] ? n_tty_open+0x19/0x150 [ 278.234703][ T9570] vzalloc+0x75/0x80 [ 278.238615][ T9570] ? n_tty_open+0x19/0x150 [ 278.243045][ T9570] n_tty_open+0x19/0x150 [ 278.247396][ T9570] tty_ldisc_setup+0xbf/0x250 [ 278.252109][ T9570] tty_init_dev+0x239/0x470 [ 278.256617][ T9570] ptmx_open+0xe1/0x2c0 [ 278.260776][ T9570] ? pty_start+0x140/0x140 [ 278.265191][ T9570] chrdev_open+0x585/0x5f0 [ 278.269714][ T9570] ? cd_forget+0x160/0x160 [ 278.274163][ T9570] ? fsnotify_perm+0x3a7/0x560 [ 278.278964][ T9570] ? cd_forget+0x160/0x160 [ 278.283538][ T9570] do_dentry_open+0x7f7/0xf90 [ 278.288224][ T9570] ? vfs_open+0x2b/0x80 [ 278.292483][ T9570] path_openat+0x2718/0x2fb0 [ 278.297211][ T9570] ? __kasan_slab_alloc+0xa9/0xc0 [ 278.302251][ T9570] ? do_filp_open+0x400/0x400 [ 278.306976][ T9570] do_filp_open+0x1df/0x400 [ 278.311493][ T9570] ? vfs_tmpfile+0x300/0x300 [ 278.316120][ T9570] ? _raw_spin_unlock+0x24/0x40 [ 278.320976][ T9570] ? alloc_fd+0x59e/0x650 [ 278.325410][ T9570] do_sys_openat2+0x14b/0x500 [ 278.330088][ T9570] ? __lock_acquire+0x7d40/0x7d40 [ 278.335246][ T9570] ? do_sys_open+0xe0/0xe0 [ 278.339675][ T9570] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 278.345702][ T9570] ? lock_chain_count+0x20/0x20 [ 278.350592][ T9570] __x64_sys_openat+0x135/0x160 [ 278.355468][ T9570] do_syscall_64+0x4c/0xa0 [ 278.359887][ T9570] ? clear_bhb_loop+0x30/0x80 [ 278.364572][ T9570] ? clear_bhb_loop+0x30/0x80 [ 278.369291][ T9570] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 278.375197][ T9570] RIP: 0033:0x7ff761c15b19 [ 278.379693][ T9570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.399286][ T9570] RSP: 002b:00007ff75fe6c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 278.407750][ T9570] RAX: ffffffffffffffda RBX: 00007ff761e9bfa0 RCX: 00007ff761c15b19 [ 278.415734][ T9570] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 278.423719][ T9570] RBP: 00007ff761cadb70 R08: 0000000000000000 R09: 0000000000000000 [ 278.431691][ T9570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.439761][ T9570] R13: 00007ff761e9c038 R14: 00007ff761e9bfa0 R15: 00007ffcf9081628 [ 278.447871][ T9570] [ 278.642307][ T9452] 8021q: adding VLAN 0 to HW filter on device bond0 [ 278.676555][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 278.726746][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 278.783936][ T9452] 8021q: adding VLAN 0 to HW filter on device team0 [ 278.815780][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 278.840988][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 278.922577][ T4276] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.929715][ T4276] bridge0: port 1(bridge_slave_0) entered forwarding state [ 279.005108][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 279.052477][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 279.101065][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 279.200578][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.207682][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.333404][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 279.381376][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 279.462040][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 279.521943][ T9594] Set syz0 is full, maxelem 0 reached [ 279.566290][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 279.633878][ T9570] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 279.638299][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 279.760583][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 279.801742][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 279.845199][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 279.878485][ T9598] FAULT_INJECTION: forcing a failure. [ 279.878485][ T9598] name failslab, interval 1, probability 0, space 0, times 0 [ 279.904914][ T21] Bluetooth: hci0: command 0x0419 tx timeout [ 279.913923][ T9598] CPU: 1 PID: 9598 Comm: syz.1.1613 Not tainted syzkaller #0 [ 279.921387][ T9598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 279.931474][ T9598] Call Trace: [ 279.934775][ T9598] [ 279.937704][ T9598] dump_stack_lvl+0x188/0x250 [ 279.942395][ T9598] ? show_regs_print_info+0x20/0x20 [ 279.947604][ T9598] ? load_image+0x410/0x410 [ 279.952131][ T9598] ? rcu_lock_release+0x5/0x20 [ 279.956917][ T9598] should_fail+0x383/0x4b0 [ 279.961345][ T9598] should_failslab+0x5/0x20 [ 279.965867][ T9598] slab_pre_alloc_hook+0x51/0xc0 [ 279.970805][ T9598] ? __nf_conntrack_alloc+0x93/0x370 [ 279.976107][ T9598] kmem_cache_alloc+0x3d/0x280 [ 279.980906][ T9598] __nf_conntrack_alloc+0x93/0x370 [ 279.986012][ T9598] init_conntrack+0x2fd/0x1530 [ 279.990769][ T9598] ? get_l4proto+0x670/0x670 [ 279.995350][ T9598] ? early_drop+0x800/0x800 [ 279.999854][ T9598] ? nf_conntrack_find_get+0x640/0x640 [ 280.005311][ T9598] ? __siphash_unaligned+0x286/0x3d0 [ 280.010742][ T9598] nf_conntrack_in+0xd76/0x17b0 [ 280.015659][ T9598] ? nf_ct_pernet+0x240/0x240 [ 280.020433][ T9598] ? ip6t_alloc_initial_table+0x640/0x640 [ 280.026249][ T9598] ? ipv6_defrag+0x2d2/0x3a0 [ 280.030852][ T9598] ? ipv6_conntrack_in+0x20/0x20 [ 280.035784][ T9598] nf_hook_slow+0xb9/0x200 [ 280.040205][ T9598] ? ip6_xmit+0x1780/0x1780 [ 280.044705][ T9598] nf_hook+0x205/0x360 [ 280.048895][ T9598] ? ip6_make_skb+0x530/0x530 [ 280.053647][ T9598] ? ip6_xmit+0x1780/0x1780 [ 280.058376][ T9598] ip6_xmit+0x1079/0x1780 [ 280.062717][ T9598] ? ip6_xmit+0x1780/0x1780 [ 280.067266][ T9598] ? ip6_autoflowlabel+0xd0/0xd0 [ 280.072307][ T9598] ? __sk_dst_check+0x14e/0x290 [ 280.077271][ T9598] ? read_lock_is_recursive+0x10/0x10 [ 280.082960][ T9598] ? inet6_csk_route_socket+0x613/0xed0 [ 280.088528][ T9598] inet6_csk_xmit+0x405/0x680 [ 280.093205][ T9598] ? inet6_csk_addr2sockaddr+0x1d0/0x1d0 [ 280.098849][ T9598] ? csum_ipv6_magic+0x1e/0x80 [ 280.103632][ T9598] __tcp_transmit_skb+0x1ca3/0x31e0 [ 280.108881][ T9598] ? read_seqbegin+0x127/0x210 [ 280.113744][ T9598] ? __tcp_send_ack+0x5d0/0x5d0 [ 280.118644][ T9598] ? tcp_fastopen_cookie_check+0x269/0x3c0 [ 280.124588][ T9598] tcp_connect+0x2d1a/0x4970 [ 280.129205][ T9598] tcp_v6_connect+0x11cf/0x1a10 [ 280.134067][ T9598] ? tcp_v6_pre_connect+0xf0/0xf0 [ 280.139113][ T9598] ? tcp_sendmsg_fastopen+0x1d5/0x600 [ 280.144480][ T9598] ? tcp_sendmsg_locked+0x2efb/0x3330 [ 280.149884][ T9598] ? tcp_sendmsg+0x2b/0x40 [ 280.154295][ T9598] ? __sys_sendto+0x46d/0x620 [ 280.158982][ T9598] ? __x64_sys_sendto+0xda/0xf0 [ 280.163860][ T9598] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 280.169928][ T9598] __inet_stream_connect+0x244/0xd80 [ 280.175213][ T9598] ? inet_dgram_connect+0x340/0x340 [ 280.180419][ T9598] tcp_sendmsg_fastopen+0x38f/0x600 [ 280.185617][ T9598] tcp_sendmsg_locked+0x2efb/0x3330 [ 280.190810][ T9598] ? aa_sk_perm+0x910/0x910 [ 280.195346][ T9598] ? mark_lock+0x94/0x320 [ 280.199764][ T9598] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 280.205759][ T9598] ? lock_chain_count+0x20/0x20 [ 280.210609][ T9598] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 280.216733][ T9598] ? tcp_free_fastopen_req+0x70/0x70 [ 280.222071][ T9598] tcp_sendmsg+0x2b/0x40 [ 280.226313][ T9598] __sys_sendto+0x46d/0x620 [ 280.230810][ T9598] ? __ia32_sys_getpeername+0x80/0x80 [ 280.236192][ T9598] ? lock_chain_count+0x20/0x20 [ 280.241130][ T9598] __x64_sys_sendto+0xda/0xf0 [ 280.245816][ T9598] do_syscall_64+0x4c/0xa0 [ 280.250245][ T9598] ? clear_bhb_loop+0x30/0x80 [ 280.254985][ T9598] ? clear_bhb_loop+0x30/0x80 [ 280.259695][ T9598] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 280.265671][ T9598] RIP: 0033:0x7f33527b3b19 [ 280.270129][ T9598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.289775][ T9598] RSP: 002b:00007f3350a0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 280.298191][ T9598] RAX: ffffffffffffffda RBX: 00007f3352a39fa0 RCX: 00007f33527b3b19 [ 280.306159][ T9598] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 280.314158][ T9598] RBP: 00007f335284bb70 R08: 00002000000007c0 R09: 000000000000001c [ 280.322143][ T9598] R10: 0000000020000075 R11: 0000000000000246 R12: 0000000000000000 [ 280.330109][ T9598] R13: 00007f3352a3a038 R14: 00007f3352a39fa0 R15: 00007fff781eeba8 [ 280.338095][ T9598] [ 280.350612][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 280.387417][ T4920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 280.410773][ T4920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 280.426125][ T9596] device-mapper: table: 248:3: writecache: Invalid block size [ 280.431564][ T9452] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 280.438202][ T9596] device-mapper: ioctl: error adding target to table [ 281.791081][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 281.823231][ T21] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 281.853891][ T9635] ubi0: attaching mtd0 [ 281.861817][ T4591] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 281.870879][ T21] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 281.897478][ T9452] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.921620][ T9635] ubi0: scanning is finished [ 282.086942][ T9635] ubi0: empty MTD device detected [ 282.832953][ T9638] fido_id[9638]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 282.916762][ T9642] using random self ethernet address [ 282.916817][ T9642] using random host ethernet address [ 282.923973][ T9644] FAULT_INJECTION: forcing a failure. [ 282.923973][ T9644] name failslab, interval 1, probability 0, space 0, times 0 [ 282.924031][ T9644] CPU: 0 PID: 9644 Comm: syz.1.1627 Not tainted syzkaller #0 [ 282.924052][ T9644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 282.924065][ T9644] Call Trace: [ 282.924071][ T9644] [ 282.924079][ T9644] dump_stack_lvl+0x188/0x250 [ 282.924111][ T9644] ? show_regs_print_info+0x20/0x20 [ 282.924134][ T9644] ? load_image+0x410/0x410 [ 282.924163][ T9644] ? __might_sleep+0xf0/0xf0 [ 282.924193][ T9644] ? __lock_acquire+0x7d40/0x7d40 [ 282.924222][ T9644] should_fail+0x383/0x4b0 [ 282.924250][ T9644] should_failslab+0x5/0x20 [ 282.924269][ T9644] slab_pre_alloc_hook+0x51/0xc0 [ 282.924290][ T9644] ? __kernfs_new_node+0xe3/0x6b0 [ 282.924313][ T9644] kmem_cache_alloc+0x3d/0x280 [ 282.924338][ T9644] __kernfs_new_node+0xe3/0x6b0 [ 282.924365][ T9644] ? kernfs_new_node+0x250/0x250 [ 282.924406][ T9644] kernfs_new_node+0x148/0x250 [ 282.924432][ T9644] kernfs_create_dir_ns+0x40/0x120 [ 282.924457][ T9644] sysfs_create_dir_ns+0x12c/0x290 [ 282.924480][ T9644] ? sysfs_warn_dup+0xa0/0xa0 [ 282.924498][ T9644] ? __mutex_lock_common+0x435/0x2400 [ 282.924525][ T9644] ? do_raw_spin_unlock+0x11d/0x230 [ 282.924548][ T9644] kobject_add_internal+0x5ba/0xcd0 [ 282.924576][ T9644] kobject_add+0x160/0x230 [ 282.924594][ T9644] ? __lock_acquire+0x7d40/0x7d40 [ 282.924621][ T9644] ? kobject_init+0x1c0/0x1c0 [ 282.924640][ T9644] ? do_raw_spin_unlock+0x11d/0x230 [ 282.924662][ T9644] ? get_device_parent+0x288/0x3e0 [ 282.924685][ T9644] device_add+0x470/0x1050 [ 282.924713][ T9644] device_create+0x266/0x300 [ 282.924735][ T9644] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 282.924755][ T9644] ? _raw_spin_unlock+0x40/0x40 [ 282.924773][ T9644] ? root_device_unregister+0xf0/0xf0 [ 282.924793][ T9644] ? update_attr+0x550/0x730 [ 282.924815][ T9644] ? memcpy+0x3c/0x60 [ 282.924834][ T9644] ? is_console_locked+0x5/0x10 [ 282.924851][ T9644] ? csi_J+0x8d6/0xdb0 [ 282.924874][ T9644] vcs_make_sysfs+0x51/0x80 [ 282.924892][ T9644] vc_allocate+0x6bd/0x7f0 [ 282.924922][ T9644] ? vc_cons_allocated+0x70/0x70 [ 282.924954][ T9644] con_install+0x9c/0x720 [ 282.924983][ T9644] ? show_tty_active+0x30/0x30 [ 282.925015][ T9644] tty_init_dev+0xbb/0x470 [ 282.925042][ T9644] tty_open+0x7e8/0xcd0 [ 282.925068][ T9644] ? __lock_acquire+0x7d40/0x7d40 [ 282.925096][ T9644] ? tty_compat_ioctl+0x570/0x570 [ 282.925123][ T9644] ? do_raw_spin_unlock+0x11d/0x230 [ 282.925147][ T9644] chrdev_open+0x585/0x5f0 [ 282.925173][ T9644] ? cd_forget+0x160/0x160 [ 282.925218][ T9644] ? fsnotify_perm+0x3a7/0x560 [ 282.925241][ T9644] ? cd_forget+0x160/0x160 [ 282.925262][ T9644] do_dentry_open+0x7f7/0xf90 [ 282.925283][ T9644] ? vfs_open+0x2b/0x80 [ 282.925307][ T9644] path_openat+0x2718/0x2fb0 [ 282.925349][ T9644] ? __kasan_slab_alloc+0xa9/0xc0 [ 282.925380][ T9644] ? do_filp_open+0x400/0x400 [ 282.925421][ T9644] do_filp_open+0x1df/0x400 [ 282.925448][ T9644] ? vfs_tmpfile+0x300/0x300 [ 282.925489][ T9644] ? _raw_spin_unlock+0x24/0x40 [ 282.925507][ T9644] ? alloc_fd+0x59e/0x650 [ 282.925534][ T9644] do_sys_openat2+0x14b/0x500 [ 282.925554][ T9644] ? __lock_acquire+0x7d40/0x7d40 [ 282.925577][ T9644] ? do_sys_open+0xe0/0xe0 [ 282.925596][ T9644] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 282.925623][ T9644] ? lock_chain_count+0x20/0x20 [ 282.925651][ T9644] __x64_sys_openat+0x135/0x160 [ 282.925673][ T9644] do_syscall_64+0x4c/0xa0 [ 282.925691][ T9644] ? clear_bhb_loop+0x30/0x80 [ 282.925709][ T9644] ? clear_bhb_loop+0x30/0x80 [ 282.925732][ T9644] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 282.925752][ T9644] RIP: 0033:0x7f335277434e [ 282.925771][ T9644] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 282.925789][ T9644] RSP: 002b:00007f3350a09b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 282.925813][ T9644] RAX: ffffffffffffffda RBX: 00007f3350a0a6c0 RCX: 00007f335277434e [ 282.925830][ T9644] RDX: 0000000000000002 RSI: 00007f3350a09c00 RDI: ffffffffffffff9c [ 282.925845][ T9644] RBP: 00007f335284bb70 R08: 0000000000000000 R09: 0000000000000000 [ 282.925859][ T9644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 282.925873][ T9644] R13: 00007f3352a3a038 R14: 00007f3352a39fa0 R15: 00007fff781eeba8 [ 282.925905][ T9644] [ 282.965251][ T9644] kobject_add_internal failed for vcsu22 (error: -12 parent: vc) [ 283.215658][ T9635] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 283.895666][ T4920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 283.896235][ T4920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 283.982421][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 283.983016][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 283.995844][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 283.996484][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 284.016735][ T9673] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1633'. [ 284.016803][ T9673] block nbd0: Unsupported socket: shutdown callout must be supported. [ 284.030932][ T9452] device veth0_vlan entered promiscuous mode [ 284.057409][ T9452] device veth1_vlan entered promiscuous mode [ 284.130035][ T9677] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1636'. [ 284.148484][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 284.234074][ T9681] fuse: Unknown parameter 'f ' [ 284.662565][ T9687] loop1: detected capacity change from 0 to 512 [ 284.779259][ T9687] EXT4-fs (loop1): Ignoring removed orlov option [ 284.910589][ T9687] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 285.008553][ T9687] EXT4-fs (loop1): group descriptors corrupted! [ 285.070817][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 285.117855][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 285.281193][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 286.025172][ T9452] device veth0_macvtap entered promiscuous mode [ 286.058239][ T9699] device syzkaller0 entered promiscuous mode [ 286.084546][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 286.104198][ T9716] loop2: detected capacity change from 0 to 8 [ 286.104550][ T9452] device veth1_macvtap entered promiscuous mode [ 286.194832][ T9707] device syzkaller0 entered promiscuous mode [ 286.369099][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.404723][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.430536][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.465608][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.492415][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.545581][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.587930][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.631343][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.676652][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.941888][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.974549][ T9452] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 286.997537][ T9720] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1648'. [ 287.036616][ T9720] 8021q: VLANs not supported on gre0 [ 287.066510][ T4264] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 287.137697][ T4264] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 287.239017][ T9] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.327023][ T9730] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 287.375736][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 287.417144][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 287.456723][ T9734] loop4: detected capacity change from 0 to 512 [ 287.481474][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 287.536232][ T9734] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 287.561919][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 288.403128][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 288.415274][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 288.425703][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 288.436671][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 288.447285][ T9452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 288.536727][ T9452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 288.578439][ T9734] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 288.579710][ T9452] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 288.705538][ T5373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 288.724857][ T5373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 288.765871][ T9734] EXT4-fs (loop4): 1 truncate cleaned up [ 288.786740][ T9734] EXT4-fs (loop4): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000007,bsddf,nomblk_io_submit,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 288.831948][ T9] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.855450][ T9452] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.890886][ T9452] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.906722][ T9452] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.504749][ T9452] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.847382][ T9] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.062116][ T9] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.389065][ T830] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.418249][ T830] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.241105][ T9791] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 292.254780][ T4206] Bluetooth: hci4: Unknown advertising packet type: 0x3438 [ 292.255136][ T4206] ================================================================== [ 292.271132][ T4206] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x12cf/0x3ca0 [ 292.278970][ T4206] Read of size 1 at addr ffff8880252b4c05 by task kworker/u5:8/4206 [ 292.286970][ T4206] [ 292.289729][ T4206] CPU: 1 PID: 4206 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 292.297260][ T4206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 292.307430][ T4206] Workqueue: hci4 hci_rx_work [ 292.313345][ T4206] Call Trace: [ 292.316723][ T4206] [ 292.319658][ T4206] dump_stack_lvl+0x188/0x250 [ 292.324549][ T4206] ? show_regs_print_info+0x20/0x20 [ 292.329773][ T4206] ? load_image+0x410/0x410 [ 292.334272][ T4206] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 292.339739][ T4206] print_address_description+0x60/0x2d0 [ 292.345287][ T4206] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 292.350398][ T4206] kasan_report+0xdf/0x130 [ 292.354948][ T4206] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 292.360309][ T4206] hci_le_meta_evt+0x12cf/0x3ca0 [ 292.365287][ T4206] ? hci_event_packet+0x363/0x1310 [ 292.370425][ T4206] ? __lock_acquire+0x7d40/0x7d40 [ 292.375477][ T4206] ? hci_remote_host_features_evt+0x240/0x240 [ 292.381647][ T4206] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 292.387398][ T4206] ? mark_lock+0x94/0x320 [ 292.391740][ T4206] ? mutex_unlock+0x10/0x10 [ 292.396235][ T4206] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 292.402224][ T4206] ? lock_chain_count+0x20/0x20 [ 292.407077][ T4206] ? __rwlock_init+0x140/0x140 [ 292.411849][ T4206] hci_event_packet+0xe0b/0x1310 [ 292.416915][ T4206] ? _raw_spin_unlock+0x40/0x40 [ 292.421780][ T4206] ? rcu_lock_release+0x20/0x20 [ 292.426627][ T4206] ? hci_send_to_monitor+0x9c/0x4a0 [ 292.431845][ T4206] hci_rx_work+0x255/0xa10 [ 292.436268][ T4206] process_one_work+0x867/0xff0 [ 292.441121][ T4206] ? worker_detach_from_pool+0x240/0x240 [ 292.446826][ T4206] ? lockdep_hardirqs_off+0x70/0x100 [ 292.452142][ T4206] ? _raw_spin_lock_irq+0xb7/0xf0 [ 292.457246][ T4206] ? _raw_spin_lock_irqsave+0x100/0x100 [ 292.462799][ T4206] ? wq_worker_running+0x97/0x170 [ 292.467828][ T4206] worker_thread+0xad7/0x12a0 [ 292.472667][ T4206] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 292.478559][ T4206] kthread+0x42e/0x520 [ 292.482661][ T4206] ? rcu_lock_release+0x20/0x20 [ 292.487515][ T4206] ? kthread_blkcg+0xd0/0xd0 [ 292.492225][ T4206] ret_from_fork+0x1f/0x30 [ 292.496743][ T4206] [ 292.499850][ T4206] [ 292.502174][ T4206] Allocated by task 9792: [ 292.506493][ T4206] __kasan_kmalloc+0xaf/0xe0 [ 292.511087][ T4206] __alloc_skb+0x22c/0x750 [ 292.515516][ T4206] vhci_write+0xbd/0x440 [ 292.519802][ T4206] vfs_write+0x748/0xd70 [ 292.524129][ T4206] ksys_write+0x153/0x260 [ 292.528738][ T4206] do_syscall_64+0x4c/0xa0 [ 292.533148][ T4206] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 292.539046][ T4206] [ 292.541387][ T4206] The buggy address belongs to the object at ffff8880252b4800 [ 292.541387][ T4206] which belongs to the cache kmalloc-1k of size 1024 [ 292.555434][ T4206] The buggy address is located 5 bytes to the right of [ 292.555434][ T4206] 1024-byte region [ffff8880252b4800, ffff8880252b4c00) [ 292.569496][ T4206] The buggy address belongs to the page: [ 292.575222][ T4206] page:ffffea000094ac00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x252b0 [ 292.585891][ T4206] head:ffffea000094ac00 order:3 compound_mapcount:0 compound_pincount:0 [ 292.594216][ T4206] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 292.602220][ T4206] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017841dc0 [ 292.610802][ T4206] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 292.619393][ T4206] page dumped because: kasan: bad access detected [ 292.625871][ T4206] page_owner tracks the page as allocated [ 292.631755][ T4206] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 155, ts 65979034542, free_ts 65948710214 [ 292.650166][ T4206] get_page_from_freelist+0x24f6/0x2670 [ 292.655737][ T4206] __alloc_pages+0x1ee/0x480 [ 292.660788][ T4206] new_slab+0xc0/0x4b0 [ 292.664950][ T4206] ___slab_alloc+0x807/0xdd0 [ 292.669692][ T4206] __kmalloc_node_track_caller+0x13d/0x3a0 [ 292.675536][ T4206] __alloc_skb+0x22c/0x750 [ 292.680087][ T4206] inet6_rt_notify+0xe0/0x290 [ 292.684916][ T4206] fib6_add+0x1e9a/0x3ee0 [ 292.689421][ T4206] ip6_route_add+0x86/0x130 [ 292.693939][ T4206] addrconf_add_linklocal+0x444/0x6d0 [ 292.699339][ T4206] addrconf_addr_gen+0x559/0x6b0 [ 292.704281][ T4206] addrconf_init_auto_addrs+0x6ec/0xab0 [ 292.709826][ T4206] addrconf_notify+0xa6b/0xf20 [ 292.714848][ T4206] raw_notifier_call_chain+0xcb/0x160 [ 292.720311][ T4206] netdev_state_change+0xe0/0x160 [ 292.725440][ T4206] linkwatch_do_dev+0x10d/0x160 [ 292.730393][ T4206] page last free stack trace: [ 292.735089][ T4206] free_unref_page_prepare+0x637/0x6c0 [ 292.740583][ T4206] free_unref_page+0x8f/0x2a0 [ 292.745260][ T4206] __unfreeze_partials+0x188/0x1e0 [ 292.750361][ T4206] put_cpu_partial+0x12d/0x190 [ 292.755169][ T4206] qlist_free_all+0x35/0x90 [ 292.759667][ T4206] kasan_quarantine_reduce+0x150/0x160 [ 292.765158][ T4206] __kasan_slab_alloc+0x2f/0xc0 [ 292.770009][ T4206] slab_post_alloc_hook+0x4c/0x380 [ 292.775129][ T4206] kmem_cache_alloc_trace+0x165/0x290 [ 292.780496][ T4206] netdevice_event+0x3ad/0x930 [ 292.785402][ T4206] raw_notifier_call_chain+0xcb/0x160 [ 292.790790][ T4206] dev_set_mac_address+0x2ed/0x400 [ 292.795937][ T4206] dev_set_mac_address_user+0x2d/0x50 [ 292.801424][ T4206] do_setlink+0x842/0x29d0 [ 292.805943][ T4206] rtnl_newlink+0x15bb/0x1920 [ 292.810628][ T4206] rtnetlink_rcv_msg+0x7f1/0xf10 [ 292.815577][ T4206] [ 292.817889][ T4206] Memory state around the buggy address: [ 292.823496][ T4206] ffff8880252b4b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 292.831557][ T4206] ffff8880252b4b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 292.839749][ T4206] >ffff8880252b4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 292.847904][ T4206] ^ [ 292.851962][ T4206] ffff8880252b4c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 292.860005][ T4206] ffff8880252b4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 292.868053][ T4206] ================================================================== [ 292.876102][ T4206] Disabling lock debugging due to kernel taint [ 292.894575][ T830] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 292.897204][ T4206] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 292.909073][ T4206] CPU: 0 PID: 4206 Comm: kworker/u5:8 Tainted: G B syzkaller #0 [ 292.918532][ T4206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 292.929054][ T4206] Workqueue: hci4 hci_rx_work [ 292.933751][ T4206] Call Trace: [ 292.937019][ T4206] [ 292.939934][ T4206] dump_stack_lvl+0x188/0x250 [ 292.944601][ T4206] ? show_regs_print_info+0x20/0x20 [ 292.949791][ T4206] ? load_image+0x410/0x410 [ 292.954302][ T4206] panic+0x2f8/0x850 [ 292.958193][ T4206] ? bpf_jit_dump+0xd0/0xd0 [ 292.962683][ T4206] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 292.968758][ T4206] ? _raw_spin_unlock+0x40/0x40 [ 292.973619][ T4206] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 292.978730][ T4206] check_panic_on_warn+0x80/0xa0 [ 292.983667][ T4206] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 292.988769][ T4206] end_report+0x6d/0xf0 [ 292.992913][ T4206] kasan_report+0x102/0x130 [ 292.997562][ T4206] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 293.002794][ T4206] hci_le_meta_evt+0x12cf/0x3ca0 [ 293.007818][ T4206] ? hci_event_packet+0x363/0x1310 [ 293.012938][ T4206] ? __lock_acquire+0x7d40/0x7d40 [ 293.017959][ T4206] ? hci_remote_host_features_evt+0x240/0x240 [ 293.024024][ T4206] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 293.029667][ T4206] ? mark_lock+0x94/0x320 [ 293.033985][ T4206] ? mutex_unlock+0x10/0x10 [ 293.038580][ T4206] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 293.044565][ T4206] ? lock_chain_count+0x20/0x20 [ 293.049517][ T4206] ? __rwlock_init+0x140/0x140 [ 293.054270][ T4206] hci_event_packet+0xe0b/0x1310 [ 293.059210][ T4206] ? _raw_spin_unlock+0x40/0x40 [ 293.064049][ T4206] ? rcu_lock_release+0x20/0x20 [ 293.068886][ T4206] ? hci_send_to_monitor+0x9c/0x4a0 [ 293.074063][ T4206] hci_rx_work+0x255/0xa10 [ 293.078563][ T4206] process_one_work+0x867/0xff0 [ 293.083400][ T4206] ? worker_detach_from_pool+0x240/0x240 [ 293.089013][ T4206] ? lockdep_hardirqs_off+0x70/0x100 [ 293.094283][ T4206] ? _raw_spin_lock_irq+0xb7/0xf0 [ 293.099292][ T4206] ? _raw_spin_lock_irqsave+0x100/0x100 [ 293.104824][ T4206] ? wq_worker_running+0x97/0x170 [ 293.109835][ T4206] worker_thread+0xad7/0x12a0 [ 293.114541][ T4206] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 293.120568][ T4206] kthread+0x42e/0x520 [ 293.124637][ T4206] ? rcu_lock_release+0x20/0x20 [ 293.129483][ T4206] ? kthread_blkcg+0xd0/0xd0 [ 293.134066][ T4206] ret_from_fork+0x1f/0x30 [ 293.138469][ T4206] [ 293.141751][ T4206] Kernel Offset: disabled [ 293.146083][ T4206] Rebooting in 86400 seconds..