last executing test programs: 3m27.579197453s ago: executing program 1 (id=5): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) writev(0xffffffffffffffff, 0x0, 0x0) request_key(0x0, 0x0, 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x200, 0x48000020, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x1000000, &(0x7f0000000540)={[{@name={'name', 0x3d, 'GPL\x00'}}]}) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920000000109021b1901000000d40904150001da40df000905", @ANYRES32], 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket(0x10, 0x2, 0xd61) socket(0x1, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0xc01, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x4000000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x8804) 3m13.501978224s ago: executing program 1 (id=10): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, 0x0, 0x48850) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) kcmp(r1, r1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_DONE(0xffffffffffffffff, 0x29, 0xc9, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd"], 0xfdef) r5 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), 0xffffffffffffffff) r6 = socket$kcm(0x29, 0x2, 0x0) sendmsg$sock(r6, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000440)='q ', 0x2}], 0x1}, 0x51) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x3, 0x0, @empty, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0), 0x3) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000000)={r2}) getsockopt$bt_hci(r0, 0x11a, 0x5, 0x0, &(0x7f0000000040)) 3m10.062954354s ago: executing program 1 (id=15): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c00000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000340), 0x7ff, r1}, 0x38) 3m7.452153623s ago: executing program 1 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000240)='./file0/../file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$tmpfs(0x0, &(0x7f0000000140)='./file0/file0\x00', &(0x7f00000001c0), 0xc00, 0x0) 3m7.330642926s ago: executing program 1 (id=18): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000740)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000180)="27031c00160014000200", 0xa}, {&(0x7f00000008c0)="7d3ed2ea1f2f210c0784b2ce65c9e34b1100301a03df46a4853ed1b3f1dc15569532315ad340ebe5f1a72c921ee9ba4439", 0x31}, {&(0x7f0000000580)="7d15a3", 0x3}], 0x3}, 0x40000) 3m7.041120934s ago: executing program 1 (id=19): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000180)=0xffffffff) r1 = msgget$private(0x0, 0x400) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xe7b, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101142, 0xeaff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x7) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x4}) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000440)) keyctl$get_persistent(0x16, 0x0, r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r7, 0x1, 0x70bd2d, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x0) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x140400, 0x0) ioctl$FBIOGETCMAP(r8, 0x4604, &(0x7f0000000180)={0x2, 0x1, &(0x7f0000001080)=[0x0], &(0x7f0000000280), 0x0, 0x0}) msgsnd(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="02002e0781780006"], 0x8, 0x800) 3m7.040829744s ago: executing program 32 (id=19): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000180)=0xffffffff) r1 = msgget$private(0x0, 0x400) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xe7b, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101142, 0xeaff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x7) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x4}) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000440)) keyctl$get_persistent(0x16, 0x0, r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r7, 0x1, 0x70bd2d, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x0) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x140400, 0x0) ioctl$FBIOGETCMAP(r8, 0x4604, &(0x7f0000000180)={0x2, 0x1, &(0x7f0000001080)=[0x0], &(0x7f0000000280), 0x0, 0x0}) msgsnd(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="02002e0781780006"], 0x8, 0x800) 1m24.850619954s ago: executing program 2 (id=225): r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_int(r0, 0x1, 0x2b, 0x0, &(0x7f0000000200)) 1m24.663724609s ago: executing program 2 (id=226): renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x8c) 1m24.521539782s ago: executing program 2 (id=227): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/current\x00') preadv(r0, &(0x7f0000000340)=[{0x0}, {&(0x7f00000001c0)=""/238, 0xee}], 0x2, 0x8000, 0x5) 1m24.401824906s ago: executing program 2 (id=228): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b1052, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) lseek(r0, 0x10001, 0x0) 1m24.302122019s ago: executing program 2 (id=229): openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x4, 0x0) 1m23.865932859s ago: executing program 2 (id=230): io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000000)=[@ioring_restriction_register_op], 0x1) r0 = io_uring_setup(0x3a61, &(0x7f0000000580)={0x0, 0x8270, 0x40, 0x3, 0x846}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0) 1m23.86574715s ago: executing program 33 (id=230): io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000000)=[@ioring_restriction_register_op], 0x1) r0 = io_uring_setup(0x3a61, &(0x7f0000000580)={0x0, 0x8270, 0x40, 0x3, 0x846}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0) 5.259612749s ago: executing program 0 (id=459): prctl$PR_SCHED_CORE(0x41, 0x42, 0x0, 0x2, 0x0) 5.142826822s ago: executing program 0 (id=460): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x380246, &(0x7f0000000380)={@align=0xdd43, {0x800, 0x1, 0x0, 0x5}}, 0x2, &(0x7f0000000500)={@_ha_fsid}, &(0x7f00000003c0)=0x80000002}) getpid() socket(0x28, 0x801, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) r6 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)=ANY=[@ANYBLOB="380000000114010000000000000000000900020073797a"], 0x38}, 0x1, 0x0, 0x0, 0x80c9}, 0x20000000) r7 = socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)}, 0x2000c000) r8 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r8, 0x1, 0x2e, 0x0, &(0x7f0000000280)) setsockopt$MRT_ADD_MFC(r5, 0x0, 0xcc, &(0x7f00000001c0)={@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, 0xffffffffffffffff, "05b327e2f7bb237aab9088d364c8e086238e0ef15a73e9ef188f295a237772e6", 0x3, 0xa, 0x7ea, 0x6}, 0x3c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000080a00000a1c000000080a0103000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 1.743164933s ago: executing program 0 (id=461): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x1b, "b0bfac0000000003000018bfff4000"}) r1 = syz_open_pts(r0, 0x200) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000080)=0xa) 719.56563ms ago: executing program 3 (id=464): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x20, 0x0, 0xc, 0xc, 0x2, [@struct]}}, &(0x7f0000000f40)=""/4089, 0x26, 0xff9, 0x1, 0x6}, 0x28) 629.806403ms ago: executing program 3 (id=465): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 511.076646ms ago: executing program 3 (id=466): r0 = syz_io_uring_setup(0xf04, &(0x7f0000000400)={0x0, 0x595f, 0x8, 0x3, 0x10000051}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SEND_ZC={0x2f, 0x0, 0x24, 0xffffffffffffffff, 0x0, 0x0, 0xa0000000, 0x40}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 401.549909ms ago: executing program 3 (id=467): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, 0x0) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000340)={0x8, r3}) ioctl$FIGETBSZ(r0, 0x2, 0x0) 331.908661ms ago: executing program 0 (id=468): r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x800, 0x1, 0x51}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 331.647351ms ago: executing program 3 (id=469): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000022f0414f670bc70e0180c200000286dd3e"], 0x4e) 182.866605ms ago: executing program 0 (id=470): r0 = landlock_create_ruleset(&(0x7f0000000000)={0x3564, 0x5, 0x3}, 0xffffffffffffff52, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0x3) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETQUOTA(r1, 0xffffffff80000701, r2, &(0x7f0000000140)) 158.84µs ago: executing program 3 (id=471): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r4 = fcntl$dupfd(r3, 0x0, r3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000) sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000002c40)=ANY=[], 0x40c}, 0x1, 0x0, 0x0, 0x90}, 0x8000) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000240)=@gcm_128={{0x303}, "b575c2c1c3a227b7", "799298c9493f4cbdfb5868d41337f3a2", "8df69b29", "ae7ebfdf4de38175"}, 0x28) read$FUSE(r4, &(0x7f0000000b80)={0x2020}, 0x2020) bind$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) 0s ago: executing program 0 (id=472): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) r0 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) ioctl$MEMREADOOB64(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x8, &(0x7f0000000000)="fdffffffffffffff"}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:24702' (ED25519) to the list of known hosts. syzkaller login: [ 76.269287][ T3365] cgroup: Unknown subsys name 'net' [ 76.479982][ T3365] cgroup: Unknown subsys name 'cpuset' [ 76.498474][ T3365] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.924798][ T3365] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.796202][ T3370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.806495][ T3372] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.822002][ T3370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.829439][ T3372] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.558502][ T3370] hsr_slave_0: entered promiscuous mode [ 87.562714][ T3370] hsr_slave_1: entered promiscuous mode [ 87.734909][ T3372] hsr_slave_0: entered promiscuous mode [ 87.738308][ T3372] hsr_slave_1: entered promiscuous mode [ 87.743040][ T3372] debugfs: 'hsr0' already exists in 'hsr' [ 87.743627][ T3372] Cannot create hsr debugfs directory [ 88.503214][ T3370] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.533752][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.541378][ T3370] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.559521][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.565057][ T3370] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.582992][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.609161][ T3370] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.628129][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.776199][ T3372] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.793678][ T3372] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.798950][ T3372] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.814405][ T3372] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.827706][ T3372] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.849513][ T3372] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.857163][ T3372] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.877361][ T3372] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.461298][ T3370] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.706755][ T3372] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.900228][ T3370] veth0_vlan: entered promiscuous mode [ 91.960996][ T3370] veth1_vlan: entered promiscuous mode [ 91.990958][ T3372] veth0_vlan: entered promiscuous mode [ 92.046742][ T3372] veth1_vlan: entered promiscuous mode [ 92.111787][ T3370] veth0_macvtap: entered promiscuous mode [ 92.135057][ T3370] veth1_macvtap: entered promiscuous mode [ 92.238763][ T3372] veth0_macvtap: entered promiscuous mode [ 92.277563][ T3372] veth1_macvtap: entered promiscuous mode [ 92.361365][ T1627] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.399605][ T1627] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.400372][ T1627] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.400520][ T1627] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.559344][ T1165] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.559837][ T1165] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.559970][ T1165] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.560095][ T1165] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.860888][ T3370] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.466764][ T3532] cgroup: No subsys list or none specified [ 95.548195][ T3532] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.568189][ T3532] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.578137][ T3532] netlink: 'syz.1.5': attribute type 1 has an invalid length. [ 101.803093][ T800] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 101.962569][ T800] usb 1-1: Using ep0 maxpacket: 32 [ 101.978622][ T800] usb 1-1: unable to get BOS descriptor or descriptor too short [ 101.989929][ T800] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 101.990367][ T800] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 101.990562][ T800] usb 1-1: config 14 has no interface number 0 [ 101.990649][ T800] usb 1-1: config 14 has no interface number 1 [ 101.993328][ T800] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 101.993573][ T800] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 101.993797][ T800] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 101.993970][ T800] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 101.994095][ T800] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 101.994233][ T800] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 101.994404][ T800] usb 1-1: config 14 interface 57 has no altsetting 0 [ 101.994525][ T800] usb 1-1: config 14 interface 228 has no altsetting 0 [ 102.023470][ T800] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 102.024327][ T800] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.025049][ T800] usb 1-1: Product: syz [ 102.025166][ T800] usb 1-1: Manufacturer: syz [ 102.025238][ T800] usb 1-1: SerialNumber: syz [ 102.479855][ T800] legousbtower 1-1:14.57: interrupt endpoints not found [ 102.888411][ T800] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 102.894792][ T800] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 106.535530][ C1] usb 1-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 106.536037][ T38] usb 1-1: USB disconnect, device number 2 [ 106.557176][ T38] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 106.797944][ T3542] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8'. [ 106.871904][ T3542] bond0: (slave bond_slave_1): Releasing backup interface [ 107.352710][ T38] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 107.503120][ T38] usb 1-1: Using ep0 maxpacket: 8 [ 107.510937][ T38] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 107.511578][ T38] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 107.511793][ T38] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 107.512316][ T38] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 107.512442][ T38] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 107.513978][ T38] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 107.514196][ T38] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.735588][ T38] usb 1-1: GET_CAPABILITIES returned 0 [ 107.735850][ T38] usbtmc 1-1:16.0: can't read capabilities [ 107.946244][ T38] usb 1-1: USB disconnect, device number 3 [ 111.022483][ T38] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 111.206662][ T38] usb 1-1: config 0 has an invalid interface number: 255 but max is 0 [ 111.209097][ T38] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.215056][ T38] usb 1-1: config 0 has no interface number 0 [ 111.218160][ T38] usb 1-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 111.221508][ T38] usb 1-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 111.233159][ T38] usb 1-1: config 0 interface 255 has no altsetting 0 [ 111.236782][ T38] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 111.239856][ T38] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.256203][ T38] usb 1-1: config 0 descriptor?? [ 111.477831][ T3516] usb 1-1: USB disconnect, device number 4 [ 112.032833][ T3516] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 112.203283][ T3516] usb 1-1: Using ep0 maxpacket: 32 [ 112.228747][ T3516] usb 1-1: unable to get BOS descriptor or descriptor too short [ 112.252438][ T3516] usb 1-1: config 2 has an invalid interface number: 236 but max is 0 [ 112.252697][ T3516] usb 1-1: config 2 has no interface number 0 [ 112.283761][ T3516] usb 1-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice=55.09 [ 112.285929][ T3516] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.288546][ T3516] usb 1-1: Product: syz [ 112.291430][ T3516] usb 1-1: Manufacturer: syz [ 112.294677][ T3516] usb 1-1: SerialNumber: syz [ 114.240647][ T2765] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.368588][ T2765] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.515240][ T2765] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.628097][ T2765] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.410596][ T2765] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 115.449096][ T2765] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 115.479653][ T2765] bond0 (unregistering): Released all slaves [ 115.624325][ T2765] hsr_slave_0: left promiscuous mode [ 115.628262][ T2765] hsr_slave_1: left promiscuous mode [ 115.642967][ T2765] veth1_macvtap: left promiscuous mode [ 115.643444][ T2765] veth0_macvtap: left promiscuous mode [ 115.643852][ T2765] veth1_vlan: left promiscuous mode [ 115.644219][ T2765] veth0_vlan: left promiscuous mode [ 116.553072][ T3217] 8021q: adding VLAN 0 to HW filter on device eth1 [ 117.404790][ T3217] 8021q: adding VLAN 0 to HW filter on device eth2 [ 118.134789][ T3575] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.159172][ T3575] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 118.400820][ T3217] 8021q: adding VLAN 0 to HW filter on device eth3 [ 119.364807][ T3575] hsr_slave_0: entered promiscuous mode [ 119.369503][ T3575] hsr_slave_1: entered promiscuous mode [ 119.374395][ T3575] debugfs: 'hsr0' already exists in 'hsr' [ 119.375676][ T3575] Cannot create hsr debugfs directory [ 119.387888][ T3217] 8021q: adding VLAN 0 to HW filter on device eth4 [ 119.980241][ T3575] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 119.995403][ T3575] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 119.999754][ T3575] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 120.009982][ T3575] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 120.017501][ T3575] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 120.028852][ T3575] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 120.035023][ T3575] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 120.045821][ T3575] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 120.716389][ T3575] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.793061][ T11] usb 1-1: USB disconnect, device number 5 [ 123.272779][ T3508] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 123.424548][ T3508] usb 1-1: Using ep0 maxpacket: 32 [ 123.439228][ T3508] usb 1-1: config 0 has an invalid interface number: 61 but max is 1 [ 123.439555][ T3508] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 123.439845][ T3508] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 123.440008][ T3508] usb 1-1: config 0 has no interface number 0 [ 123.494657][ T3508] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=b5.f6 [ 123.495712][ T3508] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.495785][ T3508] usb 1-1: Product: syz [ 123.495841][ T3508] usb 1-1: Manufacturer: syz [ 123.495922][ T3508] usb 1-1: SerialNumber: syz [ 123.514610][ T3508] usb 1-1: config 0 descriptor?? [ 123.607103][ T3575] veth0_vlan: entered promiscuous mode [ 123.647363][ T3575] veth1_vlan: entered promiscuous mode [ 123.761352][ T3575] veth0_macvtap: entered promiscuous mode [ 123.782986][ T3575] veth1_macvtap: entered promiscuous mode [ 123.910284][ T1196] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.913017][ T1196] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.915663][ T1196] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.917447][ T1196] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.242866][ T3689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.245395][ T3689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.481531][ T3691] netlink: 4 bytes leftover after parsing attributes in process `syz.2.21'. [ 127.248936][ T3699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.250304][ T3699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.143235][ T3717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.144772][ T3717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.065895][ T3744] syz.2.32 uses obsolete (PF_INET,SOCK_PACKET) [ 135.286500][ T3746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.295316][ T3746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.797118][ T3755] binder: 3754:3755 ioctl 4018620d 0 returned -22 [ 135.803730][ T3755] binder: 3754:3755 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 135.806936][ T3755] binder: 3755 RLIMIT_NICE not set [ 136.448389][ T3758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.449702][ T3758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.531531][ T3760] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 136.767644][ T3765] binder: 3764:3765 ioctl c0306201 0 returned -14 [ 136.771523][ T3765] binder: 3764:3765 got transaction to invalid handle, 1 [ 136.773758][ T3765] binder: 3764:3765 cannot find target node [ 136.775624][ T3765] binder: 3764:3765 transaction call to 0:0 failed 1/29201/-22, code 0 size 0-0 line 3252 [ 136.784652][ T3516] binder: undelivered TRANSACTION_ERROR: 29201 [ 137.105605][ T3769] bond1: entered promiscuous mode [ 137.173906][ T3772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.175206][ T3772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.366893][ T11] usb 1-1: USB disconnect, device number 6 [ 139.130952][ T3796] faux_driver vkms: [drm] Unknown color mode 256; guessing buffer size. [ 141.443300][ T38] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 141.626600][ T38] usb 1-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 141.626984][ T38] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.660832][ T38] usb 1-1: config 0 descriptor?? [ 142.276797][ T28] audit: type=1326 audit(142.120:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3830 comm="syz.2.65" exe="/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff7ef78f68 code=0x0 [ 142.836567][ T3833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.837984][ T3833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.414718][ T3838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.416132][ T3838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.436747][ T3856] trusted_key: syz.2.74 sent an empty control message without MSG_MORE. [ 151.803486][ T3880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.806004][ T3880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.911263][ T3882] ubi31: attaching mtd0 [ 151.979604][ T3882] ubi31: scanning is finished [ 151.986919][ T3882] ubi31 error: ubi_read_volume_table: the layout volume was not found [ 152.006836][ T3882] ubi31 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 155.500192][ T800] usb 1-1: USB disconnect, device number 7 [ 155.765665][ T3913] capability: warning: `syz.0.99' uses 32-bit capabilities (legacy support in use) [ 157.343008][ T3516] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 157.521211][ T3516] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 128, using maximum allowed: 30 [ 157.521631][ T3516] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 157.521723][ T3516] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 128 [ 157.521868][ T3516] usb 1-1: New USB device found, idVendor=05ac, idProduct=0236, bcdDevice= 0.00 [ 157.522543][ T3516] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.547105][ T3516] usb 1-1: config 0 descriptor?? [ 157.553943][ T3926] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 157.909110][ T3929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.912726][ T3929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.124723][ T3929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.126791][ T3929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.835101][ T3947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.843872][ T3947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 167.802209][ T38] usb 1-1: USB disconnect, device number 8 [ 168.193452][ T3968] syzkaller0: entered promiscuous mode [ 168.195671][ T3968] syzkaller0: entered allmulticast mode [ 168.346059][ T3968] sch_fq: defrate 11 ignored. [ 168.734289][ T3976] process 'syz.0.121' launched './file2' with NULL argv: empty string added [ 171.883693][ T3993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 171.887137][ T3993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.463003][ T1953] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 173.623992][ T1953] usb 1-1: Using ep0 maxpacket: 32 [ 173.646593][ T1953] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 173.675957][ T1953] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 173.676340][ T1953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.676578][ T1953] usb 1-1: Product: syz [ 173.676639][ T1953] usb 1-1: Manufacturer: syz [ 173.676695][ T1953] usb 1-1: SerialNumber: syz [ 173.730227][ T1953] usb 1-1: selecting invalid altsetting 1 [ 173.750319][ T4002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.758592][ T4002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.763901][ T1953] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 173.770865][ T1953] usb 1-1: selecting invalid altsetting 1 [ 173.794431][ T1953] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 173.811734][ T1953] usb 1-1: selecting invalid altsetting 1 [ 173.940175][ T4006] binder: 4005:4006 tried to acquire reference to desc 0, got 1 instead [ 173.943952][ T4006] binder: 4005:4006 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 173.945859][ T4006] binder: 4006 RLIMIT_NICE not set [ 173.986748][ T1953] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 174.451591][ T3940] udevd[3940]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 174.475883][ T800] binder: undelivered TRANSACTION_COMPLETE [ 175.480501][ T800] usb 1-1: USB disconnect, device number 9 [ 175.624778][ T4025] netlink: 24 bytes leftover after parsing attributes in process `syz.2.139'. [ 180.574450][ T4051] netlink: 4 bytes leftover after parsing attributes in process `syz.0.148'. [ 180.581707][ T4051] Zero length message leads to an empty skb [ 180.818610][ T4053] binder: 4052:4053 tried to acquire reference to desc 0, got 1 instead [ 180.839864][ T4053] binder: 4052:4053 ioctl c0306201 0 returned -14 [ 180.850115][ T4053] binder: 4052:4053 got reply transaction with bad transaction stack, transaction 11 has target 4052:0 [ 180.863208][ T4053] binder: 4052:4053 transaction reply to 0:0 failed 12/29201/-71, code 0 size 0-0 line 3170 [ 180.888088][ T38] binder: release 4052:4053 transaction 11 out, still active [ 180.888558][ T38] binder: undelivered TRANSACTION_COMPLETE [ 180.888834][ T38] binder: undelivered TRANSACTION_ERROR: 29201 [ 180.928975][ T38] binder: send failed reply for transaction 11, target dead [ 181.031040][ T4055] misc userio: Invalid payload size [ 184.415266][ T4079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.416915][ T4079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.572627][ T1953] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 184.742652][ T1953] usb 1-1: Using ep0 maxpacket: 32 [ 184.780138][ T1953] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 184.780549][ T1953] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 184.781286][ T1953] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 184.781845][ T1953] usb 1-1: config 1 has no interface number 0 [ 184.783787][ T1953] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 184.783875][ T1953] usb 1-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 184.784097][ T1953] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 184.784200][ T1953] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.861241][ T1953] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 185.087923][ T1953] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now attached [ 185.551047][ T1953] usb 1-1: USB disconnect, device number 10 [ 185.562979][ T1953] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 186.308539][ T38] usb 1-1: new low-speed USB device number 11 using dummy_hcd [ 187.549478][ T38] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 187.551171][ T38] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.558571][ T38] usb 1-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 187.563821][ T38] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.590735][ T38] usb 1-1: config 0 descriptor?? [ 188.051896][ T38] hid-generic 0003:0C70:F0B6.0001: hidraw0: USB HID v0.00 Device [HID 0c70:f0b6] on usb-dummy_hcd.0-1/input0 [ 188.240160][ T11] usb 1-1: USB disconnect, device number 11 [ 188.280105][ T4099] fido_id[4099]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 189.190336][ T4113] capability: warning: `syz.2.167' uses deprecated v2 capabilities in a way that may be insecure [ 201.108001][ T4175] Driver unsupported XDP return value 0 on prog (id 7) dev N/A, expect packet loss! [ 208.962832][ T3516] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 209.148565][ T3516] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 255, changing to 4 [ 209.149015][ T3516] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 32768, setting to 1023 [ 209.179193][ T3516] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 209.179631][ T3516] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.179849][ T3516] usb 1-1: Product: syz [ 209.179966][ T3516] usb 1-1: Manufacturer: syz [ 209.180075][ T3516] usb 1-1: SerialNumber: syz [ 209.196835][ T3516] usb 1-1: config 0 descriptor?? [ 209.437627][ T3516] usb 1-1: USB disconnect, device number 12 [ 212.713102][ T11] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 212.862953][ T11] usb 1-1: Using ep0 maxpacket: 16 [ 212.879770][ T11] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 212.880097][ T11] usb 1-1: config 0 has no interface number 0 [ 212.880420][ T11] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 212.880551][ T11] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 212.917334][ T11] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 212.917665][ T11] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.917885][ T11] usb 1-1: Product: syz [ 212.918006][ T11] usb 1-1: Manufacturer: syz [ 212.918103][ T11] usb 1-1: SerialNumber: syz [ 212.937485][ T11] usb 1-1: config 0 descriptor?? [ 212.947809][ T4242] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 212.959886][ T4242] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 213.175604][ T4242] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 213.180542][ T4242] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 215.354050][ T11] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 215.356512][ T11] asix 1-1:0.34: probe with driver asix failed with error -71 [ 215.406628][ T11] usb 1-1: USB disconnect, device number 13 [ 216.990201][ T4265] ======================================================= [ 216.990201][ T4265] WARNING: The mand mount option has been deprecated and [ 216.990201][ T4265] and is ignored by this kernel. Remove the mand [ 216.990201][ T4265] option from the mount to silence this warning. [ 216.990201][ T4265] ======================================================= [ 217.487987][ T50] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.609008][ T50] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.729065][ T50] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.829743][ T50] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.614535][ T50] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 218.668593][ T50] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 218.709031][ T50] bond0 (unregistering): Released all slaves [ 218.736668][ T50] bond1 (unregistering): Released all slaves [ 218.912361][ T50] hsr_slave_0: left promiscuous mode [ 218.920083][ T50] hsr_slave_1: left promiscuous mode [ 218.955197][ T50] veth1_macvtap: left promiscuous mode [ 218.957057][ T50] veth0_macvtap: left promiscuous mode [ 218.958592][ T50] veth1_vlan: left promiscuous mode [ 218.959786][ T50] veth0_vlan: left promiscuous mode [ 221.346265][ T3217] 8021q: adding VLAN 0 to HW filter on device eth5 [ 222.078712][ T4267] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 222.103990][ T4267] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 223.110078][ T3217] 8021q: adding VLAN 0 to HW filter on device eth6 [ 223.643246][ T4267] hsr_slave_0: entered promiscuous mode [ 223.649900][ T4267] hsr_slave_1: entered promiscuous mode [ 223.662888][ T4267] debugfs: 'hsr0' already exists in 'hsr' [ 223.664125][ T4267] Cannot create hsr debugfs directory [ 224.321729][ T4267] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 224.359699][ T4267] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 224.371217][ T4267] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 224.386903][ T4267] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 224.395502][ T4267] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 224.410277][ T4267] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 224.417077][ T4267] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 224.434766][ T4267] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 224.681130][ T3217] 8021q: adding VLAN 0 to HW filter on device eth7 [ 225.390199][ T4267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.718925][ T3217] 8021q: adding VLAN 0 to HW filter on device eth8 [ 229.502826][ T38] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 229.653252][ T38] usb 1-1: Using ep0 maxpacket: 32 [ 229.687100][ T38] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 229.687399][ T38] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 229.687672][ T38] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 229.687797][ T38] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.698621][ T38] usb 1-1: config 0 descriptor?? [ 230.176740][ T38] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 230.177168][ T38] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 230.381068][ T38] ft260 0003:0403:6030.0002: chip code: 0000 0000 [ 230.543870][ T4267] veth0_vlan: entered promiscuous mode [ 230.591337][ T38] ft260 0003:0403:6030.0002: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.0-1/input0 [ 230.605520][ T4267] veth1_vlan: entered promiscuous mode [ 230.710269][ T4267] veth0_macvtap: entered promiscuous mode [ 230.736971][ T4267] veth1_macvtap: entered promiscuous mode [ 230.800106][ T38] ft260 0003:0403:6030.0002: failed to retrieve status: -32, no wakeup [ 230.869447][ T50] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.870030][ T50] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.916127][ T50] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.916933][ T50] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.018305][ T3516] usb 1-1: USB disconnect, device number 14 [ 231.814825][ T38] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 232.023041][ T38] usb 1-1: Using ep0 maxpacket: 32 [ 232.041172][ T38] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 232.041517][ T38] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 232.041634][ T38] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 232.041772][ T38] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 232.042211][ T38] usb 1-1: config 1 has no interface number 0 [ 232.042425][ T38] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 232.042551][ T38] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.129343][ T38] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 232.317004][ T38] snd_usb_pod 1-1:1.1: set_interface failed [ 232.317619][ T38] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 232.318223][ T38] snd_usb_pod 1-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 232.349779][ T38] usb 1-1: USB disconnect, device number 15 [ 235.838458][ T4461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.839538][ T4461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.856076][ T4464] netlink: 'syz.0.267': attribute type 6 has an invalid length. [ 236.073164][ T4461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.266'. [ 236.157288][ T4461] bond0: (slave bond_slave_1): Releasing backup interface [ 236.592842][ T11] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 236.769909][ T11] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 236.772479][ T11] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.772810][ T11] usb 1-1: Product: syz [ 236.772918][ T11] usb 1-1: Manufacturer: syz [ 236.773018][ T11] usb 1-1: SerialNumber: syz [ 237.957811][ T11] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 237.958453][ T11] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 239.601218][ T11] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 239.601817][ T11] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 239.604666][ T11] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 239.641235][ T11] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 240.063428][ T11] usb 1-1: USB disconnect, device number 16 [ 240.110912][ T4497] netlink: 60 bytes leftover after parsing attributes in process `syz.3.277'. [ 244.177934][ T4536] netlink: 40 bytes leftover after parsing attributes in process `syz.3.286'. [ 247.512819][ T23] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 247.682587][ T23] usb 1-1: Using ep0 maxpacket: 16 [ 247.690960][ T23] usb 1-1: config 7 has an invalid interface number: 2 but max is 0 [ 247.691303][ T23] usb 1-1: config 7 has no interface number 0 [ 247.691405][ T23] usb 1-1: config 7 interface 2 has no altsetting 0 [ 247.716653][ T23] usb 1-1: New USB device found, idVendor=1bc7, idProduct=1261, bcdDevice=4d.4d [ 247.716976][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.717181][ T23] usb 1-1: Product: syz [ 247.717237][ T23] usb 1-1: Manufacturer: syz [ 247.717320][ T23] usb 1-1: SerialNumber: syz [ 248.008626][ T23] usb 1-1: USB disconnect, device number 17 [ 248.229176][ T4566] sch_fq: defrate 11 ignored. [ 253.143149][ T3458] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 253.298198][ T3458] usb 1-1: unable to get BOS descriptor or descriptor too short [ 253.308685][ T3458] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 253.310131][ T3458] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 253.333671][ T3458] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 253.335041][ T3458] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.337338][ T3458] usb 1-1: Product: syz [ 253.339150][ T3458] usb 1-1: Manufacturer: syz [ 253.340716][ T3458] usb 1-1: SerialNumber: syz [ 253.394523][ T3458] usb 1-1: selecting invalid altsetting 1 [ 253.396187][ T3458] usb 1-1: unit 6 not found! [ 253.996645][ T3458] usb 1-1: 2:0: failed to get current value for ch 0 (-71) [ 254.151152][ T3458] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 254.165210][ T3458] usb 1-1: USB disconnect, device number 18 [ 254.384924][ T4212] udevd[4212]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 254.710181][ T4638] netlink: 'syz.0.330': attribute type 1 has an invalid length. [ 254.799556][ T4640] netlink: 16 bytes leftover after parsing attributes in process `syz.0.331'. [ 254.803521][ T4640] netlink: 108 bytes leftover after parsing attributes in process `syz.0.331'. [ 254.804879][ T4640] netlink: 16 bytes leftover after parsing attributes in process `syz.0.331'. [ 254.885945][ T4642] binder: 4641:4642 ioctl c018620c 0 returned -14 [ 257.829754][ T4661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 257.833468][ T4661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.168742][ T4669] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 262.920768][ T4689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.929615][ T4689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.056147][ T4694] netlink: 20 bytes leftover after parsing attributes in process `syz.3.354'. [ 263.056419][ T4694] netlink: 8 bytes leftover after parsing attributes in process `syz.3.354'. [ 263.084172][ T4694] netlink: 20 bytes leftover after parsing attributes in process `syz.3.354'. [ 263.084357][ T4694] netlink: 8 bytes leftover after parsing attributes in process `syz.3.354'. [ 263.849515][ T4710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.855796][ T4710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 265.351050][ T4714] input: syz0 as /devices/virtual/input/input1 [ 267.336076][ T4724] syzkaller0: entered promiscuous mode [ 267.336343][ T4724] syzkaller0: entered allmulticast mode [ 267.523575][ T4724] sch_fq: defrate 11 ignored. [ 269.155078][ T4739] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 270.884707][ T4747] netlink: 'syz.3.375': attribute type 83 has an invalid length. [ 271.118396][ T4755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.121112][ T4755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.415900][ T4762] netlink: 4 bytes leftover after parsing attributes in process `syz.0.381'. [ 271.500340][ T4762] gretap0: entered promiscuous mode [ 271.507530][ T4762] macvtap1: entered promiscuous mode [ 271.514401][ T4762] macvtap1: entered allmulticast mode [ 271.514905][ T4762] gretap0: entered allmulticast mode [ 271.780008][ T4768] syzkaller0: entered promiscuous mode [ 271.780319][ T4768] syzkaller0: entered allmulticast mode [ 271.955588][ T4772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.956979][ T4772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.166248][ T4774] syzkaller0: entered promiscuous mode [ 272.168707][ T4774] syzkaller0: entered allmulticast mode [ 272.904089][ T4793] binder: 4792:4793 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 272.904420][ T4793] binder: 4793 RLIMIT_NICE not set [ 273.259643][ T4804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.285041][ T4804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.298181][ T4805] fuse: Invalid rootmode [ 273.486540][ T4811] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.489438][ T4811] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.708167][ T4817] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.716378][ T4817] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.934589][ T4823] netlink: 4 bytes leftover after parsing attributes in process `syz.0.410'. [ 275.943476][ T1953] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 276.092963][ T1953] usb 1-1: Using ep0 maxpacket: 16 [ 276.203817][ T1953] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 276.205556][ T1953] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 276.236929][ T1953] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 276.237271][ T1953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.237573][ T1953] usb 1-1: Product: syz [ 276.237636][ T1953] usb 1-1: Manufacturer: syz [ 276.237696][ T1953] usb 1-1: SerialNumber: syz [ 276.260287][ T1953] usb 1-1: 0:2 : does not exist [ 276.929941][ T38] usb 1-1: USB disconnect, device number 19 [ 277.520702][ T4690] udevd[4690]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 280.708544][ T4858] vcan0: tx drop: invalid da for name 0xffffffffffffffff [ 280.858379][ T4863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.859807][ T4863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.357862][ T4921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.360541][ T4921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.266054][ T4953] netlink: 28 bytes leftover after parsing attributes in process `syz.0.460'. [ 300.763005][ T4967] netlink: 28 bytes leftover after parsing attributes in process `syz.3.465'. [ 301.409904][ T4982] mtd partition "" doesn't have enough space: 0x8000003 < 0x20000100, disabled [ 301.414216][ T4982] ------------[ cut here ]------------ [ 301.417536][ T4982] WARNING: drivers/mtd/mtdcore.c:719 at add_mtd_device+0x678/0x740, CPU#1: syz.0.472/4982 [ 301.424320][ T4982] Modules linked in: [ 301.427144][ T4982] CPU: 1 UID: 0 PID: 4982 Comm: syz.0.472 Tainted: G L syzkaller #0 PREEMPT [ 301.427973][ T4982] Tainted: [L]=SOFTLOCKUP [ 301.428349][ T4982] Hardware name: linux,dummy-virt (DT) [ 301.428953][ T4982] pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 301.429447][ T4982] pc : add_mtd_device+0x678/0x740 [ 301.429715][ T4982] lr : mtd_add_partition+0x110/0x208 [ 301.430086][ T4982] sp : ffff8000893a3a50 [ 301.430402][ T4982] x29: ffff8000893a3a90 x28: f9f000000e1fe800 x27: 0000000000000000 [ 301.431223][ T4982] x26: f5f0000008dd8150 x25: faf00000066f63c0 x24: f9f000000e1fecf8 [ 301.431630][ T4982] x23: f4f000000515e000 x22: f4f000000515e4e8 x21: f9f000000e1fe800 [ 301.432137][ T4982] x20: 0000000000000000 x19: f9f000000e1fe9a0 x18: 0000000000000000 [ 301.432605][ T4982] x17: 0000000000000000 x16: 0000000000000000 x15: 0000fffffa4de2c0 [ 301.433092][ T4982] x14: 0000000000000232 x13: 00000000f5257d14 x12: 0000b0da8686e0ac [ 301.433517][ T4982] x11: 00000000000000c0 x10: f11dfc33dc35eefe x9 : c5c3c60b677d6bcb [ 301.434007][ T4982] x8 : f8f0000005b3e578 x7 : 0000000000000004 x6 : 0000000000000000 [ 301.434471][ T4982] x5 : fff000007f8d2188 x4 : 0000000000000001 x3 : f4f000000515e4e8 [ 301.434957][ T4982] x2 : f8f0000005b3d500 x1 : 0000000000000000 x0 : 0000000000000c00 [ 301.435594][ T4982] Call trace: [ 301.436050][ T4982] add_mtd_device+0x678/0x740 (P) [ 301.436632][ T4982] mtd_add_partition+0x110/0x208 [ 301.436920][ T4982] mtdchar_blkpg_ioctl+0xd0/0xf4 [ 301.437241][ T4982] mtdchar_ioctl+0x1b8/0xe14 [ 301.437522][ T4982] mtdchar_unlocked_ioctl+0x50/0x80 [ 301.437831][ T4982] __arm64_sys_ioctl+0xac/0x104 [ 301.438081][ T4982] invoke_syscall+0x54/0x10c [ 301.438349][ T4982] el0_svc_common.constprop.0+0x40/0xe0 [ 301.438648][ T4982] do_el0_svc+0x1c/0x34 [ 301.438909][ T4982] el0_svc+0x38/0x1fc [ 301.439213][ T4982] el0t_64_sync_handler+0xa0/0xf0 [ 301.439630][ T4982] el0t_64_sync+0x1a4/0x1a8 [ 301.440143][ T4982] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 302.066832][ T29] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.186669][ T29] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.271747][ T29] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.346450][ T29] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.984765][ T29] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 303.019599][ T29] bond0 (unregistering): Released all slaves [ 303.108030][ T29] hsr_slave_0: left promiscuous mode [ 303.110213][ T29] hsr_slave_1: left promiscuous mode [ 303.120030][ T29] veth1_macvtap: left promiscuous mode [ 303.120262][ T29] veth0_macvtap: left promiscuous mode [ 303.120612][ T29] veth1_vlan: left promiscuous mode [ 303.120865][ T29] veth0_vlan: left promiscuous mode [ 304.086357][ T29] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.181633][ T29] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.258288][ T3217] 8021q: adding VLAN 0 to HW filter on device eth9 [ 304.282838][ T29] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.384150][ T29] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.046999][ T29] gretap0 (unregistering): left allmulticast mode [ 305.147420][ T29] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 305.179282][ T29] bond0 (unregistering): Released all slaves [ 305.197101][ T3217] 8021q: adding VLAN 0 to HW filter on device eth10 [ 305.326214][ T29] hsr_slave_0: left promiscuous mode [ 305.333594][ T29] hsr_slave_1: left promiscuous mode [ 305.349027][ T29] veth1_macvtap: left promiscuous mode [ 305.350246][ T29] veth0_macvtap: left promiscuous mode [ 305.352461][ T29] veth1_vlan: left promiscuous mode [ 305.354704][ T29] veth0_vlan: left promiscuous mode [ 306.709674][ T3217] 8021q: adding VLAN 0 to HW filter on device eth11 [ 307.606368][ T3217] 8021q: adding VLAN 0 to HW filter on device eth12 [ 308.363488][ T3217] 8021q: adding VLAN 0 to HW filter on device eth13 [ 309.075578][ T3217] 8021q: adding VLAN 0 to HW filter on device eth14 [ 309.709451][ T3217] 8021q: adding VLAN 0 to HW filter on device eth15 [ 310.406606][ T3217] 8021q: adding VLAN 0 to HW filter on device eth16