last executing test programs: 18m35.183850409s ago: executing program 32 (id=236): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x811}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xfd01}, 0x8) 17m2.901975113s ago: executing program 1 (id=803): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$kcm(0x21, 0x2, 0x2) 17m1.022038525s ago: executing program 1 (id=806): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x70, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x3, 0xffffffff}, 0x0) r2 = syz_open_dev$dri(0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r2, 0xc01064c8, &(0x7f0000000300)={0xffffffffffffff5e, 0x0, 0x0}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r4, r3, &(0x7f0000002080)=0x64, 0x21c) 16m50.837171416s ago: executing program 1 (id=839): openat$rfkill(0xffffffffffffff9c, 0x0, 0x22883, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_vif\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x49) ioctl$KVM_GET_NESTED_STATE(0xffffffffffffffff, 0xc080aebe, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) accept4(r2, 0x0, 0x0, 0x800) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x627, 0x4c1, 0x43, 0x0, 0x30) 16m43.446451386s ago: executing program 1 (id=861): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x20d00, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) acct(&(0x7f0000000040)='./file0\x00') 16m41.074945207s ago: executing program 1 (id=869): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r4, 0x29, 0x36, 0xffffffffffffffff, &(0x7f00000000c0)=0xfffffffffffffcba) 16m39.699788138s ago: executing program 1 (id=875): syz_usb_connect(0x3, 0x24, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x89, 0x40, 0xcb, 0x40, 0x5d1, 0x7001, 0x5343, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x40, 0x59, 0x40, 0x1a, [{{0x9, 0x4, 0x92, 0xc, 0x0, 0xf4, 0xb9, 0x23, 0x9a}}]}}]}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$kcm(0xa, 0x5, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r0, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4001}, 0x4000004) 16m30.661866125s ago: executing program 33 (id=855): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20240000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc040}, 0x90) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r1, 0x0, 0x3fc}, 0x18) socket$kcm(0x21, 0x2, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0xfffffffe}, 0x50) close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f00000001c0)='kfree\x00', 0xffffffffffffffff, 0x0, 0xffffffffffffff33}, 0x18) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000000)={0x2, 0x1, 0x0, 0x0, 0x9}, 0xc) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f00000002c0)=0xe, 0x4) 16m24.404146141s ago: executing program 34 (id=875): syz_usb_connect(0x3, 0x24, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x89, 0x40, 0xcb, 0x40, 0x5d1, 0x7001, 0x5343, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x40, 0x59, 0x40, 0x1a, [{{0x9, 0x4, 0x92, 0xc, 0x0, 0xf4, 0xb9, 0x23, 0x9a}}]}}]}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$kcm(0xa, 0x5, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r0, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4001}, 0x4000004) 14m5.788982388s ago: executing program 5 (id=1672): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x0, 0xfffffffd, @empty}, 0x1c) r5 = dup(r4) r6 = open(&(0x7f00000000c0)='./file0\x00', 0x1298c2, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f0000000e80)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x8800000000000002}, 0x1, 0x0, 0x1}}, 0xb8}}, 0x0) ftruncate(r6, 0x200004) sendfile(r5, r6, 0x0, 0x80001d00c0d1) 14m4.254363441s ago: executing program 5 (id=1674): syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xbf5ce000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_io_uring_setup(0x18d6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chroot(&(0x7f0000000a40)='./file0\x00') syz_open_dev$tty20(0xc, 0x4, 0x1) syz_usb_connect(0x1, 0x35, &(0x7f0000000080)=ANY=[@ANYBLOB="120100035a003e200804903061150102030109022300"], 0x0) 13m59.88940855s ago: executing program 5 (id=1681): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet_sctp(0x2, 0x1, 0x84) quotactl_fd$Q_GETINFO(r4, 0xffffffff80000500, 0x0, &(0x7f00000002c0)) timerfd_create(0x0, 0x0) r5 = timerfd_create(0x0, 0x0) timerfd_settime(r5, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) read(r5, &(0x7f0000000240)=""/123, 0x7b) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x1000, 0x8, 0x2, 0x3, 0x0, 0x3}) 13m57.851585111s ago: executing program 5 (id=1683): bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfd, 0x20000}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000), 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0}, 0x94) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="190000000400000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) gettid() timer_create(0x8, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) readv(r2, &(0x7f0000001140)=[{0x0}], 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r1, 0x0, 0x2000000004}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x101, 0x7fff, 0xcc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x10000, 0x4}, 0x50) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$char_usb(r3, &(0x7f0000000280)=""/247, 0xf7) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) 13m51.270378745s ago: executing program 5 (id=1698): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/14], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee01, 0x0) r3 = fanotify_init(0x200, 0x0) close(r3) 13m49.78810422s ago: executing program 5 (id=1701): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) clock_gettime(0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r1, 0x70c}, {r2, 0x2}, {r3, 0x4}], 0x3, &(0x7f00000001c0), &(0x7f0000000380)={[0xa66e]}, 0x8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x103c02, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) setsockopt$inet_int(r3, 0x0, 0x12, &(0x7f0000000300)=0x1, 0x4) sendto$inet(r3, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x20040000, &(0x7f0000000100)={0x2, 0x4e22, @empty}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) recvmmsg(r3, &(0x7f000000e280), 0x58a, 0x42, 0x0) 13m34.519858248s ago: executing program 35 (id=1701): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) clock_gettime(0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r1, 0x70c}, {r2, 0x2}, {r3, 0x4}], 0x3, &(0x7f00000001c0), &(0x7f0000000380)={[0xa66e]}, 0x8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x103c02, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) setsockopt$inet_int(r3, 0x0, 0x12, &(0x7f0000000300)=0x1, 0x4) sendto$inet(r3, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x20040000, &(0x7f0000000100)={0x2, 0x4e22, @empty}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) recvmmsg(r3, &(0x7f000000e280), 0x58a, 0x42, 0x0) 12m48.631218566s ago: executing program 7 (id=1802): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) msgget$private(0x0, 0x790) close(r0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r5, &(0x7f00000004c0)="b0", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x21}}, 0x4}, 0x1c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, 0x0, 0x0) 12m43.444648163s ago: executing program 7 (id=1810): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f00000003c0)={'\x00', 0x2, 0x0, 0xe}) ioprio_set$uid(0x3, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000000c0)=0xff) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') renameat2(r4, &(0x7f00000006c0)='./cgroup\x00', r4, &(0x7f00000003c0)='./mnt\x00', 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000180)=0x7e) 12m38.658601607s ago: executing program 7 (id=1827): r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0xa0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x0, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000006c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x89a0, &(0x7f0000000040)={'gre0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000006180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYRES16=r4, @ANYRES32, @ANYBLOB="0c0009001100fffffcffff"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x10) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0xe8902, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x8, 0xd1}) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f7}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5c8c, 0x0, @empty, @mcast1, 0x80, 0x0, 0x0, 0x20000000}}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x1f, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4) rt_sigqueueinfo(0x0, 0x38, &(0x7f0000000240)={0x20, 0x4}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000100)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x0, 0xa, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0x71, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) 12m29.425011465s ago: executing program 7 (id=1851): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x20000106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_subtree(r3, 0x0, 0x6) r4 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) syz_open_dev$I2C(&(0x7f00000000c0), 0x79, 0x40080) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$dri(&(0x7f0000000080), 0x5, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') syz_open_procfs(0x0, 0x0) 12m22.716471614s ago: executing program 7 (id=1866): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b4050000000000007112180000000000bc201000210000009500000000000000159bb11d55cd54f795ebc6c48b7ee57df364594defe47aa18c81fbb86c6042dbf743a90b61bae3a57ba478e003fe723b194058bc41fc8c6082cee0dce6c4e98c8804a03eb15abe991b86e1c207e4b9c2e545253ec3e0a8800fd697685e0d14ef22ee60615176aa2972a57268ec0127b3869d981e769df4fd0f63d8bde942339d7e8fa10c87b5562d7cd8a361f5801b6e29c575dac7f00846c103fa144116db9a8a8850b0715c590a250c52c2b47c"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) write$binfmt_register(r3, &(0x7f00000004c0)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x0, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xea(J\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{G\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xbd\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132?\xbf\xb2\x93B\x01\'#\xc0v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde44m\x96+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x8c\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xa1W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, './file0'}, 0x237) socket(0x2, 0x3, 0x2) sendmsg$IPSET_CMD_FLUSH(r2, 0x0, 0x480c4) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = dup(r4) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40603d07, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_80211_join_ibss(&(0x7f0000000180)='wlan1\x00', &(0x7f0000000200)=@default_ibss_ssid, 0x6, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000100)={r6}) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) socket$kcm(0xa, 0x2, 0x0) socket(0x2, 0x80805, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x5}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r9, 0x0, 0x485, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x640100ff, 0x4e20, 0x3, 'lblc\x00', 0x20, 0xa7e, 0x400070}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x8000, 0x100077}, {@remote, 0x4e20, 0x3, 0x8, 0x200}}, 0x44) r10 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r10, 0x114, 0x3, &(0x7f0000000240)={{0x3ff, 0x9}, 0x22}, 0x10) 12m21.794836302s ago: executing program 7 (id=1871): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000280), 0x400000000000180, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='sched_switch\x00', r7}, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x1c, r3, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r8 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_CLAIM_PORT(r8, 0x80045518, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) sendmsg$NFC_CMD_START_POLL(r9, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={0x24, r10, 0x1, 0x123, 0x238, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_TM_PROTOCOLS={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4044000) unshare(0x2020480) r11 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r11, 0x6, 0x0, 0x0, 0x0) 12m6.526143041s ago: executing program 36 (id=1871): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000280), 0x400000000000180, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='sched_switch\x00', r7}, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x1c, r3, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r8 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_CLAIM_PORT(r8, 0x80045518, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) sendmsg$NFC_CMD_START_POLL(r9, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={0x24, r10, 0x1, 0x123, 0x238, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_TM_PROTOCOLS={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4044000) unshare(0x2020480) r11 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r11, 0x6, 0x0, 0x0, 0x0) 11m45.244699015s ago: executing program 3 (id=2026): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0) ioctl$VIDIOC_QUERYMENU(r0, 0xc02c5625, &(0x7f0000000140)={0x2, 0xfffffff0, @name="35265c22281136b6ded195a9405e29c3208b0ec5ab6c50f6a76f191af8241106"}) 11m45.10854506s ago: executing program 3 (id=2028): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x5, 0x6, 0x801, 0x0, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x48010) 11m44.963802933s ago: executing program 3 (id=2031): r0 = socket$tipc(0x1e, 0x2, 0x0) connect$tipc(r0, &(0x7f0000001800)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x2}}, 0x10) 11m44.790106681s ago: executing program 3 (id=2033): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b26, &(0x7f0000000040)={'virt_wifi0\x00', @multicast}) 11m38.642829085s ago: executing program 3 (id=2080): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = gettid() tkill(r4, 0x7) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r6, 0x0, 0x0) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) sendmsg$tipc(r5, 0x0, 0x24048840) setsockopt$TIPC_DEST_DROPPABLE(r7, 0x10f, 0x81, &(0x7f0000000000), 0x4) r8 = dup3(r6, r7, 0x0) setsockopt$TIPC_GROUP_LEAVE(r8, 0x10f, 0x88) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10) bind$tipc(r5, 0x0, 0x0) 11m35.832602317s ago: executing program 3 (id=2089): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newtaction={0x78, 0x30, 0x9, 0x0, 0x0, {}, [{0x64, 0x1, [@m_skbedit={0x60, 0x1, 0x0, 0x0, {{0xc}, {0x34, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x6, 0x6, 0x200ff4c, 0x2738}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x3}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x7}, @TCA_SKBEDIT_MARK={0xfffffee7, 0x5, 0x2}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0x3b}}}}]}]}, 0x78}}, 0x0) 11m20.758732519s ago: executing program 37 (id=2089): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newtaction={0x78, 0x30, 0x9, 0x0, 0x0, {}, [{0x64, 0x1, [@m_skbedit={0x60, 0x1, 0x0, 0x0, {{0xc}, {0x34, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x6, 0x6, 0x200ff4c, 0x2738}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x3}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x7}, @TCA_SKBEDIT_MARK={0xfffffee7, 0x5, 0x2}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0x3b}}}}]}]}, 0x78}}, 0x0) 2m7.799417568s ago: executing program 6 (id=8702): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$video(&(0x7f0000000000), 0x8, 0x20202) syz_open_dev$audion(&(0x7f0000000040), 0x1ff, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040), 0x80000000, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0x76, 0x101a01) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x1cf) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.stat\x00', 0x275a, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x8000, 0x44, 0x18}, 0x18) open(&(0x7f0000000000)='.\x00', 0x1000000, 0x0) 2m2.844806195s ago: executing program 6 (id=8727): openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2m2.518855908s ago: executing program 6 (id=8732): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) io_submit(0x0, 0x0, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000040)={0x191, 0x258, 0x1e0, 0x3f, 0x32, 0x1, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3}) 1m59.138886935s ago: executing program 6 (id=8744): sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x248}, 0x1, 0x0, 0x0, 0x4010}, 0x800) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f00000005c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d8590070", 0x22}, {&(0x7f0000000140)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad574af080de74a37f54ee5f10fe3f42b4452", 0x3f}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f00000000c0)={0x800080, 0x80, 0x8, 0x7, 0x0, 0x55a}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f0000000200)={0x800080, 0x858, 0x8, 0xc, 0x43, 0x558}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x48080, 0x85) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000340)={&(0x7f00000006c0)={0x84, 0x2, 0x7, 0x3, 0x70bd2a, 0x25dfdbfd, {0x7, 0x0, 0x9}, [@generic="902f521cf0c04af4f65f61160ee48ddf90f38950be31e61bcede013525d464336ad3e33b5eb3f5be3b2d2532ef97376518377cccd84ab8416f6462381fbb6f7e1de30b6baa8b5bc7eeb274b48f7bfd141f2cc6d8309eb9639da7804d70c8e3c0373e5c4043e9cfe47d4174fafa2add2e"]}, 0x84}, 0x1, 0x0, 0x0, 0x4048010}, 0x20044004) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, 0xa}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x2000000000, 0xb, 0x80006, 0x4000000000000e51, 0x102, 0x547b, 0x103d, 0x200000000006, 0x20000000000000, 0x3aa, 0x1, 0x1, 0xf, 0x40000000009, 0x40000000080a8c, 0x800000068], 0x4, 0x4000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m57.584831196s ago: executing program 6 (id=8753): mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x2, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) io_uring_setup(0xb, &(0x7f000001b0c0)={0x0, 0xc89e, 0xc000, 0x2, 0x265}) 1m55.658285624s ago: executing program 6 (id=8758): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000280)={0x0, 0x275, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@pass_iovec={0x1, 0x7a, 0x0, @fd=r2, 0x100000001, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) 1m40.570559417s ago: executing program 38 (id=8758): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000280)={0x0, 0x275, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@pass_iovec={0x1, 0x7a, 0x0, @fd=r2, 0x100000001, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) 20.211525424s ago: executing program 8 (id=9104): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0xc) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) r5 = accept4(r4, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x12c}, 0x1, 0x0, 0x0, 0x200400c0}, 0x40000) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) 15.086906747s ago: executing program 4 (id=9119): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFC_CMD_SE_IO(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) unshare(0x2040400) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xb, 0xff, 0x5, 0x7f, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000440)={{r4}, &(0x7f0000000100)=0x7d8, &(0x7f0000000140)='%pi6 \x00'}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) 12.196311748s ago: executing program 4 (id=9123): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) syz_open_dev$vbi(&(0x7f0000001d40), 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x20010, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setfsgid(0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = open(&(0x7f00000000c0)='.\x00', 0x10000, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x3c0, 0x0, 0x111, 0x4b4, 0x1e0, 0xd4feffff, 0x318, 0x20a, 0x278, 0x318, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0x0, 0xff, 0x0, 0xffffff00], [0x0, 0xffffffff, 0xff000000], 'ipvlan0\x00', 'ip6erspan0\x00', {}, {}, 0x6, 0x40}, 0x7a, 0x1b8, 0x1e0, 0x0, {}, [@common=@inet=@multiport={{0x50}, {0x0, 0x3, [0x4e23, 0x4e23, 0x4e21, 0x4e20, 0x4e21, 0x4e21, 0x4e22, 0x4e20, 0x4e22, 0x4e24, 0x4e20, 0x4e21, 0x4e22, 0x4e23, 0x4e21], [0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x28}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x7ff, 'snmp\x00', 'syz1\x00', {0x6}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x420) getdents(r4, &(0x7f0000001fc0)=""/184, 0xb8) 10.559696382s ago: executing program 2 (id=9130): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$inet(0x2b, 0x801, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x2b, 0x80801, 0x1) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r3}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 9.538892601s ago: executing program 8 (id=9142): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000000000001801", @ANYRES32, @ANYBLOB="0000000000000008b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000024"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r0}, 0x18) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000000e40)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x61, @private0, 0x3}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f00000000c0)={0xa, 0x4ea0, 0x10, @private0, 0x9}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000000)="95", 0x1}], 0x1}}], 0x2, 0x931766f6319eed40) shutdown(r1, 0x1) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x80000000, 0x4}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000ac0)='kmem_cache_free\x00', r2}, 0x10) r3 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x0) flock(r3, 0x6) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x2, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000027c0)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd29, 0x2, {0x0, 0x0, 0x0, r7, {0xffff, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xd, 0xfff3}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40091}, 0x0) 8.578851786s ago: executing program 4 (id=9150): futex(0x0, 0x6, 0x0, 0x0, 0x0, 0xfff0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x10, 0x803, 0x0) socket(0x1, 0x803, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r4, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x1cba8c72}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x177ffb498171ed1, 0x8040010) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x10, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf5000000}, 0x0) 8.15611912s ago: executing program 8 (id=9157): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f00000002c0)={0x28, 0x0, 0x2710, @local}, 0x10) connect$vsock_stream(r3, &(0x7f0000000180)={0x28, 0x0, 0x0, @host}, 0x10) 7.10506305s ago: executing program 4 (id=9158): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) read$msr(0xffffffffffffffff, &(0x7f00000003c0)=""/179, 0xb3) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0xe259}, {0xffffffffffffffff, 0x1020}], 0x2, 0x0, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r5 = open$dir(&(0x7f0000000000)='./file0\x00', 0x42, 0x0) vmsplice(r5, &(0x7f0000000200)=[{&(0x7f00000002c0)='u', 0x1}], 0x1, 0x0) 6.446266595s ago: executing program 2 (id=9161): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syslog(0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = eventfd(0xffffffff) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000000)={0x40000001}) r6 = epoll_create(0x113) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, 0x0) 6.416288804s ago: executing program 8 (id=9162): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) 5.068188318s ago: executing program 2 (id=9168): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_debug_messages', 0x48a82, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8101, 0x0, 0x0, 0x2cf, 0x0, r0}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x4, 0x400100) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r2, 0x7f33, 0x7c5b, 0x0, 0x0, 0xfffffe36) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3c}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002640)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r5, 0x1, 0x10, &(0x7f0000000040), 0x4) sendmmsg$inet(r5, &(0x7f0000007fc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 3.75729156s ago: executing program 8 (id=9171): getitimer(0x2, 0x0) r0 = getpgrp(0x0) r1 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000240)={{}, 0x3, 0x0, 0x9, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000040)=0x80000001, 0x4) sendto$inet6(r5, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f00000000c0)="4435c61bc9a1f1ed51c7b06188c682bd59fde0261c9bc2b1f66724ea0287fb6effd2c318abfa442135afa8ca2b68dacbb4a1aa65f9c177dc50967e99edcce6e8900d450fcd9980371cd431b9c1ad0766a9cb142c1ac79715905c856c9e549753967a92c7024ac039", 0xffffffffffffff1d, 0x850, 0x0, 0x0) 3.626358653s ago: executing program 2 (id=9173): prctl$PR_SET_FPEMU(0xa, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/psched\x00') openat$incfs(r1, &(0x7f0000000100)='.pending_reads\x00', 0x8340, 0x101) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299b000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0xf000, 0x3, &(0x7f0000009000/0xf000)=nil) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') r3 = fsopen(&(0x7f0000000140)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x1) fchdir(r4) lseek(0xffffffffffffffff, 0x101, 0x1) munmap(&(0x7f000000e000/0x3000)=nil, 0x3000) preadv(r2, &(0x7f0000001200)=[{&(0x7f0000000080)=""/4097, 0x1001}], 0x1, 0x9, 0x6a76) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x32) copy_file_range(r5, 0x0, r5, &(0x7f00000004c0)=0x100, 0x9, 0x20) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) 1.950671451s ago: executing program 0 (id=9174): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x7) r5 = socket(0xa, 0x1, 0x0) listen(r5, 0x7f) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r7, 0x0) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) recvmsg(r8, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x2) 1.907473827s ago: executing program 8 (id=9184): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = syz_open_procfs(0x0, 0x0) lseek(r4, 0x9, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) getrlimit(0xa, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x4, 0xf5ff) connect$unix(0xffffffffffffffff, 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r6) 1.890662739s ago: executing program 9 (id=9175): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r4, &(0x7f00000002c0)="32a76f4972547ea2069d8dd41391797c89bc8fe1c5df6f648cc1a9675ea4280855757225ceaf9738e9", 0x29, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xb9, @loopback, 0x203}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) 1.796047414s ago: executing program 0 (id=9176): r0 = openat(0xffffffffffffff9c, 0x0, 0xa41, 0x0) copy_file_range(0xffffffffffffffff, 0x0, r0, 0x0, 0xffffffffa003e45b, 0x700000000000000) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0xfffffffffffffff7}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x8042, 0x0) pwrite64(r5, 0x0, 0x0, 0x8080c61) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, 0x0) ptrace$peeksig(0x4209, 0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x3ff) 1.623357818s ago: executing program 4 (id=9177): r0 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x8400000}, &(0x7f0000000100), &(0x7f0000000080)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000000)={&(0x7f0000001000)={[{0x0, 0x0, 0x0, 0x300}, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x1}]}, 0x3}, 0x1) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) mmap(&(0x7f0000230000/0x1000)=nil, 0x1000, 0x1000000, 0x8010, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)={0x20, 0x35, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 1.622899243s ago: executing program 9 (id=9178): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) dup(0xffffffffffffffff) r4 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 1.622505434s ago: executing program 0 (id=9179): socket$inet6_sctp(0xa, 0x1, 0x84) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0xc4c85513, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2480, 0x1) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) 1.287216871s ago: executing program 2 (id=9180): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="62202a3a2a20720033e3e8"], 0x8) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) fanotify_init(0xf00, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0xfffffffffffffbfe, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_pts(0xffffffffffffffff, 0x141601) r4 = openat$cgroup_devices(r0, &(0x7f0000000240)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000280)={'b', ' *:* ', 'rm\x00'}, 0x9) 1.285423034s ago: executing program 9 (id=9181): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) 415.055234ms ago: executing program 4 (id=9182): getdents64(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) socket(0x1e, 0x805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffd000/0x2000)=nil, 0x4000) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r4, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r4, 0x3) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) 327.358124ms ago: executing program 0 (id=9183): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x180}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x50) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) bind$bt_hci(r4, 0x0, 0x0) write$binfmt_misc(r4, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000000)=0x9) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000280)=0x17) 326.605501ms ago: executing program 2 (id=9185): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) r5 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x43) ftruncate(r5, 0x2007ffb) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x88882, 0x200) r7 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) sendfile(r7, r6, 0x0, 0x7ffff000) creat(&(0x7f0000000000)='./bus\x00', 0x48) 326.083692ms ago: executing program 9 (id=9186): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r2, 0x40045431, 0x0) sched_setscheduler(0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) 161.776733ms ago: executing program 9 (id=9187): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r3 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) mknodat$loop(r3, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) chdir(&(0x7f0000000140)='./bus\x00') link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') open(&(0x7f0000000440)='./file0\x00', 0xe8142, 0x0) 160.934531ms ago: executing program 0 (id=9188): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) syz_genetlink_get_family_id$fou(&(0x7f00000001c0), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1, 0x0, 0x0, 0x6000}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) 649.97µs ago: executing program 9 (id=9189): connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) uname(0xfffffffffffffffc) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0x64, 0xfffffffffffffffd}, 0x33) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) syz_io_uring_setup(0x124, &(0x7f00000000c0)={0x0, 0x5885, 0x0, 0x2}, &(0x7f0000000340), 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x401, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r3, r3], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) 0s ago: executing program 0 (id=9190): r0 = io_uring_setup(0x4b00, &(0x7f0000000440)={0x0, 0x8dd9, 0x4, 0x40, 0x19e}) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = fsopen(0x0, 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r6 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r6, 0xffff) fcntl$addseals(r6, 0x409, 0x7) ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000000)={r6, 0x0, 0x0, 0x8000}) kernel console output (not intermixed with test programs): ] usb 7-1: config 1 has no interface number 0 [ 664.125102][ T804] usb 7-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 664.125128][ T804] usb 7-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 664.125150][ T804] usb 7-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 664.125193][ T804] usb 7-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 664.125216][ T804] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.249398][ T804] snd_usb_pod 7-1:1.1: Line 6 Pocket POD found [ 664.279482][ T1323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 664.393165][ T1323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 664.436926][ T804] snd_usb_pod 7-1:1.1: cannot start listening: -90 [ 664.437842][ T804] snd_usb_pod 7-1:1.1: Line 6 Pocket POD now disconnected [ 664.438524][ T804] snd_usb_pod 7-1:1.1: probe with driver snd_usb_pod failed with error -90 [ 664.509264][ T1323] bond0 (unregistering): Released all slaves [ 664.664567][ T804] usb 7-1: USB disconnect, device number 10 [ 664.732103][T11241] Bluetooth: hci0: command tx timeout [ 665.301271][ T1323] hsr_slave_0: left promiscuous mode [ 665.341952][ T1323] hsr_slave_1: left promiscuous mode [ 665.343103][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 665.392638][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 666.232761][ T1323] team0 (unregistering): Port device team_slave_1 removed [ 666.298181][T13669] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 666.474422][ T1323] team0 (unregistering): Port device team_slave_0 removed [ 666.811775][T11241] Bluetooth: hci0: command tx timeout [ 668.446830][T13555] chnl_net:caif_netlink_parms(): no params data found [ 669.048920][T11241] Bluetooth: hci0: command 0x0419 tx timeout [ 669.793946][T13815] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2925'. [ 669.862498][T13555] bridge0: port 1(bridge_slave_0) entered blocking state [ 669.863338][T13555] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.863611][T13555] bridge_slave_0: entered allmulticast mode [ 669.868952][T13555] bridge_slave_0: entered promiscuous mode [ 669.905765][T13555] bridge0: port 2(bridge_slave_1) entered blocking state [ 669.907300][T13555] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.907567][T13555] bridge_slave_1: entered allmulticast mode [ 669.925928][T13555] bridge_slave_1: entered promiscuous mode [ 670.133571][T13555] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 670.159763][T13555] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.605974][ T37] audit: type=1326 audit(1768144635.006:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13848 comm="syz.6.2942" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 670.606038][ T37] audit: type=1326 audit(1768144635.006:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13848 comm="syz.6.2942" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 670.607322][ T37] audit: type=1326 audit(1768144635.006:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13848 comm="syz.6.2942" exe="/root/syz-executor" sig=0 arch=c000003e syscall=189 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 670.607632][ T37] audit: type=1326 audit(1768144635.006:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13848 comm="syz.6.2942" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 670.608367][ T37] audit: type=1326 audit(1768144635.006:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13848 comm="syz.6.2942" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 670.794492][T13857] netlink: 'syz.6.2947': attribute type 1 has an invalid length. [ 670.810063][T13555] team0: Port device team_slave_0 added [ 670.954617][T13555] team0: Port device team_slave_1 added [ 670.988825][T13861] m1Ie5nè‹Ò: entered promiscuous mode [ 671.053680][T11241] Bluetooth: hci0: command 0x0419 tx timeout [ 671.735625][T13898] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2967'. [ 671.869937][T13904] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2969'. [ 671.869969][T13904] openvswitch: netlink: IP tunnel attribute has 7 unknown bytes. [ 671.937692][T13555] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 671.937713][T13555] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.937739][T13555] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 671.952271][T13555] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 671.952288][T13555] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.952312][T13555] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 672.074750][T12484] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 673.885285][T12484] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 674.313411][ T5808] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 674.318156][ T5808] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 674.331935][ T5808] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 674.333751][ T5808] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 674.334603][ T5808] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 674.505966][T13555] hsr_slave_0: entered promiscuous mode [ 674.507512][T13555] hsr_slave_1: entered promiscuous mode [ 674.508554][T13555] debugfs: 'hsr0' already exists in 'hsr' [ 674.508580][T13555] Cannot create hsr debugfs directory [ 676.582479][ T5808] Bluetooth: hci4: command tx timeout [ 677.122976][T13198] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 677.298649][T13198] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 677.354247][T13198] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 677.508430][ T1323] bridge_slave_1: left allmulticast mode [ 677.508460][ T1323] bridge_slave_1: left promiscuous mode [ 677.508728][ T1323] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.572749][ T1323] bridge_slave_0: left allmulticast mode [ 677.572771][ T1323] bridge_slave_0: left promiscuous mode [ 677.572961][ T1323] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.665447][ T1323] bridge_slave_1: left allmulticast mode [ 677.665472][ T1323] bridge_slave_1: left promiscuous mode [ 677.665634][ T1323] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.746036][ T1323] bridge_slave_0: left allmulticast mode [ 677.746060][ T1323] bridge_slave_0: left promiscuous mode [ 677.746222][ T1323] bridge0: port 1(bridge_slave_0) entered disabled state [ 678.053137][ T1323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 678.132285][ T1323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 678.193823][ T1323] bond0 (unregistering): Released all slaves [ 678.412278][ T1323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 678.503459][ T1323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 678.567068][ T1323] bond0 (unregistering): Released all slaves [ 678.614721][T13198] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 678.662150][ T5808] Bluetooth: hci4: command tx timeout [ 679.241856][ T1323] hsr_slave_0: left promiscuous mode [ 679.271903][ T1323] hsr_slave_1: left promiscuous mode [ 679.272657][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 679.312637][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 679.461812][ T1323] hsr_slave_0: left promiscuous mode [ 679.501855][ T1323] hsr_slave_1: left promiscuous mode [ 679.502627][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 679.532987][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 680.292358][ T1323] team0 (unregistering): Port device team_slave_1 removed [ 680.434054][ T1323] team0 (unregistering): Port device team_slave_0 removed [ 680.732479][ T5808] Bluetooth: hci4: command tx timeout [ 681.592287][ T1323] team0 (unregistering): Port device team_slave_1 removed [ 681.754202][ T1323] team0 (unregistering): Port device team_slave_0 removed [ 682.633470][T13928] chnl_net:caif_netlink_parms(): no params data found [ 682.812496][ T5808] Bluetooth: hci4: command tx timeout [ 683.168735][T13928] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.168948][T13928] bridge0: port 1(bridge_slave_0) entered disabled state [ 683.169171][T13928] bridge_slave_0: entered allmulticast mode [ 683.200296][T13928] bridge_slave_0: entered promiscuous mode [ 683.208999][T13928] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.209130][T13928] bridge0: port 2(bridge_slave_1) entered disabled state [ 683.209271][T13928] bridge_slave_1: entered allmulticast mode [ 683.210796][T13928] bridge_slave_1: entered promiscuous mode [ 683.499338][T13928] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 683.506956][T13928] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 683.731061][T13928] team0: Port device team_slave_0 added [ 683.788075][T13928] team0: Port device team_slave_1 added [ 683.791492][T13198] 8021q: adding VLAN 0 to HW filter on device bond0 [ 684.025245][T13928] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 684.025265][T13928] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 684.025285][T13928] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 684.057606][T13928] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 684.057625][T13928] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 684.057650][T13928] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 684.059161][T13555] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 684.159333][T13555] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 684.316738][T13555] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 684.452770][T13555] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 684.534684][T13198] 8021q: adding VLAN 0 to HW filter on device team0 [ 684.639147][T13928] hsr_slave_0: entered promiscuous mode [ 684.640081][T13928] hsr_slave_1: entered promiscuous mode [ 684.641367][T13928] debugfs: 'hsr0' already exists in 'hsr' [ 684.641384][T13928] Cannot create hsr debugfs directory [ 684.685806][ T9349] bridge0: port 1(bridge_slave_0) entered blocking state [ 684.686037][ T9349] bridge0: port 1(bridge_slave_0) entered forwarding state [ 684.802798][T10989] bridge0: port 2(bridge_slave_1) entered blocking state [ 684.802959][T10989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 685.920461][T13555] 8021q: adding VLAN 0 to HW filter on device bond0 [ 686.009543][T13555] 8021q: adding VLAN 0 to HW filter on device team0 [ 686.025691][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.025768][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.068928][T10987] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.069327][T10987] bridge0: port 1(bridge_slave_0) entered forwarding state [ 686.106380][T10977] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.106619][T10977] bridge0: port 2(bridge_slave_1) entered forwarding state [ 686.205708][T13198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 686.518338][ T1323] bridge_slave_1: left allmulticast mode [ 686.518370][ T1323] bridge_slave_1: left promiscuous mode [ 686.518633][ T1323] bridge0: port 2(bridge_slave_1) entered disabled state [ 686.592681][ T1323] bridge_slave_0: left allmulticast mode [ 686.592704][ T1323] bridge_slave_0: left promiscuous mode [ 686.592908][ T1323] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.922365][ T1323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 687.023287][ T1323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 687.086255][ T1323] bond0 (unregistering): Released all slaves [ 687.652585][ T1323] hsr_slave_0: left promiscuous mode [ 687.671901][ T1323] hsr_slave_1: left promiscuous mode [ 687.672717][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 687.722376][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 688.412748][ T1323] team0 (unregistering): Port device team_slave_1 removed [ 688.552567][ T1323] team0 (unregistering): Port device team_slave_0 removed [ 689.268081][T13198] veth0_vlan: entered promiscuous mode [ 689.293968][T13198] veth1_vlan: entered promiscuous mode [ 689.351873][T13555] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 689.510795][T13198] veth0_macvtap: entered promiscuous mode [ 689.626589][T13198] veth1_macvtap: entered promiscuous mode [ 689.988915][T13198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 690.072748][T13928] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 690.123483][T13198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 690.123731][T13928] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 690.170720][T13928] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 690.186201][T13928] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 690.231454][T10989] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.244418][T10989] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.245906][T10989] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.249810][T10989] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.600743][T13555] veth0_vlan: entered promiscuous mode [ 690.715293][T13555] veth1_vlan: entered promiscuous mode [ 690.726161][ T3697] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 690.726182][ T3697] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 690.909199][ T3697] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 690.909222][ T3697] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 690.995604][T13555] veth0_macvtap: entered promiscuous mode [ 691.025985][T13555] veth1_macvtap: entered promiscuous mode [ 691.036187][T13928] 8021q: adding VLAN 0 to HW filter on device bond0 [ 691.100161][T13555] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 691.129198][T13555] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 691.154725][T13928] 8021q: adding VLAN 0 to HW filter on device team0 [ 691.254171][ T1323] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.261338][ T1323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 691.267865][ T1323] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.268012][ T1323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 691.285291][ T9349] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.349451][ T9349] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.378986][ T37] audit: type=1326 audit(1768144655.776:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14017 comm="syz.6.3001" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 691.382448][ T9349] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.392168][ T9349] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.394741][ T37] audit: type=1326 audit(1768144655.796:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14017 comm="syz.6.3001" exe="/root/syz-executor" sig=0 arch=c000003e syscall=217 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 691.394787][ T37] audit: type=1326 audit(1768144655.796:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14017 comm="syz.6.3001" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 691.394826][ T37] audit: type=1326 audit(1768144655.796:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14017 comm="syz.6.3001" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x7ffc0000 [ 693.066173][ T1323] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 693.066196][ T1323] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 693.237448][T14043] ieee802154 phy0 wpan0: encryption failed: -22 [ 694.578118][T10987] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 694.578142][T10987] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 695.036526][T14065] netlink: 25 bytes leftover after parsing attributes in process `syz.4.2207'. [ 695.963783][T13928] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 697.338211][T14117] comedi comedi3: 8255: I/O port conflict (0x40404f26,4) [ 697.548776][T13928] veth0_vlan: entered promiscuous mode [ 697.588431][T13928] veth1_vlan: entered promiscuous mode [ 697.833637][T13928] veth0_macvtap: entered promiscuous mode [ 697.879241][T13928] veth1_macvtap: entered promiscuous mode [ 698.024490][T13928] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 698.061167][T13928] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 698.153335][T10989] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.154171][T10989] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.155201][T10989] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.155242][T10989] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.860650][T10989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 698.860785][T10989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.073777][T10972] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 699.073801][T10972] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.117111][T14162] netlink: 'syz.8.3040': attribute type 1 has an invalid length. [ 705.771994][ T5808] Bluetooth: hci4: Malformed HCI Event [ 706.029099][T14268] openvswitch: netlink: Message has 4 unknown bytes. [ 708.440625][T14338] MPI: mpi too large (16392 bits) [ 709.758318][T14356] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 713.178664][ T9] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 713.324966][ T9] usb 10-1: Using ep0 maxpacket: 32 [ 713.327472][ T9] usb 10-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 713.327502][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 713.369845][ T9] usb 10-1: config 0 descriptor?? [ 713.551972][ T9] as10x_usb: device has been detected [ 713.553469][ T9] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 713.768005][ T9] usb 10-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 714.920571][ T9] as10x_usb: error during firmware upload part1 [ 714.921371][ T9] Registered device nBox DVB-T Dongle [ 715.264897][ T9] usb 10-1: USB disconnect, device number 2 [ 715.395064][ T9] Unregistered device nBox DVB-T Dongle [ 715.414119][ T9] as10x_usb: device has been disconnected [ 716.882474][ T9] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 717.031676][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 717.035803][ T9] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 717.035834][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.094699][ T9] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 717.527494][ T9] gspca_nw80x: reg_r err -71 [ 717.527607][ T9] nw80x 7-1:3.0: probe with driver nw80x failed with error -71 [ 717.557945][ T9] usb 7-1: USB disconnect, device number 11 [ 718.109642][T14541] IPv6: sit1: Disabled Multicast RS [ 719.371866][ T9] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 719.521650][ T9] usb 9-1: Using ep0 maxpacket: 32 [ 719.539136][ T9] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 719.539171][ T9] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 719.539194][ T9] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 719.580496][ T9] usb 9-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 719.580526][ T9] usb 9-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 719.580545][ T9] usb 9-1: Product: syz [ 719.580559][ T9] usb 9-1: Manufacturer: syz [ 719.580571][ T9] usb 9-1: SerialNumber: syz [ 719.666673][ T9] input: appletouch as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/input/input8 [ 720.026269][ T5907] usb 9-1: USB disconnect, device number 2 [ 720.149016][T14608] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3216'. [ 720.219494][ T5907] appletouch 9-1:1.0: input: appletouch disconnected [ 721.937879][T14621] netlink: 'syz.6.3220': attribute type 8 has an invalid length. [ 722.194776][T14624] : entered promiscuous mode [ 723.800111][T14670] mkiss: ax0: crc mode is auto. [ 733.605797][T14803] nftables ruleset with unbound set [ 733.771917][ T884] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 733.921707][ T884] usb 9-1: Using ep0 maxpacket: 16 [ 733.923691][ T884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 733.923724][ T884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 733.923762][ T884] usb 9-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 733.923784][ T884] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.930504][ T884] usb 9-1: config 0 descriptor?? [ 734.328465][T14827] overlay: Unknown parameter '\ÿ' [ 734.402719][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402758][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402783][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402807][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402831][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402854][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402878][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402903][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402927][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.402951][ T884] apple 0003:05AC:0247.0003: unknown main item tag 0x0 [ 734.488794][ T884] apple 0003:05AC:0247.0003: hidraw0: USB HID v0.00 Device [HID 05ac:0247] on usb-dummy_hcd.8-1/input0 [ 734.667995][T10529] usb 9-1: USB disconnect, device number 3 [ 734.754775][T14836] fido_id[14836]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/9-1/report_descriptor': No such file or directory [ 734.762100][T14841] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3296'. [ 735.781715][ T5885] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 735.953409][ T5885] usb 5-1: Using ep0 maxpacket: 16 [ 735.956465][ T5885] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 735.956493][ T5885] usb 5-1: config 0 has no interface number 0 [ 735.956548][ T5885] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 735.956574][ T5885] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 735.959181][ T5885] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 735.959213][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 735.959235][ T5885] usb 5-1: Product: syz [ 735.959249][ T5885] usb 5-1: SerialNumber: syz [ 736.045746][ T5885] usb 5-1: config 0 descriptor?? [ 736.086391][ T5885] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 736.115397][ T5885] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input9 [ 736.307266][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.315151][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.315413][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.315665][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.316725][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.317894][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.318153][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.318894][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.319147][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.319386][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 736.511974][ T5885] usb 5-1: USB disconnect, device number 2 [ 736.512063][ C0] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 736.702604][ T5885] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 741.417291][T14959] syz.4.3340 (14959): drop_caches: 4 [ 746.798599][T14993] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3352'. [ 748.152617][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 748.152726][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.403362][T10529] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 753.501275][T15074] netlink: 21 bytes leftover after parsing attributes in process `syz.9.3331'. [ 753.573217][T10529] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 753.573238][T10529] usb 9-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 753.573249][T10529] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 753.573260][T10529] usb 9-1: config 220 has no interface number 2 [ 753.573303][T10529] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 753.573319][T10529] usb 9-1: config 220 interface 0 has no altsetting 0 [ 753.573329][T10529] usb 9-1: config 220 interface 76 has no altsetting 0 [ 753.573339][T10529] usb 9-1: config 220 interface 1 has no altsetting 0 [ 753.723365][T10529] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 753.723397][T10529] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.723418][T10529] usb 9-1: Product: syz [ 753.723432][T10529] usb 9-1: Manufacturer: syz [ 753.723446][T10529] usb 9-1: SerialNumber: syz [ 753.994227][T10529] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 753.994266][T10529] uvcvideo 9-1:220.0: No valid video chain found. [ 753.994439][T10529] usb 9-1: selecting invalid altsetting 0 [ 754.065337][T10529] usb 9-1: selecting invalid altsetting 0 [ 754.065382][T10529] usbtest 9-1:220.1: probe with driver usbtest failed with error -22 [ 754.083444][T10529] usb 9-1: USB disconnect, device number 4 [ 759.351759][T15138] bond1: (slave bridge0): Device is not bonding slave [ 759.351783][T15138] bond1: option active_slave: invalid value (bridge0) [ 759.463783][T15138] bond1 (unregistering): Released all slaves [ 760.062298][T15170] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3410'. [ 762.271926][T15182] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3413'. [ 767.411927][T15250] netlink: 'syz.8.3440': attribute type 18 has an invalid length. [ 767.922979][T15268] netlink: 'syz.8.3447': attribute type 1 has an invalid length. [ 767.923021][T15268] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 770.012023][ T5808] Bluetooth: hci2: command 0x0406 tx timeout [ 770.220810][T15348] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 770.422263][T15359] capability: warning: `syz.4.3482' uses deprecated v2 capabilities in a way that may be insecure [ 772.688448][T15400] random: crng reseeded on system resumption [ 772.855960][ T37] audit: type=1326 audit(1768144737.256:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=15403 comm="syz.4.3498" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff4541af749 code=0x0 [ 774.298665][T15467] overlayfs: workdir and upperdir must be separate subtrees [ 775.035577][ T5877] usb 9-1: new full-speed USB device number 5 using dummy_hcd [ 775.194050][ T5877] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 775.194076][ T5877] usb 9-1: config 0 has no interface number 0 [ 775.194122][ T5877] usb 9-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 775.194141][ T5877] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 775.242954][ T5877] usb 9-1: config 0 descriptor?? [ 775.267112][ T5877] usb 9-1: selecting invalid altsetting 1 [ 775.267857][ T5877] dvb_ttusb_budget: ttusb_init_controller: error [ 775.267868][ T5877] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 776.038683][ T5877] DVB: Unable to find symbol cx22700_attach() [ 776.188926][ T5877] DVB: Unable to find symbol tda10046_attach() [ 776.188944][ T5877] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 776.243241][ T5877] usb 9-1: USB disconnect, device number 5 [ 781.790604][ T6502] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 781.944582][ T6502] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 781.944619][ T6502] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 781.944660][ T6502] usb 9-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 781.944683][ T6502] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 781.997749][ T6502] usb 9-1: config 0 descriptor?? [ 782.016539][T15726] sg_write: data in/out 124/84 bytes for SCSI command 0x1c-- guessing data in; [ 782.016539][T15726] program syz.4.3634 not setting count and/or reply_len properly [ 782.460098][ T6502] hid_parser_main: 150 callbacks suppressed [ 782.460127][ T6502] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 782.460264][ T6502] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 782.476045][ T6502] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:0D8C:0022.0004/input/input10 [ 782.566441][ T5885] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 782.698237][ T6502] cm6533_jd 0003:0D8C:0022.0004: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.8-1/input0 [ 782.738675][ T5885] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 782.738707][ T5885] usb 5-1: config 0 has no interface number 0 [ 782.738760][ T5885] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 782.738787][ T5885] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 782.738829][ T5885] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 782.738854][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.802732][ T5885] usb 5-1: config 0 descriptor?? [ 782.825600][ T6502] usb 9-1: USB disconnect, device number 6 [ 782.913196][T15753] fido_id[15753]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/9-1/report_descriptor': No such file or directory [ 783.261111][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.261150][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.261174][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.261197][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.261222][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.261246][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.261270][ T5885] prodikeys 0003:041E:2801.0005: unknown main item tag 0x0 [ 783.275370][ T5885] prodikeys 0003:041E:2801.0005: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.4-1/input1 [ 783.279687][ T5885] hid_prodikeys: hid-prodikeys: failed to find output report [ 783.279687][ T5885] [ 783.508450][ T6502] usb 5-1: USB disconnect, device number 3 [ 783.567541][T15767] fido_id[15767]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 786.268735][ T5808] Bluetooth: hci0: command 0x0419 tx timeout [ 789.915802][T15959] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 793.991686][ T5885] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 794.151173][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 794.151209][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 794.151249][ T5885] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 794.151273][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 794.224056][ T5885] usb 5-1: config 0 descriptor?? [ 794.747509][ T5885] pyra 0003:1E7D:2CF6.0006: global environment stack underflow [ 794.747534][ T5885] pyra 0003:1E7D:2CF6.0006: item 0 2 1 11 parsing failed [ 794.748623][ T5885] pyra 0003:1E7D:2CF6.0006: parse failed [ 794.748702][ T5885] pyra 0003:1E7D:2CF6.0006: probe with driver pyra failed with error -22 [ 794.999012][ T5885] usb 5-1: USB disconnect, device number 4 [ 795.871327][T16112] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 795.871327][T16112] The task syz.6.3793 (16112) triggered the difference, watch for misbehavior. [ 796.801689][ T6526] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 796.951679][ T6526] usb 5-1: Using ep0 maxpacket: 32 [ 796.953858][ T6526] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 796.953880][ T6526] usb 5-1: config 0 interface 0 has no altsetting 0 [ 796.953900][ T6526] usb 5-1: New USB device found, idVendor=05ac, idProduct=0324, bcdDevice= 0.00 [ 796.953912][ T6526] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 796.963762][ T6526] usb 5-1: config 0 descriptor?? [ 797.711668][ T6526] magicmouse 0003:05AC:0324.0007: hidraw0: USB HID v0.0a Device [HID 05ac:0324] on usb-dummy_hcd.4-1/input0 [ 797.731779][ T6526] magicmouse 0003:05AC:0324.0007: magicmouse input not registered [ 797.925501][ T6526] magicmouse 0003:05AC:0324.0007: probe with driver magicmouse failed with error -12 [ 797.953152][ T6526] usb 5-1: USB disconnect, device number 5 [ 798.122680][T16158] fido_id[16158]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 804.460134][T16280] netlink: 'syz.6.3870': attribute type 1 has an invalid length. [ 808.791768][T10567] usb 9-1: new full-speed USB device number 7 using dummy_hcd [ 808.902689][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.902767][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.949669][T10567] usb 9-1: config 8 has an invalid interface number: 177 but max is 0 [ 808.949700][T10567] usb 9-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 808.949720][T10567] usb 9-1: config 8 has no interface number 0 [ 808.949769][T10567] usb 9-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 808.949796][T10567] usb 9-1: config 8 interface 177 has no altsetting 0 [ 808.949832][T10567] usb 9-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 808.949855][T10567] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 809.036562][T10567] ir_toy 9-1:8.177: required endpoints not found [ 809.250847][ T804] usb 9-1: USB disconnect, device number 7 [ 811.470838][T16504] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3974'. [ 811.471209][T16504] x_tables: ip_tables: udp match: only valid for protocol 17 [ 811.534806][T16508] overlayfs: missing 'lowerdir' [ 818.739448][T16630] Illegal XDP return value 4294967274 on prog (id 177) dev N/A, expect packet loss! [ 818.956569][T16641] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4039'. [ 821.260918][T16705] Invalid source name [ 832.203179][T16837] batadv_slave_1: entered promiscuous mode [ 833.647362][T16874] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 841.542012][T10726] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 841.717175][T10726] usb 5-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 841.717207][T10726] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.717228][T10726] usb 5-1: Product: syz [ 841.717243][T10726] usb 5-1: Manufacturer: syz [ 841.717258][T10726] usb 5-1: SerialNumber: syz [ 841.766522][T10726] usb 5-1: config 0 descriptor?? [ 842.221778][T10726] mos7840 5-1:0.0: required endpoints missing [ 842.252311][T10726] usb 5-1: USB disconnect, device number 6 [ 844.007242][T17080] dummy0: entered promiscuous mode [ 844.007550][T17080] macsec1: entered promiscuous mode [ 844.007829][T17080] macsec1: entered allmulticast mode [ 844.007844][T17080] dummy0: entered allmulticast mode [ 845.721386][ T5907] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 845.749788][ T5907] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 846.135269][T17166] fido_id[17166]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 846.591600][T14250] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 846.761656][T14250] usb 5-1: Using ep0 maxpacket: 8 [ 846.763792][T14250] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 846.763846][T14250] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 846.763873][T14250] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 846.763894][T14250] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 846.763934][T14250] usb 5-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 846.763956][T14250] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.766072][T17205] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4297'. [ 846.792279][T14250] usb 5-1: config 0 descriptor?? [ 847.286816][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.286864][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.286890][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.286916][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.286941][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.286965][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.286992][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.287017][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.287042][T14250] redragon 0003:0C45:760B.0009: unknown main item tag 0x0 [ 847.328002][T14250] redragon 0003:0C45:760B.0009: hidraw0: USB HID v0.04 Device [HID 0c45:760b] on usb-dummy_hcd.4-1/input0 [ 849.081188][ T5907] usb 5-1: USB disconnect, device number 7 [ 849.094866][ T5884] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 849.153989][T17230] fido_id[17230]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 849.243575][ T5884] usb 9-1: Using ep0 maxpacket: 16 [ 849.245990][ T5884] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 849.246756][ T5884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 849.246774][ T5884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 849.246786][ T5884] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 849.246799][ T5884] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 849.249573][ T5884] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 849.249603][ T5884] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 849.249623][ T5884] usb 9-1: Manufacturer: syz [ 849.354100][ T5884] usb 9-1: config 0 descriptor?? [ 849.753329][ T5884] rc_core: IR keymap rc-hauppauge not found [ 849.753352][ T5884] Registered IR keymap rc-empty [ 849.753990][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.771819][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.808586][ T5884] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 849.833547][ T5884] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input11 [ 849.871857][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.893102][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.911737][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.931914][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.953835][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.971833][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 849.995418][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 850.012396][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 850.031819][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 850.052114][ T5884] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 850.172368][ T5884] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 850.172395][ T5884] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 850.209036][ T5884] usb 9-1: USB disconnect, device number 8 [ 850.502910][T17274] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4329'. [ 850.502958][T17274] netlink: 288 bytes leftover after parsing attributes in process `syz.4.4329'. [ 853.413371][ T804] IPVS: starting estimator thread 0... [ 853.501759][T17339] IPVS: using max 7 ests per chain, 16800 per kthread [ 853.612923][T17344] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4363'. [ 853.751941][T17354] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4366'. [ 854.833083][T17386] tmpfs: Too few inodes for current use [ 856.759531][T17457] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4412'. [ 857.049742][T17468] program syz.6.4419 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 857.099138][T10660] hid_parser_main: 124 callbacks suppressed [ 857.099163][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099192][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099217][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099242][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099267][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099291][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099315][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099340][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099363][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.099388][T10660] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 857.128472][T10660] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.43 Device [syz1] on syz1 [ 857.306308][T17473] fido_id[17473]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 857.435042][T17483] comedi comedi3: pcmmio: I/O port conflict (0x4f28,32) [ 857.608781][T17489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4427'. [ 857.612278][T17489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4427'. [ 859.836463][T17523] option changes via remount are deprecated (pid=17519 comm=syz.6.4443) [ 859.891026][T17527] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4445'. [ 866.519945][T17640] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4498'. [ 866.519971][T17640] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4498'. [ 866.519996][T17640] netlink: 'syz.8.4498': attribute type 6 has an invalid length. [ 867.786633][T10529] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 867.933391][T17711] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 867.951729][T10529] usb 5-1: Using ep0 maxpacket: 32 [ 867.954061][T10529] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 867.954112][T10529] usb 5-1: New USB device found, idVendor=044e, idProduct=121e, bcdDevice= 0.00 [ 867.954136][T10529] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 867.964219][T10529] usb 5-1: config 0 descriptor?? [ 869.586181][T10529] hid_parser_main: 73 callbacks suppressed [ 869.586209][T10529] hid-alps 0003:044E:121E.000B: unknown main item tag 0x0 [ 869.586239][T10529] hid-alps 0003:044E:121E.000B: unknown main item tag 0x0 [ 869.586265][T10529] hid-alps 0003:044E:121E.000B: unknown main item tag 0x0 [ 869.586291][T10529] hid-alps 0003:044E:121E.000B: unknown main item tag 0x0 [ 869.586316][T10529] hid-alps 0003:044E:121E.000B: unknown main item tag 0x0 [ 869.595848][T10529] hid-alps 0003:044E:121E.000B: hidraw0: USB HID v0.95 Device [HID 044e:121e] on usb-dummy_hcd.4-1/input0 [ 869.782434][ T5884] usb 5-1: USB disconnect, device number 8 [ 869.827881][T17731] fido_id[17731]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 870.343742][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.355013][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 872.154923][T17778] macvlan0: entered promiscuous mode [ 873.115763][T17819] program syz.6.4582 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 873.782039][T17850] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4596'. [ 878.266078][T17983] hpfs: Bad magic ... probably not HPFS [ 878.289486][T17983] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 878.749943][ T37] audit: type=1326 audit(1768144843.146:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18002 comm="syz.8.4671" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f92facbf749 code=0x0 [ 880.372960][T18054] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4685'. [ 880.692851][T18063] netlink: 28 bytes leftover after parsing attributes in process `syz.8.4694'. [ 882.221964][T18088] netlink: 16 bytes leftover after parsing attributes in process `syz.8.4706'. [ 882.222033][T18088] tipc: Enabling of bearer rejected, failed to enable media [ 883.155798][T18128] Bluetooth: MGMT ver 1.23 [ 884.422095][T18184] netlink: 'syz.4.4754': attribute type 10 has an invalid length. [ 884.485251][T18184] batman_adv: batadv0: Adding interface: team0 [ 884.485271][T18184] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 884.485303][T18184] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 884.516011][T18190] netlink: 'syz.4.4754': attribute type 10 has an invalid length. [ 884.516033][T18190] netlink: 2 bytes leftover after parsing attributes in process `syz.4.4754'. [ 884.516279][T18190] team0: entered promiscuous mode [ 884.516296][T18190] team_slave_0: entered promiscuous mode [ 884.516525][T18190] team_slave_1: entered promiscuous mode [ 884.564701][T18190] 8021q: adding VLAN 0 to HW filter on device team0 [ 884.571049][T18190] batman_adv: batadv0: Interface activated: team0 [ 884.571092][T18190] batman_adv: batadv0: Interface deactivated: team0 [ 884.571108][T18190] batman_adv: batadv0: Removing interface: team0 [ 884.603266][T18190] bridge0: port 3(team0) entered blocking state [ 884.603568][T18190] bridge0: port 3(team0) entered disabled state [ 884.603773][T18190] team0: entered allmulticast mode [ 884.603790][T18190] team_slave_0: entered allmulticast mode [ 884.603810][T18190] team_slave_1: entered allmulticast mode [ 884.608063][T18190] bridge0: port 3(team0) entered blocking state [ 884.608232][T18190] bridge0: port 3(team0) entered forwarding state [ 885.562168][T10726] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 885.721861][ T5938] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 885.754276][T10726] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 885.754312][T10726] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 885.754351][T10726] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 885.754375][T10726] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.760357][T10726] usb 5-1: config 0 descriptor?? [ 885.916666][ T5938] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 885.916781][ T5938] usb 9-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 885.916806][ T5938] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.046680][ T5938] usb 9-1: config 0 descriptor?? [ 886.272689][T10726] keytouch 0003:0926:3333.000C: fixing up Keytouch IEC report descriptor [ 886.471164][T10726] input: HID 0926:3333 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0926:3333.000C/input/input12 [ 886.506519][ T5938] hid (null): invalid report_count 50514 [ 886.558143][ T5938] hid-alps 0003:044E:1215.000D: invalid report_count 50514 [ 886.558171][ T5938] hid-alps 0003:044E:1215.000D: item 0 2 1 9 parsing failed [ 886.559054][ T5938] hid-alps 0003:044E:1215.000D: parse failed [ 886.559173][ T5938] hid-alps 0003:044E:1215.000D: probe with driver hid-alps failed with error -22 [ 886.697654][ T5938] usb 9-1: USB disconnect, device number 9 [ 887.017994][T10726] keytouch 0003:0926:3333.000C: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.4-1/input0 [ 887.030793][T10726] usb 5-1: USB disconnect, device number 9 [ 887.190644][T18285] fido_id[18285]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 892.454191][T10567] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 892.601636][T10567] usb 9-1: Using ep0 maxpacket: 32 [ 892.604729][T10567] usb 9-1: config 0 has an invalid interface number: 76 but max is 0 [ 892.604758][T10567] usb 9-1: config 0 has no interface number 0 [ 892.635840][T10567] usb 9-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 892.635873][T10567] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.635894][T10567] usb 9-1: Product: syz [ 892.635909][T10567] usb 9-1: Manufacturer: syz [ 892.635922][T10567] usb 9-1: SerialNumber: syz [ 892.685367][T10567] usb 9-1: config 0 descriptor?? [ 892.702216][T10567] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 892.702274][T10567] dw2102: su3000_power_ctrl: 1, initialized 0 [ 892.702957][T10567] dvb-usb: bulk message failed: -22 (2/0) [ 892.757676][T10567] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 892.773100][T10567] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 892.773172][T10567] usb 9-1: media controller created [ 892.773915][T10567] dvb-usb: bulk message failed: -22 (6/0) [ 892.773944][T10567] dw2102: i2c transfer failed. [ 892.773966][T10567] dvb-usb: bulk message failed: -22 (6/0) [ 892.773980][T10567] dw2102: i2c transfer failed. [ 892.773999][T10567] dvb-usb: bulk message failed: -22 (6/0) [ 892.774012][T10567] dw2102: i2c transfer failed. [ 892.774031][T10567] dvb-usb: bulk message failed: -22 (6/0) [ 892.774044][T10567] dw2102: i2c transfer failed. [ 892.774062][T10567] dvb-usb: bulk message failed: -22 (6/0) [ 892.774076][T10567] dw2102: i2c transfer failed. [ 892.774094][T10567] dvb-usb: bulk message failed: -22 (6/0) [ 892.774108][T10567] dw2102: i2c transfer failed. [ 892.774118][T10567] dvb-usb: MAC address: 02:02:02:02:02:02 [ 892.882854][T10567] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 892.902240][T11241] Bluetooth: hci4: command 0x0406 tx timeout [ 892.922361][T18412] dvb-usb: bulk message failed: -22 (3/0) [ 892.922383][T18412] dw2102: i2c transfer failed. [ 892.922394][T18412] dvb-usb: bulk message failed: -22 (4/0) [ 892.922407][T18412] dw2102: i2c transfer failed. [ 892.930623][T10567] dvb-usb: bulk message failed: -22 (3/0) [ 892.930646][T10567] dw2102: command 0x0e transfer failed. [ 892.930656][T10567] dvb-usb: bulk message failed: -22 (3/0) [ 892.930671][T10567] dw2102: command 0x0e transfer failed. [ 893.231906][T10567] dvb-usb: bulk message failed: -22 (3/0) [ 893.231932][T10567] dw2102: command 0x0e transfer failed. [ 893.231942][T10567] dvb-usb: bulk message failed: -22 (3/0) [ 893.231956][T10567] dw2102: command 0x0e transfer failed. [ 893.231966][T10567] dvb-usb: bulk message failed: -22 (1/0) [ 893.231979][T10567] dw2102: command 0x51 transfer failed. [ 893.440238][T10567] DVB: Unable to find symbol ds3000_attach() [ 893.440257][T10567] dvb-usb: no frontend was attached by 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' [ 894.718290][T10567] rc_core: IR keymap rc-su3000 not found [ 894.718313][T10567] Registered IR keymap rc-empty [ 894.752549][T10567] rc rc0: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.8/usb9/9-1/rc/rc0 [ 894.756062][T10567] input: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.8/usb9/9-1/rc/rc0/input13 [ 894.794742][T10567] dvb-usb: schedule remote query interval to 150 msecs. [ 894.794767][T10567] dw2102: su3000_power_ctrl: 0, initialized 1 [ 894.794782][T10567] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 successfully initialized and connected. [ 894.825932][T10567] usb 9-1: USB disconnect, device number 10 [ 896.386925][T10567] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2. successfully deinitialized and disconnected. [ 897.297023][T18543] gretap0: entered promiscuous mode [ 897.297287][T18543] vlan2: entered promiscuous mode [ 900.528166][T18609] netlink: 'syz.8.4950': attribute type 1 has an invalid length. [ 901.331953][T18639] sg_write: data in/out 1768/10 bytes for SCSI command 0xfe-- guessing data in; [ 901.331953][T18639] program syz.8.4965 not setting count and/or reply_len properly [ 905.274890][T14250] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 905.421753][T14250] usb 5-1: Using ep0 maxpacket: 16 [ 905.430082][T14250] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 905.430136][T14250] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 905.430160][T14250] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 905.484235][T14250] usb 5-1: config 0 descriptor?? [ 905.927240][T14250] mcp2221 0003:04D8:00DD.000E: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 906.001756][T18845] program syz.8.5065 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 906.403883][T14250] usb 5-1: USB disconnect, device number 10 [ 907.581720][ T5808] Bluetooth: hci2: unexpected cc 0x042d length: 1 < 7 [ 907.581754][ T5808] Bluetooth: hci2: unexpected event for opcode 0x042d [ 914.273772][ T6526] kernel write not supported for file /snd/seq (pid: 6526 comm: kworker/1:9) [ 914.565758][T19111] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5190'. [ 914.580767][T19111] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5190'. [ 915.383393][T19151] Bluetooth: MGMT ver 1.23 [ 916.596515][ T5939] kernel read not supported for file /binder/transaction_log (pid: 5939 comm: kworker/1:7) [ 918.976069][T19294] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5278'. [ 919.631678][ T5885] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 919.784235][ T5885] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 919.784267][ T5885] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 919.784287][ T5885] usb 5-1: config 220 contains an unexpected descriptor of type 0x1, skipping [ 919.784306][ T5885] usb 5-1: config 220 has an invalid descriptor of length 1, skipping remainder of the config [ 919.784326][ T5885] usb 5-1: config 220 has no interface number 2 [ 919.784416][ T5885] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 919.784444][ T5885] usb 5-1: config 220 interface 0 has no altsetting 0 [ 919.784471][ T5885] usb 5-1: config 220 interface 76 has no altsetting 0 [ 919.784490][ T5885] usb 5-1: config 220 interface 1 has no altsetting 0 [ 919.789314][ T5885] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 919.789347][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.789367][ T5885] usb 5-1: Product: syz [ 919.789381][ T5885] usb 5-1: Manufacturer: syz [ 919.789396][ T5885] usb 5-1: SerialNumber: syz [ 920.235982][ T5885] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 920.236021][ T5885] uvcvideo 5-1:220.0: No valid video chain found. [ 920.236090][ T5885] usb 5-1: selecting invalid altsetting 0 [ 920.356894][ T5885] usb 5-1: selecting invalid altsetting 0 [ 920.356938][ T5885] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 920.388344][ T5885] usb 5-1: USB disconnect, device number 11 [ 920.516495][T19339] bond1 (unregistering): Released all slaves [ 920.847194][T19362] netlink: 'syz.4.5311': attribute type 11 has an invalid length. [ 921.517735][T19391] pimreg: entered allmulticast mode [ 921.543773][T19391] pimreg: left allmulticast mode [ 921.721406][T19394] IPVS: Unknown mcast interface: pim6reg [ 922.093291][T19416] netlink: 40 bytes leftover after parsing attributes in process `syz.8.5338'. [ 922.321967][T19427] netlink: 277 bytes leftover after parsing attributes in process `syz.8.5343'. [ 922.745282][ T5885] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 922.900647][ T5885] usb 9-1: Using ep0 maxpacket: 32 [ 922.906259][ T5885] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 922.925805][ T5885] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 922.925835][ T5885] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 922.925854][ T5885] usb 9-1: Product: syz [ 922.925868][ T5885] usb 9-1: Manufacturer: syz [ 922.925881][ T5885] usb 9-1: SerialNumber: syz [ 922.970261][ T5885] usb 9-1: config 0 descriptor?? [ 922.971207][T19436] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 922.983887][ T5885] hub 9-1:0.0: bad descriptor, ignoring hub [ 922.983931][ T5885] hub 9-1:0.0: probe with driver hub failed with error -5 [ 923.721678][ T5885] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 923.874312][ T5885] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 923.874342][ T5885] usb 5-1: config 0 has no interface number 0 [ 923.907666][ T5885] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 923.907699][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.907718][ T5885] usb 5-1: Product: syz [ 923.907732][ T5885] usb 5-1: Manufacturer: syz [ 923.907746][ T5885] usb 5-1: SerialNumber: syz [ 923.950095][ T5885] usb 5-1: config 0 descriptor?? [ 924.185361][ T5885] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 924.225333][ T5885] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 924.225768][ T5885] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 924.225823][ T5885] usb 5-1: media controller created [ 924.276059][ T5885] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 925.380289][ T5885] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 925.465088][ T5885] usb 5-1: USB disconnect, device number 12 [ 926.464299][T19599] batadv0: entered promiscuous mode [ 926.466297][T19599] bond0: entered promiscuous mode [ 926.466317][T19599] bond_slave_0: entered promiscuous mode [ 926.466568][T19599] bond_slave_1: entered promiscuous mode [ 926.502176][T19599] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 926.616783][ T6526] usb 9-1: USB disconnect, device number 11 [ 926.793601][T19616] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5436'. [ 926.793628][T19616] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5436'. [ 926.795908][T19616] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5436'. [ 926.795929][T19616] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5436'. [ 927.163858][ T5885] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 927.315777][ T5885] usb 9-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 927.315830][ T5885] usb 9-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 927.315856][ T5885] usb 9-1: config 4 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 927.315884][ T5885] usb 9-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 927.315928][ T5885] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 927.315952][ T5885] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.628670][ T5885] ath6kl: Failed to submit usb control message: -71 [ 927.628706][ T5885] ath6kl: unable to send the bmi data to the device: -71 [ 927.628715][ T5885] ath6kl: Unable to send get target info: -71 [ 927.658871][ T5885] ath6kl: Failed to init ath6kl core: -71 [ 927.660801][ T5885] ath6kl_usb 9-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 927.702678][ T5885] usb 9-1: USB disconnect, device number 12 [ 930.148566][T19765] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5509'. [ 930.186085][T19765] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5509'. [ 931.792351][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.792429][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 934.194791][ T37] audit: type=1107 audit(1768144898.546:48): pid=19937 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='s' [ 934.351605][ T43] usb 9-1: new full-speed USB device number 13 using dummy_hcd [ 934.506104][ T43] usb 9-1: config 0 has an invalid interface number: 251 but max is 0 [ 934.506135][ T43] usb 9-1: config 0 has no interface number 0 [ 934.510208][ T43] usb 9-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 934.510239][ T43] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.510259][ T43] usb 9-1: Product: syz [ 934.510274][ T43] usb 9-1: Manufacturer: syz [ 934.510289][ T43] usb 9-1: SerialNumber: syz [ 934.523173][ T43] usb 9-1: config 0 descriptor?? [ 935.003625][T19969] netlink: 56 bytes leftover after parsing attributes in process `syz.6.5607'. [ 935.227614][ T43] asix 9-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 935.227965][ T43] asix 9-1:0.251: probe with driver asix failed with error -524 [ 935.439817][ T7156] usb 9-1: USB disconnect, device number 13 [ 938.421655][ T6502] usb 9-1: new full-speed USB device number 14 using dummy_hcd [ 938.574411][ T6502] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 938.574441][ T6502] usb 9-1: config 0 has no interface number 0 [ 938.574496][ T6502] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 938.574524][ T6502] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 938.574565][ T6502] usb 9-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 938.574589][ T6502] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.624047][ T6502] usb 9-1: config 0 descriptor?? [ 939.186203][T10970] wlan1: BSS 50:50:50:50:50:50 switches to unsupported channel (0 MHz), disconnecting [ 939.208373][T20142] sock: sock_timestamping_bind_phc: sock not bind to device [ 939.242873][ T6502] uclogic 0003:28BD:0094.000F: pen parameters not found [ 939.242901][ T6502] uclogic 0003:28BD:0094.000F: interface is invalid, ignoring [ 939.312138][T10970] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 939.312160][T10970] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 939.442254][ T6502] usb 9-1: USB disconnect, device number 14 [ 939.621921][ T5885] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 939.771586][ T5885] usb 5-1: Using ep0 maxpacket: 32 [ 939.774531][ T5885] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 939.774575][ T5885] usb 5-1: config 0 interface 0 has no altsetting 0 [ 939.774611][ T5885] usb 5-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 939.774636][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.825166][ T5885] usb 5-1: config 0 descriptor?? [ 940.295296][ T5885] steelseries 0003:1038:12B6.0010: hidraw0: USB HID v0.00 Device [HID 1038:12b6] on usb-dummy_hcd.4-1/input0 [ 940.765264][ T6502] usb 5-1: USB disconnect, device number 13 [ 941.487446][T20234] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5738'. [ 941.487479][T20234] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5738'. [ 942.293606][T20270] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5755'. [ 943.313871][T20314] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5777'. [ 943.350123][T20314] bond0: entered promiscuous mode [ 943.350149][T20314] bond_slave_0: entered promiscuous mode [ 943.350411][T20314] bond_slave_1: entered promiscuous mode [ 943.402584][T20314] bond0: left promiscuous mode [ 943.402609][T20314] bond_slave_0: left promiscuous mode [ 943.402862][T20314] bond_slave_1: left promiscuous mode [ 943.855997][T20305] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 943.856178][T20305] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 943.993378][T20305] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 943.993538][T20305] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 944.068613][T20305] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 944.069890][T20305] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 944.181304][T20305] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 944.201991][T20305] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 944.644162][ T5885] kernel write not supported for file bpf-map (pid: 5885 comm: kworker/0:7) [ 945.532905][ T5808] Bluetooth: hci3: command 0x0406 tx timeout [ 946.295997][ T5808] Bluetooth: hci2: command 0x0406 tx timeout [ 946.296044][ T5808] Bluetooth: hci0: command 0x0419 tx timeout [ 946.296073][ T5808] Bluetooth: hci4: command 0x0406 tx timeout [ 947.501289][T20441] bpf: Bad value for 'uid' [ 947.613482][T11241] Bluetooth: hci3: command 0x0406 tx timeout [ 948.332139][T11241] Bluetooth: hci4: command 0x0406 tx timeout [ 948.332178][T11241] Bluetooth: hci0: command 0x0419 tx timeout [ 948.332203][T11241] Bluetooth: hci2: command 0x0406 tx timeout [ 948.332828][T20477] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5855'. [ 948.519820][T20487] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5860'. [ 948.634348][T20490] tun0: tun_chr_ioctl cmd 1074025680 [ 949.054924][T20510] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5869'. [ 949.054962][T20510] netlink: 16 bytes leftover after parsing attributes in process `syz.8.5869'. [ 949.201185][T20518] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5874'. [ 949.216372][T20518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5874'. [ 949.216390][T20518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5874'. [ 951.276515][T20604] program syz.8.5917 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 951.586434][T20621] program syz.6.5925 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 952.159084][T20646] netlink: 'syz.4.5935': attribute type 2 has an invalid length. [ 953.709622][T20697] netlink: 'syz.6.5958': attribute type 1 has an invalid length. [ 953.709648][T20697] netlink: 'syz.6.5958': attribute type 1 has an invalid length. [ 953.709682][T20697] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 955.001751][ T43] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 955.153542][ T43] usb 5-1: config 0 has no interfaces? [ 955.155543][ T43] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 955.155572][ T43] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 955.155592][ T43] usb 5-1: Product: syz [ 955.155607][ T43] usb 5-1: Manufacturer: syz [ 955.168838][ T43] usb 5-1: config 0 descriptor?? [ 955.394285][ T7156] usb 5-1: USB disconnect, device number 14 [ 958.492050][ T7156] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 958.558229][T20905] nbd0: detected capacity change from 0 to 127 [ 958.583609][ T5808] block nbd0: Receive control failed (result -32) [ 958.641697][ T7156] usb 5-1: Using ep0 maxpacket: 8 [ 958.648205][ T7156] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 958.648238][ T7156] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.678843][ T7156] pvrusb2: Hardware description: Terratec Grabster AV400 [ 958.678860][ T7156] pvrusb2: ********** [ 958.678866][ T7156] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 958.678878][ T7156] pvrusb2: Important functionality might not be entirely working. [ 958.678886][ T7156] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 958.678896][ T7156] pvrusb2: ********** [ 958.917967][ T2368] pvrusb2: Invalid write control endpoint [ 959.105563][ T2368] pvrusb2: Invalid write control endpoint [ 959.105583][ T2368] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 959.105593][ T2368] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 959.105602][ T2368] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 959.105613][ T2368] pvrusb2: Device being rendered inoperable [ 959.160048][ T2368] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 959.160156][ T2368] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 959.160415][ T7156] usb 5-1: USB disconnect, device number 15 [ 959.200495][ T2368] pvrusb2: Attached sub-driver cx25840 [ 959.200512][ T2368] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 959.200525][ T2368] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 961.443241][T20987] program syz.4.6096 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 963.701556][ T43] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 963.864490][ T43] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 963.864531][ T43] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 963.864574][ T43] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 963.864598][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 963.912092][T21083] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 963.921090][ T43] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 964.189465][T10912] usb 9-1: USB disconnect, device number 15 [ 965.527739][T21163] sp0: Synchronizing with TNC [ 966.810299][T21228] use of bytesused == 0 is deprecated and will be removed in the future, [ 966.810317][T21228] use the actual size instead. [ 968.264293][T21299] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6247'. [ 968.541692][ T5884] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 968.691597][ T5884] usb 9-1: Using ep0 maxpacket: 16 [ 968.694344][ T5884] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 968.694379][ T5884] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 968.694403][ T5884] usb 9-1: config 0 interface 0 has no altsetting 0 [ 968.694438][ T5884] usb 9-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 968.694463][ T5884] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.699586][ T5884] usb 9-1: config 0 descriptor?? [ 969.165029][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165066][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165091][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165115][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165138][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165164][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165188][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165212][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165237][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.165263][ T5884] cougar 0003:060B:500A.0011: unknown main item tag 0x0 [ 969.169788][ T5884] cougar 0003:060B:500A.0011: unexpected long global item [ 969.170736][ T5884] cougar 0003:060B:500A.0011: parse failed [ 969.170853][ T5884] cougar 0003:060B:500A.0011: probe with driver cougar failed with error -22 [ 969.340674][ T5884] usb 9-1: USB disconnect, device number 16 [ 969.497513][T21360] program syz.4.6276 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 970.140061][T21394] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6294'. [ 970.603210][T21418] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6305'. [ 971.198665][T21448] vcan0: tx address claim with dlc 0 [ 972.944483][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 973.431977][T10912] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 973.581580][T10912] usb 5-1: Using ep0 maxpacket: 32 [ 973.584114][T10912] usb 5-1: config 0 has an invalid interface number: 151 but max is 0 [ 973.584143][T10912] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 973.584164][T10912] usb 5-1: config 0 has no interface number 0 [ 973.584211][T10912] usb 5-1: config 0 interface 151 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 973.587615][T10912] usb 5-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 973.587641][T10912] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.587660][T10912] usb 5-1: Product: syz [ 973.587674][T10912] usb 5-1: Manufacturer: syz [ 973.587688][T10912] usb 5-1: SerialNumber: syz [ 973.600066][T10912] usb 5-1: config 0 descriptor?? [ 973.763359][T21560] netlink: 12 bytes leftover after parsing attributes in process `syz.8.6373'. [ 976.232654][ T5939] usb 5-1: USB disconnect, device number 16 [ 977.924018][T21677] tap0: tun_chr_ioctl cmd 1074025676 [ 977.924043][T21677] tap0: owner set to 0 [ 978.387535][T21702] macvlan0: left promiscuous mode [ 978.446835][T21702] netlink: 'syz.6.6440': attribute type 1 has an invalid length. [ 978.446861][T21702] netlink: 'syz.6.6440': attribute type 2 has an invalid length. [ 978.596664][T21714] netlink: 8 bytes leftover after parsing attributes in process `syz.8.6449'. [ 978.696192][T21717] program syz.6.6448 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 978.943270][T21731] loop8: detected capacity change from 0 to 8 [ 978.978211][T21731] Dev loop8: unable to read RDB block 8 [ 978.978260][T21731] loop8: unable to read partition table [ 978.978521][T21731] loop8: partition table beyond EOD, truncated [ 978.978542][T21731] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 979.082349][T21735] Invalid source name [ 982.602025][T21871] veth0: entered promiscuous mode [ 982.609355][T21871] veth0: left promiscuous mode [ 982.819887][ T5808] Bluetooth: hci2: unexpected event for opcode 0x2009 [ 982.824319][T21881] ALSA: mixer_oss: invalid OSS volume '' [ 983.384348][T21909] netlink: 'syz.6.6542': attribute type 8 has an invalid length. [ 983.841714][T10660] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 983.914264][T10724] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 984.001609][T10660] usb 9-1: Using ep0 maxpacket: 8 [ 984.012008][T10660] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 984.012076][T10660] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 984.012109][T10660] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 984.012134][T10660] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 984.012156][T10660] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 984.012204][T10660] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 984.012226][T10660] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.073636][T10724] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 984.073664][T10724] usb 5-1: config 0 has no interface number 0 [ 984.073709][T10724] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 984.073732][T10724] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 984.073769][T10724] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 984.073789][T10724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.080414][T10724] usb 5-1: config 0 descriptor?? [ 984.368434][T10660] usb 9-1: usb_control_msg returned -32 [ 984.368489][T10660] usbtmc 9-1:16.0: can't read capabilities [ 984.477306][T21947] tun0: tun_chr_ioctl cmd 1074025675 [ 984.477339][T21947] tun0: persist enabled [ 984.478210][T21947] tun0: tun_chr_ioctl cmd 1074025675 [ 984.478229][T21947] tun0: persist enabled [ 984.573595][T10724] prodikeys 0003:041E:2801.0012: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.4-1/input1 [ 984.574945][T10724] hid_prodikeys: hid-prodikeys: failed to find output report [ 984.574945][T10724] [ 984.726233][T10724] usb 5-1: USB disconnect, device number 17 [ 984.777161][T21963] vxcan1: entered allmulticast mode [ 984.777645][T21963] vxcan1: left allmulticast mode [ 985.585690][T21999] netlink: 'syz.4.6585': attribute type 1 has an invalid length. [ 986.637477][T22041] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6607'. [ 986.663093][T10724] usb 9-1: USB disconnect, device number 17 [ 986.914486][T22056] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 986.914509][T22056] IPv6: NLM_F_CREATE should be set when creating new route [ 987.862944][T22087] block nbd4: not configured, cannot reconfigure [ 989.195774][ T5884] kernel write not supported for file bpf-prog (pid: 5884 comm: kworker/0:6) [ 990.271597][ T7156] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 990.694945][ T7156] usb 9-1: Using ep0 maxpacket: 8 [ 990.721167][ T7156] usb 9-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 990.721200][ T7156] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 990.721220][ T7156] usb 9-1: Product: syz [ 990.721236][ T7156] usb 9-1: Manufacturer: syz [ 990.721250][ T7156] usb 9-1: SerialNumber: syz [ 990.726537][ T7156] usb 9-1: config 0 descriptor?? [ 991.468460][ T7156] gspca_main: sq930x-2.14.0 probing 2770:930c [ 992.575100][ T7156] gspca_sq930x: reg_w 0105 0f00 failed -71 [ 992.575216][ T7156] sq930x 9-1:0.0: probe with driver sq930x failed with error -71 [ 992.583530][ T7156] usb 9-1: USB disconnect, device number 18 [ 993.157265][ T5884] kernel write not supported for file bpf-map (pid: 5884 comm: kworker/0:6) [ 993.239586][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.239688][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.441631][ T5884] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 994.597962][ T5884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 994.598000][ T5884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 994.623284][ T5884] usb 9-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 8.00 [ 994.623316][ T5884] usb 9-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 994.623337][ T5884] usb 9-1: Product: syz [ 994.657277][ T5884] usb 9-1: config 0 descriptor?? [ 995.109004][ T5884] hid_parser_main: 449 callbacks suppressed [ 995.109041][ T5884] cm6533_jd 0003:0D8C:0022.0013: unknown main item tag 0x0 [ 995.109173][ T5884] cm6533_jd 0003:0D8C:0022.0013: unknown main item tag 0x0 [ 995.151978][ T5884] input: syz as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:0D8C:0022.0013/input/input15 [ 995.195511][ T5884] cm6533_jd 0003:0D8C:0022.0013: input,hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 995.392051][T10660] usb 9-1: USB disconnect, device number 19 [ 995.659529][T22316] vcan0: tx drop: invalid sa for name 0xfffffffffffffffe [ 996.656364][T22355] netlink: 'syz.8.6753': attribute type 4 has an invalid length. [ 996.716223][T22355] netlink: 'syz.8.6753': attribute type 4 has an invalid length. [ 997.041558][T10660] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 997.201632][T10660] usb 9-1: Using ep0 maxpacket: 8 [ 997.205294][T10660] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 997.205359][T10660] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 997.205383][T10660] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 997.205408][T10660] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 997.205433][T10660] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 997.205479][T10660] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 997.205503][T10660] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 997.422748][T10660] usb 9-1: usb_control_msg returned -32 [ 997.422804][T10660] usbtmc 9-1:16.0: can't read capabilities [ 999.854468][ T5885] usb 9-1: USB disconnect, device number 20 [ 1000.291661][ T5885] usb 9-1: new low-speed USB device number 21 using dummy_hcd [ 1000.444072][ T5885] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1000.444104][ T5885] usb 9-1: config 0 has no interface number 0 [ 1000.444155][ T5885] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1000.444183][ T5885] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1000.444235][ T5885] usb 9-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1000.444259][ T5885] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1000.449918][ T5885] usb 9-1: config 0 descriptor?? [ 1000.450918][T22481] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1000.481576][T10660] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 1000.538083][ T5885] iowarrior 9-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1000.641619][T10660] usb 5-1: Using ep0 maxpacket: 8 [ 1000.644251][T10660] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1000.644282][T10660] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1000.702455][ T7156] usb 9-1: USB disconnect, device number 21 [ 1000.708207][T10660] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1000.708226][T10660] pvrusb2: ********** [ 1000.708233][T10660] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1000.708245][T10660] pvrusb2: Important functionality might not be entirely working. [ 1000.708255][T10660] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1000.708266][T10660] pvrusb2: ********** [ 1000.939264][ T2368] pvrusb2: Invalid write control endpoint [ 1001.030913][ T2368] pvrusb2: Invalid write control endpoint [ 1001.030929][ T2368] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1001.030939][ T2368] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1001.030947][ T2368] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1001.030958][ T2368] pvrusb2: Device being rendered inoperable [ 1001.031031][ T2368] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1001.031087][ T2368] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1001.090417][ T2368] pvrusb2: Attached sub-driver cx25840 [ 1001.090435][ T2368] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1001.090446][ T2368] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1001.155129][T22499] pvrusb2: Attempted to execute control transfer when device not ok [ 1001.157965][ T43] usb 5-1: USB disconnect, device number 18 [ 1001.357116][T22545] ieee802154 phy0 wpan0: encryption failed: -22 [ 1001.605106][T22557] can0: slcan on ptm0. [ 1001.791546][ T43] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1001.797565][T22557] can0 (unregistered): slcan off ptm0. [ 1001.812135][T22557] Falling back ldisc for ptm0. [ 1001.942968][ T43] usb 9-1: Using ep0 maxpacket: 32 [ 1001.948408][ T43] usb 9-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1001.948439][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.956745][ T43] usb 9-1: config 0 descriptor?? [ 1001.967741][ T43] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1003.195989][ T43] gspca_vc032x: reg_w err -71 [ 1003.196017][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196028][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196038][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196047][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196056][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196065][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196074][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196083][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196093][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196102][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196111][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196120][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196129][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196138][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196147][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196156][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196165][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196174][ T43] gspca_vc032x: I2c Bus Busy Wait 00 [ 1003.196280][ T43] gspca_vc032x: Unknown sensor... [ 1003.196383][ T43] vc032x 9-1:0.0: probe with driver vc032x failed with error -22 [ 1003.229239][ T43] usb 9-1: USB disconnect, device number 22 [ 1004.587189][ T7156] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 1004.774187][ T7156] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1004.774218][ T7156] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1004.777926][ T7156] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1004.777956][ T7156] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.777976][ T7156] usb 5-1: Product: syz [ 1004.777992][ T7156] usb 5-1: Manufacturer: syz [ 1004.778005][ T7156] usb 5-1: SerialNumber: syz [ 1004.874508][ T5884] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 1005.043033][ T5884] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1005.043081][ T5884] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1005.047491][ T5884] usb 9-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 1005.047520][ T5884] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.047539][ T5884] usb 9-1: Product: syz [ 1005.047553][ T5884] usb 9-1: Manufacturer: syz [ 1005.047568][ T5884] usb 9-1: SerialNumber: syz [ 1005.077778][ T5884] usb 9-1: config 0 descriptor?? [ 1005.108196][ T7156] usb 5-1: 0:2 : does not exist [ 1005.124590][ T7156] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 1005.171372][ T5884] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1005.186399][ T7156] usb 5-1: USB disconnect, device number 19 [ 1005.260934][ T5884] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1005.269489][ T5884] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 1005.269551][ T5884] usb 9-1: media controller created [ 1005.409175][ T5884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1005.763057][ T5884] DVB: Unable to find symbol tda10046_attach() [ 1005.763076][ T5884] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 1005.763091][ T5884] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 1006.407039][ T5884] dvb_usb_m920x 9-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 1006.426677][ T5884] usb 9-1: USB disconnect, device number 23 [ 1008.166129][T22721] usb usb8: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1011.148933][T10660] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1011.780450][T10660] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.081206][T22864] kvm: kvm [22862]: vcpu128, guest rIP: 0xfff0 Unhandled RDMSR(0x40000076) [ 1014.581984][T10660] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1014.748572][T10660] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1014.748607][T10660] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.748627][T10660] usb 5-1: Product: syz [ 1014.748642][T10660] usb 5-1: Manufacturer: syz [ 1014.748657][T10660] usb 5-1: SerialNumber: syz [ 1015.203564][T10660] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1015.203639][T10660] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1015.829970][T10660] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 1015.830041][T10660] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1015.842326][T10660] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1015.898284][T10660] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 1015.954061][T10660] usb 5-1: USB disconnect, device number 20 [ 1017.533515][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1017.606306][T23093] 9p: Invalid uid '0x00000000ffffffff' [ 1018.081670][ T5884] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1018.231598][ T5884] usb 5-1: Using ep0 maxpacket: 16 [ 1018.234010][ T5884] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 1018.234038][ T5884] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1018.234057][ T5884] usb 5-1: config 0 has no interface number 0 [ 1018.236581][ T5884] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1018.236609][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.236630][ T5884] usb 5-1: Product: syz [ 1018.236644][ T5884] usb 5-1: Manufacturer: syz [ 1018.236659][ T5884] usb 5-1: SerialNumber: syz [ 1018.257057][ T5884] usb 5-1: config 0 descriptor?? [ 1018.316436][ T5884] uvcvideo 5-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 1018.316473][ T5884] uvcvideo 5-1:0.105: No valid video chain found. [ 1018.413751][T23134] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.7123'. [ 1018.486950][ T5884] usb 5-1: USB disconnect, device number 21 [ 1018.819512][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.476211][T23270] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.477035][T23270] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.477709][T23270] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.478491][T23270] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.478945][T23270] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.545649][T23272] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.655929][T23268] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1021.656899][T23268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1023.111605][ T5885] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1023.261599][ T5885] usb 9-1: Using ep0 maxpacket: 16 [ 1023.263838][ T5885] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1023.263869][ T5885] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1023.267998][ T5885] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1023.268028][ T5885] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.268048][ T5885] usb 9-1: Product: syz [ 1023.268062][ T5885] usb 9-1: Manufacturer: syz [ 1023.268076][ T5885] usb 9-1: SerialNumber: syz [ 1023.336124][ T5885] usb 9-1: config 0 descriptor?? [ 1023.351751][ T5885] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1023.351801][ T5885] em28xx 9-1:0.0: Audio interface 0 found (Vendor Class) [ 1023.972504][ T5885] em28xx 9-1:0.0: unknown em28xx chip ID (0) [ 1023.973406][ T5885] em28xx 9-1:0.0: Config register raw data: 0xfffffffb [ 1024.174820][ T5885] em28xx 9-1:0.0: AC97 chip type couldn't be determined [ 1024.174845][ T5885] em28xx 9-1:0.0: No AC97 audio processor [ 1024.214343][ T5885] usb 9-1: USB disconnect, device number 24 [ 1024.219677][ T5885] em28xx 9-1:0.0: Disconnecting em28xx [ 1024.248713][ T5885] em28xx 9-1:0.0: Freeing device [ 1024.362060][T23401] netlink: 96 bytes leftover after parsing attributes in process `syz.6.7250'. [ 1026.357050][T23484] netlink: 8 bytes leftover after parsing attributes in process `syz.8.7290'. [ 1026.537784][T23495] CUSE: unknown device info "" [ 1026.537803][T23495] CUSE: unknown device info "@" [ 1026.537811][T23495] CUSE: unknown device info "" [ 1026.537819][T23495] CUSE: DEVNAME unspecified [ 1027.133378][T10912] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1028.678224][T23585] netlink: 12 bytes leftover after parsing attributes in process `syz.6.7337'. [ 1028.713874][T10987] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1028.714158][T10987] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1028.714203][T10987] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1028.714238][T10987] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1028.714464][T23585] netlink: 12 bytes leftover after parsing attributes in process `syz.6.7337'. [ 1029.582388][T10987] Bluetooth: hci1: Frame reassembly failed (-84) [ 1030.111277][ T43] kernel write not supported for file bpf-prog (pid: 43 comm: kworker/1:1) [ 1031.612114][ T5808] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 1035.883957][T23877] trusted_key: syz.4.7473 sent an empty control message without MSG_MORE. [ 1036.224109][T10912] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 1036.374479][T10912] usb 5-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1036.374516][T10912] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1036.374544][T10912] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1036.374589][T10912] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1036.374613][T10912] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1036.445426][T23883] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1038.382097][T10912] aiptek 5-1:17.0: Aiptek using 400 ms programming speed [ 1038.386571][T10912] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:17.0/input/input16 [ 1038.487474][T10912] usb 5-1: USB disconnect, device number 22 [ 1038.487564][ C0] aiptek 5-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1039.354152][T23999] netlink: 96 bytes leftover after parsing attributes in process `syz.6.7531'. [ 1042.942068][T24188] usb usb8: usbfs: interface 0 claimed by hub while 'syz.6.7620' sets config #0 [ 1043.510752][T24209] IPv4: Oversized IP packet from 127.202.26.0 [ 1048.991634][T10660] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1049.151567][T10660] usb 5-1: Using ep0 maxpacket: 32 [ 1049.153998][T10660] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1049.154028][T10660] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1049.159694][T10660] usb 5-1: config 0 descriptor?? [ 1049.233513][T10660] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1050.822058][T10660] gspca_vc032x: reg_w err -71 [ 1050.822079][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822357][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822368][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822377][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822385][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822394][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822403][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822412][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822421][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822429][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822437][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822445][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822454][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822463][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822471][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822480][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822488][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822497][T10660] gspca_vc032x: I2c Bus Busy Wait 00 [ 1050.822506][T10660] gspca_vc032x: Unknown sensor... [ 1050.822606][T10660] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 1050.828684][T10660] usb 5-1: USB disconnect, device number 23 [ 1054.668572][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.668648][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 1056.951666][T10912] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 1057.294039][T10912] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1057.294079][T10912] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1057.294121][T10912] usb 9-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1057.294146][T10912] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1057.366574][T10912] usb 9-1: config 0 descriptor?? [ 1058.870879][T10912] usbhid 9-1:0.0: can't add hid device: -32 [ 1058.871020][T10912] usbhid 9-1:0.0: probe with driver usbhid failed with error -32 [ 1058.904736][T10912] usb 9-1: USB disconnect, device number 25 [ 1062.187415][T24916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1065.883410][T10912] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1066.031561][T10912] usb 5-1: Using ep0 maxpacket: 32 [ 1066.034360][T10912] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1066.034395][T10912] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1066.034436][T10912] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1066.034460][T10912] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1066.040123][T10912] usb 5-1: config 0 descriptor?? [ 1066.517095][T10912] ft260 0003:0403:6030.0014: unknown main item tag 0x0 [ 1066.517133][T10912] ft260 0003:0403:6030.0014: unknown main item tag 0x0 [ 1066.623607][T25056] netlink: 'syz.8.8027': attribute type 16 has an invalid length. [ 1066.623625][T25056] netlink: 'syz.8.8027': attribute type 17 has an invalid length. [ 1066.710684][T10912] ft260 0003:0403:6030.0014: chip code: 6424 8183 [ 1066.811624][T25056] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1066.911217][T10912] ft260 0003:0403:6030.0014: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 1067.112690][T10912] ft260 0003:0403:6030.0014: failed to retrieve status: -32, no wakeup [ 1067.326955][T10912] usb 5-1: USB disconnect, device number 24 [ 1069.050696][T25159] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8074'. [ 1070.953723][T25197] l2tp_ppp: sess 2/0: no socket in recv [ 1071.261906][T10660] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1071.415879][T10660] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1071.415916][T10660] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1071.417171][T10660] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1071.417199][T10660] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1071.417219][T10660] usb 5-1: Manufacturer: syz [ 1071.483442][T10660] usb 5-1: config 0 descriptor?? [ 1071.897536][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.897573][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.897598][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.897623][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.897648][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.897673][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.897698][T10660] pyra 0003:1E7D:2CF6.0015: unknown main item tag 0x0 [ 1071.904431][T10660] pyra 0003:1E7D:2CF6.0015: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 1073.098609][T10660] pyra 0003:1E7D:2CF6.0015: couldn't init struct pyra_device [ 1073.098670][T10660] pyra 0003:1E7D:2CF6.0015: couldn't install mouse [ 1073.108722][T10660] pyra 0003:1E7D:2CF6.0015: probe with driver pyra failed with error -71 [ 1073.126285][T10660] usb 5-1: USB disconnect, device number 25 [ 1080.776544][T25413] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1080.776578][T25413] overlayfs: failed to set xattr on upper [ 1080.776586][T25413] overlayfs: ...falling back to redirect_dir=nofollow. [ 1080.776594][T25413] overlayfs: ...falling back to index=off. [ 1080.776602][T25413] overlayfs: ...falling back to uuid=null. [ 1080.776656][T25413] overlayfs: conflicting lowerdir path [ 1083.809638][ T5884] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 1083.961533][ T5884] usb 9-1: Using ep0 maxpacket: 32 [ 1083.967007][ T5884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1083.967042][ T5884] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1083.967083][ T5884] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1083.967107][ T5884] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1084.017507][ T5884] usb 9-1: config 0 descriptor?? [ 1084.061543][ T5885] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1084.211622][ T5885] usb 5-1: Using ep0 maxpacket: 32 [ 1084.292358][ T5885] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1084.292389][ T5885] usb 5-1: config 0 has no interface number 0 [ 1084.292702][ T5885] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1084.330886][ T5885] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1084.331144][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.331167][ T5885] usb 5-1: Product: syz [ 1084.331182][ T5885] usb 5-1: Manufacturer: syz [ 1084.331197][ T5885] usb 5-1: SerialNumber: syz [ 1084.392073][ T5885] usb 5-1: config 0 descriptor?? [ 1084.413978][ T5885] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1084.414017][ T5885] em28xx 5-1:0.89: Video interface 89 found: bulk [ 1084.524932][ T5884] savu 0003:1E7D:2D5A.0016: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.8-1/input0 [ 1085.042603][ T5885] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 1085.130877][ T37] audit: type=1326 audit(1768145049.516:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25513 comm="syz.6.8233" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4353d2f749 code=0x0 [ 1085.242324][T10660] usb 9-1: USB disconnect, device number 26 [ 1086.071619][ T5885] em28xx 5-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1086.071653][ T5885] em28xx 5-1:0.89: board has no eeprom [ 1086.141697][ T5885] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 1086.141729][ T5885] em28xx 5-1:0.89: analog set to bulk mode. [ 1086.142178][T10724] em28xx 5-1:0.89: Registering V4L2 extension [ 1086.171574][ T5885] usb 5-1: USB disconnect, device number 26 [ 1086.174092][ T5885] em28xx 5-1:0.89: Disconnecting em28xx [ 1086.251717][T10724] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 1086.251745][T10724] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 1086.251759][T10724] em28xx 5-1:0.89: No AC97 audio processor [ 1086.288047][T10724] usb 5-1: Decoder not found [ 1086.288068][T10724] em28xx 5-1:0.89: failed to create media graph [ 1086.288100][T10724] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 1086.290233][T10724] em28xx 5-1:0.89: Registering snapshot button... [ 1086.323124][T10724] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input17 [ 1086.325443][T10724] em28xx 5-1:0.89: Remote control support is not available for this card. [ 1086.325504][ T5885] em28xx 5-1:0.89: Closing input extension [ 1086.325527][ T5885] em28xx 5-1:0.89: Deregistering snapshot button [ 1086.517080][ T5885] em28xx 5-1:0.89: Freeing device [ 1087.852214][T25599] loop2: detected capacity change from 0 to 7 [ 1087.865752][T25599] Dev loop2: unable to read RDB block 7 [ 1087.865783][T25599] loop2: unable to read partition table [ 1087.865912][T25599] loop2: partition table beyond EOD, truncated [ 1087.865924][T25599] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1089.924312][ T5884] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 1090.088274][ T5884] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1090.088309][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.088330][ T5884] usb 5-1: Product: syz [ 1090.088345][ T5884] usb 5-1: Manufacturer: syz [ 1090.088359][ T5884] usb 5-1: SerialNumber: syz [ 1090.126651][ T5884] usb 5-1: config 0 descriptor?? [ 1090.147232][ T5884] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1092.261730][ T5939] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 1092.416542][ T5939] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1092.417883][ T5939] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1092.417910][ T5939] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1092.438746][ T5939] usb 9-1: config 0 descriptor?? [ 1092.447995][ T5939] pwc: Askey VC010 type 2 USB webcam detected. [ 1092.460795][ T5884] gspca_stk1135: reg_w 0x2ff err -71 [ 1092.461836][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.461851][ T5884] gspca_stk1135: Sensor write failed [ 1092.461880][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.461889][ T5884] gspca_stk1135: Sensor write failed [ 1092.461918][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.461927][ T5884] gspca_stk1135: Sensor read failed [ 1092.461944][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.461950][ T5884] gspca_stk1135: Sensor read failed [ 1092.461954][ T5884] gspca_stk1135: Detected sensor type unknown (0x0) [ 1092.461976][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.461985][ T5884] gspca_stk1135: Sensor read failed [ 1092.462014][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.462024][ T5884] gspca_stk1135: Sensor read failed [ 1092.462052][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.462061][ T5884] gspca_stk1135: Sensor write failed [ 1092.462089][ T5884] gspca_stk1135: serial bus timeout: status=0x00 [ 1092.462098][ T5884] gspca_stk1135: Sensor write failed [ 1092.462161][ T5884] stk1135 5-1:0.0: probe with driver stk1135 failed with error -71 [ 1092.580511][ T5884] usb 5-1: USB disconnect, device number 27 [ 1092.851213][ T5939] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1092.856937][ T5939] pwc: recv_control_msg error -32 req 02 val 2700 [ 1092.857664][ T5939] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1092.861625][ T5939] pwc: recv_control_msg error -32 req 04 val 1000 [ 1092.869914][ T5939] pwc: recv_control_msg error -32 req 04 val 1300 [ 1092.874084][ T5939] pwc: recv_control_msg error -32 req 04 val 1400 [ 1092.874812][ T5939] pwc: recv_control_msg error -32 req 02 val 2000 [ 1093.076351][ T5939] pwc: recv_control_msg error -71 req 04 val 1500 [ 1093.076917][ T5939] pwc: recv_control_msg error -71 req 02 val 2500 [ 1093.079327][ T5939] pwc: recv_control_msg error -71 req 02 val 2400 [ 1093.079849][ T5939] pwc: recv_control_msg error -71 req 02 val 2600 [ 1093.080396][ T5939] pwc: recv_control_msg error -71 req 02 val 2900 [ 1093.080936][ T5939] pwc: recv_control_msg error -71 req 02 val 2800 [ 1093.123345][ T5939] pwc: recv_control_msg error -71 req 04 val 1100 [ 1093.130437][ T5939] pwc: recv_control_msg error -71 req 04 val 1200 [ 1093.161029][ T5939] pwc: Registered as video103. [ 1093.202851][ T5939] input: PWC snapshot button as /devices/platform/dummy_hcd.8/usb9/9-1/input/input18 [ 1093.232868][ T5939] usb 9-1: USB disconnect, device number 27 [ 1093.249305][T25730] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8329'. [ 1095.374299][T25763] IPv6: addrconf: prefix option has invalid lifetime [ 1098.832334][T25850] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8381'. [ 1099.668006][ T37] audit: type=1804 audit(1768145064.066:50): pid=25886 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.8393" name="/newroot/607/file0" dev="tmpfs" ino=3150 res=1 errno=0 [ 1104.350692][T25987] bridge0: entered promiscuous mode [ 1104.350818][T25987] vlan2: entered promiscuous mode [ 1106.446221][T26019] netlink: 24 bytes leftover after parsing attributes in process `syz.8.8453'. [ 1109.172228][ T37] audit: type=1804 audit(1768145073.546:51): pid=26058 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.8470" name="/newroot/616/file0" dev="tmpfs" ino=3197 res=1 errno=0 [ 1112.704131][T26130] netlink: 'syz.8.8501': attribute type 9 has an invalid length. [ 1112.704156][T26130] netlink: 'syz.8.8501': attribute type 11 has an invalid length. [ 1112.704170][T26130] netlink: 'syz.8.8501': attribute type 12 has an invalid length. [ 1112.704188][T26130] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.8501'. [ 1112.704347][T26130] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8501'. [ 1115.870251][T26175] kvm: pic: non byte write [ 1115.870353][T26175] kvm: pic: non byte write [ 1115.870563][T26175] kvm: pic: non byte write [ 1115.870643][T26175] kvm: pic: non byte write [ 1116.103284][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.103363][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.401152][T26191] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1139.558623][T26509] Context (ID=0x1) not attached to queue pair (handle=0x2:0x40) [ 1160.220081][T26730] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1165.821836][ T5939] usb 9-1: new full-speed USB device number 28 using dummy_hcd [ 1167.037164][ T5939] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1167.037503][ T5939] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1167.038609][ T5939] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1167.039255][ T5939] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1168.159777][ T5939] usb 9-1: can't set config #16, error -71 [ 1168.175537][ T5939] usb 9-1: USB disconnect, device number 28 [ 1178.126699][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 1178.126785][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 1181.493485][T20479] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1181.513624][T20479] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1181.517453][T20479] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1181.522508][T20479] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1181.523370][T20479] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1183.804645][T20479] Bluetooth: hci1: command tx timeout [ 1185.529328][T26881] chnl_net:caif_netlink_parms(): no params data found [ 1185.863594][T20479] Bluetooth: hci1: command tx timeout [ 1187.487233][T26924] netlink: 176 bytes leftover after parsing attributes in process `syz.4.8810'. [ 1187.635190][T20479] Bluetooth: hci0: unexpected event for opcode 0x3262 [ 1187.931944][T20479] Bluetooth: hci1: command tx timeout [ 1190.011595][T20479] Bluetooth: hci1: command tx timeout [ 1190.082847][T26881] bridge0: port 1(bridge_slave_0) entered blocking state [ 1190.087626][T26881] bridge0: port 1(bridge_slave_0) entered disabled state [ 1190.087878][T26881] bridge_slave_0: entered allmulticast mode [ 1190.090998][T26881] bridge_slave_0: entered promiscuous mode [ 1190.107623][T26881] bridge0: port 2(bridge_slave_1) entered blocking state [ 1190.108252][T26881] bridge0: port 2(bridge_slave_1) entered disabled state [ 1190.108449][T26881] bridge_slave_1: entered allmulticast mode [ 1190.282325][T26881] bridge_slave_1: entered promiscuous mode [ 1190.993263][T26881] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1191.100045][T26881] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1191.492834][T26881] team0: Port device team_slave_0 added [ 1191.517629][T26881] team0: Port device team_slave_1 added [ 1191.887689][T26881] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1191.887709][T26881] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1191.887738][T26881] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1192.132590][T26881] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1192.132639][T26881] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1192.132752][T26881] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1197.812984][T26881] hsr_slave_0: entered promiscuous mode [ 1198.462861][T26881] hsr_slave_1: entered promiscuous mode [ 1198.463931][T26881] debugfs: 'hsr0' already exists in 'hsr' [ 1198.463957][T26881] Cannot create hsr debugfs directory [ 1201.437260][ T37] audit: type=1800 audit(1768145165.786:52): pid=27071 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.8871" name="bus" dev="ramfs" ino=87524 res=0 errno=0 [ 1203.349884][T20479] Bluetooth: hci0: unexpected event for opcode 0x0405 [ 1207.796880][T26881] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1207.882915][T26881] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1207.987605][T26881] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1208.107780][T26881] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1208.645021][T26881] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1208.733216][T26881] 8021q: adding VLAN 0 to HW filter on device team0 [ 1208.815122][T10550] bridge0: port 1(bridge_slave_0) entered blocking state [ 1208.815368][T10550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1208.929433][T10550] bridge0: port 2(bridge_slave_1) entered blocking state [ 1208.937656][T10550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1213.751281][T26881] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1213.751860][T27274] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8952'. [ 1214.006270][T26881] veth0_vlan: entered promiscuous mode [ 1214.073753][T26881] veth1_vlan: entered promiscuous mode [ 1214.273667][T26881] veth0_macvtap: entered promiscuous mode [ 1214.368907][T26881] veth1_macvtap: entered promiscuous mode [ 1214.405278][T27287] syz.4.8957 (27287) used greatest stack depth: 16064 bytes left [ 1214.437089][T26881] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1214.497311][T26881] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1214.532611][T16782] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.532966][T16782] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.533008][T16782] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.533045][T16782] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1218.014693][T10985] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1218.014719][T10985] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1220.068296][T10982] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1220.068319][T10982] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1222.924455][T27384] netlink: 'syz.2.8996': attribute type 10 has an invalid length. [ 1223.219711][T27384] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1226.079454][T27424] sp0: Synchronizing with TNC [ 1226.698728][T27418] [U] è [ 1235.157766][ T9] kworker/0:0 (9) used greatest stack depth: 15768 bytes left [ 1235.317879][ T37] audit: type=1326 audit(2000000002.690:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.318210][ T37] audit: type=1326 audit(2000000002.690:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.319071][ T37] audit: type=1326 audit(2000000002.690:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.319698][ T37] audit: type=1326 audit(2000000002.690:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.321830][ T37] audit: type=1326 audit(2000000002.690:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.322731][ T37] audit: type=1326 audit(2000000002.700:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.323033][ T37] audit: type=1326 audit(2000000002.700:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.323985][ T37] audit: type=1326 audit(2000000002.700:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.324035][ T37] audit: type=1326 audit(2000000002.700:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1235.324080][ T37] audit: type=1326 audit(2000000002.700:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=27475 comm="syz.2.9029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00c7cdf749 code=0x7ffc0000 [ 1239.516878][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 1239.516951][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 1244.652672][ T5885] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1244.676093][T14250] libceph: connect (1)[c::]:6789 error -22 [ 1244.676350][T14250] libceph: mon0 (1)[c::]:6789 connect error [ 1244.676468][T27535] ceph: No mds server is up or the cluster is laggy [ 1244.679821][T14250] libceph: connect (1)[c::]:6789 error -22 [ 1244.680053][T14250] libceph: mon0 (1)[c::]:6789 connect error [ 1244.814067][ T5885] usb 5-1: config 64 has an invalid interface number: 146 but max is 0 [ 1244.814098][ T5885] usb 5-1: config 64 has no interface number 0 [ 1244.814133][ T5885] usb 5-1: config 64 interface 146 has no altsetting 0 [ 1244.818975][ T5885] usb 5-1: New USB device found, idVendor=05d1, idProduct=7001, bcdDevice=53.43 [ 1244.819008][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1244.819029][ T5885] usb 5-1: Product: syz [ 1244.819043][ T5885] usb 5-1: Manufacturer: syz [ 1244.819057][ T5885] usb 5-1: SerialNumber: syz [ 1245.264732][T27533] bond_slave_0: entered promiscuous mode [ 1245.268668][T27533] bond_slave_1: entered promiscuous mode [ 1245.711826][ T5885] ftdi_sio 5-1:64.146: FTDI USB Serial Device converter detected [ 1245.713727][ T5885] ftdi_sio ttyUSB0: unknown device type: 0x5343 [ 1245.717182][ T5885] usb 5-1: USB disconnect, device number 28 [ 1245.719709][ T5885] ftdi_sio 5-1:64.146: device disconnected [ 1247.721562][ T43] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 1247.843185][T27575] random: crng reseeded on system resumption [ 1247.905212][ T43] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1247.905396][ T43] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1247.905422][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1248.746452][ T43] usb 9-1: config 0 descriptor?? [ 1248.757694][ T43] pwc: Askey VC010 type 2 USB webcam detected. [ 1249.319390][ T43] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1249.320370][ T43] pwc: recv_control_msg error -32 req 02 val 2700 [ 1249.321112][ T43] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1249.338128][ T43] pwc: recv_control_msg error -32 req 04 val 1000 [ 1249.338873][ T43] pwc: recv_control_msg error -32 req 04 val 1300 [ 1249.649055][ C1] wlan1: beacon TX faster than countdown (channel/color switch) completion [ 1249.843924][ T43] pwc: recv_control_msg error -32 req 04 val 1400 [ 1249.844847][ T43] pwc: recv_control_msg error -32 req 02 val 2000 [ 1249.845755][ T43] pwc: recv_control_msg error -32 req 02 val 2100 [ 1249.846617][ T43] pwc: recv_control_msg error -32 req 04 val 1500 [ 1249.847488][ T43] pwc: recv_control_msg error -32 req 02 val 2500 [ 1249.868127][ T43] pwc: recv_control_msg error -32 req 02 val 2400 [ 1249.869330][ T43] pwc: recv_control_msg error -32 req 02 val 2600 [ 1249.872615][ T43] pwc: recv_control_msg error -32 req 02 val 2900 [ 1249.879800][ T43] pwc: recv_control_msg error -32 req 02 val 2800 [ 1249.881529][ T43] pwc: recv_control_msg error -32 req 04 val 1100 [ 1249.956914][ T43] pwc: Registered as video103. [ 1249.960652][ T43] input: PWC snapshot button as /devices/platform/dummy_hcd.8/usb9/9-1/input/input19 [ 1250.321873][ T43] usb 9-1: USB disconnect, device number 29 [ 1257.605028][T27680] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9094'. [ 1260.759259][T27692] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1260.759400][T27692] CIFS mount error: No usable UNC path provided in device string! [ 1260.759400][T27692] [ 1260.759686][T27692] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1262.427864][T27718] gfs2: gfs2 mount does not exist [ 1279.713477][T20479] ================================================================== [ 1279.713498][T20479] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.713651][T20479] Read of size 8 at addr ffff888035600500 by task kworker/u9:1/20479 [ 1279.713671][T20479] [ 1279.713687][T20479] CPU: 0 UID: 0 PID: 20479 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1279.713717][T20479] Tainted: [L]=SOFTLOCKUP [ 1279.713726][T20479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1279.713741][T20479] Workqueue: hci0 hci_rx_work [ 1279.713787][T20479] Call Trace: [ 1279.713797][T20479] [ 1279.713806][T20479] dump_stack_lvl+0xe8/0x150 [ 1279.713864][T20479] print_report+0xca/0x240 [ 1279.713896][T20479] ? l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.713925][T20479] kasan_report+0x118/0x150 [ 1279.713989][T20479] ? l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.714023][T20479] l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.714056][T20479] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 1279.714084][T20479] ? lockdep_hardirqs_on+0x7b/0x110 [ 1279.714163][T20479] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1279.714227][T20479] ? mutex_lock_nested+0x154/0x1d0 [ 1279.714255][T20479] ? hci_connect_cfm+0x2c/0x140 [ 1279.714299][T20479] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 1279.714328][T20479] hci_connect_cfm+0x95/0x140 [ 1279.714354][T20479] le_conn_complete_evt+0xf65/0x1420 [ 1279.714403][T20479] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1279.714430][T20479] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1279.714452][T20479] ? lockdep_hardirqs_on+0x7b/0x110 [ 1279.714475][T20479] ? skb_pull_data+0xfb/0x200 [ 1279.714593][T20479] hci_le_conn_complete_evt+0x187/0x480 [ 1279.714624][T20479] hci_event_packet+0x78f/0x1260 [ 1279.714646][T20479] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1279.714672][T20479] ? __pfx_hci_event_packet+0x10/0x10 [ 1279.714692][T20479] ? preempt_schedule_common+0x83/0xd0 [ 1279.714712][T20479] ? preempt_schedule_thunk+0x16/0x30 [ 1279.714738][T20479] ? hci_send_to_monitor+0xe2/0x590 [ 1279.714788][T20479] hci_rx_work+0x3ee/0x1060 [ 1279.714810][T20479] ? preempt_schedule_thunk+0x16/0x30 [ 1279.714833][T20479] ? process_scheduled_works+0x9ef/0x1770 [ 1279.714873][T20479] process_scheduled_works+0xad1/0x1770 [ 1279.714911][T20479] ? __pfx_process_scheduled_works+0x10/0x10 [ 1279.714933][T20479] ? do_raw_spin_lock+0x121/0x290 [ 1279.714966][T20479] worker_thread+0x8a0/0xda0 [ 1279.714998][T20479] ? __kthread_parkme+0x7b/0x200 [ 1279.715028][T20479] kthread+0x711/0x8a0 [ 1279.715058][T20479] ? __pfx_worker_thread+0x10/0x10 [ 1279.715082][T20479] ? __pfx_kthread+0x10/0x10 [ 1279.715109][T20479] ? rt_spin_unlock+0x150/0x200 [ 1279.715139][T20479] ? rt_spin_unlock+0x161/0x200 [ 1279.715174][T20479] ? __pfx_kthread+0x10/0x10 [ 1279.715203][T20479] ret_from_fork+0x510/0xa50 [ 1279.715240][T20479] ? __pfx_ret_from_fork+0x10/0x10 [ 1279.715261][T20479] ? __switch_to+0xc9e/0x1480 [ 1279.715294][T20479] ? __pfx_kthread+0x10/0x10 [ 1279.715322][T20479] ret_from_fork_asm+0x1a/0x30 [ 1279.715361][T20479] [ 1279.715369][T20479] [ 1279.715374][T20479] Allocated by task 20479: [ 1279.715385][T20479] kasan_save_track+0x3e/0x80 [ 1279.715409][T20479] __kasan_kmalloc+0x93/0xb0 [ 1279.715435][T20479] __kmalloc_cache_noprof+0x1fb/0x6d0 [ 1279.715476][T20479] l2cap_chan_create+0x51/0x7a0 [ 1279.715505][T20479] l2cap_sock_new_connection_cb+0x182/0x2e0 [ 1279.715536][T20479] l2cap_connect_cfm+0x367/0x10e0 [ 1279.715561][T20479] hci_connect_cfm+0x95/0x140 [ 1279.715582][T20479] le_conn_complete_evt+0xf65/0x1420 [ 1279.715606][T20479] hci_le_conn_complete_evt+0x187/0x480 [ 1279.715628][T20479] hci_event_packet+0x78f/0x1260 [ 1279.715646][T20479] hci_rx_work+0x3ee/0x1060 [ 1279.715662][T20479] process_scheduled_works+0xad1/0x1770 [ 1279.715682][T20479] worker_thread+0x8a0/0xda0 [ 1279.715703][T20479] kthread+0x711/0x8a0 [ 1279.715728][T20479] ret_from_fork+0x510/0xa50 [ 1279.715747][T20479] ret_from_fork_asm+0x1a/0x30 [ 1279.715776][T20479] [ 1279.715780][T20479] Freed by task 27884: [ 1279.715790][T20479] kasan_save_track+0x3e/0x80 [ 1279.715815][T20479] kasan_save_free_info+0x46/0x50 [ 1279.715837][T20479] __kasan_slab_free+0x5c/0x80 [ 1279.715863][T20479] kfree+0x1bd/0x900 [ 1279.715885][T20479] l2cap_sock_cleanup_listen+0xf0/0x450 [ 1279.715914][T20479] l2cap_sock_release+0x6e/0x270 [ 1279.715939][T20479] sock_close+0xc3/0x240 [ 1279.716010][T20479] __fput+0x45b/0xa80 [ 1279.716037][T20479] task_work_run+0x1d4/0x260 [ 1279.716065][T20479] exit_to_user_mode_loop+0xef/0x4e0 [ 1279.716092][T20479] do_syscall_64+0x2c1/0xf80 [ 1279.716131][T20479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1279.716180][T20479] [ 1279.716185][T20479] The buggy address belongs to the object at ffff888035600000 [ 1279.716185][T20479] which belongs to the cache kmalloc-2k of size 2048 [ 1279.716205][T20479] The buggy address is located 1280 bytes inside of [ 1279.716205][T20479] freed 2048-byte region [ffff888035600000, ffff888035600800) [ 1279.716227][T20479] [ 1279.716232][T20479] The buggy address belongs to the physical page: [ 1279.716243][T20479] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35600 [ 1279.716265][T20479] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1279.716282][T20479] flags: 0x80000000000040(head|node=0|zone=1) [ 1279.716300][T20479] page_type: f5(slab) [ 1279.716319][T20479] raw: 0080000000000040 ffff88813ff27000 dead000000000100 dead000000000122 [ 1279.716338][T20479] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 1279.716357][T20479] head: 0080000000000040 ffff88813ff27000 dead000000000100 dead000000000122 [ 1279.716375][T20479] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 1279.716393][T20479] head: 0080000000000003 ffffea0000d58001 00000000ffffffff 00000000ffffffff [ 1279.716409][T20479] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 1279.716421][T20479] page dumped because: kasan: bad access detected [ 1279.716431][T20479] page_owner tracks the page as allocated [ 1279.716439][T20479] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3697, tgid 3697 (kworker/u8:15), ts 1212038721327, free_ts 1211920271159 [ 1279.716477][T20479] post_alloc_hook+0x234/0x290 [ 1279.716504][T20479] get_page_from_freelist+0x28c0/0x2960 [ 1279.716523][T20479] __alloc_frozen_pages_noprof+0x181/0x370 [ 1279.716542][T20479] alloc_pages_mpol+0xd1/0x380 [ 1279.716558][T20479] allocate_slab+0x86/0x3b0 [ 1279.716579][T20479] ___slab_alloc+0xb10/0x13e0 [ 1279.716598][T20479] __slab_alloc+0xc6/0x1f0 [ 1279.716615][T20479] __kmalloc_node_track_caller_noprof+0x2bf/0x810 [ 1279.716644][T20479] kmalloc_reserve+0x136/0x290 [ 1279.716665][T20479] __alloc_skb+0x204/0x3a0 [ 1279.716684][T20479] mld_newpack+0x13c/0xc40 [ 1279.716748][T20479] add_grhead+0x5a/0x2a0 [ 1279.716765][T20479] add_grec+0x1452/0x1740 [ 1279.716780][T20479] mld_send_initial_cr+0x288/0x550 [ 1279.716828][T20479] ipv6_mc_dad_complete+0x88/0x410 [ 1279.716856][T20479] addrconf_dad_completed+0x58d/0xd70 [ 1279.716906][T20479] page last free pid 5804 tgid 5804 stack trace: [ 1279.716918][T20479] __free_frozen_pages+0xfe1/0x1170 [ 1279.716946][T20479] __slab_free+0x2e6/0x330 [ 1279.716967][T20479] qlist_free_all+0x97/0x100 [ 1279.716992][T20479] kasan_quarantine_reduce+0x148/0x160 [ 1279.717017][T20479] __kasan_slab_alloc+0x22/0x80 [ 1279.717044][T20479] kmem_cache_alloc_noprof+0x18d/0x6c0 [ 1279.717069][T20479] getname_flags+0xb8/0x540 [ 1279.717087][T20479] user_path_at+0x24/0x60 [ 1279.717109][T20479] __x64_sys_umount+0xee/0x160 [ 1279.717152][T20479] do_syscall_64+0xec/0xf80 [ 1279.717170][T20479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1279.717189][T20479] [ 1279.717194][T20479] Memory state around the buggy address: [ 1279.717206][T20479] ffff888035600400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1279.717220][T20479] ffff888035600480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1279.717234][T20479] >ffff888035600500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1279.717245][T20479] ^ [ 1279.717256][T20479] ffff888035600580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1279.717269][T20479] ffff888035600600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1279.717280][T20479] ================================================================== [ 1279.717293][T20479] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1279.717312][T20479] CPU: 0 UID: 0 PID: 20479 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1279.717341][T20479] Tainted: [L]=SOFTLOCKUP [ 1279.717349][T20479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1279.717363][T20479] Workqueue: hci0 hci_rx_work [ 1279.717383][T20479] Call Trace: [ 1279.717391][T20479] [ 1279.717399][T20479] vpanic+0x1e0/0x670 [ 1279.717430][T20479] panic+0xb9/0xc0 [ 1279.717458][T20479] ? __pfx_panic+0x10/0x10 [ 1279.717487][T20479] ? l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.717516][T20479] ? rcu_is_watching+0x15/0xb0 [ 1279.717539][T20479] ? l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.717567][T20479] check_panic_on_warn+0x89/0xb0 [ 1279.717608][T20479] ? l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.717636][T20479] end_report+0x6f/0x140 [ 1279.717666][T20479] kasan_report+0x129/0x150 [ 1279.717698][T20479] ? l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.717730][T20479] l2cap_connect_cfm+0x6d0/0x10e0 [ 1279.717763][T20479] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 1279.717791][T20479] ? lockdep_hardirqs_on+0x7b/0x110 [ 1279.717812][T20479] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1279.717834][T20479] ? mutex_lock_nested+0x154/0x1d0 [ 1279.717860][T20479] ? hci_connect_cfm+0x2c/0x140 [ 1279.717884][T20479] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 1279.717913][T20479] hci_connect_cfm+0x95/0x140 [ 1279.717938][T20479] le_conn_complete_evt+0xf65/0x1420 [ 1279.717970][T20479] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1279.717997][T20479] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1279.718019][T20479] ? lockdep_hardirqs_on+0x7b/0x110 [ 1279.718041][T20479] ? skb_pull_data+0xfb/0x200 [ 1279.718073][T20479] hci_le_conn_complete_evt+0x187/0x480 [ 1279.718102][T20479] hci_event_packet+0x78f/0x1260 [ 1279.718124][T20479] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1279.718158][T20479] ? __pfx_hci_event_packet+0x10/0x10 [ 1279.718177][T20479] ? preempt_schedule_common+0x83/0xd0 [ 1279.718198][T20479] ? preempt_schedule_thunk+0x16/0x30 [ 1279.718222][T20479] ? hci_send_to_monitor+0xe2/0x590 [ 1279.718251][T20479] hci_rx_work+0x3ee/0x1060 [ 1279.718273][T20479] ? preempt_schedule_thunk+0x16/0x30 [ 1279.718296][T20479] ? process_scheduled_works+0x9ef/0x1770 [ 1279.718321][T20479] process_scheduled_works+0xad1/0x1770 [ 1279.718357][T20479] ? __pfx_process_scheduled_works+0x10/0x10 [ 1279.718379][T20479] ? do_raw_spin_lock+0x121/0x290 [ 1279.718409][T20479] worker_thread+0x8a0/0xda0 [ 1279.718440][T20479] ? __kthread_parkme+0x7b/0x200 [ 1279.718470][T20479] kthread+0x711/0x8a0 [ 1279.718499][T20479] ? __pfx_worker_thread+0x10/0x10 [ 1279.718522][T20479] ? __pfx_kthread+0x10/0x10 [ 1279.718549][T20479] ? rt_spin_unlock+0x150/0x200 [ 1279.718579][T20479] ? rt_spin_unlock+0x161/0x200 [ 1279.718605][T20479] ? __pfx_kthread+0x10/0x10 [ 1279.718633][T20479] ret_from_fork+0x510/0xa50 [ 1279.718658][T20479] ? __pfx_ret_from_fork+0x10/0x10 [ 1279.718679][T20479] ? __switch_to+0xc9e/0x1480 [ 1279.718711][T20479] ? __pfx_kthread+0x10/0x10 [ 1279.718739][T20479] ret_from_fork_asm+0x1a/0x30 [ 1279.718778][T20479] [ 1279.719147][T20479] Kernel Offset: disabled