last executing test programs: 9m54.502845587s ago: executing program 4 (id=188): socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000040)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) r1 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x8e82, 0x100, 0x14, 0x1c0}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_CLOSE={0x13, 0x40}) io_uring_enter(r1, 0x3516, 0x2, 0x0, 0x0, 0x0) 9m53.942661581s ago: executing program 4 (id=190): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f0000000480)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x4, @private0, 0x8000}, @ib={0x1b, 0x6, 0x31, {"f2175c19b828a30dad6c1f84aa3483d6"}, 0x5, 0x3, 0x12f}}}, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r7, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x1000005, 0x7fffffff, 0x0, 0x1, 0x7, 0x7fffffffff7fffff, 0xffffffffffffff70, 0xa, 0x7f, 0x4, 0x80, 0x3, 0x4, 0x1, 0x1], 0xeeee0000, 0x300}) pipe2(&(0x7f0000000000), 0x80800) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) ioctl$KVM_RUN(r7, 0xae80, 0x0) listen(r4, 0x0) r8 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r8, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) accept4(r4, 0x0, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001700090025bd7000dddb3e25060000000800010003"], 0x1c}, 0x1, 0x0, 0x0, 0x400000a}, 0x4000080) recvmmsg(r8, 0x0, 0x0, 0x0, 0x0) 9m53.493732597s ago: executing program 4 (id=192): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_open_dev$loop(0x0, 0x47ffffa, 0xa7dc2) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x4) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001aa40)=""/102392, 0x18ff8) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x40}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r3 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000640)={0x4, 0x4}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r5, 0x560f, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000900)=@expire={0x104, 0x18, 0x1, 0x70bd28, 0x25dfdbfb, {{{@in=@broadcast, @in6=@private2, 0x4e22, 0x2, 0x4e20, 0x3e9, 0x2, 0x20, 0x80}, {@in6=@remote, 0x4d2, 0x3c}, @in=@broadcast, {0xb4ca, 0x9af, 0x8, 0x8, 0x1aea, 0xfffffffffffffffe, 0x8, 0x100}, {0x3, 0x7, 0x8000000000000000, 0x80000001}, {0x800, 0xaa1, 0x2}, 0x70bd28, 0x3505, 0xa, 0x1, 0x2}, 0xf}, [@mark={0xc, 0x15, {0x35075c, 0xc0}}]}, 0x104}, 0x1, 0x0, 0x0, 0x8080}, 0x2000402c) ioctl$VT_DISALLOCATE(r5, 0x5608) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000010}, 0x0) 9m52.330920236s ago: executing program 4 (id=197): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x188) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040)=0x7fffffff, 0x4) sendmmsg$inet6(r0, &(0x7f0000003a80)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x4, @mcast2, 0x3}, 0x1b, 0x0}}], 0x1, 0x20000000) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r1 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mknodat$loop(r1, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) chdir(&(0x7f0000000140)='./bus\x00') rename(&(0x7f0000006200)='./file1\x00', &(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x141000, 0x0) memfd_secret(0x80000) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000180)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x95) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r5, 0x1, &(0x7f0000000340)={0x2000, r6}, 0x0) landlock_restrict_self(r5, 0x0) 9m50.716870209s ago: executing program 4 (id=201): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x20003214, 0x0) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0xb) (async) r2 = fsmount(r1, 0x0, 0xb) fchdir(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000008c0)={0x53, 0xfffffffffffffffb, 0x0, 0x40, @scatter={0x1, 0x0, &(0x7f0000000740)=[{&(0x7f0000001940)=""/218, 0xda}]}, 0x0, 0x0, 0x5, 0x31, 0x0, 0x0}) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000080)={0x8}) syz_usb_disconnect(r0) (async) syz_usb_disconnect(r0) syz_usb_connect(0x6, 0x36, &(0x7f0000000300)=ANY=[], 0x0) (async) syz_usb_connect(0x6, 0x36, &(0x7f0000000300)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085507, 0x0) (async) ioctl$EVIOCRMFF(r0, 0x40085507, 0x0) 9m47.188252376s ago: executing program 4 (id=204): r0 = getpid() prlimit64(r0, 0x3, &(0x7f0000000180)={0x9, 0x803}, 0x0) r1 = getpgrp(0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x3c) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000180)={0x9, 0x8, 0x3, 0x34f, 0x1, "39180209c2e19beecaf646b5c6e3385d1caf18"}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x9) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x5) r3 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800007, 0x11, r3, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x7fff, 0x500) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000240)=0x1) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0xbe89, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x48, 0x0, 0x9, 0x301, 0x0, 0x0, {0xa}, [@NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_TUPLE={0x10, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x9}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8014}, 0x8840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000032680)=""/102392, 0x18ff8) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sched_setaffinity(r5, 0x8, &(0x7f0000000300)=0x7f5a) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x8000) ioctl$sock_inet_SIOCSIFBRDADDR(r9, 0x891a, &(0x7f0000000340)={'ip6_vti0\x00', {0x2, 0x4e20, @broadcast}}) setsockopt$kcm_KCM_RECV_DISABLE(r9, 0x119, 0x1, &(0x7f00000002c0)=0x4, 0x4) 9m31.688918098s ago: executing program 32 (id=204): r0 = getpid() prlimit64(r0, 0x3, &(0x7f0000000180)={0x9, 0x803}, 0x0) r1 = getpgrp(0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x3c) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000180)={0x9, 0x8, 0x3, 0x34f, 0x1, "39180209c2e19beecaf646b5c6e3385d1caf18"}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x9) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x5) r3 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800007, 0x11, r3, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x7fff, 0x500) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000240)=0x1) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0xbe89, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x48, 0x0, 0x9, 0x301, 0x0, 0x0, {0xa}, [@NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_TUPLE={0x10, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x9}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8014}, 0x8840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000032680)=""/102392, 0x18ff8) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sched_setaffinity(r5, 0x8, &(0x7f0000000300)=0x7f5a) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x8000) ioctl$sock_inet_SIOCSIFBRDADDR(r9, 0x891a, &(0x7f0000000340)={'ip6_vti0\x00', {0x2, 0x4e20, @broadcast}}) setsockopt$kcm_KCM_RECV_DISABLE(r9, 0x119, 0x1, &(0x7f00000002c0)=0x4, 0x4) 42.448108719s ago: executing program 3 (id=3076): r0 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x1c1000) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1d9, 0x0, 0x7}]}) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xcf, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000000)) 39.624083808s ago: executing program 3 (id=3076): r0 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x1c1000) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1d9, 0x0, 0x7}]}) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xcf, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000000)) 36.106809101s ago: executing program 3 (id=3076): r0 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x1c1000) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1d9, 0x0, 0x7}]}) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xcf, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000000)) 32.850417897s ago: executing program 3 (id=3076): r0 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x1c1000) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1d9, 0x0, 0x7}]}) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xcf, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000000)) 28.66047071s ago: executing program 2 (id=3241): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$xdp(&(0x7f00000e2000/0x1000)=nil, 0x1000, 0x2000000, 0x50, 0xffffffffffffffff, 0x100000000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000000000000a600"/20, @ANYRES32=0x0, @ANYBLOB="00000000060000000a00030008e7eebc872f0000180012800e00010077697265677561726400000004000280"], 0x44}}, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a000000"], 0x190) syz_emit_ethernet(0x46, &(0x7f0000000a80)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6000000000103a00fe8000000000000000000000000000bbff020000"], 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r9, &(0x7f0000001900)={&(0x7f00000010c0)={0x2, 0x4e20, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x60, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x0, [{0x6, 0x9, "ecb2be5d32cf09"}]}, @timestamp_prespec={0x44, 0xc, 0x33, 0x3, 0xd, [{@broadcast, 0x1}]}, @timestamp_addr={0x44, 0x34, 0x78, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0xff, 0x0}, 0x4}, {@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x33}, 0xffffffee}, {@multicast1, 0x9}, {@multicast2, 0x7cca}, {@loopback, 0x6}]}, @noop]}}}], 0x60}, 0x20000010) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES32=r7, @ANYRESDEC=0x0, @ANYRES32=r0], 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x0) socket$packet(0x11, 0x2, 0x300) 27.074256084s ago: executing program 2 (id=3241): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$xdp(&(0x7f00000e2000/0x1000)=nil, 0x1000, 0x2000000, 0x50, 0xffffffffffffffff, 0x100000000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000000000000a600"/20, @ANYRES32=0x0, @ANYBLOB="00000000060000000a00030008e7eebc872f0000180012800e00010077697265677561726400000004000280"], 0x44}}, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a000000"], 0x190) syz_emit_ethernet(0x46, &(0x7f0000000a80)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6000000000103a00fe8000000000000000000000000000bbff020000"], 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r9, &(0x7f0000001900)={&(0x7f00000010c0)={0x2, 0x4e20, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x60, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x0, [{0x6, 0x9, "ecb2be5d32cf09"}]}, @timestamp_prespec={0x44, 0xc, 0x33, 0x3, 0xd, [{@broadcast, 0x1}]}, @timestamp_addr={0x44, 0x34, 0x78, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0xff, 0x0}, 0x4}, {@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x33}, 0xffffffee}, {@multicast1, 0x9}, {@multicast2, 0x7cca}, {@loopback, 0x6}]}, @noop]}}}], 0x60}, 0x20000010) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES32=r7, @ANYRESDEC=0x0, @ANYRES32=r0], 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x0) socket$packet(0x11, 0x2, 0x300) 21.880587978s ago: executing program 3 (id=3076): r0 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x1c1000) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1d9, 0x0, 0x7}]}) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xcf, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000000)) 18.346614757s ago: executing program 2 (id=3241): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$xdp(&(0x7f00000e2000/0x1000)=nil, 0x1000, 0x2000000, 0x50, 0xffffffffffffffff, 0x100000000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000000000000a600"/20, @ANYRES32=0x0, @ANYBLOB="00000000060000000a00030008e7eebc872f0000180012800e00010077697265677561726400000004000280"], 0x44}}, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a000000"], 0x190) syz_emit_ethernet(0x46, &(0x7f0000000a80)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6000000000103a00fe8000000000000000000000000000bbff020000"], 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r9, &(0x7f0000001900)={&(0x7f00000010c0)={0x2, 0x4e20, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x60, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x0, [{0x6, 0x9, "ecb2be5d32cf09"}]}, @timestamp_prespec={0x44, 0xc, 0x33, 0x3, 0xd, [{@broadcast, 0x1}]}, @timestamp_addr={0x44, 0x34, 0x78, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0xff, 0x0}, 0x4}, {@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x33}, 0xffffffee}, {@multicast1, 0x9}, {@multicast2, 0x7cca}, {@loopback, 0x6}]}, @noop]}}}], 0x60}, 0x20000010) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES32=r7, @ANYRESDEC=0x0, @ANYRES32=r0], 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x0) socket$packet(0x11, 0x2, 0x300) 17.034382787s ago: executing program 2 (id=3241): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$xdp(&(0x7f00000e2000/0x1000)=nil, 0x1000, 0x2000000, 0x50, 0xffffffffffffffff, 0x100000000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000000000000a600"/20, @ANYRES32=0x0, @ANYBLOB="00000000060000000a00030008e7eebc872f0000180012800e00010077697265677561726400000004000280"], 0x44}}, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a000000"], 0x190) syz_emit_ethernet(0x46, &(0x7f0000000a80)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6000000000103a00fe8000000000000000000000000000bbff020000"], 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r9, &(0x7f0000001900)={&(0x7f00000010c0)={0x2, 0x4e20, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x60, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x0, [{0x6, 0x9, "ecb2be5d32cf09"}]}, @timestamp_prespec={0x44, 0xc, 0x33, 0x3, 0xd, [{@broadcast, 0x1}]}, @timestamp_addr={0x44, 0x34, 0x78, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0xff, 0x0}, 0x4}, {@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x33}, 0xffffffee}, {@multicast1, 0x9}, {@multicast2, 0x7cca}, {@loopback, 0x6}]}, @noop]}}}], 0x60}, 0x20000010) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES32=r7, @ANYRESDEC=0x0, @ANYRES32=r0], 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x0) socket$packet(0x11, 0x2, 0x300) 10.757885964s ago: executing program 3 (id=3076): r0 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x1c1000) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1d9, 0x0, 0x7}]}) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xcf, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000000)) 9.216459112s ago: executing program 0 (id=3320): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$dma_heap(0xffffffffffffff9c, &(0x7f00000000c0), 0x341102, 0x0) memfd_secret(0x80000) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x95) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000340)={0x2000, r4}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x115883, 0x0) close(0xffffffffffffffff) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r6 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f0000000500)={0x60, 0x1, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000d11000/0x2000)=nil, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x10, 0x58}) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$DRM_IOCTL_GET_STATS(0xffffffffffffffff, 0x80f86406, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) 8.324419119s ago: executing program 0 (id=3324): inotify_init1(0x81800) mmap(&(0x7f000047f000/0x3000)=nil, 0x3000, 0xb635773f05ebbeef, 0x30, 0xffffffffffffffff, 0x1000) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) r0 = dup(0xffffffffffffffff) bind$inet(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x2006, 0x498e82) read$FUSE(0xffffffffffffffff, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000083c0)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0226cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734bc5862ef52983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1d7abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296565722d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fd92bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f46dc53a26fd997f3af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c51ca11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff14427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c97cba5ca94ef1c555d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46babdb9247ce8eabad9718a8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a650b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0ca62212a1b6d41043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5b38f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077be00000000d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc654ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f900", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x4000000000000, {0x0, 0x1ffff7ffe, 0x2, 0x6, 0x6, 0x7fc, {0x1, 0x8010001, 0x4d0, 0x2, 0x7fff, 0x0, 0x2, 0x2, 0x5, 0x2000, 0x7ff, r1, r2, 0x3d4, 0x20000002}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@rand_addr=0x64010102, @in=@remote, 0x4e23, 0x0, 0x4e20, 0x0, 0xa, 0x20, 0xe0, 0x87, 0x0, r1}, {0x5b2, 0x5156, 0x4c21, 0x7fffffffffffffff, 0x65a, 0x945, 0x4, 0x40}, {0x6, 0x2, 0x55, 0x4}, 0x0, 0x6e6bb6, 0x1, 0x1, 0x4}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4d4, 0x17}, 0x0, @in=@loopback, 0x3506, 0x0, 0x1, 0x4, 0x5, 0xa, 0xae42}}, 0xe8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000580)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r5, 0xc4c85513, &(0x7f0000000000)={0x2, 0x4, 0x1, 0x0, 'syz1\x00', 0x109a7}) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = getpid() syz_pidfd_open(r6, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, 0x0, 0x0, 0x2, 0x0) r9 = syz_io_uring_setup(0x8d2, &(0x7f00000002c0)={0x0, 0xfffffffc, 0x400, 0x3, 0x374}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r9, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, 0x0, 0x0, {0x1, 0xf1, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) 7.280685398s ago: executing program 2 (id=3241): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$xdp(&(0x7f00000e2000/0x1000)=nil, 0x1000, 0x2000000, 0x50, 0xffffffffffffffff, 0x100000000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000000000000a600"/20, @ANYRES32=0x0, @ANYBLOB="00000000060000000a00030008e7eebc872f0000180012800e00010077697265677561726400000004000280"], 0x44}}, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a000000"], 0x190) syz_emit_ethernet(0x46, &(0x7f0000000a80)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6000000000103a00fe8000000000000000000000000000bbff020000"], 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r9, &(0x7f0000001900)={&(0x7f00000010c0)={0x2, 0x4e20, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x60, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x0, [{0x6, 0x9, "ecb2be5d32cf09"}]}, @timestamp_prespec={0x44, 0xc, 0x33, 0x3, 0xd, [{@broadcast, 0x1}]}, @timestamp_addr={0x44, 0x34, 0x78, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0xff, 0x0}, 0x4}, {@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x33}, 0xffffffee}, {@multicast1, 0x9}, {@multicast2, 0x7cca}, {@loopback, 0x6}]}, @noop]}}}], 0x60}, 0x20000010) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES32=r7, @ANYRESDEC=0x0, @ANYRES32=r0], 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x0) socket$packet(0x11, 0x2, 0x300) 6.33508208s ago: executing program 0 (id=3327): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x18, &(0x7f0000000000)=0xffff, 0x4) sendmmsg$inet6(r0, &(0x7f0000006b80)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x0, @local}, 0x1c, 0x0}}], 0x1, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000d972a440b72040155ab7010203010902120001000000000904800000ff"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, &(0x7f00000001c0)={0x40, 0xc, 0x3, '\fr\r'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="0015080000001c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f0000000280)={0x2c, &(0x7f0000000080)={0x20, 0x23, 0xf0, {0xf0, 0x21, "11b7f24b7d2dee07a31f34aba04737a56c349165f43d5e67b5c5f0ff2f44900c222a567869b4bfc29dc253f6fce53ee4c9d34d7edfd02be7b61c6b1d9f473741ffab900dd5d95a86b60e832861289664b5c9033bdbc9ad81666a981123ef5c91ea387f803dc275bd4b9763b29ef04d2e66318b2db3ba62054c3f2468e454bcbe68ca2b0261a5c1946158b2697abb85f3d95918a41296b14b65ec7df56971b70f4ed4dc744dabb2a6024c17a6437f5e2836d43f46d1240566de73712055ac1b9ccf5428498b042ea5e8927fba9430cec05b89bd3e08093229e4ba1af6db41e54bc7d56c1ba8a9826142498239f50d"}}, &(0x7f0000000180)={0x0, 0x3, 0x25, @string={0x25, 0x3, "3c32c2cb50b122bcf42ef5aa60c77b10ae6af20becc387dbfa75fbbdaa87ba8dec83e0"}}, &(0x7f00000001c0)={0x0, 0xf, 0x1a, {0x5, 0xf, 0x1a, 0x3, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x2, 0x22, 0x1, 0x98, 0x8001, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0xd, 0x9, 0xffff}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0xa, 0x10, 0x5, 0x6, "f4ca3d41", "b1d27adf"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf3, 0x0, 0x2, 0x4, 0x3, 0x5, 0x8}}}, &(0x7f0000000740)={0x84, &(0x7f00000002c0)={0x20, 0x30, 0xb1, "b058e99453715b68f95fea6d974082ff627795bf60f6300febb587c8ab89c919dea74f3c64f3bb352690ea9c8828a1afd2ccb6542c89724b1dc23f5e2ad491fa7db71abde0dcf622dc6cd70931bae51060693842a7aa0888a6d1dded75fb58618bc64df0a72e5ab5c106ee40ccfafd0ccc05d3386dc913059bfa9db160e6c03cb35538eeee70d54c9549f3da1204e5c728da0cb741cc9af0e70179db2be55fe41fb4d7996a3ca35c91fdfb2b25150ac808"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000400)={0x20, 0x0, 0x4}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x400, 0x10}}, &(0x7f0000000480)={0x40, 0x7, 0x2, 0x2}, &(0x7f00000004c0)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000500)={0x40, 0xb, 0x2, "0a9e"}, &(0x7f0000000540)={0x40, 0xf, 0x2, 0x4}, &(0x7f0000000580)={0x40, 0x13, 0x6, @multicast}, &(0x7f00000005c0)={0x40, 0x17, 0x6, @random="197c74d6dd7c"}, &(0x7f0000000600)={0x40, 0x19, 0x2, '\n7'}, &(0x7f0000000640)={0x40, 0x1a, 0x2, 0xd9}, &(0x7f0000000680)={0x40, 0x1c, 0x1, 0x81}, &(0x7f00000006c0)={0x40, 0x1e, 0x1, 0x3}, &(0x7f0000000700)={0x40, 0x21, 0x1, 0xc7}}) 6.228563178s ago: executing program 5 (id=3328): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000001100)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x20, 0x67, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x14}}, {0x4e20, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x3, 0x4, 0x100, @void}}}}}, 0x2e) 6.08071928s ago: executing program 5 (id=3329): bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000900)=ANY=[@ANYBLOB="1d0000000400000002000000000000000102", @ANYRES32, @ANYBLOB="0000000000000000000000920000000000000000987a4292f0c18a9312b0552b303a007698998e70a1711bb63b687d971e8bcd331a45e512a7187503ce19edc7ba2c8d328bee9c94547b38af3c9701fe20a3548b9f85700aa9d8320c8efb0947dc64215e4bcf972904f2293f2e086b35745b665c81143d12adf3855680b6531fe59d72c357023694651d7ea44bd60ad77c97ba05124199ca71177769eaf79efd98740fd5abd80fd213240b805b3fc9975dcc5591d1b20fdb8d123d57481edb4330be4ad19efe07879e3c3892b9", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000005"], 0x48) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000600)=@gcm_256={{0x304}, "ed649d8448419757", "b6350d4c214f323d45da5d661422e41f69fe1ff928fe123f5c26fa5d841b634f", "a2487b83", "15f11f930b93194a"}, 0x38) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a310000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000c00000009"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={0x0}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00000002c0)={0xa002a014}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07}, @generic={0x0, 0x2, "d588380003c1"}]}}}}}}, 0xfd6c) 5.905921887s ago: executing program 1 (id=3331): r0 = syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r1, &(0x7f0000000200)='m', 0x1) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000100)) socket$can_raw(0x1d, 0x3, 0x1) openat$misdntimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB], 0xf8}, 0x1, 0x0, 0x0, 0x2000c814}, 0x4000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_getscheduler(r0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0xa5) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000002240), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101140, 0x0) 5.872461072s ago: executing program 2 (id=3241): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$xdp(&(0x7f00000e2000/0x1000)=nil, 0x1000, 0x2000000, 0x50, 0xffffffffffffffff, 0x100000000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000000000000a600"/20, @ANYRES32=0x0, @ANYBLOB="00000000060000000a00030008e7eebc872f0000180012800e00010077697265677561726400000004000280"], 0x44}}, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a000000"], 0x190) syz_emit_ethernet(0x46, &(0x7f0000000a80)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6000000000103a00fe8000000000000000000000000000bbff020000"], 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r9, &(0x7f0000001900)={&(0x7f00000010c0)={0x2, 0x4e20, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x60, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x0, [{0x6, 0x9, "ecb2be5d32cf09"}]}, @timestamp_prespec={0x44, 0xc, 0x33, 0x3, 0xd, [{@broadcast, 0x1}]}, @timestamp_addr={0x44, 0x34, 0x78, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0xff, 0x0}, 0x4}, {@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x33}, 0xffffffee}, {@multicast1, 0x9}, {@multicast2, 0x7cca}, {@loopback, 0x6}]}, @noop]}}}], 0x60}, 0x20000010) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES32=r7, @ANYRESDEC=0x0, @ANYRES32=r0], 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x0) socket$packet(0x11, 0x2, 0x300) 5.822876951s ago: executing program 5 (id=3332): ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x14) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000480)={{0x4, 0x0, 0xfffc, 0x805}, 'syz0\x00', 0x40}) r0 = socket$packet(0x11, 0x3, 0x300) dup(r0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000340)) dup(r2) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) ptrace$setsig(0x4203, r4, 0x6, &(0x7f00000000c0)={0x37, 0x1ff, 0x7}) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) tgkill(r4, r4, 0x29) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000400000003"], 0x48) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x15, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="1808000060000000000000000000008018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bc0908000000000035090100000000009500000000070000b7020000000000007b9a00fe000000006609000000000000dbaaf0ff10010000bf8620000000000007080000f8ffffffbfa400000000000007040000f0ffffff770000000800000018220000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000180000084609f0ff76000000bf9800000000000056080000000018008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.565945619s ago: executing program 1 (id=3333): r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xc8df, 0xcb08, 0xa, 0x20002f7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000100)={'\x00', 0x2, 0xfffffffc, 0x0, 0x3059b452, 0x1, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@cred={{0x1c, 0x1, 0x2, {r3, 0xffffffffffffffff, 0xffffffffffffffff}}}], 0x20, 0x40044}}], 0x1, 0x4) close_range(r0, r1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) syz_clone(0x41871400, 0x0, 0xffffffffffffff80, 0x0, 0x0, 0x0) io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) 3.636982091s ago: executing program 1 (id=3334): sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x54, 0x0, 0xfe12482fe0801d67, 0x0, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x3, 0x8e, 0x1f}, {0xc, 0x8f, 0x1}, {0xc, 0x90, 0x17bfffc}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40010}, 0x4000) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000080)={'ah\x00'}, 0x0) socket$inet6(0xa, 0x3, 0xff) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) pipe(0x0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x10d00, 0xf) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@remote, 0x0, 0x2}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYRES32], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x844) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, &(0x7f0000000100)) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(0xffffffffffffffff, 0x84, 0x78, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 3.456003623s ago: executing program 1 (id=3335): syz_init_net_socket$rose(0xb, 0x5, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="44000000100001040400"/20, @ANYRES32=0x0, @ANYBLOB="00200000421005001000128008000100767469"], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=@newtaction={0x470, 0x30, 0x4, 0x0, 0x0, {}, [{0x45c, 0x1, [@m_mpls={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x3}]}, {0x4, 0x4}, {0xc}, {0xc}}}, @m_sample={0x174, 0x6, 0x0, 0x0, {{0xb}, {0x6c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xc4}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x40, 0x7, 0x3, 0x513, 0x10}}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x1}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x80000000, 0x3, 0x7, 0x9, 0x9}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x6c6}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x3, 0xda5a, 0x8, 0x4000000, 0xa}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}]}, {0xe0, 0x6, "3e391525017f26eed64a0645cf1d0ceadcbe202b9b5ad4cb1a1f7967ad541478aeeb132e4390021bc0e0246565e14071d3c467905e431cf13d535251a8cb197db744ec3d26acf09f690ed097cd45cbccbba282652fa47d028eb5935ec9f3b73edba24446b971c25a71cbbe95e3af4d106549aa8de388a4649a6e4201f6a382f78a0ab7e09e9d135cecb6b2f342e8938626726d6c6174baf570746234c937205355beb167705683cba1dbe6097e4df1a6ef31c5275dc06a0a2e5f4aa17d1515f81c6cf23be80d7173aba208548ea3e34c582b468ebb12b9351a646040"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_mpls={0xb4, 0xf, 0x0, 0x0, {{0x9}, {0x64, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x5c, 0x5, 0x4, 0xf}, 0x1}}, @TCA_MPLS_LABEL={0x8, 0x5, 0x287a9}, @TCA_MPLS_BOS={0x5}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x68, 0xa, 0x2, 0xa, 0xb}, 0x2}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x88f7}, @TCA_MPLS_PROTO={0x6, 0x4, 0x5}, @TCA_MPLS_TC={0x5}]}, {0x25, 0x6, "5ca0e3b72afc32b8630159154d59fd2f9e2043c79a3ce60f389203f23a1f363a9b"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_ctinfo={0x5c, 0x14, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x4}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x8000}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8}]}, {0x10, 0x6, "60467add7ca78ddf5e33f8d4"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3}}}}, @m_connmark={0x19c, 0x17, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffff001, 0x5, 0x20000003, 0x6}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5, 0xffff, 0x1, 0x7, 0x9}, 0x1000}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x4, 0x20000000, 0x9, 0x2}, 0x57}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x7b4, 0x7, 0xffff4f53, 0x80000000}, 0x800}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x401, 0x10000000, 0x2000000, 0xffff}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xb, 0xfffffffd, 0x7, 0x9, 0x2521}, 0x800}}]}, {0xc4, 0x6, "572266369a44f77d7289234594caa96f99f7de13edb53e9f08f83260b7020b552645872064d5eccc3963b4a93d98f94e86902dd8aa711d5f8d786dfe416fe98b84e652decc4da4c4b67004e601beec34aee98f00221b802315550199c8689964c94110dd335f0685f36411f208e71183b7cef02bf0127e9caced1b02ec24152130e0ac0c7781e47d803022284c157a0372f5da7703657de269d851bc062e8bfcf7c589a218ceca90d66b6c73ee5e6ad2ff3648601db47c010f07fc74f3ea2e58"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x470}}, 0x40000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0xb1) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket(0x2c, 0x3, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) mount$afs(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="64796e2c6175746f63656c6c2c0056285416ef099f07faeb362dfbe73f7e119a"]) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r5, 0x0, &(0x7f0000000080)=@udp6=r4}, 0x20) close(r4) r6 = syz_open_procfs(0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000007440), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYRES16=r9, @ANYBLOB="010027bd7000fedbdf250c000000080006"], 0x24}, 0x1, 0x0, 0x0, 0x4c001}, 0x10) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r6, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) recvmsg$can_bcm(r6, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1f, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r10, 0xae80, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x61, &(0x7f0000000700)={'filter\x00', 0x48}, 0xffffffffffffffbe) 3.217067349s ago: executing program 0 (id=3336): r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="06000000040000005b0000008a00000000000000", @ANYRES8=r1, @ANYRES32, @ANYBLOB="000000ec000000000000000000000000000000f95d7688232705f200f932cb3ad635067932c2a7cfa2944e6dfaa3e49037ea6d902bb3b5d798e3a773cb12f99e87f4565507d0bea6190f58d38710160606a37e6f2ce8f52854859fb79b7648dda17635c229d0f15b188a6307d9b4b6b5c23b22beb6"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000500)={{r4}, &(0x7f0000000480), &(0x7f00000004c0)='%pB \x00'}, 0x20) r5 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1b, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000003e00250304000000000000000a"], 0x14}, 0x1, 0x0, 0x0, 0x2000c001}, 0x80084) syz_io_uring_submit(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x9, 0x5, 0x9, 0x2, 0x80000001}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, &(0x7f0000000140)=0x9a7, 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) syz_clone3(&(0x7f0000000580)={0x111840000, 0x0, 0x0, 0x0, {0x25}, 0x0, 0x0, 0x0, 0x0}, 0x58) 2.356386426s ago: executing program 5 (id=3337): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x5, 0x0, 0x0, 0x5}, 'syz1\x00'}) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x4) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$UI_DEV_DESTROY(r1, 0x5502) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0x40045304, &(0x7f0000000540)={{}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x116}) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80001) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x6f) read$dsp(0xffffffffffffffff, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r4, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="0500000000", @ANYRES32], 0x24}}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1e) 2.297164305s ago: executing program 1 (id=3338): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0x4, &(0x7f0000000500)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2e}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) r5 = syz_io_uring_setup(0x1ed3, &(0x7f0000000240)={0x0, 0x0, 0x10100, 0x5, 0x279}, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='('], 0x38}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='pids.current\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r8, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x8, 0x0, 0x0, 0x9, 0x7, 0x1}) io_uring_enter(r5, 0x2d3e, 0x0, 0x0, 0x0, 0x0) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00', @ANYRES16=r3, @ANYRES32=r4, @ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f00000004c0)={'wpan0\x00', 0x0}) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), r9) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r9, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x1c, r11, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040041}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4100}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x90, r1, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_SEC_LEVEL={0x3c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x2}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x6e}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x6}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}]}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x90}}, 0x20005040) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x28, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) chdir(&(0x7f0000000040)='./file0\x00') socket$nl_route(0x10, 0x3, 0x0) 2.084846692s ago: executing program 0 (id=3339): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r4, 0x40045569, 0x4) ioctl$UI_DEV_CREATE(r4, 0x5501) ioctl$UI_DEV_DESTROY(r4, 0x5502) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r6, 0x40045304, &(0x7f0000000540)={{}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x116}) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80001) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r7, 0xc0045006, &(0x7f0000000180)=0x6f) read$dsp(0xffffffffffffffff, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r7, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001380)=ANY=[@ANYBLOB="5c19e81552cc510000b8c6b70de613b811df709602cb9634b068a62f02fc4a044e908eedc65e444877fc2e2a723f9914291b2a7149dc10c05678d4d5be36a73b0eaade89f81f3402e8049462c26b19229891df93d0801112109c325b6cede44347841b4b6127e625cf14357bcdee356ebf7efdf5f27995f876a70d72afc588b168f11dd738c1d0ceadf77b05000000775720b7f12c885b8e465f9820060b23ab6aa45799b51083204c2e7d38", @ANYRES16=r1, @ANYBLOB="475d26bd7000fedbdf251400000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8005}, 0x4040000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="0500000000", @ANYRES32], 0x24}}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1e) 122.084108ms ago: executing program 0 (id=3340): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r7, {0x0, 0xffe0}, {0xffe0, 0xb}, {0xd, 0xd}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x3, 0x8}}}]}, 0x3c}}, 0x4010804) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 96.258977ms ago: executing program 5 (id=3341): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x90) (async) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) (async) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) (async) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdir(0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000140)=r3, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 45.382066ms ago: executing program 1 (id=3342): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000200)="66b9a00d00000f32dbd567f0879f00a00000670f4fa1ea000000660f388080062e0f01c5baf80c66b8d789868866efbafc0cec0f0666b9800000c00f320f304466b8010000000f23d80f21f86635800000300f23f866350a00000044360f01d1", 0x60}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x0, 0xf, 0x24, 0x3, 0x0, 0x3, 0x0, 0x7, 0x6, 0x6, 0x7f}}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000080)=ANY=[@ANYBLOB="58000000009b", @ANYRES32=0x0, @ANYBLOB="a400060040000000240012800c0001006d6163766c616e001400028008000100100000000800030002000000140035006d6163766c616e300000000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x8840}, 0x8000) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x8000000000000035, 0x400ffc, 0x14000000215b9037, 0x40190, 0x1, 0x11, 0x8000000000f2, 0x7, 0x3, 0x20000005, 0x5, 0xc6bd, 0x568, 0x45, 0x5, 0x7], 0x6006, 0x1c0293}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r4, &(0x7f0000000480)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd", 0x12}, {&(0x7f00000004c0)="b70000000180", 0x6}, {&(0x7f00000003c0)="06000000750d08c4daf10a7742e39e31ceefb1fcd2e5bc3fc84150da0d1787cc10d211447da94c", 0x27}], 0x3) 0s ago: executing program 5 (id=3343): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000100)={{0x5, 0x0, 0x0, 0x5}, 'syz1\x00'}) ioctl$UI_SET_LEDBIT(r4, 0x40045569, 0x4) ioctl$UI_DEV_CREATE(r4, 0x5501) ioctl$UI_DEV_DESTROY(r4, 0x5502) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r6, 0x40045304, &(0x7f0000000540)={{}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x116}) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80001) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r7, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r7, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001380)=ANY=[@ANYBLOB="5c19e81552cc510000b8c6b70de613b811df709602cb9634b068a62f02fc4a044e908eedc65e444877fc2e2a723f9914291b2a7149dc10c05678d4d5be36a73b0eaade89f81f3402e8049462c26b19229891df93d0801112109c325b6cede44347841b4b6127e625cf14357bcdee356ebf7efdf5f27995f876a70d72afc588b168f11dd738c1d0ceadf77b05000000775720b7f12c885b8e465f9820060b23ab6aa45799b51083204c2e7d38", @ANYRES16=r1, @ANYBLOB="475d26bd7000fedbdf251400000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8005}, 0x4040000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="0500000000", @ANYRES32], 0x24}}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1e) kernel console output (not intermixed with test programs): 9] usb 2-1: not running at top speed; connect to a high speed hub [ 515.003492][ T9] usb 2-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 515.014210][ T9] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 515.045529][ T9] usb 2-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 515.058153][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.148734][ T9] usb 2-1: Product: syz [ 515.196114][ T9] usb 2-1: Manufacturer: syz [ 515.225016][T14818] syzkaller0: entered promiscuous mode [ 515.230857][T14818] syzkaller0: entered allmulticast mode [ 515.245172][ T9] usb 2-1: SerialNumber: syz [ 515.519462][T14825] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2722'. [ 515.659688][ T9] usb 2-1: USB disconnect, device number 32 [ 515.753342][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 516.616991][T14838] fuse: Bad value for 'fd' [ 518.539062][T14870] input: syz1 as /devices/virtual/input/input25 [ 518.668575][T14876] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 520.192455][T14889] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2737'. [ 521.146860][T14907] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 521.750219][ T5879] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 522.035243][ T5879] usb 6-1: Using ep0 maxpacket: 8 [ 522.042891][ T5879] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 522.054809][ T5879] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 522.065001][ T5879] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 522.074297][ T5879] usb 6-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 2, skipping [ 522.085670][ T5879] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 522.100417][ T5879] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 522.110321][ T5879] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.118560][ T5879] usb 6-1: Product: syz [ 522.146340][ T5879] usb 6-1: Manufacturer: syz [ 522.180918][ T5879] usb 6-1: SerialNumber: syz [ 522.513748][ T5879] usb 6-1: 0:2 : does not exist [ 522.529350][T14925] syzkaller0: entered promiscuous mode [ 522.546714][ T5879] usb 6-1: USB disconnect, device number 22 [ 522.560152][T14925] syzkaller0: entered allmulticast mode [ 522.587550][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 526.956212][T14982] IPVS: sh: FWM 3 0x00000003 - no destination available [ 527.163142][T14986] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 528.056642][T14995] syzkaller0: entered promiscuous mode [ 528.090974][T14995] syzkaller0: entered allmulticast mode [ 528.129487][T15004] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2768'. [ 530.048484][T15020] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2775'. [ 531.765394][T15053] syzkaller1: entered promiscuous mode [ 531.778362][T15053] syzkaller1: entered allmulticast mode [ 532.439584][T15060] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2783'. [ 532.439684][T15059] netlink: 'syz.1.2784': attribute type 10 has an invalid length. [ 535.628311][T15078] syzkaller0: entered promiscuous mode [ 535.651509][T15078] syzkaller0: entered allmulticast mode [ 537.346487][T15102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2797'. [ 539.028471][T15130] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2807'. [ 539.400096][ T30] audit: type=1400 audit(1770605795.724:516): avc: denied { connect } for pid=15126 comm="syz.2.2805" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 539.806685][T15137] syzkaller0: entered promiscuous mode [ 539.812766][T15137] syzkaller0: entered allmulticast mode [ 539.920296][T15141] syzkaller0: entered promiscuous mode [ 539.928368][T15141] syzkaller0: entered allmulticast mode [ 539.935297][ T1104] syzkaller0: tun_net_xmit 70 [ 539.942238][T15143] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2812'. [ 540.483895][T15151] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2813'. [ 541.120098][ T9] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 541.280137][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 541.287527][ T9] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 541.296266][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 541.307167][ T9] usb 6-1: config 0 has no interface number 0 [ 541.314688][ T9] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 541.325662][ T9] usb 6-1: config 0 interface 55 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 541.339008][ T9] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 541.348654][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.366993][ T9] usb 6-1: config 0 descriptor?? [ 541.379282][ T9] ldusb 6-1:0.55: Interrupt in endpoint not found [ 541.653072][T15151] netlink: 88 bytes leftover after parsing attributes in process `syz.1.2813'. [ 541.860231][ T9] usb 6-1: USB disconnect, device number 23 [ 541.878618][T15162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2818'. [ 543.607307][T15187] tipc: Enabled bearer , priority 0 [ 544.133206][T15187] tipc: Resetting bearer [ 544.194196][T15192] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 544.204576][T15183] tipc: Disabling bearer [ 544.365599][T15192] netlink: 'syz.2.2826': attribute type 1 has an invalid length. [ 544.373623][T15192] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2826'. [ 544.870347][T15198] syzkaller0: entered promiscuous mode [ 544.889958][T15204] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2830'. [ 544.901032][T15198] syzkaller0: entered allmulticast mode [ 545.038319][T15208] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2832'. [ 545.150408][T15210] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2831'. [ 549.171018][T15236] tipc: Enabling of bearer rejected, failed to enable media [ 549.861739][T15261] tipc: Enabled bearer , priority 0 [ 549.876629][T15261] tipc: Resetting bearer [ 549.922599][T15259] tipc: Disabling bearer [ 549.977027][T15269] input: syz1 as /devices/virtual/input/input26 [ 550.171500][ T9] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 550.185694][T15273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 551.042500][T15286] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 551.148490][T15288] netlink: 'syz.5.2850': attribute type 298 has an invalid length. [ 551.162001][T15288] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.171286][T15288] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.234939][T15289] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.243939][T15289] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.256577][T15289] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.265512][T15289] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.543575][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 551.561266][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 551.580732][ T9] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 551.594349][ T9] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 551.594521][T15292] syzkaller0: entered promiscuous mode [ 551.609338][T15292] syzkaller0: entered allmulticast mode [ 551.616420][ T9] usb 1-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 551.625691][T15288] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.634585][T15288] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2850'. [ 551.646408][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.656262][ T9] usb 1-1: Product: syz [ 551.660762][ T9] usb 1-1: Manufacturer: syz [ 551.665449][ T9] usb 1-1: SerialNumber: syz [ 551.993830][ T9] usb 1-1: USB disconnect, device number 31 [ 552.979538][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 553.196079][T15302] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2854'. [ 553.416445][T15308] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2855'. [ 555.237442][T15325] tipc: Enabling of bearer rejected, failed to enable media [ 555.327221][T15335] input: syz1 as /devices/virtual/input/input27 [ 555.544414][T15339] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 555.578583][T15337] syzkaller0: entered promiscuous mode [ 555.615866][T15337] syzkaller0: entered allmulticast mode [ 556.951348][T15342] netlink: 'syz.3.2862': attribute type 10 has an invalid length. [ 558.291163][ T9] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 558.892556][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 558.905891][T15368] IPVS: sh: FWM 3 0x00000003 - no destination available [ 558.929818][ T9] usb 3-1: not running at top speed; connect to a high speed hub [ 558.944533][ T9] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 558.951602][T15366] syzkaller0: entered promiscuous mode [ 558.964726][T15366] syzkaller0: entered allmulticast mode [ 558.969356][ T9] usb 3-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 558.989694][ T9] usb 3-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 558.999442][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.008714][ T9] usb 3-1: Product: syz [ 559.013588][ T9] usb 3-1: Manufacturer: syz [ 559.018335][ T9] usb 3-1: SerialNumber: syz [ 559.384223][ T9] usb 3-1: USB disconnect, device number 22 [ 559.821496][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 561.854733][T15394] netlink: 240 bytes leftover after parsing attributes in process `syz.5.2877'. [ 561.963748][T15397] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2878'. [ 562.015946][T15398] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2878'. [ 562.454792][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.218213][T15406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2880'. [ 563.320071][ T9] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 563.508936][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 563.905332][ T9] usb 6-1: not running at top speed; connect to a high speed hub [ 563.971549][ T9] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 563.990980][ T9] usb 6-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 564.003417][T15419] syzkaller0: entered promiscuous mode [ 564.008900][T15419] syzkaller0: entered allmulticast mode [ 564.023655][ T9] usb 6-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 564.035532][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.050227][ T9] usb 6-1: Product: syz [ 564.054464][ T9] usb 6-1: Manufacturer: syz [ 564.059060][ T9] usb 6-1: SerialNumber: syz [ 564.514469][T15427] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2889'. [ 564.646758][ T9] usb 6-1: USB disconnect, device number 24 [ 564.891561][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 564.925735][T15433] syzkaller0: entered promiscuous mode [ 564.980108][T15433] syzkaller0: entered allmulticast mode [ 565.886445][T15452] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2895'. [ 567.801874][T15470] syzkaller0: entered promiscuous mode [ 567.807391][T15470] syzkaller0: entered allmulticast mode [ 567.868536][ T36] syzkaller0: tun_net_xmit 70 [ 567.951129][T15479] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2901'. [ 568.556035][T15478] syzkaller1: entered promiscuous mode [ 568.563318][T15478] syzkaller1: entered allmulticast mode [ 568.907045][T15498] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2907'. [ 571.565017][T15548] tipc: Enabled bearer , priority 0 [ 571.573528][T15548] syzkaller0: entered promiscuous mode [ 571.579950][T15548] syzkaller0: entered allmulticast mode [ 571.603140][T15548] tipc: Resetting bearer [ 571.622690][T15544] tipc: Resetting bearer [ 571.655904][T15544] tipc: Disabling bearer [ 572.220079][ T10] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 572.420403][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 572.443833][ T10] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 572.464223][ T10] usb 1-1: config 0 has no interface number 0 [ 572.535688][ T10] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 572.603545][ T10] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 572.622237][ T10] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 572.661022][ T10] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 572.744761][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.782443][ T10] usb 1-1: config 0 descriptor?? [ 572.799681][ T10] ldusb 1-1:0.55: Interrupt in endpoint not found [ 573.257804][ T9024] usb 1-1: USB disconnect, device number 32 [ 574.319163][T15616] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2928'. [ 574.630308][T15625] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2931'. [ 575.142497][T15636] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2935'. [ 575.608731][T15641] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2934'. [ 577.128817][T15659] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2940'. [ 577.270254][ T9024] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 577.380123][T15657] syzkaller0: entered promiscuous mode [ 577.385650][T15657] syzkaller0: entered allmulticast mode [ 577.500482][ T9024] usb 4-1: Using ep0 maxpacket: 8 [ 577.515003][ T9024] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 577.532323][T15672] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2944'. [ 577.559652][ T9024] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 577.580187][ T9024] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 577.589436][ T9024] usb 4-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 2, skipping [ 577.609290][ T9024] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 577.646190][T15677] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2947'. [ 577.775017][ T9024] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 577.784428][ T9024] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.792592][ T9024] usb 4-1: Product: syz [ 577.796752][ T9024] usb 4-1: Manufacturer: syz [ 578.294046][ T9024] usb 4-1: SerialNumber: syz [ 578.353422][T15687] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2949'. [ 578.728362][ T9024] usb 4-1: 0:2 : does not exist [ 578.836149][ T9024] usb 4-1: USB disconnect, device number 20 [ 579.554210][T15696] input: syz1 as /devices/virtual/input/input28 [ 579.775753][T15698] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 580.390531][T15703] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 580.746814][T15707] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2954'. [ 581.084118][T15709] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2955'. [ 581.403541][T15719] netlink: 'syz.3.2956': attribute type 298 has an invalid length. [ 581.433208][T15719] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2956'. [ 581.442921][T15719] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2956'. [ 581.467315][T15719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2956'. [ 581.476259][T15719] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2956'. [ 581.487804][T15719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2956'. [ 581.496756][T15719] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2956'. [ 581.938365][T15723] syzkaller0: entered promiscuous mode [ 581.985671][T15723] syzkaller0: entered allmulticast mode [ 582.450985][T15734] netlink: 'syz.3.2960': attribute type 298 has an invalid length. [ 582.468084][T15734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2960'. [ 582.477124][T15734] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2960'. [ 582.730353][ T5879] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 582.970178][ T5879] usb 2-1: Using ep0 maxpacket: 8 [ 583.042707][ T5879] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 583.082057][ T5879] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 583.175921][ T5879] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 583.259007][ T5879] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 2, skipping [ 583.346951][ T5879] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 583.400792][ T5879] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 583.409872][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.441958][ T5879] usb 2-1: Product: syz [ 583.453128][ T5879] usb 2-1: Manufacturer: syz [ 583.460489][ T5879] usb 2-1: SerialNumber: syz [ 583.630055][ T9] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 583.828076][ T5879] usb 2-1: 0:2 : does not exist [ 583.859407][ T5879] usb 2-1: USB disconnect, device number 33 [ 583.915224][T15754] syzkaller0: entered promiscuous mode [ 583.935886][T15754] syzkaller0: entered allmulticast mode [ 583.987476][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 584.003293][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 584.018905][ T9] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 584.027724][ T9] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 584.039060][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 584.048254][ T9] usb 4-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 2, skipping [ 584.059267][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 584.112328][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 584.150726][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.186331][ T9] usb 4-1: Product: syz [ 584.207874][ T9] usb 4-1: Manufacturer: syz [ 584.244110][ T9] usb 4-1: SerialNumber: syz [ 584.515901][T15762] syzkaller0: entered promiscuous mode [ 584.523117][T15762] syzkaller0: entered allmulticast mode [ 584.567722][ T9] usb 4-1: 0:2 : does not exist [ 584.582376][ T9] usb 4-1: USB disconnect, device number 21 [ 584.612977][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 585.395022][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 585.412452][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 585.421338][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 585.429095][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 585.436694][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 586.020544][T15783] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 586.569070][T15794] __nla_validate_parse: 8 callbacks suppressed [ 586.569102][T15794] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2979'. [ 586.644058][T15795] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2979'. [ 586.653022][T15795] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2979'. [ 587.270981][T15793] netlink: 'syz.5.2979': attribute type 298 has an invalid length. [ 587.279198][T15794] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2979'. [ 587.279967][T15795] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2979'. [ 587.288626][T15794] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2979'. [ 587.297059][T15795] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2979'. [ 587.398362][T15803] netlink: 'syz.1.2982': attribute type 298 has an invalid length. [ 587.410800][T15803] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2982'. [ 587.420608][T15803] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2982'. [ 587.433915][T15803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2982'. [ 587.521253][T12317] Bluetooth: hci0: command tx timeout [ 587.909783][T15774] chnl_net:caif_netlink_parms(): no params data found [ 588.008575][T15808] syzkaller0: entered promiscuous mode [ 588.017014][T15808] syzkaller0: entered allmulticast mode [ 588.585259][T15819] input: syz1 as /devices/virtual/input/input29 [ 588.642886][T15774] bridge0: port 1(bridge_slave_0) entered blocking state [ 588.770483][T15774] bridge0: port 1(bridge_slave_0) entered disabled state [ 588.912224][T15774] bridge_slave_0: entered allmulticast mode [ 588.925034][T15774] bridge_slave_0: entered promiscuous mode [ 589.570736][T12317] Bluetooth: hci0: command tx timeout [ 589.702180][T15833] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 590.901286][T15774] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.939260][T15774] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.978690][T15774] bridge_slave_1: entered allmulticast mode [ 590.999442][T15774] bridge_slave_1: entered promiscuous mode [ 591.415297][T15774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 591.439608][T15774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 591.573526][T15774] team0: Port device team_slave_0 added [ 591.588610][T15774] team0: Port device team_slave_1 added [ 591.650405][T12317] Bluetooth: hci0: command tx timeout [ 591.668788][T15852] netlink: 'syz.3.2994': attribute type 1 has an invalid length. [ 591.678027][T15774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 591.700116][T15774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 591.729509][T15852] __nla_validate_parse: 3 callbacks suppressed [ 591.729524][T15852] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2994'. [ 591.745761][T15854] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input30 [ 591.800257][T15774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 591.842540][T15774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 591.849478][T15774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 591.876524][T15774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 592.750664][T15868] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2996'. [ 592.871834][T15866] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 592.904379][T15774] hsr_slave_0: entered promiscuous mode [ 592.917324][T15774] hsr_slave_1: entered promiscuous mode [ 592.974428][T15774] debugfs: 'hsr0' already exists in 'hsr' [ 592.997057][T15774] Cannot create hsr debugfs directory [ 593.750314][T12317] Bluetooth: hci0: command tx timeout [ 593.924793][T15774] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.936722][T15774] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.947686][ T10] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 594.029466][T15774] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.040268][T15774] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.140651][T15774] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.151263][T15774] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.468614][T15774] team0: Port device netdevsim0 removed [ 594.479597][T15774] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.490847][T15774] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.492131][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 594.509602][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 594.518231][ T10] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 594.528643][ T10] usb 6-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 594.539516][ T10] usb 6-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 594.548681][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.556858][ T10] usb 6-1: Product: syz [ 594.561134][ T10] usb 6-1: Manufacturer: syz [ 594.565766][ T10] usb 6-1: SerialNumber: syz [ 594.639578][T15774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 594.649573][T15774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 594.659142][T15774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 594.670746][T15774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 594.726299][T15774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 594.748226][T15774] 8021q: adding VLAN 0 to HW filter on device team0 [ 594.771905][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.779003][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 594.813085][ T7292] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.820226][ T7292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.032614][T15894] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3002'. [ 595.284889][T15774] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 595.387785][ T10] usb 6-1: USB disconnect, device number 25 [ 595.475795][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 595.534994][T15898] tipc: Enabling of bearer rejected, failed to enable media [ 595.886208][T15902] syzkaller0: entered promiscuous mode [ 595.900155][T15902] syzkaller0: entered allmulticast mode [ 595.914599][T15898] sch_tbf: burst 256 is lower than device syzkaller0 mtu (1514) ! [ 596.079414][T15910] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3005'. [ 596.169732][T15774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 596.191325][T15774] veth0_vlan: entered promiscuous mode [ 596.209418][T15774] veth1_vlan: entered promiscuous mode [ 596.229006][T15774] veth0_macvtap: entered promiscuous mode [ 596.286319][T15774] veth1_macvtap: entered promiscuous mode [ 596.314522][T15774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.325825][T15774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.428919][ T7292] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.438346][ T7292] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.451874][ T7292] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.461621][ T7292] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.071119][ T1104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.079105][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.253666][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.267950][ T1104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.655744][ T30] audit: type=1400 audit(1770605853.974:517): avc: denied { mounton } for pid=15774 comm="syz-executor" path="/root/syzkaller.fkpFy6/syz-tmp" dev="sda1" ino=2049 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 597.717603][ T30] audit: type=1400 audit(1770605853.974:518): avc: denied { mounton } for pid=15774 comm="syz-executor" path="/root/syzkaller.fkpFy6/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 598.170121][ T9024] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 598.412353][T15934] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3010'. [ 598.491461][ T9024] usb 6-1: Using ep0 maxpacket: 8 [ 598.515296][ T9024] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 598.593215][ T9024] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 598.609199][ T9024] usb 6-1: config 0 has no interface number 0 [ 598.634106][ T9024] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 598.711532][ T9024] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 598.744190][ T9024] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.762574][ T9024] usb 6-1: config 0 descriptor?? [ 598.780843][ T9024] ldusb 6-1:0.55: Interrupt in endpoint not found [ 599.221664][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 599.250240][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 599.275827][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 599.302591][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 599.350966][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 599.584980][ T9] usb 6-1: USB disconnect, device number 26 [ 599.779339][T15950] input: syz1 as /devices/virtual/input/input31 [ 599.799303][ T5807] syz_tun (unregistering): left allmulticast mode [ 599.940929][ T7292] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 599.951528][ T7292] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.078679][ T7292] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.090400][ T7292] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.177478][T15955] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 600.351599][ T7292] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.368311][ T7292] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.399475][T15942] chnl_net:caif_netlink_parms(): no params data found [ 600.447404][ T7292] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.457881][ T7292] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.509943][T15942] bridge0: port 1(bridge_slave_0) entered blocking state [ 600.518025][T15942] bridge0: port 1(bridge_slave_0) entered disabled state [ 600.525360][T15942] bridge_slave_0: entered allmulticast mode [ 600.532475][T15942] bridge_slave_0: entered promiscuous mode [ 600.553269][T15942] bridge0: port 2(bridge_slave_1) entered blocking state [ 600.570181][T15942] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.577329][T15942] bridge_slave_1: entered allmulticast mode [ 600.584951][T15942] bridge_slave_1: entered promiscuous mode [ 600.659595][T15965] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3016'. [ 600.694764][T15942] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 600.730920][T15942] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 600.759879][ T7292] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.771778][ T7292] bridge_slave_0: left allmulticast mode [ 600.777717][ T7292] bridge_slave_0: left promiscuous mode [ 600.784847][ T7292] bridge0: port 1(bridge_slave_0) entered disabled state [ 600.871685][T15926] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 601.493572][T12317] Bluetooth: hci4: command tx timeout [ 602.490772][ T793] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 602.853395][ T793] usb 3-1: unable to get BOS descriptor or descriptor too short [ 602.883629][ T793] usb 3-1: not running at top speed; connect to a high speed hub [ 602.913968][ T793] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 603.002099][T15976] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3020'. [ 603.011882][ T793] usb 3-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 603.032388][ T793] usb 3-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 603.050316][ T793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.058386][ T793] usb 3-1: Product: syz [ 603.066467][ T793] usb 3-1: Manufacturer: syz [ 603.071464][ T793] usb 3-1: SerialNumber: syz [ 603.212796][ T7292] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 603.234599][ T7292] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 603.253616][ T7292] bond0 (unregistering): Released all slaves [ 603.337584][ T793] usb 3-1: USB disconnect, device number 23 [ 603.382811][T15942] team0: Port device team_slave_0 added [ 603.421948][T15942] team0: Port device team_slave_1 added [ 603.427755][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 603.594884][T12317] Bluetooth: hci4: command tx timeout [ 603.763399][ T7292] tipc: Left network mode [ 603.813305][T15942] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 603.840871][T15942] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 603.893153][T15994] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3023'. [ 603.900025][T15942] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 604.010538][T16001] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 604.017781][T16001] IPv6: NLM_F_CREATE should be set when creating new route [ 604.090838][T15996] tipc: Enabling of bearer rejected, failed to enable media [ 604.167876][T16006] netlink: 'syz.5.3024': attribute type 298 has an invalid length. [ 604.195567][T16006] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.204538][T16006] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.270059][T16008] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.278974][T16008] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.290534][T16008] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.299417][T16008] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.423984][T15942] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 604.500450][T15942] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.588639][T15942] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 604.611610][T15991] syzkaller0: entered promiscuous mode [ 604.622632][T15991] syzkaller0: entered allmulticast mode [ 604.631052][T16003] sch_tbf: burst 256 is lower than device syzkaller0 mtu (1514) ! [ 604.829406][T16006] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.838572][T16006] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3024'. [ 604.925033][T16026] input: syz1 as /devices/virtual/input/input32 [ 605.014345][T16019] syzkaller1: entered promiscuous mode [ 605.019830][T16019] syzkaller1: entered allmulticast mode [ 605.197982][ T7292] hsr_slave_0: left promiscuous mode [ 605.805244][T12317] Bluetooth: hci4: command tx timeout [ 605.983858][ T7292] hsr_slave_1: left promiscuous mode [ 606.000356][ T7292] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 606.025379][ T7292] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 606.143720][ T7292] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 606.154683][T16037] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 606.164517][ T7292] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 606.211575][ T7292] veth1_macvtap: left promiscuous mode [ 606.229709][ T7292] veth0_macvtap: left promiscuous mode [ 606.266468][ T7292] veth1_vlan: left promiscuous mode [ 606.420215][ T7292] veth0_vlan: left promiscuous mode [ 607.890876][T12317] Bluetooth: hci4: command tx timeout [ 607.985465][ T7292] team0 (unregistering): Port device team_slave_1 removed [ 608.013663][ T7292] team0 (unregistering): Port device team_slave_0 removed [ 608.273670][T16055] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 608.285527][T16058] tipc: Enabling of bearer rejected, failed to enable media [ 608.321304][T15942] hsr_slave_0: entered promiscuous mode [ 608.328060][T15942] hsr_slave_1: entered promiscuous mode [ 608.335864][T15942] debugfs: 'hsr0' already exists in 'hsr' [ 608.341890][T15942] Cannot create hsr debugfs directory [ 611.496273][T16086] syzkaller0: entered promiscuous mode [ 611.503214][T16086] syzkaller0: entered allmulticast mode [ 611.557097][ T7292] IPVS: stop unused estimator thread 0... [ 612.747159][T16105] syzkaller1: entered promiscuous mode [ 612.752712][T16105] syzkaller1: entered allmulticast mode [ 613.528036][T16111] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3046'. [ 613.553810][T16111] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 613.561070][T16111] IPv6: NLM_F_CREATE should be set when creating new route [ 613.609199][T15942] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 613.637914][T15942] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 613.677680][T16116] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3047'. [ 613.709453][T15942] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 613.765304][T15942] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 614.524584][ T30] audit: type=1400 audit(1770605870.854:519): avc: denied { append } for pid=16134 comm="syz.0.3041" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 614.593175][T15942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 614.629698][T15942] 8021q: adding VLAN 0 to HW filter on device team0 [ 614.644051][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 614.651201][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 615.120903][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 615.128035][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 615.353263][T16160] Invalid source name [ 615.700584][T16164] netlink: 'syz.0.3054': attribute type 11 has an invalid length. [ 615.761312][T16170] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 615.869587][T15942] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 617.078762][T15942] veth0_vlan: entered promiscuous mode [ 617.509199][T15942] veth1_vlan: entered promiscuous mode [ 617.540395][T16183] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3057'. [ 617.560921][T15942] veth0_macvtap: entered promiscuous mode [ 617.569701][T16186] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input33 [ 617.606610][T15942] veth1_macvtap: entered promiscuous mode [ 617.667740][T15942] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 617.706085][T15942] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 617.833659][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.868956][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.893640][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.914790][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 618.507966][T16213] syzkaller0: entered promiscuous mode [ 618.513545][T16213] syzkaller0: entered allmulticast mode [ 618.598055][T16218] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3060'. [ 619.728584][T16238] input: syz1 as /devices/virtual/input/input34 [ 621.666272][T16220] tipc: Enabling of bearer rejected, failed to enable media [ 621.733363][T16251] syzkaller0: entered promiscuous mode [ 621.745765][T16251] syzkaller0: entered allmulticast mode [ 621.864532][ T7292] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 621.884164][ T7292] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 623.960630][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.209898][ T2997] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 624.276513][ T2997] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 624.402945][T16278] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3069'. [ 624.516076][T16282] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3071'. [ 624.618731][T16290] netlink: 'syz.2.3064': attribute type 1 has an invalid length. [ 624.760252][T16290] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3064'. [ 625.058664][T16301] input: syz1 as /devices/virtual/input/input35 [ 625.154147][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 625.164482][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 625.173678][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 625.177274][T16296] syzkaller0: entered promiscuous mode [ 625.189428][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 625.197461][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 625.257758][T16296] syzkaller0: entered allmulticast mode [ 627.333463][T12317] Bluetooth: hci2: command tx timeout [ 627.807585][T16323] tipc: Enabling of bearer rejected, failed to enable media [ 627.882742][T12317] Bluetooth: Unexpected continuation frame (len 20) [ 627.996882][T16343] tipc: Enabled bearer , priority 0 [ 628.031585][T16348] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input36 [ 628.060370][T16351] netlink: 'syz.0.3087': attribute type 13 has an invalid length. [ 628.073153][T16343] syzkaller0: entered promiscuous mode [ 628.081008][T16343] syzkaller0: entered allmulticast mode [ 628.304806][T16351] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.312420][T16351] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.362944][T16360] netlink: 260 bytes leftover after parsing attributes in process `syz.1.3084'. [ 628.437113][T16351] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 628.451792][T16351] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 628.581681][T16352] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 628.602208][T16355] tipc: Resetting bearer [ 628.622256][ T7292] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.631180][ T5865] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 628.644207][ T7292] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.662198][T16341] tipc: Resetting bearer [ 628.685732][T16341] tipc: Disabling bearer [ 628.706871][T16304] chnl_net:caif_netlink_parms(): no params data found [ 628.729273][ T7292] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.738301][ T7292] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.790134][ T5865] usb 6-1: Using ep0 maxpacket: 8 [ 628.802960][T16373] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3092'. [ 628.817503][ T5865] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 628.827667][ T5865] usb 6-1: config 0 has no interface number 0 [ 628.834079][ T5865] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 628.845221][ T5865] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 628.857128][ T5865] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 628.876448][ T5865] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 628.890855][ T5865] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 628.901353][ T5865] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.924624][ T5865] usb 6-1: config 0 descriptor?? [ 628.947412][T16375] syzkaller0: entered promiscuous mode [ 628.959383][ T5865] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 628.967616][T16375] syzkaller0: entered allmulticast mode [ 629.300233][T16375] sch_tbf: burst 256 is lower than device syzkaller0 mtu (1514) ! [ 629.414166][T12317] Bluetooth: hci2: command tx timeout [ 629.646255][ T793] usb 6-1: USB disconnect, device number 27 [ 629.694579][ T793] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 629.721831][T16304] bridge0: port 1(bridge_slave_0) entered blocking state [ 629.728957][T16304] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.767473][T16304] bridge_slave_0: entered allmulticast mode [ 629.790877][T16304] bridge_slave_0: entered promiscuous mode [ 630.210823][T16304] bridge0: port 2(bridge_slave_1) entered blocking state [ 630.217952][T16304] bridge0: port 2(bridge_slave_1) entered disabled state [ 630.240213][T16304] bridge_slave_1: entered allmulticast mode [ 630.251065][T16304] bridge_slave_1: entered promiscuous mode [ 630.278206][T16304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 630.302781][T16304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 630.371371][T16304] team0: Port device team_slave_0 added [ 630.379224][T16304] team0: Port device team_slave_1 added [ 630.417050][T16304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 630.436120][T16304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 630.486472][T16304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 630.517724][T16391] tipc: Started in network mode [ 630.527552][T16391] tipc: Node identity ea3958a3111e, cluster identity 4711 [ 630.552472][T16391] tipc: Enabled bearer , priority 0 [ 630.579807][T16392] syzkaller0: entered promiscuous mode [ 630.585521][T16392] syzkaller0: entered allmulticast mode [ 630.593728][T16304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 630.604236][T16304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 630.656932][T16304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 630.681490][T16393] sch_tbf: peakrate 786 is lower than or equals to rate 19658 ! [ 630.699491][T16392] tipc: Resetting bearer [ 630.750272][T16390] tipc: Resetting bearer [ 630.794533][T16390] tipc: Disabling bearer [ 631.060669][T16304] hsr_slave_0: entered promiscuous mode [ 631.069285][T16304] hsr_slave_1: entered promiscuous mode [ 631.081868][T16304] debugfs: 'hsr0' already exists in 'hsr' [ 631.087692][T16304] Cannot create hsr debugfs directory [ 631.246281][T16403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.255292][T16403] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.320235][T16405] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.329152][T16405] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.420304][ T5879] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 631.495115][T12317] Bluetooth: hci2: command tx timeout [ 631.501030][T16402] netlink: 'syz.0.3098': attribute type 298 has an invalid length. [ 631.517214][T16405] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.517216][ T2997] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.534868][T16405] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.565384][ T2997] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.584111][ T2997] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.598588][T16403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.607575][T16403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3098'. [ 631.617501][ T5879] usb 2-1: Using ep0 maxpacket: 8 [ 631.628257][ T5879] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 631.637346][ T2997] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.647570][ T5879] usb 2-1: config 1 has an invalid descriptor of length 130, skipping remainder of the config [ 631.659661][ T5879] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 631.671162][ T5879] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 631.680677][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.688712][ T5879] usb 2-1: Product: syz [ 631.693500][ T5879] usb 2-1: Manufacturer: syz [ 631.698130][ T5879] usb 2-1: SerialNumber: syz [ 631.825878][T16304] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 631.827389][ T793] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 631.843585][T16304] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 631.932228][ T5879] usb 2-1: 0:2 : does not exist [ 631.967450][ T5879] usb 2-1: USB disconnect, device number 34 [ 632.000218][ T793] usb 6-1: Using ep0 maxpacket: 8 [ 632.001517][T16304] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 632.015025][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 632.050130][T16304] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.080250][ T793] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 632.088957][ T793] usb 6-1: config 1 has an invalid descriptor of length 130, skipping remainder of the config [ 632.115278][ T793] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 632.126504][ T793] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 632.150255][ T793] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.180089][ T793] usb 6-1: Product: syz [ 632.200202][ T793] usb 6-1: Manufacturer: syz [ 632.205853][ T793] usb 6-1: SerialNumber: syz [ 632.335085][T16419] netlink: 'syz.0.3102': attribute type 298 has an invalid length. [ 632.349556][T16419] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3102'. [ 632.359045][T16419] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3102'. [ 632.598647][T16304] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 632.609609][T16304] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.632137][ T793] usb 6-1: 0:2 : does not exist [ 632.656272][ T793] usb 6-1: USB disconnect, device number 28 [ 632.716813][T16304] team0: Port device netdevsim0 removed [ 633.570093][T12317] Bluetooth: hci2: command tx timeout [ 633.659423][T16304] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 633.742219][T16304] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 633.760455][T16304] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 633.772106][T16304] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 633.860074][ T5879] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 633.908359][T16304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 633.937226][T16304] 8021q: adding VLAN 0 to HW filter on device team0 [ 633.963139][ T2997] bridge0: port 1(bridge_slave_0) entered blocking state [ 633.970301][ T2997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 633.992478][ T2997] bridge0: port 2(bridge_slave_1) entered blocking state [ 633.999640][ T2997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 634.041624][ T30] audit: type=1400 audit(1770605890.344:520): avc: denied { read } for pid=16439 comm="syz.5.3110" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 634.070469][ T5879] usb 1-1: unable to get BOS descriptor or descriptor too short [ 634.085606][ T5879] usb 1-1: not running at top speed; connect to a high speed hub [ 634.101869][ T5879] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 634.116301][ T30] audit: type=1400 audit(1770605890.344:521): avc: denied { open } for pid=16439 comm="syz.5.3110" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 634.146134][ T5879] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 634.170642][ T5879] usb 1-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 634.183985][ T5879] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.203623][ T5879] usb 1-1: Product: syz [ 634.221244][ T5879] usb 1-1: Manufacturer: syz [ 634.236080][ T5879] usb 1-1: SerialNumber: syz [ 634.387476][T16304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 634.438052][T16304] veth0_vlan: entered promiscuous mode [ 634.623214][T16452] netlink: 'syz.1.3109': attribute type 298 has an invalid length. [ 635.013953][ T5879] usb 1-1: USB disconnect, device number 33 [ 635.123779][T16304] veth1_vlan: entered promiscuous mode [ 635.144051][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 635.183608][T16304] veth0_macvtap: entered promiscuous mode [ 635.217037][T16304] veth1_macvtap: entered promiscuous mode [ 635.237760][T16304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 635.303416][T16304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 635.363048][T16304] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 635.407157][T16304] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 635.441953][T16304] wireguard: wg0: Could not create IPv4 socket [ 635.458216][T16304] wireguard: wg1: Could not create IPv4 socket [ 635.477806][T16304] wireguard: wg2: Could not create IPv4 socket [ 635.580211][ T793] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 635.820081][ T793] usb 2-1: Using ep0 maxpacket: 16 [ 635.855341][ T793] usb 2-1: config 0 has an invalid interface number: 22 but max is 0 [ 635.866346][ T793] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 635.914107][ T793] usb 2-1: config 0 has no interface number 0 [ 635.939819][ T793] usb 2-1: config 0 interface 22 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 635.984315][ T793] usb 2-1: config 0 interface 22 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 636.011974][ T793] usb 2-1: New USB device found, idVendor=05d1, idProduct=8003, bcdDevice=a7.09 [ 636.021414][ T793] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.029642][ T793] usb 2-1: Product: syz [ 636.041895][ T793] usb 2-1: Manufacturer: syz [ 636.046618][ T793] usb 2-1: SerialNumber: syz [ 636.075809][ T793] usb 2-1: config 0 descriptor?? [ 636.101425][ T793] ftdi_sio 2-1:0.22: FTDI USB Serial Device converter detected [ 636.109601][ T793] ftdi_sio ttyUSB0: unknown device type: 0xa709 [ 636.321199][ T793] usb 2-1: USB disconnect, device number 35 [ 636.426634][ T793] ftdi_sio 2-1:0.22: device disconnected [ 636.526771][T16473] netlink: 'syz.0.3117': attribute type 298 has an invalid length. [ 636.543429][T16473] __nla_validate_parse: 10 callbacks suppressed [ 636.543465][T16473] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3117'. [ 636.559311][T16473] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3117'. [ 636.575663][T16473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3117'. [ 636.584629][T16473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3117'. [ 636.596122][T16473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3117'. [ 636.605041][T16473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3117'. [ 637.552002][T16479] syzkaller0: entered promiscuous mode [ 637.557632][T16479] syzkaller0: entered allmulticast mode [ 637.586716][T16479] sch_tbf: burst 256 is lower than device syzkaller0 mtu (1514) ! [ 638.157681][T16483] fuse: Unknown parameter 'euid>00000000000000049663' [ 639.412950][T16506] Failed to initialize the IGMP autojoin socket (err -2) [ 639.757233][T16509] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3127'. [ 640.520181][T16523] netlink: 'syz.1.3123': attribute type 298 has an invalid length. [ 640.765300][T16515] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3123'. [ 640.774767][T16515] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 640.802666][T16518] binder: BINDER_SET_CONTEXT_MGR already set [ 640.847929][T16518] binder: 16517:16518 ioctl 4018620d 200000000040 returned -16 [ 640.911439][T16518] binder: 16517:16518 ioctl c0306201 200000000300 returned -11 [ 640.950888][T16515] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3123'. [ 641.005252][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 641.015341][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 641.025838][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 641.037031][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 641.047643][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 641.094617][ T30] audit: type=1400 audit(1770605897.324:522): avc: denied { connect } for pid=16519 comm="syz.2.3129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 641.273380][T16527] Failed to initialize the IGMP autojoin socket (err -2) [ 641.418508][ T30] audit: type=1400 audit(1770605897.744:523): avc: denied { write } for pid=16532 comm="syz.5.3131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 641.620180][T16545] __nla_validate_parse: 1 callbacks suppressed [ 641.620198][T16545] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3134'. [ 641.651327][T16527] chnl_net:caif_netlink_parms(): no params data found [ 642.680623][ T9] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 642.843894][T16571] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3138'. [ 642.881344][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 642.922745][T16527] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.935836][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 642.936881][T16527] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.960170][T16527] bridge_slave_0: entered allmulticast mode [ 642.968737][T16527] bridge_slave_0: entered promiscuous mode [ 642.985715][T16527] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.993376][ T9] usb 6-1: New USB device found, idVendor=0755, idProduct=2626, bcdDevice= 0.00 [ 642.994347][T16527] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.010352][T16527] bridge_slave_1: entered allmulticast mode [ 643.023499][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.025152][T16527] bridge_slave_1: entered promiscuous mode [ 643.049930][ T9] usb 6-1: config 0 descriptor?? [ 643.104656][ T52] Bluetooth: hci2: command tx timeout [ 643.627313][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.650246][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.675863][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.705819][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.737871][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.749684][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.764853][ T9] aureal 0003:0755:2626.000A: unknown main item tag 0x0 [ 643.791310][ T9] aureal 0003:0755:2626.000A: hidraw0: USB HID v1.ff Device [HID 0755:2626] on usb-dummy_hcd.5-1/input0 [ 643.814946][T16527] team0: Port device team_slave_0 added [ 644.190317][T16527] team0: Port device team_slave_1 added [ 644.643821][ T1104] bridge_slave_1: left allmulticast mode [ 644.649679][ T1104] bridge_slave_1: left promiscuous mode [ 644.655993][ T9] usb 6-1: USB disconnect, device number 29 [ 644.682577][ T1104] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.736375][T16591] netlink: 4768 bytes leftover after parsing attributes in process `syz.5.3143'. [ 644.747617][ T1104] bridge_slave_0: left allmulticast mode [ 644.776248][ T1104] bridge_slave_0: left promiscuous mode [ 644.790219][ T1104] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.170130][ T52] Bluetooth: hci2: command tx timeout [ 645.439912][T16607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3142'. [ 645.450119][T16607] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3142'. [ 645.832098][ T1104] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 645.842285][ T1104] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 645.852436][ T1104] bond0 (unregistering): Released all slaves [ 645.886992][T16591] 8021q: adding VLAN 0 to HW filter on device bond2 [ 645.895129][T16591] bond2: entered promiscuous mode [ 645.903523][T16591] team0: Port device bond2 added [ 645.938215][T16601] netlink: 'syz.2.3142': attribute type 298 has an invalid length. [ 645.984391][T16607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3142'. [ 645.997673][T16527] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 646.010407][T16607] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3142'. [ 646.023432][T16527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 646.049518][T16527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 646.088351][T16527] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 646.095572][T16527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 646.127810][T16527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 646.825496][ T1104] hsr_slave_0: left promiscuous mode [ 646.839582][ T1104] hsr_slave_1: left promiscuous mode [ 646.857590][ T1104] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 646.872126][ T1104] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 646.888369][ T1104] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 646.906632][ T1104] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 646.983100][ T1104] veth1_macvtap: left promiscuous mode [ 646.988639][ T1104] veth0_macvtap: left promiscuous mode [ 646.995297][ T1104] veth1_vlan: left promiscuous mode [ 647.000714][ T1104] veth0_vlan: left promiscuous mode [ 647.250041][ T52] Bluetooth: hci2: command tx timeout [ 647.558297][ T1104] team0 (unregistering): Port device team_slave_1 removed [ 647.590270][ T1104] team0 (unregistering): Port device team_slave_0 removed [ 648.803024][T16527] hsr_slave_0: entered promiscuous mode [ 648.809460][T16527] hsr_slave_1: entered promiscuous mode [ 648.828318][T16527] debugfs: 'hsr0' already exists in 'hsr' [ 648.841151][T16527] Cannot create hsr debugfs directory [ 649.340139][ T52] Bluetooth: hci2: command tx timeout [ 651.135310][ T793] usb 1-1: new full-speed USB device number 34 using dummy_hcd [ 651.893489][ T793] usb 1-1: unable to get BOS descriptor or descriptor too short [ 651.913880][ T793] usb 1-1: not running at top speed; connect to a high speed hub [ 651.931699][ T793] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 651.942998][ T793] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 651.983882][ T793] usb 1-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 651.996242][ T793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.014628][ T793] usb 1-1: Product: syz [ 652.019406][ T793] usb 1-1: Manufacturer: syz [ 652.028814][ T793] usb 1-1: SerialNumber: syz [ 652.615716][ T30] audit: type=1326 audit(1770605908.944:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16722 comm="syz.2.3168" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8df5f9aeb9 code=0x0 [ 652.639672][T16729] syzkaller0: entered promiscuous mode [ 652.645233][T16729] syzkaller0: entered allmulticast mode [ 653.245237][ T793] usb 1-1: USB disconnect, device number 34 [ 653.933852][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 654.109209][T16527] netdevsim netdevsim3 netdevsim0: renamed from eth5 [ 654.665834][T16527] netdevsim netdevsim3 netdevsim1: renamed from eth6 [ 654.706199][T16527] netdevsim netdevsim3 netdevsim2: renamed from eth7 [ 654.755215][T16527] netdevsim netdevsim3 netdevsim3: renamed from eth8 [ 654.811916][T16766] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3175'. [ 654.853784][T16775] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3177'. [ 655.225593][T16527] 8021q: adding VLAN 0 to HW filter on device team0 [ 655.280449][ T5939] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.287560][ T5939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 655.324658][ T5939] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.331769][ T5939] bridge0: port 2(bridge_slave_1) entered forwarding state [ 655.670908][T16788] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3180'. [ 655.687578][T16788] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3180'. [ 655.704158][T16788] netlink: 388 bytes leftover after parsing attributes in process `syz.2.3180'. [ 656.139854][T16791] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3182'. [ 656.160341][ T10] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 656.171243][T16791] bridge_slave_1: left allmulticast mode [ 656.176873][T16791] bridge_slave_1: left promiscuous mode [ 656.198350][T16791] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.296284][T16791] bridge_slave_0: left allmulticast mode [ 656.302054][T16791] bridge_slave_0: left promiscuous mode [ 656.310143][T16791] bridge0: port 1(bridge_slave_0) entered disabled state [ 656.362816][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 656.373354][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 656.384493][ T10] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 656.396087][ T10] usb 6-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 656.419078][ T10] usb 6-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 656.430308][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.438424][ T10] usb 6-1: Product: syz [ 656.449866][ T10] usb 6-1: Manufacturer: syz [ 656.456036][ T10] usb 6-1: SerialNumber: syz [ 656.556713][T16790] overlayfs: statfs failed on './file0' [ 656.625672][T16527] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 656.740357][ T10] usb 6-1: USB disconnect, device number 30 [ 656.784285][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 656.880045][ T115] usb 1-1: new full-speed USB device number 35 using dummy_hcd [ 656.882392][T16527] veth0_vlan: entered promiscuous mode [ 656.897160][T16801] syzkaller0: entered promiscuous mode [ 656.904086][T16801] syzkaller0: entered allmulticast mode [ 656.915001][T16527] veth1_vlan: entered promiscuous mode [ 657.014857][T16527] veth0_macvtap: entered promiscuous mode [ 657.056035][ T115] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 657.057173][T16527] veth1_macvtap: entered promiscuous mode [ 657.083559][ T115] usb 1-1: config 0 has no interface number 0 [ 657.089717][ T115] usb 1-1: config 0 interface 41 has no altsetting 0 [ 657.103488][ T115] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 657.113200][ T115] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.121714][ T115] usb 1-1: Product: syz [ 657.188356][ T115] usb 1-1: Manufacturer: syz [ 657.196113][ T115] usb 1-1: SerialNumber: syz [ 657.221076][ T115] usb 1-1: config 0 descriptor?? [ 657.301642][T16805] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 657.640142][T16527] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 657.685030][T16527] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 657.705506][T16527] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 657.727440][T16527] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 657.746701][T16527] wireguard: wg0: Could not create IPv4 socket [ 658.432966][T16527] wireguard: wg1: Could not create IPv4 socket [ 658.445882][T16527] wireguard: wg2: Could not create IPv4 socket [ 658.652149][T16814] [U] vÔ3¸Âfù¾"SçÁ/Éê4:ÃXTz“W¡t‘’lWµ«= [ 658.658304][T16814] [U] J"—e:ÀÆ" [ 658.685272][T16813] tipc: Started in network mode [ 658.690492][T16813] tipc: Node identity 6e5e55bf909d, cluster identity 4711 [ 658.698031][T16813] tipc: Enabled bearer , priority 0 [ 658.708444][T16813] sch_tbf: burst 256 is lower than device syzkaller0 mtu (1514) ! [ 658.725926][T16814] Failed to initialize the IGMP autojoin socket (err -2) [ 658.736380][T16813] tipc: Resetting bearer [ 658.750643][T16811] tipc: Disabling bearer [ 659.215829][ T115] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -71 [ 659.273722][ T115] usb 1-1: USB disconnect, device number 35 [ 659.548507][T16827] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3191'. [ 660.100047][ T115] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 660.350185][ T115] usb 1-1: Using ep0 maxpacket: 8 [ 660.378875][T16846] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 660.699511][ T115] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 660.732617][ T115] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 660.743446][ T115] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 660.754747][ T115] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 660.769124][ T115] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 660.778778][ T115] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.997346][ T115] usb 1-1: GET_CAPABILITIES returned 0 [ 661.003053][ T115] usbtmc 1-1:16.0: can't read capabilities [ 661.025613][T16850] syzkaller0: entered promiscuous mode [ 661.031291][T16850] syzkaller0: entered allmulticast mode [ 661.992183][T16861] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3192'. [ 662.056419][ T793] usb 1-1: USB disconnect, device number 36 [ 662.362682][T16869] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input37 [ 662.777798][T16887] tipc: Enabled bearer , priority 0 [ 662.809045][ T5820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 662.823450][ T5820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 662.834334][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 662.847960][ T5820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 663.357438][T16887] sch_tbf: burst 256 is lower than device syzkaller0 mtu (1514) ! [ 663.366811][ T5820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 663.434752][T16893] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3202'. [ 663.491114][T16887] tipc: Resetting bearer [ 663.747102][T16884] Failed to initialize the IGMP autojoin socket (err -2) [ 663.828648][T16885] tipc: Disabling bearer [ 664.259098][ T793] tipc: Node number set to 1229573268 [ 664.374558][T16909] syzkaller0: entered promiscuous mode [ 664.380153][T16909] syzkaller0: entered allmulticast mode [ 664.399387][T16913] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3205'. [ 664.497804][T16916] mkiss: ax0: crc mode is auto. [ 665.022326][ T30] audit: type=1400 audit(1770605921.334:525): avc: denied { read } for pid=16920 comm="syz.1.3209" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 665.130557][ T30] audit: type=1400 audit(1770605921.334:526): avc: denied { open } for pid=16920 comm="syz.1.3209" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 665.250546][ T30] audit: type=1400 audit(1770605921.574:527): avc: denied { mount } for pid=16920 comm="syz.1.3209" name="/" dev="autofs" ino=54118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 665.345857][ T30] audit: type=1400 audit(1770605921.574:528): avc: denied { ioctl } for pid=16920 comm="syz.1.3209" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9379 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 665.478916][ T30] audit: type=1400 audit(1770605921.804:529): avc: denied { unmount } for pid=15942 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 665.570089][ T5820] Bluetooth: hci2: command tx timeout [ 666.338253][T16940] input: syz1 as /devices/virtual/input/input38 [ 666.473902][ T793] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 666.509295][T16948] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3213'. [ 666.581362][T16949] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3213'. [ 666.590385][T16949] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3213'. [ 666.884054][T16951] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 667.050351][ T793] usb 3-1: Using ep0 maxpacket: 8 [ 667.119177][ T793] usb 3-1: config 1 has an invalid interface descriptor of length 2, skipping [ 667.204581][ T793] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 667.276979][ T793] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 667.428425][ T793] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 667.472761][T16946] netlink: 'syz.1.3213': attribute type 298 has an invalid length. [ 667.496252][ T793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.508086][T16948] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3213'. [ 667.517006][T16948] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3213'. [ 667.570480][ T793] usb 3-1: Product: syz [ 667.584777][ T793] usb 3-1: Manufacturer: syz [ 667.597680][ T793] usb 3-1: SerialNumber: syz [ 667.604072][T16949] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3213'. [ 667.613277][T16949] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3213'. [ 667.659853][ T5820] Bluetooth: hci2: command tx timeout [ 667.830114][ T5872] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 667.860516][ T793] usb 3-1: 0:2 : does not exist [ 667.906117][ T793] usb 3-1: USB disconnect, device number 24 [ 668.050093][ T5872] usb 6-1: Using ep0 maxpacket: 8 [ 668.056685][ T5872] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 668.095286][ T5872] usb 6-1: config 0 has no interface number 0 [ 668.138716][ T5872] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 668.161874][ T5872] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 668.161904][ T5872] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 668.161934][ T5872] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 668.161971][ T5872] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 668.161991][ T5872] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.197307][ T5872] usb 6-1: config 0 descriptor?? [ 668.202855][ T5872] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 668.656753][T16884] netdevsim netdevsim3 netdevsim0: renamed from eth5 [ 669.053026][ T5872] usb 6-1: USB disconnect, device number 31 [ 669.068758][T16884] netdevsim netdevsim3 netdevsim1: renamed from eth6 [ 669.099619][ T5872] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 669.113930][T16884] netdevsim netdevsim3 netdevsim2: renamed from eth7 [ 669.127795][T16965] netlink: 'syz.0.3216': attribute type 10 has an invalid length. [ 669.556116][T16969] netlink: 'syz.1.3217': attribute type 10 has an invalid length. [ 669.594853][T16969] team0: Port device netdevsim0 added [ 669.609855][T16965] team0: Port device netdevsim0 added [ 669.639579][T16884] netdevsim netdevsim3 netdevsim3: renamed from eth8 [ 669.730018][ T5820] Bluetooth: hci2: command tx timeout [ 671.201897][T16884] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 671.321733][T16884] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 671.374181][T17011] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3224'. [ 671.436342][T16884] wireguard: wg0: Could not create IPv4 socket [ 671.467030][T16884] wireguard: wg1: Could not create IPv4 socket [ 671.476483][T16884] wireguard: wg2: Could not create IPv4 socket [ 672.330078][T17021] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 672.539233][ T5820] Bluetooth: hci2: command tx timeout [ 673.110037][ T5922] usb 1-1: new full-speed USB device number 37 using dummy_hcd [ 673.128434][T17040] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3222'. [ 673.200370][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 673.261588][ T5922] usb 1-1: unable to get BOS descriptor or descriptor too short [ 673.276461][ T5922] usb 1-1: not running at top speed; connect to a high speed hub [ 673.294337][ T5922] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 673.309372][ T5922] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 673.329910][ T5922] usb 1-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 673.348812][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.360850][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 673.368243][ T5922] usb 1-1: Product: syz [ 673.374132][ T5922] usb 1-1: Manufacturer: syz [ 673.381580][ T9] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 673.392682][ T5922] usb 1-1: SerialNumber: syz [ 673.398417][ T9] usb 2-1: config 1 has no interface number 1 [ 673.439504][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 673.449775][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.459318][ T9] usb 2-1: Product: syz [ 673.467123][ T9] usb 2-1: Manufacturer: syz [ 673.475024][ T9] usb 2-1: SerialNumber: syz [ 673.724677][ T9] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 673.734492][ T5922] usb 1-1: USB disconnect, device number 37 [ 673.767243][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 673.786421][ T9] usb 2-1: USB disconnect, device number 36 [ 673.877953][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 673.956427][ T30] audit: type=1400 audit(1770605930.284:530): avc: denied { watch watch_reads } for pid=17060 comm="syz.2.3229" path="pipe:[4502]" dev="pipefs" ino=4502 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 674.010102][ T30] audit: type=1400 audit(1770605930.314:531): avc: denied { relabelfrom } for pid=17060 comm="syz.2.3229" name="" dev="pipefs" ino=55024 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 674.180422][T17066] netlink: 'syz.2.3230': attribute type 10 has an invalid length. [ 674.974533][T17077] netlink: 'syz.2.3233': attribute type 298 has an invalid length. [ 675.282149][T17077] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.291216][T17077] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.414266][T17076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.423337][T17076] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.434449][T17076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.443407][T17076] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.517334][T17077] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3233'. [ 675.527634][T17077] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3233'. [ 676.983243][T17094] input: syz1 as /devices/virtual/input/input39 [ 677.269167][T17102] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 679.458012][T17107] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3239'. [ 680.093168][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 680.111697][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 680.121865][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 680.129851][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 680.143470][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 680.188136][T17118] Failed to initialize the IGMP autojoin socket (err -2) [ 680.520312][ T30] audit: type=1400 audit(1770605936.844:532): avc: denied { mounton } for pid=17130 comm="syz.1.3243" path="/syzcgroup/cpu/syz1/cgroup.procs" dev="cgroup" ino=178 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 681.260051][ T5879] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 681.276004][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 681.286247][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 681.294515][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 681.302295][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 681.344351][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 681.410776][ T5879] usb 1-1: Using ep0 maxpacket: 8 [ 681.424663][ T5879] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 681.444825][T17143] Failed to initialize the IGMP autojoin socket (err -2) [ 681.451932][ T5879] usb 1-1: config 1 has no interface number 1 [ 681.707967][T17142] overlayfs: missing 'lowerdir' [ 681.864970][T17118] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 682.073524][ T5879] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 682.092737][ T5879] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.120013][ T5879] usb 1-1: Product: syz [ 682.130571][ T5879] usb 1-1: Manufacturer: syz [ 682.135190][ T5879] usb 1-1: SerialNumber: syz [ 682.214729][ T5820] Bluetooth: hci2: command tx timeout [ 682.255600][T17118] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 682.417880][T17118] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 682.432089][ T5879] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 682.480647][ T5879] usb 1-1: USB disconnect, device number 38 [ 682.538789][T17118] team0: Port device netdevsim0 removed [ 682.556485][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 682.576740][T17118] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 682.708832][ T7292] bridge_slave_1: left allmulticast mode [ 682.723511][ T7292] bridge_slave_1: left promiscuous mode [ 682.754403][ T7292] bridge0: port 2(bridge_slave_1) entered disabled state [ 683.287061][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 683.296576][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 683.300898][T17180] input: syz1 as /devices/virtual/input/input40 [ 683.314451][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 683.489749][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 683.514623][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 683.709570][T17188] netlink: 'syz.1.3248': attribute type 10 has an invalid length. [ 683.835135][T17196] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 684.290082][ T5820] Bluetooth: hci2: command tx timeout [ 684.934148][ T30] audit: type=1400 audit(1770605941.264:533): avc: denied { append } for pid=17203 comm="syz.0.3249" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 685.204001][ T7292] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 685.216259][ T7292] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 685.228300][ T7292] bond0 (unregistering): Released all slaves [ 685.239288][ T7292] bond1 (unregistering): Released all slaves [ 685.284904][T17183] Failed to initialize the IGMP autojoin socket (err -2) [ 685.339326][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.377137][ T7292] tipc: Left network mode [ 685.457708][ T7292] IPVS: stopping backup sync thread 9517 ... [ 685.654830][T17229] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3252'. [ 686.062304][ T7292] hsr_slave_0: left promiscuous mode [ 686.087414][ T7292] hsr_slave_1: left promiscuous mode [ 686.106752][ T7292] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 686.114596][ T7292] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 686.375604][ T5820] Bluetooth: hci2: command tx timeout [ 686.890492][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 686.901638][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 686.911689][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 686.921428][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 686.937413][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 687.764215][ T7292] team0 (unregistering): Port device team_slave_1 removed [ 687.877806][ T7292] team0 (unregistering): Port device team_slave_0 removed [ 688.345374][T17255] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 688.373821][T17260] Failed to initialize the IGMP autojoin socket (err -2) [ 688.455437][ T52] Bluetooth: hci2: command tx timeout [ 688.710291][T17118] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 688.760132][ T115] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 688.779845][T17118] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 688.783110][T17313] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input41 [ 688.812927][T17118] wireguard: wg0: Could not create IPv4 socket [ 688.861276][T17118] wireguard: wg1: Could not create IPv4 socket [ 688.869352][T17118] wireguard: wg2: Could not create IPv4 socket [ 688.953768][ T115] usb 1-1: Using ep0 maxpacket: 8 [ 688.964993][ T115] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 688.986088][ T115] usb 1-1: config 1 has no interface number 1 [ 689.011927][ T115] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 689.027132][ T115] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 689.046417][ T115] usb 1-1: Product: syz [ 689.057235][ T7292] IPVS: stop unused estimator thread 0... [ 689.070071][ T115] usb 1-1: Manufacturer: syz [ 689.074694][ T115] usb 1-1: SerialNumber: syz [ 689.314473][ T115] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 689.351353][ T115] usb 1-1: USB disconnect, device number 39 [ 689.386407][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 690.151573][T17361] netlink: 'syz.0.3259': attribute type 10 has an invalid length. [ 690.307752][T17366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3260'. [ 690.316698][T17366] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3260'. [ 690.382636][T17368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3260'. [ 690.391617][T17368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3260'. [ 690.764679][T17365] netlink: 'syz.1.3260': attribute type 298 has an invalid length. [ 690.891842][T17366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3260'. [ 690.900813][T17366] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3260'. [ 690.915283][ T5820] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 690.924654][ T5820] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 690.933216][ T5820] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 690.949250][ T5820] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 690.966440][ T5820] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 691.011254][T17368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3260'. [ 691.020146][T17368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3260'. [ 691.095331][T17373] Failed to initialize the IGMP autojoin socket (err -2) [ 691.118915][T17378] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3263'. [ 691.480339][ T30] audit: type=1400 audit(1770605947.754:534): avc: denied { create } for pid=17382 comm="syz.0.3264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 691.537570][T17393] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 691.828998][ T115] usb 6-1: new full-speed USB device number 32 using dummy_hcd [ 692.030512][ T115] usb 6-1: unable to get BOS descriptor or descriptor too short [ 692.160718][ T115] usb 6-1: not running at top speed; connect to a high speed hub [ 692.190037][ T115] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 692.211713][ T115] usb 6-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 692.229110][ T115] usb 6-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 692.244387][ T115] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.386669][ T115] usb 6-1: Product: syz [ 692.395683][ T115] usb 6-1: Manufacturer: syz [ 692.415330][ T115] usb 6-1: SerialNumber: syz [ 692.561725][ T5820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 692.573272][ T5820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 692.583723][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 692.591520][ T5820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 692.598992][ T5820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 692.676017][T17412] Failed to initialize the IGMP autojoin socket (err -2) [ 692.757790][ T115] usb 6-1: USB disconnect, device number 32 [ 692.835265][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 693.010841][ T52] Bluetooth: hci1: command tx timeout [ 693.316983][T17373] netdevsim netdevsim3 netdevsim0: renamed from eth9 [ 693.365865][T17373] netdevsim netdevsim3 netdevsim1: renamed from eth10 [ 693.408870][T17373] netdevsim netdevsim3 netdevsim2: renamed from eth11 [ 693.608970][T17373] netdevsim netdevsim3 netdevsim3: renamed from eth12 [ 694.141786][ T5820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 694.152486][ T5820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 694.161452][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 694.171355][ T5820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 694.178918][ T5820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 694.253651][T17442] Failed to initialize the IGMP autojoin socket (err -2) [ 694.515227][ T1104] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x1 [ 694.681326][ T115] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 694.707038][T17464] tipc: Cannot configure node identity twice [ 695.000536][ T30] audit: type=1400 audit(1770605951.024:535): avc: denied { setopt } for pid=17450 comm="syz.1.3268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 695.030130][ T9] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 695.046063][ T30] audit: type=1400 audit(1770605951.044:536): avc: denied { write } for pid=17450 comm="syz.1.3268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 695.102141][ T5820] Bluetooth: hci1: command tx timeout [ 695.159693][T17373] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 695.184651][T17373] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 695.208333][T17373] wireguard: wg0: Could not create IPv4 socket [ 695.217523][T17373] wireguard: wg1: Could not create IPv4 socket [ 695.223873][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 695.229116][ T115] usb 6-1: Using ep0 maxpacket: 8 [ 695.237315][ T9] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 695.248520][T17373] wireguard: wg2: Could not create IPv4 socket [ 695.255648][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.343521][ T9] usb 1-1: Product: syz [ 695.347816][ T9] usb 1-1: Manufacturer: syz [ 695.356563][ T115] usb 6-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 695.369994][ T9] usb 1-1: SerialNumber: syz [ 695.380073][ T115] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 695.404252][ T9] usb 1-1: config 0 descriptor?? [ 695.413193][ T9] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 695.431091][ T115] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 695.440679][ T115] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.450453][ T115] usb 6-1: Product: syz [ 695.471093][ T115] usb 6-1: Manufacturer: syz [ 695.480158][ T115] usb 6-1: SerialNumber: syz [ 695.588544][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 695.614975][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 695.624670][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 695.652776][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 695.660893][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 695.798960][T17480] Failed to initialize the IGMP autojoin socket (err -2) [ 695.801583][T17486] netlink: 'syz.1.3272': attribute type 10 has an invalid length. [ 695.979071][ T115] usb 6-1: 0:2 : does not exist [ 696.002238][ T115] usb 6-1: USB disconnect, device number 33 [ 696.066667][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 696.348003][ T30] audit: type=1400 audit(1770605952.674:537): avc: denied { append } for pid=17501 comm="syz.1.3274" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 696.389733][T17448] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3270'. [ 696.449845][T17459] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3270'. [ 696.691305][ T9] gspca_ov534_9: reg_w failed -110 [ 696.739700][T17448] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3270'. [ 696.980376][ T9] gspca_ov534_9: Unknown sensor 0000 [ 696.980449][ T9] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 697.058125][ T9] usb 1-1: USB disconnect, device number 40 [ 697.290093][ T5872] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 697.470216][ T5872] usb 2-1: Using ep0 maxpacket: 8 [ 697.497596][ T5872] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 697.529104][ T30] audit: type=1326 audit(1770605953.854:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fab9aeb9 code=0x7ffc0000 [ 697.562593][ T5872] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.653138][ T5872] pvrusb2: Hardware description: Terratec Grabster AV400 [ 697.705726][T17532] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3278'. [ 697.710120][ T5872] pvrusb2: ********** [ 697.862249][ T5820] Bluetooth: hci1: command tx timeout [ 697.894974][ T30] audit: type=1326 audit(1770605953.854:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fab9aeb9 code=0x7ffc0000 [ 697.932412][ T5872] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 697.976506][ T5872] pvrusb2: Important functionality might not be entirely working. [ 698.020205][ T5872] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 698.038595][ T30] audit: type=1326 audit(1770605953.854:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f05fab9c747 code=0x7ffc0000 [ 698.067467][T17480] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 698.077380][ T5872] pvrusb2: ********** [ 698.114670][T17480] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 698.131084][ T2330] pvrusb2: Invalid write control endpoint [ 698.152470][T17480] wireguard: wg0: Could not create IPv4 socket [ 698.157457][ T30] audit: type=1326 audit(1770605953.884:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f05fab5b78e code=0x7ffc0000 [ 698.184582][T17480] wireguard: wg1: Could not create IPv4 socket [ 698.205320][T17480] wireguard: wg2: Could not create IPv4 socket [ 698.217499][ T30] audit: type=1326 audit(1770605953.884:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f05fab5b78e code=0x7ffc0000 [ 698.264543][ T2330] pvrusb2: Invalid write control endpoint [ 698.275519][ T2330] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 698.329053][ T2330] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 698.380378][ T30] audit: type=1326 audit(1770605953.884:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f05fab5b78e code=0x7ffc0000 [ 698.406558][ T2330] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 698.431614][ T2330] pvrusb2: Device being rendered inoperable [ 698.454147][ T2330] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 698.467787][ T30] audit: type=1326 audit(1770605953.884:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f05fab5b78e code=0x7ffc0000 [ 698.496703][ T2330] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 698.517706][ T2330] pvrusb2: Attached sub-driver cx25840 [ 698.529977][ T2330] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 698.544936][ T30] audit: type=1326 audit(1770605953.884:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fab9aeb9 code=0x7ffc0000 [ 698.569825][ T2330] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 698.600683][ T30] audit: type=1326 audit(1770605953.884:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f05fab5b78e code=0x7ffc0000 [ 698.660593][ T30] audit: type=1326 audit(1770605953.884:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17527 comm="syz.0.3278" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f05fab9c1d7 code=0x7ffc0000 [ 698.667145][ T9] usb 2-1: USB disconnect, device number 37 [ 698.786016][T17548] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3281'. [ 699.006398][T17559] netlink: 'syz.5.3282': attribute type 29 has an invalid length. [ 699.016701][T17559] netlink: 'syz.5.3282': attribute type 29 has an invalid length. [ 699.030789][T17559] netlink: 500 bytes leftover after parsing attributes in process `syz.5.3282'. [ 699.279626][T17565] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3284'. [ 699.850086][ T9] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 700.000113][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 700.008117][ T9] usb 2-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 700.019217][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 700.073567][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 700.091461][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.122702][ T9] usb 2-1: Product: syz [ 700.126878][ T9] usb 2-1: Manufacturer: syz [ 700.141857][ T9] usb 2-1: SerialNumber: syz [ 700.381889][ T9] usb 2-1: 0:2 : does not exist [ 700.420085][ T9] usb 2-1: USB disconnect, device number 38 [ 700.454362][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 701.068588][T17630] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 701.100477][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 701.110436][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 701.131484][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 701.152101][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 701.161548][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 701.217498][T17633] Failed to initialize the IGMP autojoin socket (err -2) [ 702.263728][T17658] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3292'. [ 702.340546][ T5872] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 702.470176][T17662] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3293'. [ 702.541569][ T5872] usb 2-1: Using ep0 maxpacket: 32 [ 702.673966][ T5872] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 702.697850][ T5872] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 702.708244][ T5872] usb 2-1: New USB device found, idVendor=258a, idProduct=0033, bcdDevice= 0.00 [ 702.773636][T17672] netlink: 'syz.5.3295': attribute type 298 has an invalid length. [ 702.801801][T17672] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.810735][T17672] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.822356][T17672] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.831735][T17672] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.870929][T17672] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.879837][T17672] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.891461][T17672] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3295'. [ 702.900538][T17672] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3295'. [ 703.071489][ T5872] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.081694][ T5872] usb 2-1: config 0 descriptor?? [ 703.251266][ T5820] Bluetooth: hci1: command tx timeout [ 703.680842][ T5872] glorious 0003:258A:0033.000B: unknown main item tag 0x0 [ 703.691744][ T5872] glorious 0003:258A:0033.000B: unknown main item tag 0x0 [ 703.710267][ T5872] glorious 0003:258A:0033.000B: unknown main item tag 0x0 [ 703.734101][ T5872] glorious 0003:258A:0033.000B: hidraw0: USB HID v0.00 Device [Glorious Model D] on usb-dummy_hcd.1-1/input0 [ 703.923220][T17654] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 703.965968][ T10] usb 2-1: USB disconnect, device number 39 [ 704.102394][T17633] netdevsim netdevsim3 netdevsim0: renamed from eth9 [ 704.120983][T17633] netdevsim netdevsim3 netdevsim1: renamed from eth10 [ 704.136179][T17633] netdevsim netdevsim3 netdevsim2: renamed from eth11 [ 704.166625][T17633] netdevsim netdevsim3 netdevsim3: renamed from eth12 [ 704.398709][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 704.407200][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 704.416611][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 704.424680][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 704.433353][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 704.468876][T17711] Failed to initialize the IGMP autojoin socket (err -2) [ 704.520790][ T5879] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 704.564979][T17633] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 704.588000][T17633] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 704.610224][T17633] wireguard: wg0: Could not create IPv4 socket [ 704.619339][T17633] wireguard: wg1: Could not create IPv4 socket [ 704.652021][T17633] wireguard: wg2: Could not create IPv4 socket [ 704.692007][ T5879] usb 6-1: Using ep0 maxpacket: 8 [ 704.723723][ T5879] usb 6-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 704.760859][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 704.760877][ T30] audit: type=1400 audit(1770605961.074:583): avc: denied { listen } for pid=17717 comm="syz.1.3300" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 704.793139][ T5879] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 704.824081][ T5879] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 704.845457][ T5879] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 704.866209][ T5879] usb 6-1: Product: syz [ 704.874921][ T5879] usb 6-1: Manufacturer: syz [ 704.885045][ T5879] usb 6-1: SerialNumber: syz [ 705.126967][ T5879] usb 6-1: 0:2 : does not exist [ 705.147736][ T5879] usb 6-1: USB disconnect, device number 34 [ 705.567318][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 705.590190][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 705.599894][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 705.610367][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 705.618059][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 705.668337][T17757] Failed to initialize the IGMP autojoin socket (err -2) [ 706.524143][T17775] netlink: 'syz.1.3303': attribute type 11 has an invalid length. [ 706.722022][T17775] netlink: 'syz.1.3303': attribute type 11 has an invalid length. [ 707.700109][ T5820] Bluetooth: hci1: command tx timeout [ 708.576102][T17833] netlink: 'syz.1.3312': attribute type 298 has an invalid length. [ 708.604232][T17833] __nla_validate_parse: 7 callbacks suppressed [ 708.604263][T17833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.619321][T17833] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.676125][T17835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.685068][T17835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.910849][T17835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.919727][T17835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.979774][T17833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.990330][T17833] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3312'. [ 708.990391][ T10] usb 6-1: new full-speed USB device number 35 using dummy_hcd [ 709.127825][T17757] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 709.179434][T17757] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 709.197480][T17757] wireguard: wg0: Could not create IPv4 socket [ 709.205855][T17757] wireguard: wg1: Could not create IPv4 socket [ 709.215078][T17757] wireguard: wg2: Could not create IPv4 socket [ 709.297758][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 709.318215][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 709.336731][ T10] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 709.376161][T17848] input: syz1 as /devices/virtual/input/input42 [ 709.384424][ T10] usb 6-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 709.422007][ T10] usb 6-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 709.445111][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.464721][ T10] usb 6-1: Product: syz [ 709.484063][ T10] usb 6-1: Manufacturer: syz [ 709.495610][ T10] usb 6-1: SerialNumber: syz [ 709.546948][T17854] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 710.191917][ T10] usb 6-1: USB disconnect, device number 35 [ 710.463291][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 711.130094][ T10] usb 6-1: new low-speed USB device number 36 using dummy_hcd [ 711.293744][ T10] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 711.307151][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 711.317744][ T10] usb 6-1: config 0 has no interface number 0 [ 711.324162][ T10] usb 6-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 711.340915][ T5922] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 711.348842][ T10] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 711.359002][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.379344][ T10] usb 6-1: config 0 descriptor?? [ 711.386809][ T10] iowarrior 6-1:0.1: no interrupt-in endpoint found [ 711.501602][ T5922] usb 2-1: unable to get BOS descriptor or descriptor too short [ 711.519759][ T5922] usb 2-1: not running at top speed; connect to a high speed hub [ 711.528779][ T5922] usb 2-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 711.555134][ T5922] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 711.582428][ T5922] usb 2-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 711.601711][ T5922] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.609719][ T5922] usb 2-1: Product: syz [ 711.631793][ T5922] usb 2-1: Manufacturer: syz [ 711.637183][ T5922] usb 2-1: SerialNumber: syz [ 711.985532][ T793] usb 6-1: USB disconnect, device number 36 [ 712.001171][ T5922] usb 2-1: USB disconnect, device number 40 [ 712.037496][ T6015] udevd[6015]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 712.192174][T17901] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3318'. [ 712.205477][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 712.218530][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 712.227901][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 712.249277][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 712.256972][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 712.276302][T17902] Failed to initialize the IGMP autojoin socket (err -2) [ 712.294933][T17906] program syz.0.3319 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 712.608779][ T30] audit: type=1400 audit(1770605968.934:584): avc: denied { read write } for pid=17922 comm="syz.1.3322" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 712.641658][T17923] 9p: Bad value for 'rfdno' [ 712.672659][ T30] audit: type=1400 audit(1770605968.934:585): avc: denied { open } for pid=17922 comm="syz.1.3322" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 712.699175][ T52] Bluetooth: hci5: unexpected event for opcode 0x200b [ 712.715581][T17925] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3322'. [ 712.969057][ T30] audit: type=1400 audit(1770605969.294:586): avc: denied { remount } for pid=17932 comm="syz.1.3323" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 713.049166][T17937] CUSE: info not properly terminated [ 713.468707][T17967] syzkaller0: entered promiscuous mode [ 713.474533][T17967] syzkaller0: entered allmulticast mode [ 714.293724][ T52] Bluetooth: hci1: command tx timeout [ 715.326280][T17985] tipc: Enabling of bearer rejected, failed to enable media [ 715.507943][ T5820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 715.518253][ T5820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 715.554635][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 715.563892][ T5820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 715.579024][ T5820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 715.640230][ T5922] usb 1-1: new full-speed USB device number 41 using dummy_hcd [ 715.641816][T18047] Failed to initialize the IGMP autojoin socket (err -2) [ 715.802452][ T5922] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 715.821867][ T5922] usb 1-1: config 0 has no interface number 0 [ 715.834912][ T5922] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 715.858827][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.867580][ T5922] usb 1-1: Product: syz [ 715.886500][ T5922] usb 1-1: Manufacturer: syz [ 715.896559][ T5922] usb 1-1: SerialNumber: syz [ 715.903126][ T30] audit: type=1400 audit(1770605972.234:587): avc: denied { create } for pid=18058 comm="syz.1.3331" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 716.043068][ T5922] usb 1-1: config 0 descriptor?? [ 716.370124][ T52] Bluetooth: hci1: command tx timeout [ 716.410192][ T10] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 716.528655][T17902] netdevsim netdevsim3 netdevsim0: renamed from eth9 [ 716.538863][ T5922] usb 1-1: Firmware: major: 12, minor: 114, hardware type: UNKNOWN (13) [ 716.540540][T17902] netdevsim netdevsim3 netdevsim1: renamed from eth10 [ 716.567083][T17902] netdevsim netdevsim3 netdevsim2: renamed from eth11 [ 716.570013][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 716.586716][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 716.586829][T17902] netdevsim netdevsim3 netdevsim3: renamed from eth12 [ 716.611158][ T10] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 716.626220][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 716.637303][ T10] usb 6-1: config 0 descriptor?? [ 716.742573][ T5922] usb 1-1: Read permanent extended address 00:00:00:00:00:00:00:1c from device [ 716.762851][ T5922] usb 1-1: atusb_probe: initialization failed, error = -524 [ 716.781643][ T5922] atusb 1-1:0.128: probe with driver atusb failed with error -524 [ 716.849325][ T10] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 716.924320][ T30] audit: type=1400 audit(1770605973.254:588): avc: denied { unlink } for pid=15942 comm="syz-executor" name="file0" dev="tmpfs" ino=413 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 716.972172][T17902] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 716.993883][T17902] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 717.012845][T17902] wireguard: wg0: Could not create IPv4 socket [ 717.021508][T17902] wireguard: wg1: Could not create IPv4 socket [ 717.029691][T17902] wireguard: wg2: Could not create IPv4 socket [ 717.445071][ T5820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 717.464123][ T5820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 717.473595][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 717.493817][ T5820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 717.509183][ T5820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 717.549687][T18100] Failed to initialize the IGMP autojoin socket (err -2) [ 718.087874][T18127] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input43 [ 718.291437][T18137] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3335'. [ 718.309348][T18137] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3335'. [ 718.409904][ T5872] usb 1-1: USB disconnect, device number 41 [ 718.552406][T18100] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 718.847394][T18100] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 719.252896][ T5872] usb 6-1: USB disconnect, device number 37 [ 719.255473][T18100] wireguard: wg0: Could not create IPv4 socket [ 719.278203][T18100] wireguard: wg1: Could not create IPv4 socket [ 719.376842][T18155] input: syz1 as /devices/virtual/input/input44 [ 719.402249][T18100] wireguard: wg2: Could not create IPv4 socket [ 719.547440][T18161] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 719.574879][ T52] Bluetooth: hci2: command tx timeout [ 720.391209][T18170] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 721.650287][ T5820] Bluetooth: hci2: command tx timeout [ 721.675291][T18184] tipc: Enabled bearer , priority 0 [ 721.713264][T18184] syzkaller0: entered promiscuous mode [ 721.718723][T18184] syzkaller0: entered allmulticast mode [ 721.732982][T18100] [ 721.735330][T18100] ====================================================== [ 721.742332][T18100] WARNING: possible circular locking dependency detected [ 721.749329][T18100] syzkaller #0 Tainted: G L [ 721.755280][T18100] ------------------------------------------------------ [ 721.762270][T18100] syz-executor/18100 is trying to acquire lock: [ 721.768480][T18100] ffff88802a692840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0x4ca/0xcb0 [ 721.780038][T18100] [ 721.780038][T18100] but task is already holding lock: [ 721.787374][T18100] ffff88802a692b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x760 [ 721.796221][T18100] [ 721.796221][T18100] which lock already depends on the new lock. [ 721.796221][T18100] [ 721.806594][T18100] [ 721.806594][T18100] the existing dependency chain (in reverse order) is: [ 721.815582][T18100] [ 721.815582][T18100] -> #1 (&conn->lock#2){+.+.}-{4:4}: [ 721.823031][T18100] __mutex_lock+0x1a2/0x1b90 [ 721.828121][T18100] l2cap_info_timeout+0x79/0xa0 [ 721.833489][T18100] process_one_work+0x9c2/0x1840 [ 721.838923][T18100] worker_thread+0x5da/0xe40 [ 721.844011][T18100] kthread+0x3b3/0x730 [ 721.848575][T18100] ret_from_fork+0x754/0xaf0 [ 721.853663][T18100] ret_from_fork_asm+0x1a/0x30 [ 721.858921][T18100] [ 721.858921][T18100] -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}: [ 721.869141][T18100] __lock_acquire+0x14b8/0x2630 [ 721.874488][T18100] lock_acquire+0x17c/0x330 [ 721.879485][T18100] __flush_work+0x4de/0xcb0 [ 721.884486][T18100] cancel_delayed_work_sync+0xd1/0xf0 [ 721.890360][T18100] l2cap_conn_del+0x5c5/0x760 [ 721.895533][T18100] l2cap_disconn_cfm+0x9f/0x100 [ 721.900877][T18100] hci_conn_hash_flush+0x10e/0x280 [ 721.906505][T18100] hci_dev_close_sync+0x5a7/0x1240 [ 721.912119][T18100] hci_dev_do_close+0x2e/0xb0 [ 721.917296][T18100] hci_unregister_dev+0x227/0x670 [ 721.922820][T18100] vhci_release+0x17d/0x230 [ 721.927825][T18100] __fput+0x3ff/0xb40 [ 721.932306][T18100] task_work_run+0x150/0x240 [ 721.937393][T18100] do_exit+0x829/0x2a30 [ 721.942043][T18100] do_group_exit+0xd5/0x2a0 [ 721.947042][T18100] __x64_sys_exit_group+0x3e/0x50 [ 721.952563][T18100] x64_sys_call+0x14fd/0x1510 [ 721.957738][T18100] do_syscall_64+0xc9/0xf80 [ 721.962739][T18100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.969127][T18100] [ 721.969127][T18100] other info that might help us debug this: [ 721.969127][T18100] [ 721.979343][T18100] Possible unsafe locking scenario: [ 721.979343][T18100] [ 721.986768][T18100] CPU0 CPU1 [ 721.992104][T18100] ---- ---- [ 721.997442][T18100] lock(&conn->lock#2); [ 722.001665][T18100] lock((work_completion)(&(&conn->info_timer)->work)); [ 722.011179][T18100] lock(&conn->lock#2); [ 722.017920][T18100] lock((work_completion)(&(&conn->info_timer)->work)); [ 722.024918][T18100] [ 722.024918][T18100] *** DEADLOCK *** [ 722.024918][T18100] [ 722.033045][T18100] 5 locks held by syz-executor/18100: [ 722.038387][T18100] #0: ffff88805dd60ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 722.047933][T18100] #1: ffff88805dd600c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 [ 722.057566][T18100] #2: ffffffff9068c768 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 722.067549][T18100] #3: ffff88802a692b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x760 [ 722.076836][T18100] #4: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xfd/0xcb0 [ 722.085944][T18100] [ 722.085944][T18100] stack backtrace: [ 722.091811][T18100] CPU: 0 UID: 0 PID: 18100 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 722.091831][T18100] Tainted: [L]=SOFTLOCKUP [ 722.091835][T18100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 722.091843][T18100] Call Trace: [ 722.091848][T18100] [ 722.091852][T18100] dump_stack_lvl+0x100/0x190 [ 722.091870][T18100] print_circular_bug.cold+0x178/0x1c7 [ 722.091891][T18100] check_noncircular+0x146/0x160 [ 722.091914][T18100] __lock_acquire+0x14b8/0x2630 [ 722.091929][T18100] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 722.091944][T18100] lock_acquire+0x17c/0x330 [ 722.091957][T18100] ? __flush_work+0x4ca/0xcb0 [ 722.091973][T18100] ? mark_held_locks+0x40/0x70 [ 722.091985][T18100] ? __flush_work+0x4ca/0xcb0 [ 722.092001][T18100] __flush_work+0x4de/0xcb0 [ 722.092017][T18100] ? __flush_work+0x4ca/0xcb0 [ 722.092032][T18100] ? __timer_delete+0x11/0x1b0 [ 722.092052][T18100] ? __pfx___flush_work+0x10/0x10 [ 722.092068][T18100] ? find_held_lock+0x2b/0x80 [ 722.092086][T18100] ? l2cap_conn_del+0x3d2/0x760 [ 722.092098][T18100] ? __pfx_wq_barrier_func+0x10/0x10 [ 722.092121][T18100] ? __pfx___might_resched+0x10/0x10 [ 722.092139][T18100] cancel_delayed_work_sync+0xd1/0xf0 [ 722.092159][T18100] l2cap_conn_del+0x5c5/0x760 [ 722.092172][T18100] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 722.092185][T18100] l2cap_disconn_cfm+0x9f/0x100 [ 722.092197][T18100] hci_conn_hash_flush+0x10e/0x280 [ 722.092217][T18100] hci_dev_close_sync+0x5a7/0x1240 [ 722.092237][T18100] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 722.092256][T18100] ? up_write+0x290/0x4f0 [ 722.092272][T18100] hci_dev_do_close+0x2e/0xb0 [ 722.092289][T18100] hci_unregister_dev+0x227/0x670 [ 722.092307][T18100] vhci_release+0x17d/0x230 [ 722.092325][T18100] ? __pfx_vhci_release+0x10/0x10 [ 722.092343][T18100] __fput+0x3ff/0xb40 [ 722.092364][T18100] task_work_run+0x150/0x240 [ 722.092379][T18100] ? __pfx_task_work_run+0x10/0x10 [ 722.092396][T18100] do_exit+0x829/0x2a30 [ 722.092410][T18100] ? do_raw_spin_lock+0x128/0x260 [ 722.092426][T18100] ? __pfx_do_exit+0x10/0x10 [ 722.092438][T18100] ? do_group_exit+0x1bd/0x2a0 [ 722.092451][T18100] ? do_group_exit+0x1bd/0x2a0 [ 722.092464][T18100] ? rcu_is_watching+0x12/0xc0 [ 722.092483][T18100] do_group_exit+0xd5/0x2a0 [ 722.092497][T18100] __x64_sys_exit_group+0x3e/0x50 [ 722.092511][T18100] x64_sys_call+0x14fd/0x1510 [ 722.092522][T18100] do_syscall_64+0xc9/0xf80 [ 722.092537][T18100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.092551][T18100] RIP: 0033:0x7f074859aeb9 [ 722.092561][T18100] Code: Unable to access opcode bytes at 0x7f074859ae8f. [ 722.092567][T18100] RSP: 002b:00007ffca4baab88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 722.092580][T18100] RAX: ffffffffffffffda RBX: 00007f0748608125 RCX: 00007f074859aeb9 [ 722.092588][T18100] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 [ 722.092600][T18100] RBP: 00007f0748608168 R08: 0000000000000000 R09: 000000000000002e [ 722.092608][T18100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 722.092616][T18100] R13: 000000000000002e R14: 0000000000000025 R15: 00007ffca4baacc2 [ 722.092628][T18100] [ 722.406312][T18184] tipc: Resetting bearer SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 722.420864][T18190] input: syz1 as /devices/virtual/input/input46 [ 722.473291][T18180] tipc: Resetting bearer [ 722.738059][T18180] tipc: Disabling bearer [ 722.807721][ T10] tipc: Node number set to 4213659811 [ 722.968236][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.978638][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 723.024844][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 723.035405][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 723.065031][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 723.075370][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 723.130802][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): left promiscuous mode [ 723.144507][ T13] team0: Port device netdevsim0 removed [ 723.151378][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 723.163627][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 723.237571][ T13] bridge_slave_1: left allmulticast mode [ 723.244740][ T13] bridge_slave_1: left promiscuous mode [ 723.251500][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 723.259688][ T13] bridge_slave_0: left allmulticast mode [ 723.261142][ T5820] Bluetooth: hci0: command 0x0406 tx timeout [ 723.266898][ T13] bridge_slave_0: left promiscuous mode [ 723.277378][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 723.712581][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 723.727712][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 723.738854][ T13] bond0 (unregistering): Released all slaves [ 723.747773][ T13] bond1 (unregistering): Released all slaves [ 723.836039][ T13] bond2 (unregistering): left promiscuous mode [ 723.842917][ T13] team0: Port device bond2 removed [ 723.848776][ T13] bond2 (unregistering): Released all slaves [ 723.910455][ T13] tipc: Left network mode [ 724.032616][ T13] hsr_slave_0: left promiscuous mode [ 724.038259][ T13] hsr_slave_1: left promiscuous mode [ 724.044178][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 724.053472][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 724.062108][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 724.069655][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 724.080127][ T13] veth0_macvtap: left allmulticast mode [ 724.085723][ T13] veth1_macvtap: left promiscuous mode [ 724.091472][ T13] veth1_vlan: left promiscuous mode [ 724.096709][ T13] veth0_vlan: left promiscuous mode [ 724.287828][ T13] team_slave_1 (unregistering): left promiscuous mode [ 724.299090][ T13] team0 (unregistering): Port device team_slave_1 removed [ 724.327842][ T13] team_slave_0 (unregistering): left promiscuous mode [ 724.337817][ T13] team0 (unregistering): Port device team_slave_0 removed [ 724.418556][T18195] infiniband syz0: ib_query_port failed (-19) [ 724.615179][ T13] IPVS: stop unused estimator thread 0...