last executing test programs: 2m23.715830236s ago: executing program 1 (id=2): r0 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r3, 0x80, 0x7f, 0xa}, [@NDA_LLADDR={0xa, 0x2, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @loopback, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r5, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) recvfrom(r4, &(0x7f0000001380)=""/179, 0xb3, 0x1, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d382e23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r4, &(0x7f0000001540)=[{&(0x7f0000000140)='X', 0x1}], 0x1) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 2m19.024149838s ago: executing program 1 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x2a5b091, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x145091, 0x0) umount2(&(0x7f00000000c0)='./file0/../file0\x00', 0x2) 2m18.549931625s ago: executing program 1 (id=20): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, 0x36, 0x1, 0x7fffc, 0x4, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r1, &(0x7f0000002700)={&(0x7f0000001240)={0xa, 0x4e28, 0x5, @local, 0xa}, 0x1c, &(0x7f0000002680)=[{&(0x7f0000001280)="542771bbc0c957", 0x7}], 0x1}, 0x9d9e977f75d4487c) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x880, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0x1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f00000001c0)}, 0x20) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x1}, 0x50) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r6, 0x60b6f000) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd86) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)}, 0x20) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000009c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000280)="ad56fa8ef1d91a4574758ecefbe1d7a46df6d558ecf1820f", 0x18) r10 = accept4(r9, 0x0, 0x0, 0x800) syz_ublk_setup_io_uring(0x3696, &(0x7f0000000900)={0x0, 0x24fa, 0x4000, 0x1, 0x2bc}, &(0x7f0000000980), &(0x7f0000000a40)=0x0, &(0x7f0000000a80)) r12 = mmap$IORING_OFF_SQES(0x0, 0x5, 0x200000f, 0x40010, r7, 0x10000000) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f00000006c0)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x21, &(0x7f00000001c0), 0x1, 0x40}) syz_io_uring_setup(0xf00, &(0x7f0000000480)={0x0, 0x0, 0x1000, 0x1000000, 0x55}, &(0x7f0000000380)=0x0, &(0x7f00000002c0), &(0x7f0000000080)) syz_ublk_add_dev(0xffffffffffffffff, r13, 0x0, 0x0, &(0x7f0000000540)={0x2e, 0x8, 0x300, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x8003, 0x3b4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x10}}}, &(0x7f0000000340)) r14 = getpgid(0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r11, r12, &(0x7f0000000b00)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000ac0)=@any_dev={0x4, 0x9e5, 0x0, 0x0, 0x1000, 0x3, r14, 0x0, 0x8}}}, &(0x7f0000000b80)) sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343e", 0xc4}], 0x2}], 0x1, 0x40800) connect$l2tp6(r10, &(0x7f00000008c0)={0xa, 0x0, 0x101, @mcast1, 0x0, 0x4}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x33, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xd97}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @generic={0x1, 0x5, 0x8, 0x4, 0x2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @alu={0x4, 0x1, 0xc, 0x8, 0x7, 0x18, 0xfffffffffffffff0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @ldst={0x1, 0x2, 0x1, 0x2, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000004c0)='syzkaller\x00', 0xcc, 0x8c, &(0x7f0000000500)=""/140, 0x41100, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000600)={0x3, 0x4, 0x0, 0x101}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000700)=[r7, 0xffffffffffffffff, r8], &(0x7f0000000740)=[{0x2, 0x5, 0x7, 0x4}, {0x1, 0x4, 0x9, 0x8}, {0x5, 0x3, 0x2, 0x8}, {0x2, 0x1, 0x6, 0xc}, {0x3, 0x3, 0xf, 0x3}, {0x2, 0x2, 0x2, 0x6}, {0x2, 0x1, 0xd, 0xb}, {0x2, 0x4, 0xf, 0x9}, {0x4, 0x1, 0xc, 0x4}], 0x10, 0xffff796b}, 0x94) 2m14.279330026s ago: executing program 1 (id=34): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000002000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0xed00}, 0x10}, 0x94) r4 = socket$unix(0x1, 0x5, 0x0) r5 = syz_open_procfs(r0, &(0x7f0000000100)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x100000003) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r6, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000000000000000000000000000000000000000000000000000000000000000000063727970745f64657600"/325) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(r7, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c0320904000002080650000705010200020007058202000200090400010408066200070501020002000324010705020200020003"], 0x0) waitid(0x2, 0x0, 0x0, 0x4, 0x0) chdir(&(0x7f0000000100)='./dev\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r8, 0x40305829, 0x0) syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) 2m13.917231507s ago: executing program 32 (id=34): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000002000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0xed00}, 0x10}, 0x94) r4 = socket$unix(0x1, 0x5, 0x0) r5 = syz_open_procfs(r0, &(0x7f0000000100)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x100000003) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r6, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000000000000000000000000000000000000000000000000000000000000000000063727970745f64657600"/325) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(r7, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c0320904000002080650000705010200020007058202000200090400010408066200070501020002000324010705020200020003"], 0x0) waitid(0x2, 0x0, 0x0, 0x4, 0x0) chdir(&(0x7f0000000100)='./dev\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r8, 0x40305829, 0x0) syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) 11.768753685s ago: executing program 2 (id=303): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b000000070000000200000022ff000001000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00'}) socket(0x10, 0x803, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x29, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f00000000c0)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @local, 0x1, 0x6, 0x2, 0x700, 0x4, 0x86020086, r6}) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000040), &(0x7f0000000180)=r3}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r3}, 0xc) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000000)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000080), r1, 0x0, 0x3, 0x1}}, 0x20) 11.124516727s ago: executing program 4 (id=305): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(0x0, 0xbd3d92d421aeb6fd) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, 0x0, 0x90) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="1700feffffff0080040006"], 0x1c}, 0x1, 0x0, 0x0, 0x22004000}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=@newlink={0x48, 0x10, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2180}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0xffffffff, 0x401}}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20048811}, 0x20000040) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113380000000000bf1000000000000025000200091b00003d200000000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200000300000015030000ffffffffbf052000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_msg}, 0x48) 10.913714254s ago: executing program 2 (id=307): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, 0x36, 0x1, 0x7fffc, 0x4, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r1, &(0x7f0000002700)={&(0x7f0000001240)={0xa, 0x4e28, 0x5, @local, 0xa}, 0x1c, &(0x7f0000002680)=[{&(0x7f0000001280)="542771bbc0c957", 0x7}], 0x1}, 0x9d9e977f75d4487c) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x880, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0x1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f00000001c0)}, 0x20) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x1}, 0x50) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r6, 0x60b6f000) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd86) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)}, 0x20) r9 = socket$alg(0x26, 0x5, 0x0) r10 = accept4(r9, 0x0, 0x0, 0x800) r11 = syz_io_uring_setup(0xd3a, &(0x7f0000000b00)={0x0, 0x2, 0x3010, 0x2, 0x3}, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r12, r13, r14, &(0x7f00000006c0)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x21, &(0x7f00000001c0), 0x1, 0x40}) syz_io_uring_setup(0xf00, &(0x7f0000000480)={0x0, 0x0, 0x1000, 0x1000000, 0x55, 0x0, r11}, &(0x7f0000000380)=0x0, &(0x7f00000002c0), &(0x7f0000000080)) syz_ublk_add_dev(r11, r15, r13, r14, &(0x7f0000000540)={0x2e, 0x8, 0x300, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x8003, 0x3b4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x10}}}, &(0x7f0000000340)) r16 = getpgid(0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000ac0)=@any_dev={0x4, 0x9e5, 0x0, 0x0, 0x1000, 0x3, r16, 0x0, 0x8}}}, &(0x7f0000000b80)) sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343e", 0xc4}], 0x2}], 0x1, 0x40800) connect$l2tp6(r10, &(0x7f00000008c0)={0xa, 0x0, 0x101, @mcast1, 0x0, 0x4}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x33, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xd97}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @generic={0x1, 0x5, 0x8, 0x4, 0x2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @alu={0x4, 0x1, 0xc, 0x8, 0x7, 0x18, 0xfffffffffffffff0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @ldst={0x1, 0x2, 0x1, 0x2, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000004c0)='syzkaller\x00', 0xcc, 0x8c, &(0x7f0000000500)=""/140, 0x41100, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000600)={0x3, 0x4, 0x0, 0x101}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000700)=[r7, 0xffffffffffffffff, r8], &(0x7f0000000740)=[{0x2, 0x5, 0x7, 0x4}, {0x1, 0x4, 0x9, 0x8}, {0x5, 0x3, 0x2, 0x8}, {0x2, 0x1, 0x6, 0xc}, {0x3, 0x3, 0xf, 0x3}, {0x2, 0x2, 0x2, 0x6}, {0x2, 0x1, 0xd, 0xb}, {0x2, 0x4, 0xf, 0x9}, {0x4, 0x1, 0xc, 0x4}], 0x10, 0xffff796b}, 0x94) 10.720108709s ago: executing program 0 (id=308): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, 0x36, 0x1, 0x7fffc, 0x4, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r1, &(0x7f0000002700)={&(0x7f0000001240)={0xa, 0x4e28, 0x5, @local, 0xa}, 0x1c, &(0x7f0000002680)=[{&(0x7f0000001280)="542771bbc0c957", 0x7}], 0x1}, 0x9d9e977f75d4487c) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x880, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0x1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f00000001c0)}, 0x20) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x1}, 0x50) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r6, 0x60b6f000) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd86) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)}, 0x20) bind$alg(0xffffffffffffffff, &(0x7f00000009c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) r9 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r10 = syz_io_uring_setup(0xd3a, &(0x7f0000000b00)={0x0, 0x2, 0x3010, 0x2, 0x3}, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r11, r12, r13, &(0x7f00000006c0)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x21, &(0x7f00000001c0), 0x1, 0x40}) syz_io_uring_setup(0xf00, &(0x7f0000000480)={0x0, 0x0, 0x1000, 0x1000000, 0x55, 0x0, r10}, &(0x7f0000000380)=0x0, &(0x7f00000002c0), &(0x7f0000000080)) syz_ublk_add_dev(r10, r14, r12, r13, &(0x7f0000000540)={0x2e, 0x8, 0x300, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x8003, 0x3b4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x10}}}, &(0x7f0000000340)) r15 = getpgid(0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000ac0)=@any_dev={0x4, 0x9e5, 0x0, 0x0, 0x1000, 0x3, r15, 0x0, 0x8}}}, &(0x7f0000000b80)) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343e", 0xc4}], 0x2}], 0x1, 0x40800) connect$l2tp6(r9, &(0x7f00000008c0)={0xa, 0x0, 0x101, @mcast1, 0x0, 0x4}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x33, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xd97}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @generic={0x1, 0x5, 0x8, 0x4, 0x2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @alu={0x4, 0x1, 0xc, 0x8, 0x7, 0x18, 0xfffffffffffffff0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @ldst={0x1, 0x2, 0x1, 0x2, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000004c0)='syzkaller\x00', 0xcc, 0x8c, &(0x7f0000000500)=""/140, 0x41100, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000600)={0x3, 0x4, 0x0, 0x101}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000700)=[r7, 0xffffffffffffffff, r8], &(0x7f0000000740)=[{0x2, 0x5, 0x7, 0x4}, {0x1, 0x4, 0x9, 0x8}, {0x5, 0x3, 0x2, 0x8}, {0x2, 0x1, 0x6, 0xc}, {0x3, 0x3, 0xf, 0x3}, {0x2, 0x2, 0x2, 0x6}, {0x2, 0x1, 0xd, 0xb}, {0x2, 0x4, 0xf, 0x9}, {0x4, 0x1, 0xc, 0x4}], 0x10, 0xffff796b}, 0x94) 9.921591126s ago: executing program 4 (id=310): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x82000, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cd000000000000040000008500000005000000"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000001780)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r3}, &(0x7f00000006c0), &(0x7f0000000700)}, 0x20) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$unix(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f00000000c0)="b3", 0x1}], 0x1, 0x0, 0x0, 0x20048000}, 0x4000080) openat(0xffffffffffffff9c, 0x0, 0x121302, 0x0) 8.831831866s ago: executing program 0 (id=312): r0 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\"\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000001"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x6, &(0x7f0000000240)=[{0x585, 0x3e, 0x9, 0x800000}, {0x2, 0x3, 0x36, 0x5}, {0x7f, 0x2, 0xa, 0x2}, {0x20, 0x2, 0xb, 0x8}, {0x307, 0x7b, 0x82, 0x4}, {0x9, 0x7, 0x7, 0xffffffa4}]}) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e702008000040905", @ANYRES32], 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x3, 0x1002) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000180)) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a07000000000000000000020000000900010073797a300000000014000000020a0900000000000000000000000000b8110000080a010200000000000000000700000008000940000000020900010073797a31000000000c00034000000000000000050c0007408bcd6a5f0e24cf8808000b400000000308000a400000000304110480001101800e000100696d6d656469617465000000ec1002800800014000000015d81002809b000100232ae285de2056da738663517c0842d2ac4d4d3821bbf47708ec26849689268e483e0c86863676f805f00095c8e6d4c977ab917b17c592108a1b992e042752a7c4ddde5745c67133b03e6a0debd82e43f88b0f0ceba260c70409bc371d04d53164601980a41f01fa4d1bddd0bdff376ad7da4010a8ede0c7992da7c0a965743e68b5b5ed52543a6d8dab9b88f1194752bb556a0f20f12b0004100100b66e6c8bd9cf544f4882322c5e7bb6a83943920d33ac543474d65214ad24e4c6491d2dfbb866b1a9c413439d20c337ea8fa6a42127803f770f1663370e57056416024c03955c399bc072825a7f93fc71d1508f12d52b5b5dc63e8c8a609a69f21c487c76ca31e25324b7042a6b6df08bd2865455a2a6ad3aaf920350ae397c26ce6b25d2dbb1a877630d6c1cb88b9d5e4693275e622c45fbf5c5ce19e91a7a574a1ba1aa325dcedc8caac33d65b2fb9f0fb039f9c6041af92789606cee7bb18b1c1510d93b65f13207dcd15dec0934a7737199dc1c6979be1520cb2cd14c636518d464b61abf778074b37883485b2834cca5693e0de65fa3183e064f972d6894ddb39c0f19e95713d3557baae850c0df1ae378db1504d4145a3813ee69993d3706a816df95bd69b5ebf724ba907439f9169270b8658c3fe3864eb1bc9e3bd4dd61c7d043cd9d4cc7b8ce9259f789aa22549a9848aa975782ac31dc85083ba6bb6e555dae1dcb9fab29a475b86a36e3f056312c1aafc864797efc44b6d73b63692bcc5b2dd03cd86b59202f27a6d4e57086f9d23e12eb620d0d1c2b381420a0b6d0539322555fd903e360246e35c059f216c1ae68b5aa417539c9366994c2dec14affdea13e4bfebfaa23fd2c5b68ae93bfd5a96fc65c5eee7e326ae1ce3f432af7ea163d12c4a20a3c1385366c9382aa30c3dd448d10dd653799e11b4dd5dcbf1470ddb4288f0f9a5e6d280db32aff647f9fa7384d526ca3504cc8f6a0fee538f6931ea71a2644dd8ce64c7bddd15db1da1e5162cf3d173fc9c242ed89867d964ff954f9bd86469f44aa5c8051240451869a4a27799c3efcd6d8ad65292b8c6090c0257217fee69f04de5e3b01bee3dffe0163915b710014827bb922dd4ffc2c0d832de5806072288cc299657a0f26f210d0ee82ad0fb4e781bc573e7fac38fb72d3fc679b4b8623809076abcb119172076065684db1bda04270eb84089eb2763b9238799a97fd652c3df3a2d6854db0489e558148eb85ad51ad74ab65d78f7cfee5a784206ed3c2fbea4e226d6b9e8abd1e48786958bf98cf0b2c6f51e7ebccc5d26d0fa25bed6910fbd647ce4874eb704d69a3b943893624beda168864b51c798f79e29e3e84748021aab400d5a558aa8f703b1093e559fe58131ec7413675853fd46c2146be8cf242468b49b2ba4a3bb93761e01d295edd4afaf3adbab9e20423a96311d0b01151518296b5ea0aa743089c3a77ec1240d818cdc8d53ef5e98815e1f94fc427ec0ba6364996164812bf7d3c9271bf44f9763d7f38a04fec87bae113bb20fad76cb614164ec829ce8d950b1ba7fef3ce33555c167ee671cc00c8650e8334ed5ce644b72955bbec8e09a768ace742fe107c6270f4cadd39ee797da4cb25bd2057decd81d51b7f4a481675d024b970827ce1df272263420d226fdd50419ed7425ca3f9f479612faada018e743b22bae4d0263247646b09ac0abfeb4eefa7eeb702345a21ea367f36f875f122fe403ffd2d02a7ea0378f444ff9c43c0cc82ffb39d216c848e7fb14aec66396384617cffacf525d45e93602671ceba196d60f0efb787cc0657ae1dad1e3882ab5cf7b57d74005e1a4823949a22013a62afb661bcca9f262593ab9932f0d008d977b0366604f1ae4e93bfcf14ad980b1377fa19b85f88a4d2bdd15ca5a0722205088c585ef6ae456479407a548a5e4dbb7e33a5e493d311b398173dca50cb012bf669f53501de61fdda06a4b7189c8dd44d2d48b4269d3ffcd66ed9042bff496b2679357108d89b24c054c7b846bae97238bf05f7a6fc7155d2ee74d47f2acf43b98e4f94e29e13e57882ffe2201593c6edd5bab84afc6326e93bf1575d535e40d03793746454e1cfcd500e0eb3f75a99a71faf12c029edf50d70e392cebcbb8c3836dbbf4c6c2c99f3df679d17b239a67327bd6a68bdf1fc1b2cdcd512e21c23bc26a37a26db46a61ce013d3ca97c8fb8dfb363af2f42208ce49f83af3cc90aa9dc0494715c8f739435beccfa87510dd4699f7f4f3f733f4d9dd718a5ee9514374571742163dd39fc66b8b1687a495cc68195c086f4800c8fa2e2a85fbce66e9f6f51fb8256bebde7b6d5633b4d9e1e224462e1c210d859747701dedcad819ca67bfed8cae9ddabe3476bec58ce6e05c2747730ddebeedb273887d9545dcc6041937b2d32afb5988d4b96041d4478fddc7ed7bac7b27553c3b336e8eecc87d3fae30d4ca35ac6d58f0c674dfd1dbf729668e57ea5332d6b6ea4d9b562428c87e5217a22bf4a05010594f7e0602ac0dfd2a107937624560a6fb228a419ea52674c92e0b8e909b04566825d9e794fd310ccbabdda5ae81fd31dd9b160c48bcbac73cccf9633d99df2680c38df8d7368d5d2d9d74e668824d86b9f5a5d936e1d9943fc398a4ea18cb91883903e3581802bfa46547cfcae3432a4de419aa4e0950f2c31e97d109cd6248eb8fc94c86353116a057b1ea584c917e8915a04603bdb259925bac320dcf5b19571785cb85d6eb91c481774c155270988f911c5e38aeebe8e97fa56abb242366f2eedc08f393974438be1c45a63baff29f1283b00dd6738647bc227d8bdc252f43dfeb872a799dca6cf6e4fb6875a844c6cacba0de1a471ea39bff60c3ee56960bb105e1110e9a013d580e482866f523fece24fe30d1f0c68b7aa55cd5762ad929fb05ab57316c144a84e6568bf4c1ee91597d373af23d01435e2042f98f50ca81ebaac903a25562e6ebdfb98c2a8fec9764565bb593c2c693095cc053951c40662192bc8b70884cbcfc2d0161dc15e7be650f16c5753cbfe547df6eaa108a600a61b7e3421705ddedfa5989c52cd63092e4c9bd1916e0ced6e99fc7b35085d4d976e548bc149af9f38a50a02941c434f6c9a1e3b4d71960e9dcc38d8ae8f136041ba7a303ce7a5402458815b2bbec1d951c73d8d75a7d8d39577741b192192a5ff545388aefb898cc75d9448b10746ca060cdb55f44440589598393984333dcba84905786bf776e6516a9de1eb0a0ca1e89474bbed713b338f02b384382eecadc5e0ff946c0afb7b4072620832bb3650d9889f173d5711b441e4f1c02f84cb2b505394e12311ca38f9b487375cf463a171d41cff2cc20a8798817d45add3ae83c156a5808c290edd60c40bf06b43c1763f0633061b2e4527ac78bbe9d66327d0d984ca413f681086bc3ed8defa74267fb216dff9ffcde42aae65d9622a55256f41fdca1f4a7730e6c4bd0074a00d63fca7f4f1b2a95a8dabc8b2e3bb8f5d24d6efaadf9fbb796bdc530ab8e71cd133f1b1dc5f6ad53c03e73991692e31404d8ad5f69fa0e08711de5eb42cf8d4211a33f003c49f53d484bf379a7e714e629cb83252b538b4bd5088601a699e508dbc36ed6e3c80572a760ee0a806503421793b8fb913ade551b4b725436d274f2748edc600f1dcfb947f774d784b1fca95bf645f91fb46a10a0dd112919b791aa3c137d80a51869594fc03f8ffb0b62cc6651ec1cff52dd8ccd5e0088d03f3a500039b661149b29f8881b677b681636318e6512689bba62cec72ed6611d16b35f54c3d78acf869750f8c5668b06e71d3f72c452a6eb71a2f55fc42d8aa0eac0b191e9ba4a7b9134b66d0717c80b249d66413c615c3bdb8bb3e265d6e98d9017cedd91b27e10736f38777c05a59e569ffb2e1ea0d200080db331ad38cc23dcbeb94596bc771c8210eed7480784b2f5201317eb192449f85d8f363bd64319d128d81b20952409e02aa5acbee5498e3081d73fe0df167ae69780c6aaa676203321ef5facaf2cd368955ce355a3e995e7658e1dd4842298990c8851146c4d1b0fc27115fc5713ae7ff8af152a3795bcb1fac487f7980dd72cd7e0c8b5d6e86d1abc029684da3368bd29f040054e2cc014c2291add98c65a5a5bd9b03d238d9cec42e9969cfd9c590e90d3e90c4d257d200eff110ac810d9e2b8b4f48760affe7bb6647a89e19375dd3dc29dd84c445efac8fb9aceff25a28353c5a44313588811d9d97ea42cc48d9d8e70055d2d62a72af7494cea29fe23236af140e23ff2338efde1622a400dd2a005ebf5dc9496624581101039b69918102984fd4393d88cfdf6f653e26a6940738e066af2c7047fd2c6fb268a1a421e0498c16372ef90d8fffe94165afda40c273a57be3a43bd08034825c80d0c1826e1700679c941e5b9232a76315dd4c06b8dd655d4458d14342ff6eb3d992183663acbcdb79c2bde2ea2bad688f5ce7bd6dd9e7f41b6bf574d705cd3964f806c6e4713453bb25a84ff350736b8f73da7e32914a2d02414a73f98959edfdc951c50c41f30b1fb3566dc0fcb4b138f8a6e28423c087433165cbb60471db666a6e0e6526a0a219e611c84994ac935502f14c0cc7cdce10bbf7c6fbe42673e910dc87fef6b559edcbe4b785a894c0d2374f985ba7462b6a76e46d950cd6fa5b4d02b7e749564af2266348123f713faca83322b4dc7978b150b9efc29633732b43ea545cc26706b40dc559496a1a38cd8092bb58e3d0f3d68178ee677fb2cb3b72dfeac1ada6b05f706669ac7bc8dbc8584289b37d0474e814ef4dad93642614b821db9c81d0d91aa89a7e55d08120bd2be2a6391e0778c9de5ba0eb079f9b6670c48626d5d6529e72ddf8b6f60bc80457c53d503a3f79bde9cef6c64c3240b3c19d641f0b266b63d722fb7010aab9a37f0449c4973355be891f218d7d45243ab9c619bff2304bd4b1c84767763dea1919a0e9e1042aa106fcb223146c365a6cd17896f1ba52d1904995b68b2a7d9033b2d67d70fc25561ec013c6b875a9b56d5344edb3d6e69e916566cc190b548f987484508bc37333dfc67c52f491f92e2faf026b57e126cdb9f6e93b0d602e2dc5f78cc42d33c2ccd98a3847f8be0ed8eb6d72c4f1f7f7df17d5b4a1ce4595d57f3c5009eb205d0479a8d69ac1cd7ccc7731e9c39c5bbce8ae259daf1d1d08924cbb5c39147cf87ff59ae087aac582e9d2615dd2ffb5a43e97b2dbeba0d459054b30c18709cc51c9f6da436e3d39429c98c5ea235450a1dc0dcc4561296dbf582dffc8564184586ab4451a75eaeed4745bcba567e67162bd186c6bf95d3ad5c481227733f397f64ba7da26af5d24bf92d22fd0856b1567e5d6af4ca57387d7b5ce475fab383be76512eacd9f4fd5087b698587e2cf74073509752de4b36d36e2ae0445c901746e39d007311cd09ad6bae9f682f9773c759d19e19eb5e791254e2120fb0f2325bf4779a1bde51f23d4173e928f7bbad28db088ce31bdf09d7ed1103af5ce7c481352460c3349be954ff12271e44753416b5f2aecf0f8ca42fd2974aa549ea015c47e3968056045408033d6370fa8fb8b73ac8dcae439f1c50e507a651ca6c6d0b90ac01091436b53af84882b2b9324b08cb13a6d33efda06051ae4db5fad9068d599f0fd09f3049d93c4004fdb54e8125d73034ec370466c0f81a03e61ee85edfa2c8b741d56f0fcd64c4545b89e19c9fa84be75c2dd9568fcb3fa976d20cf9a8f15dfa5a612f1b5c88b776bab6eb65e974b3c35d63dbffa9eabea6ddf5c79f2c9b5ce1896bb520881619c742df5cb31b032eb985e98931e74ffc48ad063fda1ed8c99dc04a3222deb821f99c7ecc975f75f811f68390f9cb417da150ff067e0389c70ac94ea239a52ec345518b9a562d6b4c7bcc85c550314d865a6c2700ad6853b15973fe58ab3612cd87705bc8fc6d37e7522a302c0736e463b52fb3cdcce485d26b602ecf7f09de9bded3a0eaebebfd0c00028008000180fffffffb280002800800034000000001080003400000000208000340000000020900020073797a320000000008000140000000034a0007"], 0x1438}}, 0x40002) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, &(0x7f0000001100)) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r7, 0x7, 0x0) fcntl$lock(r7, 0x7, 0x0) fcntl$lock(r7, 0x7, &(0x7f00000000c0)={0x2, 0x2, 0x8, 0x3}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000010000000000000000000000b7080000000000007b8af8ff00000000b70800000e45b93713b5294e00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000002000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x9, 0xff8, &(0x7f0000001e00)=""/4088, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r8 = syz_open_dev$hiddev(&(0x7f0000000000), 0x6, 0x2000) ioctl$HIDIOCGCOLLECTIONINDEX(r8, 0x40184810, &(0x7f0000000040)={0x3, 0x0, 0xffff7fff, 0x8, 0x7ff, 0x6f4dc7dc}) 8.717494524s ago: executing program 3 (id=313): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x2) syz_open_procfs(r0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r3, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000000000000000000000000000000000000000000000000000000000000000000063727970745f64657600"/325) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c0320904000002080650000705010200020007058202000200090400010408066200070501020002000324010705020200020003"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) 7.241311549s ago: executing program 4 (id=314): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='.\x00', 0x400) r3 = dup(0xffffffffffffffff) inotify_rm_watch(r3, r2) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @rand_addr=0x64010101}, 0x10) r5 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000400)={0xf0f000, 0x1}) 7.11155024s ago: executing program 2 (id=315): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="0018000000000000000c0000000c0000000200000000000000000000040000000000003203b9437337b3e819abae9262aa4e3cc6010cdb7218854b92c6320ed6f5fa515f"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000002000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0xed00}, 0x10}, 0x94) r3 = socket$unix(0x1, 0x5, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x100000003) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r5, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000000000000000000000000000000000000000000000000000000000000000000063727970745f64657600"/325) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(r6, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) 5.621680955s ago: executing program 0 (id=316): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b000000070000000200000022ff000001000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00'}) socket(0x10, 0x803, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x29, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f00000000c0)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @local, 0x1, 0x6, 0x2, 0x700, 0x4, 0x86020086, r6}) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000040), &(0x7f0000000180)=r3}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r3}, 0xc) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000000)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000080), r1, 0x0, 0x3, 0x1}}, 0x20) 5.496180116s ago: executing program 3 (id=317): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$inet6(0xa, 0x2, 0x3a) socket$xdp(0x2c, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) 4.983705345s ago: executing program 0 (id=318): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xf4240}]}]}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0xa000000}]}}]}, 0xa4}}, 0x0) 4.443724965s ago: executing program 3 (id=319): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000140), 0x0) r4 = syz_open_dev$vim2m(0x0, 0x3, 0x2) ioctl$vim2m_VIDIOC_TRY_FMT(r4, 0xc0d05640, &(0x7f0000000240)={0x9, @pix_mp={0x100, 0x100, 0x0, 0x0, 0x0, [], 0x1}}) 4.380722607s ago: executing program 2 (id=320): prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) capset(&(0x7f0000000080)={0x20080522, 0xffffffffffffffff}, &(0x7f00000002c0)={0x4, 0x6, 0x5, 0x8, 0x0, 0x2}) r0 = fanotify_init(0x8, 0x80000) fanotify_mark(r0, 0x105, 0x4800003a, 0xffffffffffffffff, 0x0) truncate(0x0, 0x7f0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x120, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={0x0, &(0x7f00000000c0)=""/189, 0x0, 0xbd, 0x1}, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.swap.current\x00', 0x275a, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000140)={0x4, 0x62cf, 0x9}) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010102, 0x4e1f, 0x3, 'lc\x00', 0x34, 0x83, 0x5}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcf, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_EDITDEST(r4, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'ovf\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e23, 0x2000, 0x8, 0x48001}}, 0x44) 4.380201647s ago: executing program 4 (id=321): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x80, 0x0, 0x3}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=ANY=[@ANYBLOB="180000001626ffe500210900000000000000000a", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r0, &(0x7f0000000040)='status\x00') r3 = socket$netlink(0x10, 0x3, 0x0) setresgid(0xee00, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000e40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}], 0x20, 0x1}}], 0x2, 0x0) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0) syz_usb_disconnect(0xffffffffffffffff) unshare(0x22020600) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYRES32], 0x10000) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140), 0x800000, &(0x7f0000000480)={[{@favordynmods}]}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000003c0)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000240)={r8, 0x2}, 0x8) ppoll(&(0x7f0000000200)=[{r5, 0x80}, {r6, 0x402}, {r1, 0x4008}, {r5, 0x200}], 0x4, &(0x7f0000000280)={0x0, 0x3938700}, &(0x7f00000002c0)={[0x5]}, 0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0x0}, 0x106}}, 0x20) 3.007568477s ago: executing program 0 (id=322): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1f35, &(0x7f0000000040)={0x0, 0x2096c, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000008fc0)=[{{0x0, 0x0, &(0x7f0000003d40)=[{&(0x7f0000002b40)="cec7d91d105ac7da4ca5d817c47eb5d31799ed97acd8f7d1afa1e2663d8d9e8ea5622b925057b6a23e8cca76c10374ae9962822e104b8bd7180c6b0163349c911ff36170ee162b97293bc54de3d1c4764916cfe40215ed52bdbf704536b465e46f69632383d68c30832047842d3dfff209b5e0774e476e4cf1d56ba7854c14ab4d4a5e8908e5efd5d0f5388213b559ac16e9e8a20f8f2a7e3591c8e4a642af9e2840c113eff9752dadb8e36a43db147bccf0483fb45da35660dc3f5dc199f612e5b419153c5332a3e73c93b9162db3e519c9ef15c04e92b1cf3a61fba55a7b2c0dc91814dbeb5c099bef3471c071eff94254335316e9fe2370a4ab0e1ee99d8ba7fb366f026b3992f9bb3752a93a105dbf0c4d7e0fce787de4c9058f99393b55a8ef357ec0d8e7430e2a9175dc395c24faa1712e233f9cc3092881d35c51fc0245a36dab6ff1b8e77da83f9eacc7f865da0e685dc7a7b15e5a8e279da8171be185e9d59381ae6fe56bcd3e529fb837bede71b6a340f967ca56ae0a033c9fd1732a2ca32f2305c87fd7af265f6bd9b95e401e5c6d6c49f3d2370d4442483bed0a93cc36c66500cd5397eb9e6831d63d7413462b8a4df6e90afc442fe7e7df58d021bc47e019e67a453edbcc2b83132bcee117facc728f15cd16d58737a8c4c673f2647457e74ea310dd5fddc64b2e6d28af19c0b38135e593d0ea866a29a419c3f140478ba038160816d6212e5d7957af5395ec000676da85775e48f0adbca3a2e04586a26212c12bde073a6d0d4748d8d329ec23d9fd3f479e8136efd05a91ee2f4daec97200e0c4177a72c5ca012f8288dccdc4e043f61c056c16a783592ac72db32b78b78f81fd0333a5eb1c5eea337b7380816c787f1f874e337cdf3d47dc21090306fbf79ca6562124cc06b14d6ad5ad5ab37aafdce08b43b18994086ad852a28e4a8397e01c0efd5a28140db2372062b038db52538b130831d51c96bbacde776aaf60da266c2b43c85c24e7d262860234962887336b1ba983517798be78183fa102b16265e6c34e589bed0271dd5ddb0684e712ccd9a2a5438408fbcc9669702db0acf762934cb354c9463d1fe6b33980fbe8438e76e55534e3c8548c3d646cab29543819c1c20b175f1e60a2bd6bcf5a47f1f4c491654002e0c8887455a2ec3dc80e3506da37d2f3f761bf54d44262a0c4b370245168c28891af678dd77ebe4bd03019d5efd73dbec0e193b7ead47b323a472f0d65c709c23f2458b39323b0f2415a54bc8e4919c310b53c61417e9338274697bba5ced7f4811e03b3920e4358c9a433975a89cbe15d508c6e44e7ba0055f134f53bab359b033f30ee3720f6f631e74b38be58525bd08d5355991e941baba9c7a47c1a364705fbf55afc8e2932579bf0070b1a4108ef2b30f7ff9674ad0d4ca5359cf30891a1d7da0c04a993a16c85b56664c5400e755a466fe0dc94fa7ba695015fd77c9a3ca89f0e41a2fb1999e26289cc52b181b8f6f3226d555e391db86a0630974a43c024e4d49521e02742959505a2f043064e0e35b0236f63a0bffdf4c9d7c5be3d1c9b7b82461589ed41fdc9783a278af1e60b0616e16c6bbf51470b9e4d4e202e6b7d8435972f5a1e944d085beb6c0176cf866d3187bc0fd4cb3e999c5a0f8009946b472a908e2c5daa27275cd220419cbe834e853c6edc07380c9b509dc69f7264b67a549cf81233b7e57232f96e5121b761296369aaa17863aa676ac00d8cce3b0ed53076a3229b16a2456efa9e3f024eb6496030a9e8ddad0778d1924ecbca9df7960949a224bf31a42cc243994d30a6ae89112d675acc7dbfd8407a6df6162a0c16f24e5846445a55cd022ca3a0d8bf237b019543d691422116cda575d503f950b56b3badf661ea801e50ca7fefe530c395c2317128650e54616ea74834c70f4adbcc19939d144db66088158a1987835aba61367f9585d6858c405e905c6eb93a97447a4e1794138a61cc605966804ccc1f42a16789a20f891199c12b6fe23f57fac2d473f9d7e3014574d42d03776b53c01b6df32ff1101a4b79c595a9d24c25102503fabaad3851e28a28da855f53f86e6428172b4c7be7f2d8fa023090451015bc861a9de3d2b767f5b3dad19d84777016ae0adb49e1ae5deb3dd292c021526adb6f7302b181e19ed25a5d30281b2966dbf004a27ab16699676d7934516fd69cc132245d8bb4c8f89799ccc8c7a47e61b011e273f2ed22f94a1d62eaa5d4b47e778fbf752e2d322821e8e67ec42e2948b402b05b03ad90b6bb43d21191bd0bcf996bc51295ebc3bbc634e856aa2255babba8ae8d18bbe2b7bf5f912556302269fc0431992f68390f58920f111464ac5d0599d987354d7e909164aa9d27a431a0b563828ecb37a48fb48a0432bef075081e323713b9d5d8ca1d39926a1f12e6d60631f7e170eeda9386a04f868fdd523cf2926eb90bf443f030d84908f0dcd82e06948335c0998342de45fc79ff17b3419c7996ef68216c54c10534e36509cba201a5db678570090a2f0c7e6f51436fd7a64a4b7b3abe1d313b98f9d095df967d02d30238595f249992d5bf9aecb2993a066cd49cc0361b32b8a5269b04d579aed853337d89943391f4e85c65395c1d15ae21789c2336a503bb70b3b11cbcc433915627708ca7d952f9549103b73f461dfd00c5918f54c30435332bfe80b639480813eff3e86d88e5e463006ae47aab24fe3fdbc3db517e07b4ce67120a641a1898b28f3a72b66bce5a115490cdea3af3d2268ce79d20991336fcbecc4108cb4122b1cf4b606f3660dfa75319ee7acd470c86c77db7f57a1af116fcbe3fca7597b740aa03cd955510518a3fc955bdfc1bcf6d1d254549ab1c040ab4deb8571275150f726ed26967e128ef08ab4eb8c9e70ff4d4cc779fbc82cfc4b650bb775494dba004f8b38ca1a85a161e59248e4efba61afe4fb34052fd9395064fe0fcc756c02109b76f789d11e69276c41f7b458f5de22e7c5f38f11fcec67b1d868bc6f98522232a1e04d5785e19a0dccd45229f2496f9a121f34141c07389e2728edc074f215e5145584c5b9e01fbf2a2ff17e959ea87e1e10b67d302474da63e99f923b3bdb50af10e799fef9a4d2c4134adce1b480d92e7026c26122d22e54dd9bad35f983921d260db5f471f5269ef97c287ead13fe8074327f6c071cdaa4911e4c94b3e1ff6e5f004d3ac00271023ec277a3091c8e0504b26e774fc27666e865db17f51fce85ce9d95fa7083c72cf2d6030a84d232b44aa33841bba5928bd348fd01907d545bb513242231f4b452e0eb346274a5a10edf67dd281a31f0e35fdbc548f2950bee936833142900e0667933e64cf571071d9dccd5f171a76dbcdea1e47353949b3ed6842212b4c35cc61f6636c44d09d5ee93b35111158e936bc63c3257227ce5201468cd4177f0d75940cc8e27324be1f88618a0500c49c00c81baef03d8d671076149c5cbb5fac87035cafa7442b5ad8409712350fa34c69e805673e2542b89a3ac155667ba330d92494f6b7d42529c97696651092721dd31f29dfcb9bd9c528558f280c59c1dbb124f535e2092701fb4764f8b8a2141332753d04bf2cbfcb3a96bc1a81f8c88df550a87a30d80b399908f5fc0f5b66d57d7b9b6e82e27899849b7a0b132c6fd448a38b7c9c56e0848d3a356c235820dd8a10a3a56b87d14d28a64206ce5cc06d74cc32188cc1ac4e95089553873bf66fc75d7a09547342c6e3db41bef54e20c5c49497d22e3b0905c153a9eb12e6e19df043b58b3f0d49c950ea8ae390272fb10dc40a5e693f71778193544320691dcfee725c6389047cdb2e98257270977688bb7b0eab0cd26b09c64868346a22367c3313c95634ca685578dd150f704eb08019af0ba48cd51ee4da8d7c0216d90485a367019b46d933776f21c3f103118e65bfd2371239b522bba633bd632b53a7671a4b1e18e8a0be31f30ac104e753f0405466220b20083a52b33d03e32cae1aaddace0a7cd9c8112d0cfae454442eaecfc5143e2259542260a0c7c371cb84f9191e598754c8da76d76a7e3f09182480310076371dd5fc50b19e74cd2a7bca8326dbfb29e397debd95aa7ee1f4fa9077693ef5beabb2a1976e0a8d0ec5d9b0a84983f92367eb35104ec11386eb0f323127cbfef7fcb2896859b747675d6433473ee70b815eed928f3060b8178585b078233782b1c032e014eeb40a65858a8b0e5256a69a55e0451b1ff62f8b8960b75803de2a76359a0567c73eb3132620c838e73c7c733017b4a370e62119501996e77a1aaf2fe40f6a9752ffd0acc8f2c8ae8e2ddb81274fc61d3332bbcf191e8a002f6a77fbc55d14fa97718a1cf7148b9f5a2959ce613162c1d48d7593695ed0def3d26fc4c251fef2dba4a260f4e6b64c82eeeef409be32194ab630f0cfcb8c60ab3e138e6a5eefdc711fcf76f8ab2c38b2a73e7bf74a95c88a485a8e4e224458787684755abca317579ea07bf1506166f5", 0xc79}], 0x1}}], 0x1, 0x4010) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 3.005952768s ago: executing program 3 (id=323): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) openat$uhid(0xffffff9c, &(0x7f00000002c0), 0x802, 0x0) gettimeofday(0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x220, 0x4000}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x4}, @IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x1}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x58}}, 0x20000090) pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, &(0x7f0000000740), 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000040)=0x20) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r3, 0x2) 2.992684754s ago: executing program 2 (id=324): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, 0x0, 0x1, 0x0, 0x0) 2.752129816s ago: executing program 0 (id=325): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x5, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x202, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0xf) ioctl$TCFLSH(r1, 0x400455cb, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000140)) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f00000007c0)={0x7ff, [[0x7, 0x0, 0x7, 0xed4, 0x4, 0x7ff, 0xfffffffc, 0x7fffffff], [0x6, 0x81, 0x400, 0x10, 0x0, 0x1, 0xfffffffc], [0xcf, 0x9, 0x5, 0x8, 0x6, 0x0, 0x800, 0x5]], '\x00', [{0x2f, 0x9, 0x1, 0x1, 0x1, 0x1}, {0xffffffff, 0x37, 0x1, 0x1}, {0x9, 0x4, 0x1}, {0x4, 0x8, 0x1, 0x0, 0x1, 0x1}, {0x4, 0xfff, 0x0, 0x0, 0x1, 0x1}, {0x8, 0x0, 0x0, 0x1}, {0x6, 0x0, 0x1}, {0x8, 0x6, 0x1, 0x0, 0x1, 0x1}, {0x6, 0xf2, 0x0, 0x1}, {0x81, 0x7, 0x1, 0x1, 0x1}, {0x3, 0x2, 0x1}, {0x480, 0x0, 0x1, 0x1, 0x0, 0x1}], '\x00', 0xe}) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) writev(r3, &(0x7f0000000400)=[{&(0x7f0000000100)="0fe7af90029ca1ca2dbe7a7581318bfa", 0x10}, {&(0x7f0000000200)="41fd0af69c453b65be0710ed20aedf66c0e00cc592142781a5fff147fc8b725749a8470695a5ed5cdf2ccc9b2a00000000000000540f442fe6c94e36f3840a6ae847b7cd88fb4f680fd92b211bc67f93cbbed19bc2239fc44902e773b04221fd545adeccf9c894b319372d4aa21884bf3d7d18964c61a47a612a3f144d6affdb1d2a506a452110422a25daa60ae2d613f57166c997ac01d1d27888a38868500a36245ffe1a0b1a63ce8d9ac08436182204674a45f807740a08196cb2c686e032b9545d0ad01e3918ad1f8a86d5e812feaf", 0xd1}, {&(0x7f0000000440)="58c25c811d53739ac0f8357019ced9dbc5705102009f4c0421ff8b89c1ad2bef0a267668a3bd8affa6f61208fb8c9122da89ba02c08084db579c71ddee2aae03f600100000ff3963ccebc53f3b3fa563dd088e5b61fbbab31e3c2165050000000069434405f2c3431a8d26cc22000000000000000000000000000000b3060db5d3e3e4e8a7f1de51e0fa76cd17701ea111d7498d83aa2b0ddddabd8cfe06a94ce28766b828ba7b4ca8b0b2921b78e35d39959e19d19209fa777eb383561c08f67686c18a5d38cc6ceaf3fcaaa1717e63", 0xd0}], 0x3) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa1010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000780)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="020300090b000000000000000000000802000100000000000007000200000000030005003c00000002000000ac1e0001000000000000000001001800088100000300060000000e0002000000e000000900000000000000009c29140fa304c4982d7d3299"], 0x58}}, 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201800760000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r4, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(r3, &(0x7f00000001c0)='tcp 2', 0x5) 1.653688873s ago: executing program 2 (id=326): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vhci_hcd.0', 0xa) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r2 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f0000000480)={0x80000000, 0xffffffffffffffff, 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x50) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1720000021200000400012800c0001006d6163766c616e0030000280080003000300000008000100100000001c0005800a000400aaaaaaaaaa2d00000a0004003426f7b68ed1000008000500", @ANYRES32=r5], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) getsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000001040), &(0x7f0000000100)) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000001c0), &(0x7f0000000780)={'syz', 0x1}, 0x0, 0x0, r6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x8000000}) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETA(r7, 0x5406, &(0x7f0000000200)={0xfff, 0xa925, 0x9, 0x8007, 0x8, "7a3800e5ffffff00"}) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000006c0)=0x16) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={@cgroup, 0xe, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad19576", 0x544, r6) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r8}, &(0x7f0000000840)=ANY=[], 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@map=r3, r0, 0x7}, 0x10) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x7fff8) 1.640629035s ago: executing program 3 (id=327): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1, 0x1}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f00000000c0)={0x0, 0xffff, 0x0, 0x0, 0x0}) timer_create(0x2, &(0x7f0000000140)={0x0, 0x5, 0x2, @tid=r2}, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x1c, 0x0, &(0x7f00000001c0)=[@increfs={0x40046304, 0x1}, @register_looper, @request_death={0x400c630e, 0x2}], 0x55, 0x0, &(0x7f0000000200)="f2324d523bf4b9ee54255a7f86e2fcc17eb9777aa04c0b5faf0aae34824015c46ad298e313f76628674ce633f2e90f96bc373abf7daf9029c37b147cf58f00092ba3699316c5f01bec9ff7cfb6211d9afcaf85c569"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000002c0)=0xd) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x23) ioctl$KVM_MEMORY_ENCRYPT_REG_REGION(r3, 0x8010aebb, &(0x7f0000000300)={0x4, 0x108000}) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000340)) ioctl$BTRFS_IOC_SYNC(r3, 0x9408, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000380), 0x8, 0x1) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000003c0)=0x1000) ioctl$SIOCX25CALLACCPTAPPRV(r4, 0x89e8) r5 = signalfd4(r4, &(0x7f0000000400)={[0x4]}, 0x8, 0x80000) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f0000000440)={0x5000, 0xc000}) r6 = syz_open_dev$sndctrl(&(0x7f0000000480), 0x8000000000000001, 0x101) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r6, 0xc008551b, &(0x7f00000004c0)={0xdc, 0x18, [0xff, 0x8b, 0x4, 0x0, 0xbb, 0x8]}) get_mempolicy(&(0x7f0000000500), &(0x7f0000000540), 0x4, &(0x7f0000ffc000/0x4000)=nil, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000b00)={0x104, 0x0, &(0x7f0000000900)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000680)={@flat=@handle={0x73682a85, 0xa, 0x3}, @ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/249, 0xf9, 0x0, 0x3e}, @fd={0x66642a85, 0x0, r5}}, &(0x7f0000000700)={0x0, 0x18, 0x40}}, 0x1000}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000740)={@fd={0x66642a85, 0x0, r6}, @fda={0x66646185, 0x7, 0x1, 0x36}, @fd={0x66642a85, 0x0, r6}}, &(0x7f00000007c0)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x3}, @dead_binder_done, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000840)={@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x0, &(0x7f0000000800)=""/44, 0x2c, 0x2, 0x36}, @flat=@handle={0x73682a85, 0x10e, 0x2}}, &(0x7f00000008c0)={0x0, 0x18, 0x40}}}], 0x9e, 0x0, &(0x7f0000000a40)="cac215fda7a1862a34e6114909b08ce99c2991d497a298666d035e64259abcf4b29274d0c1f57e1e41085bc4dca4e8bbc03375f34f67a235a74ffdb31a381b8d8e3225f58f4e429feb0082d18d4888cca7d0b0634d2078d12f4cae9168290a997db1183cfc334bea1bdd8d1b4da6f839a4d71a2a5891feec5318e2078f80ac7cc3e97fa49e76f13c9eb2817f6f2b00ef54283a37191ab8d0963e31f0a5fb"}) r7 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r7, 0x6b, 0x3, &(0x7f0000000b40), &(0x7f0000000b80)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000bc0)={0x424, 0x2}) r8 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r8, 0x800442d3, &(0x7f0000000c40)={0x7, 0xff, 0x5, @random="2e749da9e23b", 'lo\x00'}) 1.459523573s ago: executing program 4 (id=328): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) openat$uhid(0xffffff9c, &(0x7f00000002c0), 0x802, 0x0) gettimeofday(0x0, &(0x7f0000000080)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x220, 0x4000}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x4}, @IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x1}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x58}}, 0x20000090) pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, &(0x7f0000000740), 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000040)=0x20) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$DRM_IOCTL_GET_CLIENT(r6, 0xc0286405, &(0x7f0000000000)={0x1, 0x1, {r0}, {0xffffffffffffffff}, 0x1, 0x90}) ptrace$getregset(0x4204, r7, 0x6, &(0x7f0000000480)={&(0x7f00000008c0)=""/203, 0x118}) shutdown(r3, 0x2) 1.380680462s ago: executing program 3 (id=329): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="0018000000000000000c0000000c0000000200000000000000000000040000000000003203b9437337b3e819abae9262aa4e3cc6010cdb7218854b92c6320ed6f5fa515f"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000002000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0xed00}, 0x10}, 0x94) r3 = socket$unix(0x1, 0x5, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x100000003) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r5, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000000000000000000000000000000000000000000000000000000000000000000063727970745f64657600"/325) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(r6, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) 0s ago: executing program 4 (id=330): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='.\x00', 0x400) r3 = dup(0xffffffffffffffff) inotify_rm_watch(r3, r2) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @rand_addr=0x64010101}, 0x10) r5 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000400)={0xf0f000, 0x1}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.9' (ED25519) to the list of known hosts. [ 87.062597][ T31] cfg80211: failed to load regulatory.db [ 87.651521][ T5573] cgroup: Unknown subsys name 'net' [ 87.892437][ T5573] cgroup: Unknown subsys name 'cpuset' [ 87.946821][ T5573] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 89.903256][ T5573] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.393025][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 92.397513][ T5588] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 92.405000][ T5588] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 92.407617][ T5588] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 92.408457][ T5588] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 92.437958][ T4900] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 92.464283][ T4900] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 92.469675][ T4900] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 92.474287][ T4900] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 92.477736][ T4900] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 92.570221][ T5588] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 92.579810][ T5588] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 92.580846][ T5588] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 92.584040][ T5588] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 92.584904][ T5588] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 92.649352][ T5597] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 92.664293][ T5597] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 92.678949][ T59] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 92.685524][ T59] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 92.705942][ T59] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 92.710883][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 92.713656][ T59] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 92.716253][ T59] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 92.725630][ T5591] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 92.727357][ T5591] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 94.557083][ T5597] Bluetooth: hci0: command tx timeout [ 94.557092][ T5591] Bluetooth: hci1: command tx timeout [ 94.707096][ T5591] Bluetooth: hci2: command tx timeout [ 94.786592][ T5591] Bluetooth: hci4: command tx timeout [ 94.869753][ T5591] Bluetooth: hci3: command tx timeout [ 95.163811][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.165052][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.165170][ T5596] bridge_slave_0: entered allmulticast mode [ 95.177636][ T5596] bridge_slave_0: entered promiscuous mode [ 95.216292][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.216403][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.216511][ T5596] bridge_slave_1: entered allmulticast mode [ 95.218893][ T5596] bridge_slave_1: entered promiscuous mode [ 95.377725][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.377894][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.377998][ T5592] bridge_slave_0: entered allmulticast mode [ 95.380592][ T5592] bridge_slave_0: entered promiscuous mode [ 95.382781][ T5587] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.382941][ T5587] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.383491][ T5587] bridge_slave_0: entered allmulticast mode [ 95.385185][ T5587] bridge_slave_0: entered promiscuous mode [ 95.394243][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.394549][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.394666][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.394828][ T5590] bridge_slave_0: entered allmulticast mode [ 95.400930][ T5590] bridge_slave_0: entered promiscuous mode [ 95.429954][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.430137][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.430300][ T5592] bridge_slave_1: entered allmulticast mode [ 95.434299][ T5592] bridge_slave_1: entered promiscuous mode [ 95.437445][ T5587] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.437563][ T5587] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.437720][ T5587] bridge_slave_1: entered allmulticast mode [ 95.441054][ T5587] bridge_slave_1: entered promiscuous mode [ 95.445863][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.538243][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.538345][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.538738][ T5590] bridge_slave_1: entered allmulticast mode [ 95.540314][ T5590] bridge_slave_1: entered promiscuous mode [ 95.541508][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.541635][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.541769][ T5595] bridge_slave_0: entered allmulticast mode [ 95.543397][ T5595] bridge_slave_0: entered promiscuous mode [ 95.705981][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.706906][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.707536][ T5595] bridge_slave_1: entered allmulticast mode [ 95.710263][ T5595] bridge_slave_1: entered promiscuous mode [ 95.752978][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.778551][ T5587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.780899][ T5596] team0: Port device team_slave_0 added [ 95.784033][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.790794][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.817814][ T5587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.821889][ T5596] team0: Port device team_slave_1 added [ 95.825383][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.851138][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.906463][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.955092][ T5592] team0: Port device team_slave_0 added [ 95.973461][ T5587] team0: Port device team_slave_0 added [ 95.974845][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.974856][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.974871][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.994271][ T5590] team0: Port device team_slave_0 added [ 96.004748][ T5592] team0: Port device team_slave_1 added [ 96.045523][ T5587] team0: Port device team_slave_1 added [ 96.052200][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.052215][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.052231][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.054456][ T5590] team0: Port device team_slave_1 added [ 96.107109][ T5595] team0: Port device team_slave_0 added [ 96.160530][ T5595] team0: Port device team_slave_1 added [ 96.193417][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.193435][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.193461][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.219006][ T5587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.219023][ T5587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.219047][ T5587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.225903][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.225920][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.225943][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.232175][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.232190][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.232222][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.281919][ T5587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.281936][ T5587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.281960][ T5587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.283550][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.283563][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.283585][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.300956][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.300972][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.300996][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.351586][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.351604][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.351627][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.366790][ T5596] hsr_slave_0: entered promiscuous mode [ 96.369046][ T5596] hsr_slave_1: entered promiscuous mode [ 96.575933][ T5592] hsr_slave_0: entered promiscuous mode [ 96.577580][ T5592] hsr_slave_1: entered promiscuous mode [ 96.578638][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 96.578738][ T5592] Cannot create hsr debugfs directory [ 96.593403][ T5590] hsr_slave_0: entered promiscuous mode [ 96.594750][ T5590] hsr_slave_1: entered promiscuous mode [ 96.595680][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 96.595703][ T5590] Cannot create hsr debugfs directory [ 96.624035][ T5587] hsr_slave_0: entered promiscuous mode [ 96.624934][ T5587] hsr_slave_1: entered promiscuous mode [ 96.625552][ T5587] debugfs: 'hsr0' already exists in 'hsr' [ 96.625569][ T5587] Cannot create hsr debugfs directory [ 96.626507][ T5597] Bluetooth: hci1: command tx timeout [ 96.626593][ T5591] Bluetooth: hci0: command tx timeout [ 96.786404][ T5591] Bluetooth: hci2: command tx timeout [ 96.866495][ T5591] Bluetooth: hci4: command tx timeout [ 96.946371][ T5591] Bluetooth: hci3: command tx timeout [ 97.143207][ T5595] hsr_slave_0: entered promiscuous mode [ 97.144046][ T5595] hsr_slave_1: entered promiscuous mode [ 97.144616][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 97.144633][ T5595] Cannot create hsr debugfs directory [ 97.834051][ T5596] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 97.887799][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.895886][ T5596] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 97.922913][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.926034][ T5596] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 97.961395][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.987357][ T5596] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 98.019384][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.117938][ T5592] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 98.157741][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 98.162278][ T5592] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 98.191099][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 98.210658][ T5592] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 98.250403][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 98.272758][ T5592] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 98.302242][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.423807][ T5590] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 98.461630][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 98.474065][ T5590] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 98.500936][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 98.505686][ T5590] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 98.530343][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 98.560951][ T5590] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 98.590051][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.706299][ T5597] Bluetooth: hci1: command tx timeout [ 98.706659][ T5591] Bluetooth: hci0: command tx timeout [ 98.762196][ T5587] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 98.803587][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 98.820765][ T5587] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 98.840619][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 98.846049][ T5587] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 98.871921][ T5591] Bluetooth: hci2: command tx timeout [ 98.887585][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 98.913230][ T5587] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 98.942093][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.946287][ T5591] Bluetooth: hci4: command tx timeout [ 99.026468][ T5591] Bluetooth: hci3: command tx timeout [ 99.107890][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.113189][ T5595] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.150644][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.160917][ T5595] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.204395][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.223990][ T5595] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.259517][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.265326][ T5595] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.301251][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.365381][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.375114][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.419203][ T1698] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.419359][ T1698] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.473040][ T1006] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.473150][ T1006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.512793][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.551286][ T1698] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.551420][ T1698] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.588747][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.620313][ T1698] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.620412][ T1698] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.719166][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.762017][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.762157][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.800076][ T5587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.820375][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.820481][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.003502][ T5587] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.040796][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.095647][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.095809][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.205280][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.205510][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.302772][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.392427][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.392673][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.474703][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.474867][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.786558][ T5591] Bluetooth: hci0: command tx timeout [ 100.786596][ T5591] Bluetooth: hci1: command tx timeout [ 100.956680][ T5597] Bluetooth: hci2: command tx timeout [ 101.027474][ T5597] Bluetooth: hci4: command tx timeout [ 101.107367][ T5597] Bluetooth: hci3: command tx timeout [ 101.325327][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.514662][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.798876][ T5596] veth0_vlan: entered promiscuous mode [ 101.973194][ T5596] veth1_vlan: entered promiscuous mode [ 102.208884][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.221792][ T5596] veth0_macvtap: entered promiscuous mode [ 102.265630][ T5596] veth1_macvtap: entered promiscuous mode [ 102.418238][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.462714][ T5587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.473762][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.510728][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.585047][ T5590] veth0_vlan: entered promiscuous mode [ 102.655776][ T5592] veth0_vlan: entered promiscuous mode [ 102.755820][ T5590] veth1_vlan: entered promiscuous mode [ 102.842421][ T5592] veth1_vlan: entered promiscuous mode [ 102.993779][ T5587] veth0_vlan: entered promiscuous mode [ 103.030193][ T1671] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.030207][ T1671] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.080196][ T5595] veth0_vlan: entered promiscuous mode [ 103.113262][ T5587] veth1_vlan: entered promiscuous mode [ 103.143946][ T5590] veth0_macvtap: entered promiscuous mode [ 103.160292][ T1671] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.160314][ T1671] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.161264][ T5592] veth0_macvtap: entered promiscuous mode [ 103.184010][ T5595] veth1_vlan: entered promiscuous mode [ 103.206742][ T5592] veth1_macvtap: entered promiscuous mode [ 103.210582][ T5590] veth1_macvtap: entered promiscuous mode [ 103.328886][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.336472][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.390645][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.392706][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.393317][ T5587] veth0_macvtap: entered promiscuous mode [ 103.457521][ T5587] veth1_macvtap: entered promiscuous mode [ 103.482307][ T5595] veth0_macvtap: entered promiscuous mode [ 103.508434][ T5595] veth1_macvtap: entered promiscuous mode [ 103.655436][ T5587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.922715][ T5587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.126594][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.260176][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.363625][ T2516] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.363649][ T2516] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.579922][ T5775] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 104.628211][ T3296] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.628233][ T3296] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.964619][ T3296] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.964644][ T3296] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.265056][ T1698] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.265076][ T1698] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.723670][ T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.723693][ T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.818884][ T2516] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.881396][ T1698] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.881419][ T1698] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.912830][ T5687] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 105.972036][ T1698] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.972059][ T1698] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.039867][ T2516] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.041039][ T2516] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.041238][ T2516] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.041615][ T2516] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.041797][ T2516] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.041967][ T2516] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.042137][ T2516] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.042340][ T2516] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.042779][ T2516] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.043209][ T2516] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.196771][ T5687] usb 4-1: Using ep0 maxpacket: 32 [ 106.197313][ T2516] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.199063][ T2516] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.200039][ T5687] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 106.200339][ T2516] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.200921][ T2516] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.201629][ T2516] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.237332][ T5687] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 106.237371][ T5687] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 106.237397][ T5687] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 106.237423][ T5687] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 106.266419][ T5687] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.266445][ T5687] usb 4-1: Product: syz [ 106.266458][ T5687] usb 4-1: Manufacturer: syz [ 106.266470][ T5687] usb 4-1: SerialNumber: syz [ 106.407851][ T2516] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.407872][ T2516] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.456421][ T1698] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.492246][ T5687] usb 4-1: config 0 descriptor?? [ 106.513536][ T145] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.567791][ T5780] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 106.709823][ T5787] netlink: 'syz.2.8': attribute type 1 has an invalid length. [ 106.883728][ T5687] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input5 [ 107.023436][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 107.645505][ C1] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 107.645773][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 107.678800][ T36] usb 4-1: USB disconnect, device number 2 [ 107.791776][ T5787] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.056595][ T145] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.109744][ T145] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.021772][ T5805] faux_driver vgem: [drm] Unknown color mode 11173; guessing buffer size. [ 110.208393][ T4967] IPVS: starting estimator thread 0... [ 110.490890][ T5810] syz_tun: entered allmulticast mode [ 110.718721][ T5802] syz_tun: left allmulticast mode [ 110.913920][ T5809] IPVS: using max 8 ests per chain, 19200 per kthread [ 111.183853][ T5811] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 113.676909][ T5844] Zero length message leads to an empty skb [ 113.698926][ T5844] netlink: 8 bytes leftover after parsing attributes in process `syz.4.21'. [ 113.707114][ T5840] comedi comedi1: pcl724: I/O base address or length out of range [ 113.744814][ T5840] capability: warning: `syz.0.12' uses 32-bit capabilities (legacy support in use) [ 114.025941][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.669349][ T5850] syz.2.23 (5850) used greatest stack depth: 17576 bytes left [ 115.787295][ T5708] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 115.938029][ T5708] usb 4-1: Using ep0 maxpacket: 32 [ 115.939717][ T5708] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 115.943785][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 115.943820][ T5708] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 115.943846][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 115.943872][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 115.975047][ T5708] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.975074][ T5708] usb 4-1: Product: syz [ 115.975088][ T5708] usb 4-1: Manufacturer: syz [ 115.975101][ T5708] usb 4-1: SerialNumber: syz [ 117.288388][ T5708] usb 4-1: config 0 descriptor?? [ 117.292329][ T5861] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 117.510357][ T5708] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input6 [ 117.598143][ T5707] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 117.803031][ T5707] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 117.872139][ T5707] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.885331][ T5707] usb 3-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 117.892954][ T5707] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.892982][ T5707] usb 3-1: Product: syz [ 117.892995][ T5707] usb 3-1: Manufacturer: syz [ 117.893062][ T5707] usb 3-1: SerialNumber: syz [ 118.708360][ C1] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 118.712067][ T5708] usb 4-1: USB disconnect, device number 3 [ 119.087254][ T1650] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.838326][ T5687] IPVS: starting estimator thread 0... [ 120.061852][ T5899] IPVS: using max 1 ests per chain, 2400 per kthread [ 120.471344][ T5707] usb-storage 3-1:1.0: USB Mass Storage device detected [ 120.693120][ T5707] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 121.687178][ T5707] scsi host1: usb-storage 3-1:1.0 [ 122.097315][ T5591] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 122.132839][ T5591] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 122.147196][ T5591] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 122.164503][ T5591] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 122.167206][ T5591] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 122.787682][ T5707] usb 3-1: USB disconnect, device number 2 [ 124.226261][ T5591] Bluetooth: hci0: command tx timeout [ 124.298063][ T5708] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 124.478948][ T5708] usb 4-1: Using ep0 maxpacket: 32 [ 124.479658][ T5708] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 124.481271][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 124.481305][ T5708] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 124.481331][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 124.481357][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 124.775273][ T5708] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.775302][ T5708] usb 4-1: Product: syz [ 124.775317][ T5708] usb 4-1: Manufacturer: syz [ 124.775331][ T5708] usb 4-1: SerialNumber: syz [ 125.643626][ T5708] usb 4-1: config 0 descriptor?? [ 125.655805][ T1650] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.920224][ T5708] usb 4-1: can't set config #0, error -71 [ 125.964032][ T5708] usb 4-1: USB disconnect, device number 4 [ 126.494849][ T5591] Bluetooth: hci0: command tx timeout [ 127.722703][ T5974] overlayfs: overlapping lowerdir path [ 128.852030][ T5591] Bluetooth: hci0: command tx timeout [ 129.171651][ T10] IPVS: starting estimator thread 0... [ 129.257467][ T5997] IPVS: using max 6 ests per chain, 14400 per kthread [ 129.514520][ T1650] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.574192][ T6010] netlink: 'syz.4.63': attribute type 1 has an invalid length. [ 129.775209][ T5996] syzkaller0: entered promiscuous mode [ 129.775240][ T5996] syzkaller0: entered allmulticast mode [ 130.570396][ T999] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 130.716948][ T999] usb 3-1: Using ep0 maxpacket: 32 [ 130.717894][ T999] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 130.720505][ T999] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 130.720554][ T999] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 130.720581][ T999] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 130.720607][ T999] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 130.728114][ T999] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.728139][ T999] usb 3-1: Product: syz [ 130.728153][ T999] usb 3-1: Manufacturer: syz [ 130.728167][ T999] usb 3-1: SerialNumber: syz [ 130.768609][ T999] usb 3-1: config 0 descriptor?? [ 130.770166][ T6016] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 130.786618][ T999] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input7 [ 130.987086][ T5591] Bluetooth: hci0: command tx timeout [ 131.196854][ T6029] overlayfs: overlapping lowerdir path [ 133.022000][ T1650] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.047567][ C1] xpad 3-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 133.047632][ C1] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 133.052620][ T999] usb 3-1: USB disconnect, device number 3 [ 133.125501][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.140139][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.615706][ T6051] syz.3.74 uses obsolete (PF_INET,SOCK_PACKET) [ 136.610683][ T6069] overlayfs: overlapping lowerdir path [ 136.622342][ T6066] syz_tun: entered allmulticast mode [ 137.063234][ T6053] syz_tun: left allmulticast mode [ 137.306274][ T3126] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 137.456219][ T3126] usb 1-1: Using ep0 maxpacket: 32 [ 137.457331][ T3126] usb 1-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 137.460367][ T3126] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 137.460399][ T3126] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 137.460423][ T3126] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 137.460447][ T3126] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 137.547543][ T3126] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.547574][ T3126] usb 1-1: Product: syz [ 137.547589][ T3126] usb 1-1: Manufacturer: syz [ 137.547603][ T3126] usb 1-1: SerialNumber: syz [ 137.602513][ T3126] usb 1-1: config 0 descriptor?? [ 137.604534][ T6080] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 137.679609][ T3126] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input8 [ 138.286759][ C1] xpad 1-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 138.359618][ T3126] usb 1-1: USB disconnect, device number 2 [ 138.360120][ C1] xpad 1-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 139.562061][ T1650] bridge_slave_1: left allmulticast mode [ 139.562213][ T1650] bridge_slave_1: left promiscuous mode [ 139.625350][ T1650] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.872960][ T1650] bridge_slave_0: left allmulticast mode [ 141.873000][ T1650] bridge_slave_0: left promiscuous mode [ 141.873268][ T1650] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.915698][ T6112] overlayfs: overlapping lowerdir path [ 142.476429][ T5687] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 142.698177][ T5687] usb 3-1: Using ep0 maxpacket: 32 [ 142.699108][ T5687] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 142.700774][ T5687] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 142.700809][ T5687] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 142.700836][ T5687] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 142.700863][ T5687] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 142.704120][ T5687] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.704144][ T5687] usb 3-1: Product: syz [ 142.704159][ T5687] usb 3-1: Manufacturer: syz [ 142.704174][ T5687] usb 3-1: SerialNumber: syz [ 142.964812][ T5687] usb 3-1: config 0 descriptor?? [ 142.975731][ T6118] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 142.994448][ T5687] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input9 [ 143.147099][ T1650] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 143.147839][ C1] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 143.213019][ T1650] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 143.241560][ T1650] bond0 (unregistering): Released all slaves [ 143.280432][ T6105] syz_tun: entered allmulticast mode [ 143.280739][ T6105] syz_tun: left allmulticast mode [ 143.471477][ T6124] lo: entered allmulticast mode [ 143.647143][ C1] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 143.894172][ T5707] usb 3-1: USB disconnect, device number 4 [ 143.894276][ C1] xpad 3-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 144.116632][ T6120] lo: left allmulticast mode [ 146.902051][ T6158] binder: BINDER_SET_CONTEXT_MGR already set [ 146.902068][ T6158] binder: 6151:6158 ioctl 4018620d 0 returned -16 [ 148.317697][ T6174] overlayfs: overlapping lowerdir path [ 148.455415][ T6148] comedi comedi1: pcl724: I/O base address or length out of range [ 148.949254][ T5247] 8021q: adding VLAN 0 to HW filter on device eth1 [ 149.346635][ T5852] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 149.508048][ T5890] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.508202][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.508431][ T5890] bridge_slave_0: entered allmulticast mode [ 149.512946][ T5890] bridge_slave_0: entered promiscuous mode [ 149.519331][ T5890] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.519556][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.519754][ T5890] bridge_slave_1: entered allmulticast mode [ 149.522841][ T5890] bridge_slave_1: entered promiscuous mode [ 149.623847][ T5687] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 149.630731][ T5852] usb 5-1: Using ep0 maxpacket: 32 [ 149.640595][ T5852] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 149.663646][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.663674][ T5852] usb 5-1: Product: syz [ 149.663688][ T5852] usb 5-1: Manufacturer: syz [ 149.663700][ T5852] usb 5-1: SerialNumber: syz [ 149.696488][ T5852] usb 5-1: config 0 descriptor?? [ 149.752668][ T5890] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 149.786302][ T5687] usb 4-1: Using ep0 maxpacket: 32 [ 149.788565][ T5687] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 149.793413][ T5687] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 149.793514][ T5687] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 149.793543][ T5687] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 149.793569][ T5687] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 149.796425][ T3126] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 149.821344][ T5687] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.821372][ T5687] usb 4-1: Product: syz [ 149.821441][ T5687] usb 4-1: Manufacturer: syz [ 149.821454][ T5687] usb 4-1: SerialNumber: syz [ 149.924423][ T5687] usb 4-1: config 0 descriptor?? [ 149.929195][ T5852] airspy 5-1:0.0: usb_control_msg() failed -32 request 09 [ 149.929239][ T5852] airspy 5-1:0.0: Could not detect board [ 149.929347][ T5852] airspy 5-1:0.0: probe with driver airspy failed with error -32 [ 149.946293][ T3126] usb 1-1: Using ep0 maxpacket: 16 [ 149.947091][ T3126] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 149.949183][ T3126] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 149.949210][ T3126] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 149.949231][ T3126] usb 1-1: config 0 interface 0 has no altsetting 0 [ 149.949261][ T3126] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.970411][ T6184] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 150.010616][ T3126] usb 1-1: config 0 descriptor?? [ 150.053981][ T5687] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input10 [ 150.805736][ T5890] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 151.031956][ T36] usb 5-1: USB disconnect, device number 3 [ 151.265513][ T5687] usb 4-1: USB disconnect, device number 5 [ 151.265612][ C0] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 151.433722][ T5890] team0: Port device team_slave_0 added [ 151.501768][ T5890] team0: Port device team_slave_1 added [ 151.621342][ T3126] usb 1-1: USB disconnect, device number 3 [ 154.181972][ T6223] overlayfs: overlapping lowerdir path [ 156.246460][ T1650] hsr_slave_0: left promiscuous mode [ 156.279498][ T1650] hsr_slave_1: left promiscuous mode [ 156.280717][ T1650] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 156.280797][ T1650] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 156.367809][ T1650] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 156.367840][ T1650] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 156.472629][ T1650] veth1_macvtap: left promiscuous mode [ 156.472828][ T1650] veth0_macvtap: left promiscuous mode [ 156.473009][ T1650] veth1_vlan: left promiscuous mode [ 156.473301][ T1650] veth0_vlan: left promiscuous mode [ 156.586379][ T5852] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 156.820589][ T5852] usb 5-1: Using ep0 maxpacket: 32 [ 156.835307][ T5852] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 156.853298][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.853328][ T5852] usb 5-1: Product: syz [ 156.853360][ T5852] usb 5-1: Manufacturer: syz [ 156.853375][ T5852] usb 5-1: SerialNumber: syz [ 156.878530][ T5852] usb 5-1: config 0 descriptor?? [ 157.665276][ T5852] airspy 5-1:0.0: usb_control_msg() failed -71 request 09 [ 157.665305][ T5852] airspy 5-1:0.0: Could not detect board [ 157.665420][ T5852] airspy 5-1:0.0: probe with driver airspy failed with error -71 [ 157.741258][ T5852] usb 5-1: USB disconnect, device number 4 [ 157.782764][ T6255] trusted_key: syz.4.127 sent an empty control message without MSG_MORE. [ 158.833075][ T6267] ======================================================= [ 158.833075][ T6267] WARNING: The mand mount option has been deprecated and [ 158.833075][ T6267] and is ignored by this kernel. Remove the mand [ 158.833075][ T6267] option from the mount to silence this warning. [ 158.833075][ T6267] ======================================================= [ 159.241545][ T6273] netlink: 'syz.3.133': attribute type 1 has an invalid length. [ 159.756854][ T1650] team0 (unregistering): Port device team_slave_1 removed [ 159.825070][ T1650] team0 (unregistering): Port device team_slave_0 removed [ 160.351576][ T5890] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 160.351593][ T5890] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 160.351619][ T5890] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 160.414392][ T5247] 8021q: adding VLAN 0 to HW filter on device eth2 [ 160.609727][ T6273] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.637010][ T5890] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 160.637030][ T5890] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 160.637058][ T5890] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 160.914390][ T5707] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 161.064846][ T5890] hsr_slave_0: entered promiscuous mode [ 161.067203][ T5890] hsr_slave_1: entered promiscuous mode [ 161.068376][ T5890] debugfs: 'hsr0' already exists in 'hsr' [ 161.068401][ T5890] Cannot create hsr debugfs directory [ 161.076382][ T5707] usb 1-1: Using ep0 maxpacket: 32 [ 161.078156][ T5707] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 161.082450][ T5707] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.082472][ T5707] usb 1-1: Product: syz [ 161.082485][ T5707] usb 1-1: Manufacturer: syz [ 161.082499][ T5707] usb 1-1: SerialNumber: syz [ 161.098761][ T5707] usb 1-1: config 0 descriptor?? [ 161.256259][ T5852] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 161.305181][ T5707] airspy 1-1:0.0: usb_control_msg() failed -32 request 09 [ 161.305212][ T5707] airspy 1-1:0.0: Could not detect board [ 161.305332][ T5707] airspy 1-1:0.0: probe with driver airspy failed with error -32 [ 161.406260][ T5852] usb 3-1: Using ep0 maxpacket: 32 [ 161.407347][ T5852] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 161.408963][ T5852] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 161.408987][ T5852] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 161.414465][ T5852] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.414492][ T5852] usb 3-1: Product: syz [ 161.414523][ T5852] usb 3-1: Manufacturer: syz [ 161.414538][ T5852] usb 3-1: SerialNumber: syz [ 161.513907][ T5852] usb 3-1: config 0 descriptor?? [ 161.621022][ T6279] comedi comedi1: pcl724: I/O base address or length out of range [ 161.737730][ T5796] usb 3-1: USB disconnect, device number 5 [ 161.906362][ T10] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 162.071765][ T10] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 162.073500][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 162.073535][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 162.073581][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.133729][ T10] usb 5-1: config 0 descriptor?? [ 162.135949][ T6279] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 162.873302][ T10] usbhid 5-1:0.0: can't add hid device: -71 [ 162.873445][ T10] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 162.910382][ T10] usb 5-1: USB disconnect, device number 5 [ 163.231807][ T6321] overlayfs: overlapping lowerdir path [ 163.459399][ T5247] 8021q: adding VLAN 0 to HW filter on device eth3 [ 163.709516][ T5707] usb 1-1: USB disconnect, device number 4 [ 164.076225][ T37] audit: type=1326 audit(1786303895.836:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.076301][ T37] audit: type=1326 audit(1786303895.836:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.076358][ T37] audit: type=1326 audit(1786303895.836:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.076404][ T37] audit: type=1326 audit(1786303895.836:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=103 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.076451][ T37] audit: type=1326 audit(1786303895.836:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.333882][ T37] audit: type=1326 audit(1786303895.866:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.333938][ T37] audit: type=1326 audit(1786303895.866:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.333982][ T37] audit: type=1326 audit(1786303895.906:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.334027][ T37] audit: type=1326 audit(1786303895.906:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.334070][ T37] audit: type=1326 audit(1786303896.046:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6325 comm="syz.2.146" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc7c8bce0d9 code=0x7ffc0000 [ 164.529903][ T5890] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 164.619189][ T5890] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 164.667131][ T2516] netdevsim netdevsim120 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.694679][ T5890] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 164.925338][ T5890] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 165.697668][ T5890] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 165.713086][ T5707] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 165.927827][ T5707] usb 4-1: Using ep0 maxpacket: 32 [ 165.930791][ T5890] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 165.932621][ T5707] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 165.943389][ T5707] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 165.968783][ T5890] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 165.983158][ T5707] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.983188][ T5707] usb 4-1: Product: syz [ 165.983204][ T5707] usb 4-1: Manufacturer: syz [ 165.983218][ T5707] usb 4-1: SerialNumber: syz [ 166.343962][ T5707] usb 4-1: config 0 descriptor?? [ 166.959526][ T5890] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 166.991178][ T10] usb 4-1: USB disconnect, device number 6 [ 168.441491][ T5247] 8021q: adding VLAN 0 to HW filter on device eth4 [ 168.747471][ T5890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 168.875264][ T6384] netlink: 8 bytes leftover after parsing attributes in process `syz.4.157'. [ 169.042223][ T5890] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.119950][ T1650] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.121681][ T1650] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.189744][ T6384] netlink: 16 bytes leftover after parsing attributes in process `syz.4.157'. [ 169.189779][ T6384] netlink: 6 bytes leftover after parsing attributes in process `syz.4.157'. [ 169.287204][ T1650] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.287380][ T1650] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.590794][ T3126] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 175.766470][ T3126] usb 4-1: Using ep0 maxpacket: 32 [ 175.767343][ T3126] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 175.773679][ T3126] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 175.814767][ T3126] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.814797][ T3126] usb 4-1: Product: syz [ 175.814813][ T3126] usb 4-1: Manufacturer: syz [ 175.814825][ T3126] usb 4-1: SerialNumber: syz [ 175.863566][ T3126] usb 4-1: config 0 descriptor?? [ 176.245949][ T5890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 177.706494][ T3126] usb 4-1: USB disconnect, device number 7 [ 179.120481][ T5597] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 180.288501][ T5597] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 180.289920][ T5597] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 180.428760][ T5597] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 180.431690][ T5597] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 182.776237][ T3126] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 182.786340][ T5591] Bluetooth: hci5: command tx timeout [ 182.926199][ T3126] usb 1-1: Using ep0 maxpacket: 32 [ 182.935424][ T3126] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 182.954060][ T3126] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 182.971561][ T3126] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.971592][ T3126] usb 1-1: Product: syz [ 182.971606][ T3126] usb 1-1: Manufacturer: syz [ 182.971621][ T3126] usb 1-1: SerialNumber: syz [ 183.018087][ T3126] usb 1-1: config 0 descriptor?? [ 183.324787][ T5796] usb 1-1: USB disconnect, device number 5 [ 183.360619][ T6544] netlink: 84 bytes leftover after parsing attributes in process `syz.3.190'. [ 183.784818][ T6526] comedi comedi1: pcl724: I/O base address or length out of range [ 184.908939][ T5707] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 185.108685][ T5591] Bluetooth: hci5: command tx timeout [ 186.049170][ T5707] usb 4-1: Using ep0 maxpacket: 32 [ 186.050067][ T5707] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 186.059510][ T5707] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.059539][ T5707] usb 4-1: Product: syz [ 186.059555][ T5707] usb 4-1: Manufacturer: syz [ 186.059570][ T5707] usb 4-1: SerialNumber: syz [ 186.168736][ T5707] usb 4-1: config 0 descriptor?? [ 186.393643][ T5707] airspy 4-1:0.0: usb_control_msg() failed -32 request 09 [ 186.393679][ T5707] airspy 4-1:0.0: Could not detect board [ 186.393799][ T5707] airspy 4-1:0.0: probe with driver airspy failed with error -32 [ 187.266381][ T5591] Bluetooth: hci5: command tx timeout [ 188.438456][ T10] usb 4-1: USB disconnect, device number 8 [ 188.642386][ T6603] syz_tun: entered allmulticast mode [ 188.642999][ T6603] syz_tun: left allmulticast mode [ 189.166268][ T10] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 189.316323][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 189.317307][ T10] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 189.330614][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.330701][ T10] usb 4-1: Product: syz [ 189.330744][ T10] usb 4-1: Manufacturer: syz [ 189.330788][ T10] usb 4-1: SerialNumber: syz [ 189.346833][ T5591] Bluetooth: hci5: command tx timeout [ 189.879411][ T10] usb 4-1: config 0 descriptor?? [ 190.093141][ T10] airspy 4-1:0.0: usb_control_msg() failed -32 request 09 [ 190.093170][ T10] airspy 4-1:0.0: Could not detect board [ 190.093291][ T10] airspy 4-1:0.0: probe with driver airspy failed with error -32 [ 190.615518][ T6634] netlink: 'syz.4.207': attribute type 1 has an invalid length. [ 192.136967][ T5707] usb 4-1: USB disconnect, device number 9 [ 192.606904][ T6650] netlink: 'syz.0.212': attribute type 1 has an invalid length. [ 193.556277][ T5852] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 193.708573][ T5852] usb 5-1: Using ep0 maxpacket: 32 [ 193.711731][ T5852] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 193.745348][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.745380][ T5852] usb 5-1: Product: syz [ 193.745396][ T5852] usb 5-1: Manufacturer: syz [ 193.745410][ T5852] usb 5-1: SerialNumber: syz [ 193.808374][ T5852] usb 5-1: config 0 descriptor?? [ 194.138910][ T5852] airspy 5-1:0.0: usb_control_msg() failed -32 request 09 [ 194.138940][ T5852] airspy 5-1:0.0: Could not detect board [ 194.139062][ T5852] airspy 5-1:0.0: probe with driver airspy failed with error -32 [ 194.743175][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.743255][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.022755][ T6653] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.450377][ T5852] usb 5-1: USB disconnect, device number 6 [ 196.616319][ T4967] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 197.647678][ T4967] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 197.649159][ T4967] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.650495][ T4967] usb 1-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 197.654900][ T4967] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.654925][ T4967] usb 1-1: Product: syz [ 197.654940][ T4967] usb 1-1: Manufacturer: syz [ 197.654954][ T4967] usb 1-1: SerialNumber: syz [ 197.745891][ T6697] lo: entered allmulticast mode [ 197.746285][ T6697] lo: left allmulticast mode [ 197.986674][ T4967] usb-storage 1-1:1.0: USB Mass Storage device detected [ 198.032754][ T4967] usb-storage 1-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 198.049070][ T4967] scsi host1: usb-storage 1-1:1.0 [ 199.687046][ T31] usb 1-1: USB disconnect, device number 6 [ 200.016311][ T5796] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 200.176190][ T5796] usb 4-1: Using ep0 maxpacket: 32 [ 200.177244][ T5796] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 200.178994][ T5796] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 200.179027][ T5796] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 200.179054][ T5796] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 200.179080][ T5796] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 200.183195][ T5796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.183219][ T5796] usb 4-1: Product: syz [ 200.183233][ T5796] usb 4-1: Manufacturer: syz [ 200.183248][ T5796] usb 4-1: SerialNumber: syz [ 200.437901][ T5796] usb 4-1: config 0 descriptor?? [ 200.439314][ T6729] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 201.452187][ T2516] bridge_slave_1: left allmulticast mode [ 201.452225][ T2516] bridge_slave_1: left promiscuous mode [ 201.452507][ T2516] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.454640][ T5796] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input11 [ 201.770826][ C0] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 201.945971][ T2516] bridge_slave_0: left allmulticast mode [ 201.946011][ T2516] bridge_slave_0: left promiscuous mode [ 201.961806][ T2516] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.217828][ C0] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 202.376316][ T6760] netlink: 80 bytes leftover after parsing attributes in process `syz.2.231'. [ 206.739163][ T2516] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 206.746310][ T5796] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 206.800551][ T2516] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 206.833160][ T2516] bond0 (unregistering): Released all slaves [ 206.957555][ T5796] usb 5-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 206.959084][ T5796] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 206.959193][ T5796] usb 5-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 206.962091][ T5796] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.962124][ T5796] usb 5-1: Product: syz [ 206.962138][ T5796] usb 5-1: Manufacturer: syz [ 206.962151][ T5796] usb 5-1: SerialNumber: syz [ 206.973338][ T5796] usb-storage 5-1:1.0: USB Mass Storage device detected [ 206.987757][ T5796] usb-storage 5-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 206.996338][ T5796] scsi host1: usb-storage 5-1:1.0 [ 207.198533][ T5811] usb 4-1: USB disconnect, device number 10 [ 207.198641][ C0] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 207.390304][ T6783] binder: BINDER_SET_CONTEXT_MGR already set [ 207.390321][ T6783] binder: 6782:6783 ioctl 4018620d 0 returned -16 [ 207.501141][ T2516] hsr_slave_0: left promiscuous mode [ 207.538513][ T2516] hsr_slave_1: left promiscuous mode [ 207.543200][ T2516] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 207.604217][ T2516] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 207.829269][ T37] kauditd_printk_skb: 32 callbacks suppressed [ 207.829291][ T37] audit: type=1326 audit(1786303939.586:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.829726][ T37] audit: type=1326 audit(1786303939.596:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.829857][ T37] audit: type=1326 audit(1786303939.596:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.830016][ T37] audit: type=1326 audit(1786303939.596:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.832813][ T37] audit: type=1326 audit(1786303939.596:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=103 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.832989][ T37] audit: type=1326 audit(1786303939.596:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.833143][ T37] audit: type=1326 audit(1786303939.596:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.833480][ T37] audit: type=1326 audit(1786303939.596:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.833676][ T37] audit: type=1326 audit(1786303939.596:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 207.833974][ T37] audit: type=1326 audit(1786303939.596:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6786 comm="syz.0.239" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfe7dce0d9 code=0x7ffc0000 [ 208.556256][ T5811] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 208.716250][ T5811] usb 3-1: Using ep0 maxpacket: 16 [ 208.717318][ T5811] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 208.719354][ T5811] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.719386][ T5811] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 208.719409][ T5811] usb 3-1: config 0 interface 0 has no altsetting 0 [ 208.719446][ T5811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.796589][ T5811] usb 3-1: config 0 descriptor?? [ 208.807234][ T31] usb 5-1: USB disconnect, device number 7 [ 209.487025][ T5811] usb 3-1: USB disconnect, device number 6 [ 211.949360][ T5796] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 212.147529][ T5796] usb 5-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 212.149053][ T5796] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 212.149127][ T5796] usb 5-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 212.151537][ T5796] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.151562][ T5796] usb 5-1: Product: syz [ 212.151577][ T5796] usb 5-1: Manufacturer: syz [ 212.151592][ T5796] usb 5-1: SerialNumber: syz [ 212.215769][ T5796] usb-storage 5-1:1.0: USB Mass Storage device detected [ 212.228169][ T5796] usb-storage 5-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 212.238534][ T5796] scsi host1: usb-storage 5-1:1.0 [ 212.459385][ T2516] team0 (unregistering): Port device team_slave_1 removed [ 212.507419][ T2516] team0 (unregistering): Port device team_slave_0 removed [ 212.795157][ T6493] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.795300][ T6493] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.795510][ T6493] bridge_slave_0: entered allmulticast mode [ 212.828979][ T6493] bridge_slave_0: entered promiscuous mode [ 212.863882][ T6493] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.864023][ T6493] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.864250][ T6493] bridge_slave_1: entered allmulticast mode [ 212.923453][ T6493] bridge_slave_1: entered promiscuous mode [ 213.288759][ T6493] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.313151][ T6493] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.476604][ T6493] team0: Port device team_slave_0 added [ 213.544343][ T6493] team0: Port device team_slave_1 added [ 214.169241][ T5852] usb 5-1: USB disconnect, device number 8 [ 216.165619][ T6493] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 216.165638][ T6493] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 216.165667][ T6493] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 216.233869][ T6493] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 216.233888][ T6493] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 216.233916][ T6493] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 216.456313][ T5707] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 216.678192][ T5707] usb 3-1: Using ep0 maxpacket: 32 [ 216.702447][ T5707] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 216.707989][ T5707] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 216.708021][ T5707] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 216.708046][ T5707] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 216.708068][ T5707] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 216.715173][ T5707] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.715197][ T5707] usb 3-1: Product: syz [ 216.715211][ T5707] usb 3-1: Manufacturer: syz [ 216.715224][ T5707] usb 3-1: SerialNumber: syz [ 216.762113][ T5707] usb 3-1: config 0 descriptor?? [ 216.763263][ T6854] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 217.121228][ T6852] Bluetooth: hci1: command 0x0406 tx timeout [ 217.121451][ T6852] Bluetooth: hci2: command 0x0406 tx timeout [ 217.121478][ T6852] Bluetooth: hci4: command 0x0406 tx timeout [ 217.121502][ T6852] Bluetooth: hci3: command 0x0406 tx timeout [ 217.157904][ T5707] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input12 [ 217.312295][ T5247] 8021q: adding VLAN 0 to HW filter on device eth5 [ 217.481070][ C0] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 217.574061][ T6493] hsr_slave_0: entered promiscuous mode [ 217.584328][ T6493] hsr_slave_1: entered promiscuous mode [ 217.683658][ T6493] debugfs: 'hsr0' already exists in 'hsr' [ 217.683688][ T6493] Cannot create hsr debugfs directory [ 217.781815][ C0] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 217.887726][ T4967] usb 3-1: USB disconnect, device number 7 [ 217.887758][ C0] xpad 3-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 217.887826][ C0] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 218.906884][ T4967] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 219.068395][ T4967] usb 3-1: Using ep0 maxpacket: 32 [ 219.069443][ T4967] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 219.128490][ T4967] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.128520][ T4967] usb 3-1: Product: syz [ 219.128535][ T4967] usb 3-1: Manufacturer: syz [ 219.128549][ T4967] usb 3-1: SerialNumber: syz [ 219.170283][ T4967] usb 3-1: config 0 descriptor?? [ 219.439301][ T4967] airspy 3-1:0.0: usb_control_msg() failed -32 request 09 [ 219.439332][ T4967] airspy 3-1:0.0: Could not detect board [ 219.439455][ T4967] airspy 3-1:0.0: probe with driver airspy failed with error -32 [ 222.690363][ T4967] usb 3-1: USB disconnect, device number 8 [ 222.837903][ T5796] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 224.037082][ T5796] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 224.039843][ T5796] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.039889][ T5796] usb 4-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 224.042028][ T5796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.042054][ T5796] usb 4-1: Product: syz [ 224.042069][ T5796] usb 4-1: Manufacturer: syz [ 224.042084][ T5796] usb 4-1: SerialNumber: syz [ 224.116287][ T5687] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 224.156976][ T5796] usb-storage 4-1:1.0: USB Mass Storage device detected [ 224.177434][ T5796] usb-storage 4-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 224.201931][ T5796] scsi host1: usb-storage 4-1:1.0 [ 224.238327][ T5707] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 224.286265][ T5687] usb 1-1: Using ep0 maxpacket: 32 [ 224.287290][ T5687] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 224.292316][ T5687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.292343][ T5687] usb 1-1: Product: syz [ 224.292358][ T5687] usb 1-1: Manufacturer: syz [ 224.292373][ T5687] usb 1-1: SerialNumber: syz [ 224.343036][ T5687] usb 1-1: config 0 descriptor?? [ 224.397133][ T5707] usb 5-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 224.399606][ T5707] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.399682][ T5707] usb 5-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 224.404291][ T5707] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.404319][ T5707] usb 5-1: Product: syz [ 224.404334][ T5707] usb 5-1: Manufacturer: syz [ 224.404350][ T5707] usb 5-1: SerialNumber: syz [ 224.566529][ T5687] airspy 1-1:0.0: usb_control_msg() failed -71 request 09 [ 224.566559][ T5687] airspy 1-1:0.0: Could not detect board [ 224.566686][ T5687] airspy 1-1:0.0: probe with driver airspy failed with error -71 [ 224.566976][ T5707] usb-storage 5-1:1.0: USB Mass Storage device detected [ 224.628689][ T5687] usb 1-1: USB disconnect, device number 7 [ 224.675062][ T5707] usb-storage 5-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 224.677701][ T5707] scsi host2: usb-storage 5-1:1.0 [ 224.916873][ T6951] netlink: 8 bytes leftover after parsing attributes in process `syz.2.275'. [ 225.383175][ T5707] usb 4-1: USB disconnect, device number 11 [ 225.494123][ T5687] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 225.657626][ T5687] usb 1-1: Using ep0 maxpacket: 32 [ 225.658446][ T5687] usb 1-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 225.659915][ T5687] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 225.659948][ T5687] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 225.659973][ T5687] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 225.659997][ T5687] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 225.665829][ T5687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.665855][ T5687] usb 1-1: Product: syz [ 225.665870][ T5687] usb 1-1: Manufacturer: syz [ 225.665883][ T5687] usb 1-1: SerialNumber: syz [ 225.818052][ T5811] usb 5-1: USB disconnect, device number 9 [ 225.850072][ T5687] usb 1-1: config 0 descriptor?? [ 225.851207][ T6959] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 225.980030][ T5687] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input13 [ 226.268080][ C1] xpad 1-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 226.398125][ T5796] usb 1-1: USB disconnect, device number 8 [ 226.398223][ C1] xpad 1-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 228.078544][ T31] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 228.237813][ T31] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 228.239370][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 228.239443][ T31] usb 3-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 228.242611][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.242639][ T31] usb 3-1: Product: syz [ 228.242653][ T31] usb 3-1: Manufacturer: syz [ 228.242668][ T31] usb 3-1: SerialNumber: syz [ 228.264293][ T31] usb-storage 3-1:1.0: USB Mass Storage device detected [ 228.276206][ T5707] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 228.356772][ T5708] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 228.469897][ T5707] usb 4-1: Using ep0 maxpacket: 16 [ 228.470892][ T5707] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 228.472665][ T5707] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 228.472694][ T5707] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 228.472717][ T5707] usb 4-1: config 0 interface 0 has no altsetting 0 [ 228.472750][ T5707] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.426349][ T5708] usb 5-1: Using ep0 maxpacket: 32 [ 229.427169][ T5708] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 229.453400][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.453430][ T5708] usb 5-1: Product: syz [ 229.453445][ T5708] usb 5-1: Manufacturer: syz [ 229.453459][ T5708] usb 5-1: SerialNumber: syz [ 229.501987][ T31] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 229.502313][ T5707] usb 4-1: config 0 descriptor?? [ 229.504393][ T5707] usb 4-1: can't set config #0, error -71 [ 229.517929][ T31] scsi host1: usb-storage 3-1:1.0 [ 229.644855][ T5708] usb 5-1: config 0 descriptor?? [ 229.659464][ T5707] usb 4-1: USB disconnect, device number 12 [ 230.902190][ T31] usb 3-1: USB disconnect, device number 9 [ 231.014339][ T5708] airspy 5-1:0.0: usb_control_msg() failed -110 request 09 [ 231.014370][ T5708] airspy 5-1:0.0: Could not detect board [ 231.014491][ T5708] airspy 5-1:0.0: probe with driver airspy failed with error -110 [ 232.806680][ T999] usb 5-1: USB disconnect, device number 10 [ 233.032072][ T7014] lo: entered allmulticast mode [ 233.034651][ T7014] lo: left allmulticast mode [ 233.220137][ T6493] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 233.505807][ T6493] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 233.518516][ T6493] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 233.652460][ T6493] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 233.700907][ T6493] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 233.796232][ T5687] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 233.825297][ T6493] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 234.013156][ T6493] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 234.116180][ T5687] usb 4-1: Using ep0 maxpacket: 32 [ 234.121574][ T5687] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 234.136330][ T5687] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.136360][ T5687] usb 4-1: Product: syz [ 234.136376][ T5687] usb 4-1: Manufacturer: syz [ 234.136390][ T5687] usb 4-1: SerialNumber: syz [ 234.348605][ T6493] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 234.685338][ T7038] syz_tun: entered allmulticast mode [ 235.200327][ T7031] syz_tun: left allmulticast mode [ 235.241766][ T5687] usb 4-1: config 0 descriptor?? [ 235.991439][ T5687] airspy 4-1:0.0: Board ID: 00 [ 235.991465][ T5687] airspy 4-1:0.0: Firmware version: [ 237.017011][ T5687] airspy 4-1:0.0: usb_control_msg() failed -71 request 11 [ 237.948551][ T999] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 238.033655][ T5687] airspy 4-1:0.0: Registered as swradio24 [ 238.033680][ T5687] airspy 4-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 238.054395][ T5687] usb 4-1: USB disconnect, device number 13 [ 238.055986][ T7057] netlink: 8 bytes leftover after parsing attributes in process `syz.4.299'. [ 238.387984][ T999] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 238.389214][ T999] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 238.389289][ T999] usb 3-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 238.391749][ T999] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.391774][ T999] usb 3-1: Product: syz [ 238.391790][ T999] usb 3-1: Manufacturer: syz [ 238.391805][ T999] usb 3-1: SerialNumber: syz [ 238.490645][ T999] usb-storage 3-1:1.0: USB Mass Storage device detected [ 238.583984][ T999] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 238.598235][ T999] scsi host1: usb-storage 3-1:1.0 [ 239.067331][ T7074] lo: entered allmulticast mode [ 239.890156][ T7065] lo: left allmulticast mode [ 240.190755][ T5707] usb 3-1: USB disconnect, device number 10 [ 240.554884][ T5588] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 240.595624][ T5588] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 240.600780][ T5588] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 240.615476][ T5588] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 240.622548][ T5588] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 241.162349][ T7090] netlink: 8 bytes leftover after parsing attributes in process `syz.4.305'. [ 243.367029][ T59] Bluetooth: hci0: command tx timeout [ 244.389728][ T31] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 244.482306][ T10] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 244.677205][ T31] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 244.678724][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 244.678797][ T31] usb 4-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 244.681773][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.681797][ T31] usb 4-1: Product: syz [ 244.681812][ T31] usb 4-1: Manufacturer: syz [ 244.681826][ T31] usb 4-1: SerialNumber: syz [ 244.766196][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 244.767243][ T10] usb 1-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 244.768949][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 244.768982][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 244.769009][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 244.769035][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 244.773394][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.773421][ T10] usb 1-1: Product: syz [ 244.773436][ T10] usb 1-1: Manufacturer: syz [ 244.773450][ T10] usb 1-1: SerialNumber: syz [ 244.950716][ T10] usb 1-1: config 0 descriptor?? [ 244.952261][ T7113] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 244.955708][ T31] usb-storage 4-1:1.0: USB Mass Storage device detected [ 244.972017][ T31] usb-storage 4-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 244.972897][ T31] scsi host1: usb-storage 4-1:1.0 [ 245.031638][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input14 [ 245.111543][ T7128] syz_tun: entered allmulticast mode [ 245.427361][ T59] Bluetooth: hci0: command tx timeout [ 245.504715][ T10] usb 1-1: USB disconnect, device number 9 [ 245.504715][ C1] xpad 1-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 245.533146][ T7118] syz_tun: left allmulticast mode [ 246.316028][ T999] usb 4-1: USB disconnect, device number 14 [ 247.507088][ T59] Bluetooth: hci0: command tx timeout [ 247.597802][ T7142] netlink: 8 bytes leftover after parsing attributes in process `syz.4.321'. [ 249.606993][ T59] Bluetooth: hci0: command tx timeout [ 250.527186][ T5687] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 250.531085][ T7167] vhci_hcd vhci_hcd.0: remove, state 4 [ 250.531382][ T7167] usb usb34: USB disconnect, device number 1 [ 251.762119][ T5687] usb 1-1: Using ep0 maxpacket: 32 [ 251.774829][ T5687] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 251.782173][ T5687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.782202][ T5687] usb 1-1: Product: syz [ 251.782215][ T5687] usb 1-1: Manufacturer: syz [ 251.782228][ T5687] usb 1-1: SerialNumber: syz [ 251.801996][ T5687] usb 1-1: config 0 descriptor?? [ 251.912858][ T7178] capability: warning: `syz.2.326' uses deprecated v2 capabilities in a way that may be insecure [ 252.400694][ T5687] airspy 1-1:0.0: Board ID: 00 [ 252.400721][ T5687] airspy 1-1:0.0: Firmware version: [ 252.705596][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.705620][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.705654][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.742755][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.742775][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.742803][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.767905][ T7167] vhci_hcd vhci_hcd.0: USB bus 34 deregistered [ 252.776694][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.776716][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.776747][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.803722][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.803742][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.804195][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.804241][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.804254][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.804284][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.804554][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.804574][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.804604][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.830636][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.830655][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.830684][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.830778][ T43] vhci_hcd vhci_hcd.0: stop threads [ 252.830790][ T43] vhci_hcd vhci_hcd.0: release socket [ 252.830815][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 252.965218][ T7167] vhci_hcd vhci_hcd.0: remove, state 4 [ 252.965267][ T7167] usb usb33: USB disconnect, device number 1 [ 253.055895][ T7167] vhci_hcd vhci_hcd.0: USB bus 33 deregistered [ 253.058025][ T43] vhci_hcd vhci_hcd.0: stop threads [ 253.079042][ T43] vhci_hcd vhci_hcd.0: release socket [ 253.113840][ T43] ================================================================== [ 253.113858][ T43] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 [ 253.113890][ T43] Read of size 1 at addr ffff888029fd4708 by task kworker/u8:2/43 [ 253.113908][ T43] [ 253.113921][ T43] CPU: 0 UID: 0 PID: 43 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 253.113949][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.113963][ T43] Workqueue: usbip_event event_handler [ 253.113992][ T43] Call Trace: [ 253.114001][ T43] [ 253.114009][ T43] dump_stack_lvl+0xe8/0x150 [ 253.114040][ T43] print_address_description+0x55/0x1e0 [ 253.114071][ T43] ? rt_spin_lock+0x83/0x400 [ 253.114092][ T43] print_report+0x58/0x70 [ 253.114118][ T43] kasan_report+0x117/0x150 [ 253.114143][ T43] ? rt_spin_lock+0x83/0x400 [ 253.114168][ T43] ? vhci_cleanup_unlink_list+0x81/0x450 [ 253.114196][ T43] __kasan_check_byte+0x2a/0x40 [ 253.114217][ T43] lock_acquire+0x84/0x350 [ 253.114237][ T43] ? preempt_schedule_common+0x82/0xd0 [ 253.114266][ T43] ? preempt_schedule_thunk+0x16/0x40 [ 253.114291][ T43] rt_spin_lock+0x83/0x400 [ 253.114312][ T43] ? vhci_cleanup_unlink_list+0x81/0x450 [ 253.114343][ T43] ? __pfx_rt_spin_lock+0x10/0x10 [ 253.114366][ T43] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 253.114398][ T43] ? rt_spin_lock+0x1e0/0x400 [ 253.114424][ T43] vhci_cleanup_unlink_list+0x81/0x450 [ 253.114455][ T43] ? rt_spin_unlock+0x163/0x200 [ 253.114480][ T43] vhci_shutdown_connection+0x299/0x630 [ 253.114512][ T43] event_handler+0x2b0/0x4a0 [ 253.114538][ T43] ? process_scheduled_works+0xa20/0x14e0 [ 253.114567][ T43] process_scheduled_works+0xa8e/0x14e0 [ 253.114602][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 253.114627][ T43] ? assign_work+0x3cf/0x5d0 [ 253.114651][ T43] worker_thread+0xa47/0xfb0 [ 253.114687][ T43] kthread+0x388/0x470 [ 253.114716][ T43] ? __pfx_worker_thread+0x10/0x10 [ 253.114739][ T43] ? __pfx_kthread+0x10/0x10 [ 253.114767][ T43] ret_from_fork+0x514/0xb70 [ 253.114798][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 253.114824][ T43] ? __switch_to+0xc89/0x1420 [ 253.114848][ T43] ? __pfx_kthread+0x10/0x10 [ 253.114874][ T43] ret_from_fork_asm+0x1a/0x30 [ 253.114909][ T43] [ 253.114916][ T43] [ 253.114921][ T43] Allocated by task 1: [ 253.114930][ T43] kasan_save_track+0x3e/0x80 [ 253.114959][ T43] __kasan_kmalloc+0x93/0xb0 [ 253.114977][ T43] __kmalloc_noprof+0x41a/0x780 [ 253.114994][ T43] __usb_create_hcd+0x67/0x900 [ 253.115018][ T43] vhci_hcd_probe+0x104/0x3f0 [ 253.115042][ T43] platform_probe+0xf9/0x190 [ 253.115063][ T43] really_probe+0x254/0xae0 [ 253.115088][ T43] __driver_probe_device+0x1e8/0x360 [ 253.115112][ T43] driver_probe_device+0x4f/0x240 [ 253.115137][ T43] __device_attach_driver+0x270/0x410 [ 253.115162][ T43] bus_for_each_drv+0x25b/0x2f0 [ 253.115180][ T43] __device_attach+0x2c7/0x450 [ 253.115203][ T43] device_initial_probe+0xa1/0xd0 [ 253.115226][ T43] bus_probe_device+0x12d/0x220 [ 253.115243][ T43] device_add+0x7d7/0xb80 [ 253.115263][ T43] platform_device_add+0x4bd/0x860 [ 253.115283][ T43] platform_device_register_full+0x62d/0x710 [ 253.115304][ T43] vhci_hcd_init+0x227/0x370 [ 253.115326][ T43] do_one_initcall+0x250/0x870 [ 253.115352][ T43] do_initcall_level+0x10a/0x1a0 [ 253.115374][ T43] do_initcalls+0x59/0xa0 [ 253.115403][ T43] kernel_init_freeable+0x29d/0x3e0 [ 253.115424][ T43] kernel_init+0x1d/0x1d0 [ 253.115442][ T43] ret_from_fork+0x514/0xb70 [ 253.115469][ T43] ret_from_fork_asm+0x1a/0x30 [ 253.115497][ T43] [ 253.115502][ T43] Freed by task 7167: [ 253.115512][ T43] kasan_save_track+0x3e/0x80 [ 253.115541][ T43] kasan_save_free_info+0x40/0x50 [ 253.115565][ T43] __kasan_slab_free+0x5c/0x80 [ 253.115582][ T43] kfree+0x1c5/0x6c0 [ 253.115608][ T43] vhci_hcd_remove+0xed/0x110 [ 253.115631][ T43] device_release_driver_internal+0x48b/0x880 [ 253.115655][ T43] unbind_store+0x1a4/0x1d0 [ 253.115675][ T43] kernfs_fop_write_iter+0x3a5/0x540 [ 253.115701][ T43] vfs_write+0x61e/0xbb0 [ 253.115723][ T43] ksys_write+0x156/0x270 [ 253.115744][ T43] do_syscall_64+0x174/0x580 [ 253.115771][ T43] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.115791][ T43] [ 253.115796][ T43] Last potentially related work creation: [ 253.115804][ T43] kasan_save_stack+0x3e/0x60 [ 253.115833][ T43] kasan_record_aux_stack+0xbd/0xd0 [ 253.115857][ T43] insert_work+0x3d/0x330 [ 253.115875][ T43] __queue_work+0xd1d/0x10f0 [ 253.115895][ T43] queue_work_on+0x106/0x1d0 [ 253.115916][ T43] unlink1+0x33d/0x3e0 [ 253.115936][ T43] usb_hcd_unlink_urb+0xda/0x1d0 [ 253.115958][ T43] usb_kill_urb+0x10b/0x2f0 [ 253.115983][ T43] hub_quiesce+0x20f/0x320 [ 253.116001][ T43] hub_suspend+0x904/0xad0 [ 253.116016][ T43] usb_suspend_both+0x285/0x1040 [ 253.116035][ T43] usb_runtime_suspend+0x58/0x110 [ 253.116056][ T43] __rpm_callback+0x2d6/0x930 [ 253.116080][ T43] rpm_suspend+0x8a0/0x17a0 [ 253.116100][ T43] __pm_runtime_suspend+0x12c/0x1a0 [ 253.116121][ T43] usb_new_device+0xade/0x1680 [ 253.116144][ T43] register_root_hub+0x250/0x5c0 [ 253.116162][ T43] usb_add_hcd+0xac7/0xf80 [ 253.116179][ T43] vhci_hcd_probe+0x141/0x3f0 [ 253.116197][ T43] platform_probe+0xf9/0x190 [ 253.116212][ T43] really_probe+0x254/0xae0 [ 253.116230][ T43] __driver_probe_device+0x1e8/0x360 [ 253.116248][ T43] driver_probe_device+0x4f/0x240 [ 253.116267][ T43] __device_attach_driver+0x270/0x410 [ 253.116286][ T43] bus_for_each_drv+0x25b/0x2f0 [ 253.116299][ T43] __device_attach+0x2c7/0x450 [ 253.116315][ T43] device_initial_probe+0xa1/0xd0 [ 253.116333][ T43] bus_probe_device+0x12d/0x220 [ 253.116346][ T43] device_add+0x7d7/0xb80 [ 253.116361][ T43] platform_device_add+0x4bd/0x860 [ 253.116376][ T43] platform_device_register_full+0x62d/0x710 [ 253.116401][ T43] vhci_hcd_init+0x227/0x370 [ 253.116416][ T43] do_one_initcall+0x250/0x870 [ 253.116438][ T43] do_initcall_level+0x10a/0x1a0 [ 253.116454][ T43] do_initcalls+0x59/0xa0 [ 253.116470][ T43] kernel_init_freeable+0x29d/0x3e0 [ 253.116487][ T43] kernel_init+0x1d/0x1d0 [ 253.116501][ T43] ret_from_fork+0x514/0xb70 [ 253.116521][ T43] ret_from_fork_asm+0x1a/0x30 [ 253.116543][ T43] [ 253.116547][ T43] Second to last potentially related work creation: [ 253.116553][ T43] kasan_save_stack+0x3e/0x60 [ 253.116575][ T43] kasan_record_aux_stack+0xbd/0xd0 [ 253.116593][ T43] insert_work+0x3d/0x330 [ 253.116607][ T43] __queue_work+0xd1d/0x10f0 [ 253.116623][ T43] queue_work_on+0x106/0x1d0 [ 253.116639][ T43] usb_hcd_submit_urb+0xa2d/0x1b40 [ 253.116656][ T43] usb_start_wait_urb+0x13f/0x5b0 [ 253.116678][ T43] usb_control_msg+0x234/0x3e0 [ 253.116698][ T43] hub_ext_port_status+0x114/0x810 [ 253.116717][ T43] hub_activate+0x740/0x1b10 [ 253.116731][ T43] process_scheduled_works+0xa8e/0x14e0 [ 253.116746][ T43] worker_thread+0xa47/0xfb0 [ 253.116762][ T43] kthread+0x388/0x470 [ 253.116781][ T43] ret_from_fork+0x514/0xb70 [ 253.116801][ T43] ret_from_fork_asm+0x1a/0x30 [ 253.116823][ T43] [ 253.116827][ T43] The buggy address belongs to the object at ffff888029fd4000 [ 253.116827][ T43] which belongs to the cache kmalloc-8k of size 8192 [ 253.116843][ T43] The buggy address is located 1800 bytes inside of [ 253.116843][ T43] freed 8192-byte region [ffff888029fd4000, ffff888029fd6000) [ 253.116860][ T43] [ 253.116865][ T43] The buggy address belongs to the physical page: [ 253.116874][ T43] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29fd0 [ 253.116892][ T43] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 253.116906][ T43] flags: 0x80000000000040(head|node=0|zone=1) [ 253.116921][ T43] page_type: f5(slab) [ 253.116936][ T43] raw: 0080000000000040 ffff88813ffb2280 dead000000000122 0000000000000000 [ 253.116950][ T43] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 253.116965][ T43] head: 0080000000000040 ffff88813ffb2280 dead000000000122 0000000000000000 [ 253.116981][ T43] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 253.116997][ T43] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 253.117010][ T43] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 253.117019][ T43] page dumped because: kasan: bad access detected [ 253.117027][ T43] page_owner tracks the page as allocated [ 253.117033][ T43] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10657093910, free_ts 0 [ 253.117062][ T43] post_alloc_hook+0x1f9/0x250 [ 253.117085][ T43] get_page_from_freelist+0x262a/0x26a0 [ 253.117101][ T43] __alloc_frozen_pages_noprof+0x18d/0x380 [ 253.117117][ T43] allocate_slab+0x79/0x5e0 [ 253.117135][ T43] refill_objects+0x2d8/0x350 [ 253.117153][ T43] __pcs_replace_empty_main+0x330/0x690 [ 253.117172][ T43] __kmalloc_cache_noprof+0x468/0x6b0 [ 253.117187][ T43] dummy_hcd_init+0x3e2/0xd00 [ 253.117200][ T43] do_one_initcall+0x250/0x870 [ 253.117222][ T43] do_initcall_level+0x10a/0x1a0 [ 253.117239][ T43] do_initcalls+0x59/0xa0 [ 253.117255][ T43] kernel_init_freeable+0x29d/0x3e0 [ 253.117272][ T43] kernel_init+0x1d/0x1d0 [ 253.117286][ T43] ret_from_fork+0x514/0xb70 [ 253.117306][ T43] ret_from_fork_asm+0x1a/0x30 [ 253.117327][ T43] page_owner free stack trace missing [ 253.117334][ T43] [ 253.117338][ T43] Memory state around the buggy address: [ 253.117347][ T43] ffff888029fd4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.117358][ T43] ffff888029fd4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.117369][ T43] >ffff888029fd4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.117385][ T43] ^ [ 253.117395][ T43] ffff888029fd4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.117405][ T43] ffff888029fd4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.117413][ T43] ================================================================== [ 253.171920][ T43] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 253.171940][ T43] CPU: 0 UID: 0 PID: 43 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 253.171962][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.171974][ T43] Workqueue: usbip_event event_handler [ 253.172003][ T43] Call Trace: [ 253.172010][ T43] [ 253.172021][ T43] vpanic+0x56c/0xa60 [ 253.172051][ T43] ? __pfx_vpanic+0x10/0x10 [ 253.172077][ T43] ? __pfx___schedule+0x10/0x10 [ 253.172103][ T43] panic+0xc5/0xd0 [ 253.172128][ T43] ? __pfx_panic+0x10/0x10 [ 253.172155][ T43] ? preempt_schedule_common+0x82/0xd0 [ 253.172181][ T43] ? rt_spin_lock+0x83/0x400 [ 253.172199][ T43] check_panic_on_warn+0x89/0xb0 [ 253.172226][ T43] ? rt_spin_lock+0x83/0x400 [ 253.172245][ T43] end_report+0x73/0x170 [ 253.172264][ T43] ? rt_spin_lock+0x83/0x400 [ 253.172283][ T43] kasan_report+0x128/0x150 [ 253.172303][ T43] ? rt_spin_lock+0x83/0x400 [ 253.172325][ T43] ? vhci_cleanup_unlink_list+0x81/0x450 [ 253.172351][ T43] __kasan_check_byte+0x2a/0x40 [ 253.172371][ T43] lock_acquire+0x84/0x350 [ 253.172398][ T43] ? preempt_schedule_common+0x82/0xd0 [ 253.172423][ T43] ? preempt_schedule_thunk+0x16/0x40 [ 253.172446][ T43] rt_spin_lock+0x83/0x400 [ 253.172466][ T43] ? vhci_cleanup_unlink_list+0x81/0x450 [ 253.172494][ T43] ? __pfx_rt_spin_lock+0x10/0x10 [ 253.172514][ T43] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 253.172535][ T43] ? rt_spin_lock+0x1e0/0x400 [ 253.172558][ T43] vhci_cleanup_unlink_list+0x81/0x450 [ 253.172588][ T43] ? rt_spin_unlock+0x163/0x200 [ 253.172611][ T43] vhci_shutdown_connection+0x299/0x630 [ 253.172639][ T43] event_handler+0x2b0/0x4a0 [ 253.172663][ T43] ? process_scheduled_works+0xa20/0x14e0 [ 253.172685][ T43] process_scheduled_works+0xa8e/0x14e0 [ 253.172719][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 253.172744][ T43] ? assign_work+0x3cf/0x5d0 [ 253.172768][ T43] worker_thread+0xa47/0xfb0 [ 253.172799][ T43] kthread+0x388/0x470 [ 253.172826][ T43] ? __pfx_worker_thread+0x10/0x10 [ 253.172847][ T43] ? __pfx_kthread+0x10/0x10 [ 253.172874][ T43] ret_from_fork+0x514/0xb70 [ 253.172902][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 253.172929][ T43] ? __switch_to+0xc89/0x1420 [ 253.172954][ T43] ? __pfx_kthread+0x10/0x10 [ 253.172982][ T43] ret_from_fork_asm+0x1a/0x30 [ 253.173020][ T43] [ 253.173168][ T43] Kernel Offset: disabled