last executing test programs: 19m52.585810316s ago: executing program 32 (id=311): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0xb, 0x7ffc0001}]}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, r0, 0x3, 0x80000}) bpf$MAP_CREATE(0x0, &(0x7f0000001380)=ANY=[@ANYBLOB="0f000000040000000800000001"], 0x50) fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000008070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) 18m24.832167493s ago: executing program 33 (id=956): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e21, @multicast2}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000740)={r2, @in6={{0xa, 0x4e22, 0x85, @local, 0x40}}}, &(0x7f0000000040)=0x84) 18m22.559396525s ago: executing program 34 (id=970): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x40091}, 0x4048851) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x40090) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010400000000ffdbdf2500000000", @ANYRES32=r2, @ANYBLOB="3a2205000a010000300012800b00010067656e6576650000200002"], 0x50}, 0x1, 0x0, 0x0, 0x40680c5}, 0x40) 18m9.661863067s ago: executing program 35 (id=1034): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(r0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 14m55.714459701s ago: executing program 1 (id=2191): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000003900), 0x34aa945a513d639, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) ftruncate(r1, 0x10001) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)=0x0) clock_gettime(0x0, &(0x7f00000000c0)) timer_settime(r3, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 14m53.64606642s ago: executing program 1 (id=2195): syz_init_net_socket$x25(0x9, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fee000/0x12000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b81, &(0x7f0000000040)={0x0, 0x24d34f, 0x1f480, 0x3, 0x2000010}) syz_emit_ethernet(0x22, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa"], 0x0) io_uring_enter(r0, 0x126, 0x8359, 0x17, 0x0, 0x0) 14m53.331229104s ago: executing program 1 (id=2200): r0 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0xf0b11a6505d7c266, 0x32, 0x33, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) keyctl$read(0xb, r0, &(0x7f00000000c0)=""/104, 0x68) 14m53.136772183s ago: executing program 1 (id=2202): bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) socket$inet6(0xa, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2, 0x16, 0x7, 0x0, 0x3, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_sec_ctx={0x1, 0x18, 0x1, 0x5}]}, 0x18}}, 0x8804) 14m50.332975913s ago: executing program 0 (id=2207): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x441c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000001b80)=""/112, 0x70}], 0x1}}], 0x1, 0x700, 0x0) sendfile(r1, r0, 0x0, 0x578410eb) 14m50.33220724s ago: executing program 1 (id=2208): socket$packet(0x11, 0x2, 0x300) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="00000000b99b5c65df", 0x9}], 0x1}}], 0x1, 0x20008000) recvmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380), 0x5c}, 0x123) shutdown(r0, 0x1) syz_usb_connect$midi(0x4, 0x48, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 14m49.071439001s ago: executing program 0 (id=2210): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000440), 0x2000) r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000002440)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1, @local, 0x90}, 0x1c, 0x0}}], 0x1, 0x80) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xa4fffffb, @loopback}}}, 0x108) 14m48.185152583s ago: executing program 1 (id=2214): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0x4}, {0x6, 0x1, 0x0, 0x1}]}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x28, 0x25, 0x44, 0xfffff00c}]}) ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180)) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x4004743d, 0x110e22fff6) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) 14m47.047669108s ago: executing program 0 (id=2217): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000004c40)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000001c0)="fcef4667434d78cf0973fb59663a86ffd51ba5661be0714943033abc35b9a23a9430ff6034765431c328aa20326037a6983b858400bd649a978a12cbe5b4cac2e5eb3469ac21c3e4c60e8afd24831e802dbe00d110507efcab8406bf6f98f6a1b76323817926028e7b4789859f4dc84656817f6f7088d3a3f8b539c818127738b2e7125c0edb02e19f95ca219f77dd43f467e2b492d638cd37a163493c42e1c54b07d7682a159d5e069d3be04332", 0xae}, {&(0x7f00000002c0)="4282be42aba512fe9f4e1c1efa0883f768ef2cdc940b9798a30438d13d", 0x1d}, {&(0x7f0000000340)="932aa6cf28bc3eaafb27cb5e275c22affd17067b35d9c3645f9a389b5f", 0x1d}, {&(0x7f0000000680)="78fb9403be50942f20e6988d6babf6179b8fd2acff2108cea48acd7727e424141c8ef01dde9104b4a2813474d270578961cf73ed2114d759e81773073e1e81542730a309871f908d9a1ab8086f05a0f5202db2a35f2272df62a27be88d878a", 0x5f}], 0x4}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000002500)="06a24cea0cf41d141883039516b8fc181732b7ffff261cd5051809c1741f08f33c42d789d6aff41bea3f2e27d66dea5b35ea4810dcacca523d6aa0a88421964a2f9d88a845de908898ea2c8b1af6366269ae10165bb0eb1b3981ffbc0312407c967f0b658629cd500ab4935156bbe7e4dd0113f2dce053fdfbb2a62a8e793e5653071d702c81cc59726f78d83083b44803f995557c3bdc99a0219d1470fe9b8e30d3f117d554b3a1688fdcb23c1ca3e6c60a8a8640278e37fa6c90d9c333716ea3aff98b39698d948a7dbf4f905c0fa7a3c9ba049f70013146f817c6745c2d534da007e0451af732e2cda6c0bee53a19cb0a64351425b6400bc24f0be01f50696ea5980ce3cfa2b856340bb0eca7579de03fec88ec339fcdb59cb39f83e7595c7396523e9e8753faa781e0b4844a71d2b88e2f4a7611e8d2a50b9ebca44b0d2b576a2cad8e03a2e1f9e1178a7d90fa86f2b9870ae6f75498a3a17859b356415bc08eaa28a890b7d8def5546213c80483a6f74f0751f26a860b56ed34f2f4a9b0c73589b0d9776bf16a57f83e0f44bb24ad9d6e40f737e0e5e0bf533d2f03c0a96b68d8b3b3af3167c5d79a57a8e0c7754479159769160e575f797008f4efa033624d82b8ff3426947edba3524d3d9effdd2e0a0597e2c3dc7d9102f841a2d7890ec1de62da971a3232b8cf608b69ccd2232c117badccf0f4c9da58390c1af7f7a22d5fcd06c9f0b8b46f034b9dcb388c9544389fa93a5e36fe78c2f1a7dc38b341437857cdbdffd54acd48c75f85d588aeebf503c8f2b2020dedd01ab6d181910f6a003095bd343725376a1ccd76e8dd0e5b268da39ac5b3b0a9f4ca1548bb01293ea393ff040c6d1ba7378f11b06e588e778da94ec465bcf1e8b6c8811cbc40c57d8126b7450e55c6397ec4a2dc50de9b0f45665da3caa95b0bff7d60a58eeac13545b41e87c079cf0c4a6e3365652a587c7e34649fcb6be8c4939d6ae85d5df44fde9bc13766190bf3cbc6c4dcd37d3476405e9853312146250631cb8c94f106fb9e3686643b364cf56a337cf6ebda82a3165b9eb730ba54cfcd405e27f7fda61443e7cf616e5984a68c9455b000be012cb39ff49500ea254548c77f0e3adc3b8ecf710836cfe8b3bdc7534eb784dc7cfb4717c7cfef46ce6293bd248cd92329b5cc3a1ec02595d0b3ae8efff0eb4d9c749f15564cfe40fa75434a3b1ddf5682a768095d46531be8bb59e0726ce59c4115c790c79fd1c20acf47ba776a0de1efe0b62c31a2bf0d3ed29c3b13f2ee74cef4c8f8389f18b36164f62310af07a748c8bdd46aff85c38b73957d0d5a2c81a349402cab7320641a4866fec475c126b802a427c41b77aa603d27a7666e6b03554456308e2cbe7170f828bdbb6d8c9bb2be261ad604449c783f64157686b1428f753b966e67491bf69f3399363da057425b57ca0ad01ff691ee277521259c3c77bcacadfddeb8ced2f4ae8184f6e3630c83e4b3d31a297fc6c99795051e0d180b46946653cc124c7ab5b609f62540929d5b5e21afe20121ff9ec21f26f15ffc4f3a307a070fb4ee6f28ecbba8f6e78d7bfb41a6de4604b2affec1e01674a9749abb471144bb7c5193abad00bdaa2026dfb96d944ec7741c905296a6404df3bbcde4e47e1fe4a4cdfa0eec530d9584fddecf255eb56cd73debcc80c399f88d16036e55606f2fb3356c7f3dabc5c95c55bf47dc3f31b8e03c0b51d878af33ce4f9d46acf2eb29d869921705a8c423af3181d66b0e759d8184abeebdca9a0b4c28aaf82484bea0aea0a778bdc4ba04707378d5295a1d2ee01928400e67ff9c67f9d3c18fbb69d63b07ba258c925e7e83918b56586de564f7c3c19ebb725d577318d94de27d06053c70a5ccfb632299101413aa7c1bca8f035e42e4e832ffe100c236b4b6fcd8e09c55f1cdde20461eee0611932200db75693895fcbd426ba9b5e9b92f9b353bde312af8f8c541ee5050e5036a2d4f4713a32f0f5bfefbb741879c2226d135633d0e437e2310ba331a701c709a1f033e45797581a89deb44f8e221717ee57baab3add1b22e17bce1784f0fbe6b78b3a7c34b9bf1c660b017ab659d6b87d8a4de027bea0b530c4fe3bc15bd305373dd94ab36173b2e53199bb2977e254acea3ad8e51e3e8a111cd7aa1b394f067cd8e83436439133df5ca1fe78514bcb802d5ce3e92fb628f3fd3dcc0c220fc77e853d7e1809c44e2cdf201ca82d9d6e286e799a3d567bcea5c76e0eaf326d70067b9824aa1b4af0ae271ead3dba0894f40eb8314abf9fe757d1f70a039431d8d7fc1ccf7d62e431843ff46e35a66c2bd411fde93443c2d437d41384f0dc16d9ee26e50655ef7f3908eca5ffc685b2b97d0811c5a601ee4c564f421f7d425f780488017655f0de1414336ac9216c057a1142613f334e89e6e6346e22c855e1db224c3c2af665ccf740e2d308aeceacb057cbc6e2315de469fc61e5b38d24556d91b266b531f0b3da1f94c9cd677e2a214d293c139793125278260ae20b0764e4aa8841084cc3caf6965aac507b8b60346c83dbe3779d0b951e8bb947b3c455c98f7338dae7a9e4c3a07ee06aa106067a86ad47db04a12b34a8a9115b0fb04b041f0fc841b2880567ab4f6822c129d1ffb84255931ea492d6cce9d755a465375b2aa5e1a642dd43a0ddc7dbcd7990c04ad49e99708ff9154d0aaa17eca74e5bc1b2a2683d65706dae8b6da99ac68e60f501ce8738cd503c4eef3b06470117c05a8b39b101fb9a202cdf864d522ba0adaad7d2160b4ba50dabf6189559b98285379a1ef9c7c2bc9e45bb1cfef97163f8db8e860a2f3d95e5495b5fd7e816ff054f855c4cf12522439449b7e5fe2d4f46c280f7f6479969d2f4d5c2d660df3e87cc11811d83aaffadac212c758914222f433c65338bd567f6ac6264622141776227bf96f0109d36a961a010066f918a8cc343cd636089985f1588aeaaa1b6841b4da86ff80b4c7854106642644ad2f204e7ee49e8bd5fe112267472e9735c00305ec8a0868be6afe862237ee84fb6f020b7788789cad5f906379e0b93e7ff89684ed0020cb17a4447321c2ac6b00a34ac84202c4ca593e14f0365f96c58cd23fe776099e331541840ea65fdd833f109acb469336afbc19b81880ed68050e65d897596e4a1937e3fe691dbfa86caf015be695997f83e1b8590c629dea1efc5983dd6f2739c501ebcdefe36014fae6dd9b882479711f303037ea9e38bc763307cc75b4a826e4c38777de728408bf7dcd4b8991e82b040d234d683e09f4f3ddef5fd519f788029e1a25f379f456d00ffee27c9e38689316e8190a5d385c38383f6f82e85aa8295514d727eba526c122fd0a56876e4738f9e5edadc4661247f4237e6bf703f5225711ad7a88120c3650ecc44ace2a483fe18f24506fdecb6ac141cb9b03ab1526164cabca6b68e6644fe05f3eeec17ed0162a588ffeb3d85d6704538cb83f86dff2da948ea42ce1c2d72af13b6c9b63d01e5e6ef1dc43d538ca93864d75a4ae9add9053c5f5fdaa", 0x9cc}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000003980)=[{0x0}], 0x1}}], 0x3, 0x885) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) 14m46.863708907s ago: executing program 0 (id=2218): rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 14m45.49326525s ago: executing program 0 (id=2224): socket$packet(0x11, 0x2, 0x300) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="00000000b99b5c65df", 0x9}], 0x1}}], 0x1, 0x20008000) recvmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380), 0x5c}, 0x123) shutdown(r0, 0x1) syz_usb_connect$midi(0x4, 0x48, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 14m44.102598134s ago: executing program 0 (id=2226): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) r1 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000c40), 0x12) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x1, 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'veth0_vlan\x00'}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000"], &(0x7f0000000200)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r6, r4, 0x16, 0x0, @void}, 0x10) write$cgroup_pid(r5, &(0x7f00000001c0), 0x12) 14m42.998917613s ago: executing program 6 (id=2228): socket$kcm(0x21, 0x2, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xccdb, 0xc000, 0x0, 0x20002fb}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x29, 0xfa00, {0x1, 0x0, 0x111, 0x9}}, 0x20) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 14m42.877206418s ago: executing program 6 (id=2229): r0 = syz_usb_connect$uac2(0x3, 0x83, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100020000002082052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708240a00000b7f00090401efff01022000090401010101022000090501"], 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000400)={0x40, 0xa, 0x4, "bfb514ff"}, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x82, 0x1, "7f"}, &(0x7f0000000540)={0x20, 0x83, 0x2, "14a8"}, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) 14m40.698398766s ago: executing program 6 (id=2234): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000240)="94", 0x1) vmsplice(r3, &(0x7f0000000380)=[{&(0x7f0000013580)}], 0x1, 0x0) tee(r1, r4, 0x8f5, 0x0) 14m40.548580222s ago: executing program 6 (id=2235): socket$nl_route(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0xd) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff7000/0x2000)=nil, 0x0, 0x5e}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x200, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xc}}}, 0x24}}, 0x4004004) r1 = socket$inet(0x2, 0x80001, 0x84) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 14m40.473028695s ago: executing program 6 (id=2236): socket$packet(0x11, 0x2, 0x300) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="00000000b99b5c65df", 0x9}], 0x1}}], 0x1, 0x20008000) recvmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380), 0x5c}, 0x123) shutdown(r0, 0x1) syz_usb_connect$midi(0x4, 0x48, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 14m39.704895392s ago: executing program 6 (id=2239): sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x4800) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0), 0xf00) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) 14m38.200913705s ago: executing program 36 (id=2201): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd63"], 0x66) 14m33.096172091s ago: executing program 37 (id=2214): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0x4}, {0x6, 0x1, 0x0, 0x1}]}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x28, 0x25, 0x44, 0xfffff00c}]}) ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180)) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x4004743d, 0x110e22fff6) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) 14m28.717593097s ago: executing program 38 (id=2226): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) r1 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000c40), 0x12) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x1, 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'veth0_vlan\x00'}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000"], &(0x7f0000000200)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r6, r4, 0x16, 0x0, @void}, 0x10) write$cgroup_pid(r5, &(0x7f00000001c0), 0x12) 14m24.44901469s ago: executing program 39 (id=2239): sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x4800) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0), 0xf00) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) 13m19.475130203s ago: executing program 8 (id=2381): rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(0x0, 0x80, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 13m19.070959979s ago: executing program 8 (id=2382): openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x180000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 13m18.868243631s ago: executing program 8 (id=2383): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) setpriority(0x1, 0x0, 0x80080000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='stat\x00') read$FUSE(r1, &(0x7f0000003680)={0x2020}, 0x2020) 13m18.571569677s ago: executing program 8 (id=2385): socket$kcm(0x21, 0x2, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000fea000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xccdb, 0xc000, 0x0, 0x20002fb}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x29, 0xfa00, {0x1, 0x0, 0x111, 0x9}}, 0x20) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, &(0x7f0000000300)) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 13m18.207874477s ago: executing program 9 (id=2386): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = openat$rtc(0xffffff9c, &(0x7f0000000040), 0xc2440, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xd}, {}, {0x7, 0x17}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x1, 0x2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x4f, &(0x7f0000000600)=ANY=[], 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xe, &(0x7f00000006c0)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @ringbuf_output={{0x18, 0x5, 0x1, 0x0, r6}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x63}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 13m17.014140274s ago: executing program 9 (id=2387): bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2, 0x16, 0x7, 0x0, 0x3, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_sec_ctx={0x1, 0x18, 0x1, 0x5}]}, 0x18}}, 0x8804) 13m16.451699334s ago: executing program 8 (id=2388): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) 13m15.36063612s ago: executing program 8 (id=2389): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x200005, 0xffffffff, 0x10000003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x12, 0x8, 0x4fbee}, 0x13, 0x1, 0x3, 0x7, 0x10, 0x4, 0x15, 0x18, 0x5, 0x402, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x8800, 0x0, 0x0) close(0x3) 13m14.08871829s ago: executing program 9 (id=2390): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x40000000203, 0x101301) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffff6, 0xc0, &(0x7f0000000080)={0x20, 0xc, 0xe, 0x287}, 0x8, 0x0, 0x4, 0x0, 0x5, 0x80000001, 0x0}) 13m13.998355301s ago: executing program 9 (id=2391): capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x3) listen(0xffffffffffffffff, 0x6) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x7) r4 = socket(0xa, 0x1, 0x0) listen(r4, 0x7f) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r6, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) recvfrom(r7, 0x0, 0x0, 0x0, 0x0, 0x0) 13m13.901738592s ago: executing program 9 (id=2392): bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x42}, 0x28) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000f9ffff030000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 13m12.872303565s ago: executing program 9 (id=2393): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r0}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newtaction={0x14, 0x30, 0x9, 0x0, 0x8}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) 13m0.071922213s ago: executing program 40 (id=2389): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x200005, 0xffffffff, 0x10000003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x12, 0x8, 0x4fbee}, 0x13, 0x1, 0x3, 0x7, 0x10, 0x4, 0x15, 0x18, 0x5, 0x402, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x8800, 0x0, 0x0) close(0x3) 12m57.530521172s ago: executing program 41 (id=2393): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r0}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newtaction={0x14, 0x30, 0x9, 0x0, 0x8}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) 10m28.138946038s ago: executing program 4 (id=2602): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f00000003c0)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b40)={r0, 0x0, 0x0}, 0x10) 10m27.602641326s ago: executing program 4 (id=2604): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(0x3) 10m21.830538042s ago: executing program 4 (id=2615): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x409d132, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) socket$netlink(0x10, 0x3, 0x0) inotify_init1(0x80000) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x2d, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x8, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x9, 0x0, 0x0, 0x2}, {0xeda7, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x80000000, 0xfffffffffffffff8, 0x0, 0x0, 0x2004cb, 0x200000003, 0x4100000000000000, 0xfffffffffffffff8, 0x0, 0xfffffffffffff2ab, 0x2000000000003ff, 0x80000002, 0xfffffffffffffffd], 0x0, 0x200306}) openat$tun(0xffffffffffffff9c, 0x0, 0xc0a41, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r1, 0xae80, 0x0) 10m20.357406802s ago: executing program 4 (id=2619): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r0 = syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) tgkill(r0, r0, 0x21) 10m18.772913018s ago: executing program 4 (id=2625): sendmsg$tipc(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2002, 0x50000000}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4040041}, 0x200008c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x12, 0xf, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1}, &(0x7f0000000080), &(0x7f0000000380)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) 10m16.943305732s ago: executing program 4 (id=2631): socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) unshare(0x22020600) 10m0.996966076s ago: executing program 42 (id=2631): socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) unshare(0x22020600) 7m59.196944803s ago: executing program 2 (id=2905): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7"], 0x0, 0x2000, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000200), &(0x7f0000000240)='%-5lx \x00'}, 0x20) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 7m56.633625134s ago: executing program 2 (id=2910): syz_usb_connect(0x1, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009a65d0860040800dee20102030109021b05000000000009040000f678eaf50009058402", @ANYRESOCT=0x0], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 7m53.324067254s ago: executing program 2 (id=2916): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000440), 0x2000) r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000002440)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1, @local, 0x90}, 0x1c, 0x0}}], 0x1, 0x80) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000001000)={0x7, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0xfffe, 0x9, @dev={0xfe, 0x80, '\x00', 0x42}, 0x4}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xa4fffffb, @loopback}}}, 0x108) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 7m48.969054606s ago: executing program 2 (id=2920): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x0) r2 = gettid() ioctl$BTRFS_IOC_INO_LOOKUP(0xffffffffffffffff, 0xd0009412, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000bbdffc)=0x0) timer_settime(r3, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSW2(r1, 0x5408, &(0x7f0000000540)={0xff, 0x37, 0xffffffee, 0x7fffffef, 0x0, "b850e43615b1b70500000000000400", 0x81002, 0x2}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet(0xffffffffffffffff, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'pimreg\x00', 0x5005}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) write$tun(r5, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000)={r4, r0}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000280)={@link_local, @broadcast, @void, {@canfd={0xd, {{0x2, 0x1, 0x1, 0x1}, 0x18, 0xad28079dd663979d, 0x0, 0x0, "66737c9f6a9a1e7967ff8956dd21756aaa745459a4b21beff840ada3bc0355f8573346e19b3b883f186af7c4a1ee21936f73e9a2f3e4b1f6f77dd50843ab89cb"}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 7m42.236845406s ago: executing program 2 (id=2931): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x1000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x801, 0x1}, 0x50) 7m41.92524776s ago: executing program 2 (id=2935): timer_create(0xfffffffffffffffd, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2c, 0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) open(&(0x7f0000000080)='./file1\x00', 0x146142, 0x90) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x4) rename(&(0x7f0000000380)='./file1\x00', &(0x7f0000000240)='./file3\x00') 7m26.458698468s ago: executing program 43 (id=2935): timer_create(0xfffffffffffffffd, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2c, 0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) open(&(0x7f0000000080)='./file1\x00', 0x146142, 0x90) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x4) rename(&(0x7f0000000380)='./file1\x00', &(0x7f0000000240)='./file3\x00') 21.707145981s ago: executing program 5 (id=3839): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000180), 0x3db66e6159adff3, 0x10100, 0x0) 12.794954964s ago: executing program 3 (id=3858): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) r2 = openat$cgroup_procs(r0, &(0x7f00000001c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) 12.571622898s ago: executing program 7 (id=3859): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) userfaultfd(0x80001) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e2200000000000000"], 0x190) setsockopt$inet_group_source_req(r3, 0x0, 0x2b, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) readlinkat(0xffffffffffffffff, &(0x7f0000000180)='./file1\x00', &(0x7f0000002780)=""/4112, 0x1010) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0x1c1e, 0x0, 0xfffffffe, 0x2f6}, 0x0, 0x1, 0x0, 0x0) 9.397354249s ago: executing program 7 (id=3860): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x4006041) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xf, 0x4, 0x4, 0x16, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) bpf$ENABLE_STATS(0x20, 0x0, 0x0) 9.39697404s ago: executing program 3 (id=3861): read$FUSE(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 9.266487531s ago: executing program 3 (id=3862): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000300)='sub:evt:mod:syz_mod_123', 0x17) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x48, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f00000007c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x4}, 0xe) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x80079a0) 8.536978585s ago: executing program 7 (id=3863): r0 = socket(0x1e, 0x4, 0x0) mknod$loop(0x0, 0x800, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000180)=""/175, 0xaf}], 0x1, &(0x7f0000001fc0)=""/65, 0x41}, 0x40000005}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r0, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x6cac0fd3fd00cb8c, 0x1, 0x2}}, 0x10, &(0x7f0000000300), 0x1}, 0x2000c8c0) syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x80000) recvmsg$unix(r0, &(0x7f00000031c0)={&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000003080)=[{0x0}, {&(0x7f0000003040)=""/14, 0xe}], 0x2, &(0x7f0000003100)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xc0}, 0x81) socket$can_raw(0x1d, 0x3, 0x1) r1 = socket(0x1e, 0x4, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0xa4) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000040)=@v2={0x2, @adiantum, 0x2, '\x00', @c}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), r2) r3 = socket(0x1e, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r4, &(0x7f0000003700)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)=""/4073, 0xfe9}], 0x1}, 0x9}], 0x1, 0x40012100, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x1}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="1e", 0x1}], 0x1}}], 0x1, 0x9200000000000000) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x44, r5, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x2}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfc}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x1}]}, 0x44}}, 0x20000000) r6 = dup3(r3, r1, 0x0) recvmmsg(r6, &(0x7f0000008840)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x40000001, 0x0) 7.380817532s ago: executing program 3 (id=3864): syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setresgid(0xee00, 0xee01, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f00000002c0)=0x9, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000002540)={0xa, 0x0, 0x0, @empty, 0x400}, 0x1c) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0), 0x28) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100, 0x4}}) socket$inet6_udp(0xa, 0x2, 0x0) timer_create(0x0, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r5 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r5, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) connect$pptp(r5, &(0x7f0000000080)={0x18, 0x2, {0xfff8, @multicast1}}, 0x1e) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r6, 0x40047438, &(0x7f0000000180)=0x1) dup3(r6, r5, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 6.764025625s ago: executing program 5 (id=3865): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x249, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0xa0, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x3, 0xef, {0x9, 0x21, 0x6519, 0x40, 0x1, {0x22, 0xeb8}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x4, 0x5, 0x3}}}}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x4d, 0x1, 0xe, 0x78, 0xde}, 0x69, 0x0}) syz_usb_control_io$hid(r1, &(0x7f0000000480)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$uac3(0x5, 0x0, 0x0, 0x0) 6.589299824s ago: executing program 7 (id=3866): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_disconnect(r0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, 0x0, 0x0) syz_usb_disconnect(r1) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r1) syz_usb_connect$cdc_ecm(0x3, 0x171, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES16, @ANYRESDEC=0x0], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc295, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xe7}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xa, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000040), 0x1f, 0xe14635b7486f8bb7) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16=r5], 0x0) ioctl$EVIOCSREP(r5, 0x40084503, &(0x7f0000000880)=[0x8, 0x2]) ioctl$EVIOCSABS3F(r5, 0x401845ff, &(0x7f0000000840)={0x7fff, 0x84, 0x0, 0x9, 0x6, 0x1}) syz_usb_control_io(r4, &(0x7f0000000280)={0x2c, &(0x7f00000000c0)={0x0, 0x23, 0x1a, {0x1a, 0x11, "378f54ee01c0496714985cefc6d5a10e63151ceb75235b46"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x427}}, &(0x7f0000000140)={0x0, 0xf, 0x46, {0x5, 0xf, 0x46, 0x4, [@wireless={0xb, 0x10, 0x1, 0xc, 0xfdc5cce300327c55, 0x8, 0x0, 0x3, 0xb5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xe, 0x47, 0x5, 0x400}, @ssp_cap={0x18, 0x10, 0xa, 0xe, 0x3, 0xef, 0xf000, 0x5, [0xc00f, 0x3f0f, 0xf]}, @ss_container_id={0x14, 0x10, 0x4, 0xdf, "ebda4f20b8c40f530ea2d8965ff044a1"}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf8, 0x80, 0x65, 0x32, "b3c54dbd", "9004bb28"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf6, 0x18, 0x65, 0x81, 0xf8, 0x4, 0x400}}}, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x40, 0xd, 0xcd, "e5aac01afc1130e899fb97da45d7a165b81e59bf73a7360eca89ce881a30f0eff4940ec9c761b91a965493754354497d95042001daa85dbf6725d1314607566b9f17993b8101e0e05b21f5511721a7036c6eab192c7fc12c24e30a9bd5a2169e8c4d6e57ba2d1a655bd8ee11b20f4a04f134a57d7e05e8867211c8b7e8d45c9cf9629d3407e29144efbf32a2eb62c963ef2273dcb110dc69b57a55a7b7e2d838650afaeee854105e89321d2f4bf418cf018b20dbfbb880a82f5a54cd919cd968ca25e02fd57271ac9013fcdeb5"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xaa}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000480)=ANY=[@ANYBLOB="2000890000000000000008000000"], &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000000500)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000540)={0x40, 0xb, 0x2, "2ebc"}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0x2}, &(0x7f00000005c0)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000600)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}}, &(0x7f0000000640)={0x40, 0x19, 0x2, "6fa5"}, &(0x7f0000000680)={0x40, 0x1a, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000000700)={0x40, 0x1e, 0x1}, &(0x7f0000000740)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io$hid(r4, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.49203964s ago: executing program 3 (id=3867): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@local=@item_4={0x3, 0x2, 0x2, "6dae0065"}, @global=@item_012={0x2, 0x1, 0x5, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x0, 0x2, 0x2}, @main=@item_4={0x3, 0x0, 0x8}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) 4.076824608s ago: executing program 5 (id=3868): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) userfaultfd(0x80001) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e2200000000000000"], 0x190) setsockopt$inet_group_source_req(r3, 0x0, 0x2b, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) readlinkat(0xffffffffffffffff, &(0x7f0000000180)='./file1\x00', &(0x7f0000002780)=""/4112, 0x1010) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0x1c1e, 0x0, 0xfffffffe, 0x2f6}, 0x0, 0x1, 0x0, 0x0) 1.799614813s ago: executing program 3 (id=3869): syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01) r0 = syz_usb_connect(0x4, 0x90, &(0x7f0000000040)=ANY=[@ANYBLOB="12010102138d28200819201300000102030109027e0080ffffff000904ae0e051966858f0b240600013a6af75c828205240009000d020000000000000400fdff0606241a8d000809050308000402080607250182070100090509001000a903080725018134000009050c10000408018d0725010007060007250100096f0e09050b1000020fab080905"], 0x0) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002"], 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r1) syz_usb_control_io$lan78xx(r0, &(0x7f0000000380)={0x14, &(0x7f0000000200)={0x20, 0x10, 0x2, {0x2, 0xd}}, &(0x7f0000000300)={0x0, 0x3, 0x6e, @string={0x6e, 0x3, "2453a046402c86aaa1bab047891078269cd788713479413f014920cdf92e7fbbb0295b1d70ec032578f3913d10330d49cd07121447444dd54edf516372010ef36e07c56a7749f9672268c671d89b8d13d9d73e0a33362a379949c706cb4b70948d3162f78460ff8f7a29be06"}}}, &(0x7f0000000580)={0x34, &(0x7f0000000400)={0x0, 0x6}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x1}, 0x0, &(0x7f00000004c0)={0xc0, 0xa1, 0x4, 0x8}, &(0x7f0000000500)={0x40, 0xa0, 0x4, 0x7}, &(0x7f0000000540)={0xc0, 0xa2, 0x2f, "fb9ac0799da036a559f617eda8620af7a8e7dca16b7c47543e8863661ab159f039c0cf3ce94bdd536116f3f86735c0"}}) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000000904004001030000000921010000012205"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00221200000083"], 0x0}, 0x0) syz_usb_ep_write(r1, 0x81, 0x1, &(0x7f0000000140)='P') r3 = syz_usb_connect$uac1(0x3, 0xa2, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d01014000010203010902900003010380000904000000010100000a24010f00030201020c2402060602040c0032a304090401000001020000090401010101020000072401200404000c2402010201400f0a3b4725090501090000f7090607250183020c0009040200000103000009040201010102000007"], 0x0) syz_usb_control_io(r3, &(0x7f00000003c0)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="12030400000004033804"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x1, 0x36, 0x0, 0x0) syz_open_dev$hiddev(0x0, 0x6, 0x1f1482) r4 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) 1.716253525s ago: executing program 7 (id=3870): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0006}]}) mknod(&(0x7f00000048c0)='./file0\x00', 0x0, 0xffffffff) read$FUSE(0xffffffffffffffff, &(0x7f000000a380)={0x2020}, 0x2020) write(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x713, 0xb) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.606060022s ago: executing program 7 (id=3871): syz_usb_connect$cdc_ecm(0x2, 0x5c, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000202505a1a440000000010109024a0001010000000904000017020200000524060000052400c4000d240f01000000000600009e2006240704070009058102400000000009059b8310000000000905030240"], 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000580)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x0, [{{0x9, 0x2, 0xff19}}]}}, 0x0) r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000002c0)={{0x12, 0x1, 0x110, 0x2b, 0x51, 0x32, 0x40, 0x424, 0x9d00, 0x5327, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0x50, 0xf, "", [{{0x9, 0x4, 0x7f, 0x0, 0x0, 0x1, 0x16, 0xdc, 0x2c}}]}}]}}, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$uac3(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000d40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000a00)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.313981754s ago: executing program 5 (id=3872): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xe, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbefa, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x65, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xa4}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 986.700676ms ago: executing program 5 (id=3873): timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) r0 = socket$tipc(0x1e, 0x2, 0x0) creat(0x0, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2, 0xf5ff}, 0x10) sendmsg$tipc(r1, &(0x7f0000000540)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x4}}, 0x10, 0x0}, 0x10) 0s ago: executing program 5 (id=3874): r0 = socket(0x1e, 0x4, 0x0) mknod$loop(0x0, 0x800, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000180)=""/175, 0xaf}], 0x1, &(0x7f0000001fc0)=""/65, 0x41}, 0x40000005}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r0, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x6cac0fd3fd00cb8c, 0x1, 0x2}}, 0x10, &(0x7f0000000300), 0x1}, 0x2000c8c0) syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x80000) recvmsg$unix(r0, &(0x7f00000031c0)={&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000003080)=[{0x0}, {&(0x7f0000003040)=""/14, 0xe}], 0x2, &(0x7f0000003100)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xc0}, 0x81) socket$can_raw(0x1d, 0x3, 0x1) r1 = socket(0x1e, 0x4, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0xa4) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000040)=@v2={0x2, @adiantum, 0x2, '\x00', @c}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), r2) r3 = socket(0x1e, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r4, &(0x7f0000003700)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)=""/4073, 0xfe9}], 0x1}, 0x9}], 0x1, 0x40012100, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x1}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="1e", 0x1}], 0x1}}], 0x1, 0x9200000000000000) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x44, r5, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x2}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfc}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x1}]}, 0x44}}, 0x20000000) r6 = dup3(r3, r1, 0x0) recvmmsg(r6, &(0x7f0000008840)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x40000001, 0x0) kernel console output (not intermixed with test programs): 559] bridge0: port 2(bridge_slave_1) entered disabled state [ 800.390833][T15559] bridge_slave_1: entered allmulticast mode [ 800.395150][T15559] bridge_slave_1: entered promiscuous mode [ 800.632563][T13910] appleir 0003:05AC:8243.0003: unknown main item tag 0x0 [ 800.843124][T13910] appleir 0003:05AC:8243.0003: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 802.082036][T15730] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2816'. [ 803.327649][ T201] usb 3-1: USB disconnect, device number 3 [ 805.057140][T15741] IPv6: NLM_F_REPLACE set, but no existing node found! [ 806.799187][T15764] netlink: 80 bytes leftover after parsing attributes in process `syz.5.2827'. [ 808.112647][T15769] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 808.112679][T15769] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 808.978920][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.028999][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.572363][T15559] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 809.589868][T15559] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 810.633857][T14171] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 811.085920][T14171] usb 6-1: Using ep0 maxpacket: 16 [ 811.086739][T14171] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 811.089502][T14171] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 811.193314][T15559] team0: Port device team_slave_0 added [ 811.197265][T15559] team0: Port device team_slave_1 added [ 811.240002][T15559] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 811.240019][T15559] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 811.240045][T15559] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 811.242538][T15559] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 811.242552][T15559] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 811.242578][T15559] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 811.512734][T14171] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.512767][T14171] usb 6-1: Product: syz [ 811.512781][T14171] usb 6-1: Manufacturer: syz [ 811.512794][T14171] usb 6-1: SerialNumber: syz [ 811.598191][T14171] r8152-cfgselector 6-1: Unknown version 0x0000 [ 811.598216][T14171] r8152-cfgselector 6-1: config 0 descriptor?? [ 813.728397][T15559] hsr_slave_0: entered promiscuous mode [ 813.737368][T15559] hsr_slave_1: entered promiscuous mode [ 813.740506][T15559] debugfs: 'hsr0' already exists in 'hsr' [ 813.740532][T15559] Cannot create hsr debugfs directory [ 814.452069][ T5249] 8021q: adding VLAN 0 to HW filter on device eth10 [ 814.752266][ T5712] r8152-cfgselector 6-1: USB disconnect, device number 4 [ 815.251107][T15830] netlink: 80 bytes leftover after parsing attributes in process `syz.5.2841'. [ 821.077918][T15883] tipc: Invalid UDP bearer configuration [ 821.078041][T15883] tipc: Enabling of bearer rejected, failed to enable media [ 822.516323][T14453] bridge_slave_1: left allmulticast mode [ 822.516359][T14453] bridge_slave_1: left promiscuous mode [ 822.516604][T14453] bridge0: port 2(bridge_slave_1) entered disabled state [ 822.765662][T14453] bridge_slave_0: left allmulticast mode [ 822.765699][T14453] bridge_slave_0: left promiscuous mode [ 822.766068][T14453] bridge0: port 1(bridge_slave_0) entered disabled state [ 824.795047][T15925] syz.5.2864(15925): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 826.280030][T15940] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2866'. [ 826.546361][T14453] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 826.616445][T14453] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 826.678082][T14453] bond0 (unregistering): Released all slaves [ 826.720729][T14171] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 826.732574][T15914] bridge1: entered promiscuous mode [ 826.814340][ T5249] 8021q: adding VLAN 0 to HW filter on device eth11 [ 826.914813][T14171] usb 6-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 826.927384][T14171] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 826.927452][T14171] usb 6-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 826.936104][T14171] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.936128][T14171] usb 6-1: Product: syz [ 826.936141][T14171] usb 6-1: Manufacturer: syz [ 826.936155][T14171] usb 6-1: SerialNumber: syz [ 827.059545][T14171] usb-storage 6-1:1.0: USB Mass Storage device detected [ 827.240267][T14171] usb-storage 6-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 827.245416][T14171] scsi host1: usb-storage 6-1:1.0 [ 827.751683][T14171] usb 6-1: USB disconnect, device number 5 [ 830.132378][T14453] hsr_slave_0: left promiscuous mode [ 830.197909][T14453] hsr_slave_1: left promiscuous mode [ 830.198617][T14453] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 830.236577][T14453] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 831.065686][ T201] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 831.220731][ T201] usb 3-1: New USB device found, idVendor=056e, idProduct=010c, bcdDevice= 0.40 [ 831.222787][ T201] usb 3-1: config 1 interface 0 altsetting 14 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 831.222819][ T201] usb 3-1: config 1 interface 0 altsetting 14 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 831.222834][ T201] usb 3-1: config 1 interface 0 has no altsetting 0 [ 831.224993][ T201] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 831.225017][ T201] usb 3-1: Product: syz [ 831.225030][ T201] usb 3-1: Manufacturer: syz [ 831.225043][ T201] usb 3-1: SerialNumber: syz [ 832.137031][T14453] team0 (unregistering): Port device team_slave_1 removed [ 832.221483][T14453] team0 (unregistering): Port device team_slave_0 removed [ 832.423358][ T5249] 8021q: adding VLAN 0 to HW filter on device eth12 [ 833.251629][T15994] bridge1: entered promiscuous mode [ 834.676041][ T201] usbhid 3-1:1.0: can't add hid device: -71 [ 834.676146][ T201] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 834.728883][ T201] usb 3-1: USB disconnect, device number 4 [ 836.496031][T16028] hub 8-0:1.0: USB hub found [ 836.496515][T16028] hub 8-0:1.0: 1 port detected [ 837.845690][ T201] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 838.062202][ T201] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 838.063709][ T201] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 838.063741][ T201] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 838.063766][ T201] usb 3-1: config 1 interface 0 has no altsetting 0 [ 838.075766][ T201] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.075794][ T201] usb 3-1: Product: syz [ 838.075809][ T201] usb 3-1: Manufacturer: syz [ 838.075822][ T201] usb 3-1: SerialNumber: syz [ 838.130163][T16047] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 838.130344][T16047] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 838.586312][T13908] usb 8-1: new low-speed USB device number 3 using dummy_hcd [ 838.745869][T13908] usb 8-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 838.747681][T13908] usb 8-1: config index 0 descriptor too short (expected 1307, got 27) [ 838.747708][T13908] usb 8-1: config 0 has an invalid interface number: 0 but max is -1 [ 838.747728][T13908] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 838.747991][T13908] usb 8-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 838.748032][T13908] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 838.748054][T13908] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 838.753326][T13908] usb 8-1: string descriptor 0 read error: -22 [ 838.949754][T13908] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 839.180870][T13908] usb 8-1: config 0 descriptor?? [ 839.193351][T16049] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 839.237571][T13908] hub 8-1:0.0: bad descriptor, ignoring hub [ 839.237605][T13908] hub 8-1:0.0: probe with driver hub failed with error -5 [ 839.242901][T13908] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input7 [ 839.248286][ T201] (unnamed net_device) (uninitialized): Assigned a random MAC address: 72:85:99:b7:cd:ce [ 840.270952][T16055] workqueue: Failed to create a rescuer kthread for wq "kdmflush/248:1": -EINTR [ 840.448137][ T201] rtl8150 3-1:1.0: eth22: rtl8150 is detected [ 840.658922][T16063] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2896'. [ 840.830297][T13908] usb 8-1: USB disconnect, device number 3 [ 840.830405][ C0] usb_acecad 8-1:0.0: can't resubmit intr, dummy_hcd.7-1/input0, status -19 [ 840.866893][ T201] usb 3-1: USB disconnect, device number 5 [ 844.117532][T16096] ip6erspan0: entered allmulticast mode [ 844.427948][ T5596] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 845.282886][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 845.321401][ T5596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 845.419683][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 845.473955][ T5596] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 845.879813][T16120] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2908'. [ 846.666328][T13908] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 846.816500][T13908] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 846.819264][T13908] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 846.819290][T13908] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 846.819307][T13908] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 846.819340][T13908] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 846.819380][T13908] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 846.819402][T13908] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 846.831471][T13908] usb 3-1: string descriptor 0 read error: -22 [ 846.831615][T13908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.893261][T13908] usb 3-1: config 0 descriptor?? [ 847.034204][T16131] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 847.114195][T13908] hub 3-1:0.0: bad descriptor, ignoring hub [ 847.114233][T13908] hub 3-1:0.0: probe with driver hub failed with error -5 [ 847.613336][ T5596] Bluetooth: hci3: command tx timeout [ 848.133527][T13908] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input9 [ 849.696052][ T5596] Bluetooth: hci3: command tx timeout [ 849.762127][T16159] hub 8-0:1.0: USB hub found [ 849.762576][T16159] hub 8-0:1.0: 1 port detected [ 851.676522][T13908] usb 3-1: USB disconnect, device number 6 [ 851.764278][ T5596] Bluetooth: hci3: command tx timeout [ 853.875619][ T5596] Bluetooth: hci3: command tx timeout [ 854.872844][ T43] bridge_slave_1: left allmulticast mode [ 854.872880][ T43] bridge_slave_1: left promiscuous mode [ 854.873151][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 854.986884][ T43] bridge_slave_0: left allmulticast mode [ 854.986912][ T43] bridge_slave_0: left promiscuous mode [ 854.989499][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 855.416183][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 855.487163][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 855.527216][ T43] bond0 (unregistering): Released all slaves [ 860.535593][ T5603] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 860.696450][ T5603] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 860.697960][ T5603] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 860.697990][ T5603] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 860.698026][ T5603] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.754509][ T5603] usb 4-1: config 0 descriptor?? [ 860.860050][ T43] hsr_slave_0: left promiscuous mode [ 860.902746][ T43] hsr_slave_1: left promiscuous mode [ 860.919867][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 860.982694][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 861.180792][ T5603] usbhid 4-1:0.0: can't add hid device: -71 [ 861.180920][ T5603] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 862.277855][ T5603] usb 4-1: USB disconnect, device number 6 [ 868.917472][ T43] team0 (unregistering): Port device team_slave_1 removed [ 869.124479][ T43] team0 (unregistering): Port device team_slave_0 removed [ 870.820085][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.820148][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 875.432669][T16348] binder: BINDER_SET_CONTEXT_MGR already set [ 875.432684][T16348] binder: 16345:16348 ioctl 4018620d 200000000040 returned -16 [ 875.444055][T16348] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 876.229736][T14171] bridge0: entered promiscuous mode [ 876.850497][T12239] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 876.938895][T12239] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 876.940340][T12239] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 876.941595][T12239] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 876.942521][T12239] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 877.208488][T16107] bridge0: port 1(bridge_slave_0) entered blocking state [ 877.210130][T16107] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.210349][T16107] bridge_slave_0: entered allmulticast mode [ 877.212723][T16107] bridge_slave_0: entered promiscuous mode [ 877.246740][T16107] bridge0: port 2(bridge_slave_1) entered blocking state [ 877.246973][T16107] bridge0: port 2(bridge_slave_1) entered disabled state [ 877.247239][T16107] bridge_slave_1: entered allmulticast mode [ 877.249953][T16107] bridge_slave_1: entered promiscuous mode [ 877.336961][T16107] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 877.342975][T16107] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 877.435164][T16107] team0: Port device team_slave_0 added [ 877.444858][T16107] team0: Port device team_slave_1 added [ 879.825079][T16107] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 879.825097][T16107] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 879.825122][T16107] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 879.831162][T16107] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 879.831179][T16107] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 879.831206][T16107] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 879.861969][ T5596] Bluetooth: hci1: command tx timeout [ 880.694715][T16407] binder: BINDER_SET_CONTEXT_MGR already set [ 880.694730][T16407] binder: 16404:16407 ioctl 4018620d 200000000040 returned -16 [ 880.820447][T16107] hsr_slave_0: entered promiscuous mode [ 880.830484][T16107] hsr_slave_1: entered promiscuous mode [ 880.855814][T16107] debugfs: 'hsr0' already exists in 'hsr' [ 880.855851][T16107] Cannot create hsr debugfs directory [ 881.158840][ T5249] 8021q: adding VLAN 0 to HW filter on device eth1 [ 881.905717][ T5596] Bluetooth: hci1: command tx timeout [ 884.683625][ T5596] Bluetooth: hci1: command tx timeout [ 887.037996][ T5596] Bluetooth: hci1: command tx timeout [ 887.580466][T16482] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2981'. [ 887.600459][T16107] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 887.639584][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 887.720334][T16107] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 887.772308][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 887.773327][T16107] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 887.852091][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 887.861203][T16107] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 887.913413][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 893.485179][T16370] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.485387][T16370] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.487437][T16370] bridge_slave_0: entered allmulticast mode [ 893.493121][T16370] bridge_slave_0: entered promiscuous mode [ 894.360575][T16370] bridge0: port 2(bridge_slave_1) entered blocking state [ 894.360691][T16370] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.360921][T16370] bridge_slave_1: entered allmulticast mode [ 894.535565][T16370] bridge_slave_1: entered promiscuous mode [ 896.994837][T16370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 897.083086][T16370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 897.179620][T16540] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2991'. [ 897.277813][ T5249] 8021q: adding VLAN 0 to HW filter on device eth2 [ 897.301364][T16370] team0: Port device team_slave_0 added [ 897.314049][T16370] team0: Port device team_slave_1 added [ 897.505183][T16370] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 897.505202][T16370] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 897.505230][T16370] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 898.518878][T16370] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 898.518895][T16370] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 898.518921][T16370] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 899.409148][T16552] tipc: Started in network mode [ 899.409179][T16552] tipc: Node identity 7f000001, cluster identity 4711 [ 899.639957][T16552] tipc: New replicast peer: 127.0.0.1 [ 900.415304][T16552] tipc: Enabled bearer , priority 10 [ 900.788122][T16553] tipc: Disabling bearer [ 900.825321][ T5600] tipc: Node number set to 2130706433 [ 901.280514][T16370] hsr_slave_0: entered promiscuous mode [ 901.286124][T16370] hsr_slave_1: entered promiscuous mode [ 901.291064][T16370] debugfs: 'hsr0' already exists in 'hsr' [ 901.291092][T16370] Cannot create hsr debugfs directory [ 901.550504][T16569] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3001'. [ 901.692097][T16107] 8021q: adding VLAN 0 to HW filter on device bond0 [ 906.412230][ T5596] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 906.450585][ T5596] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 906.455314][ T5596] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 906.471588][ T5596] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 906.475161][ T5596] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 906.976052][T16623] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3010'. [ 908.644796][T12239] Bluetooth: hci0: command tx timeout [ 910.705993][T12239] Bluetooth: hci0: command tx timeout [ 912.821431][T12239] Bluetooth: hci0: command tx timeout [ 912.944581][T16684] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3019'. [ 915.894218][T12239] Bluetooth: hci0: command tx timeout [ 919.096141][T16726] netlink: 100 bytes leftover after parsing attributes in process `syz.5.3027'. [ 919.841173][T16734] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3028'. [ 926.384366][T16782] bridge2: entered promiscuous mode [ 926.563000][T16785] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3039'. [ 932.426651][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 932.427233][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 936.136928][T16830] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3051'. [ 936.429281][T16823] bridge1: entered promiscuous mode [ 937.677703][ T5596] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 937.723929][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 937.727364][ T5596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 937.743462][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 937.778462][ T5596] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 939.926958][T12239] Bluetooth: hci3: command tx timeout [ 941.997118][T12239] Bluetooth: hci3: command tx timeout [ 943.822845][T16888] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3060'. [ 943.992679][T16890] bridge1: entered promiscuous mode [ 944.110387][T12239] Bluetooth: hci3: command tx timeout [ 947.135622][ T5596] Bluetooth: hci3: command tx timeout [ 948.117831][T16598] bridge0: port 1(bridge_slave_0) entered blocking state [ 948.148457][T16598] bridge0: port 1(bridge_slave_0) entered disabled state [ 948.213003][T16598] bridge_slave_0: entered allmulticast mode [ 948.424452][T16598] bridge_slave_0: entered promiscuous mode [ 948.765583][T16929] warning: `syz.5.3071' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 948.772893][T16598] bridge0: port 2(bridge_slave_1) entered blocking state [ 948.773018][T16598] bridge0: port 2(bridge_slave_1) entered disabled state [ 948.773275][T16598] bridge_slave_1: entered allmulticast mode [ 948.809444][T16598] bridge_slave_1: entered promiscuous mode [ 949.591494][ T1188] bridge_slave_1: left allmulticast mode [ 949.591529][ T1188] bridge_slave_1: left promiscuous mode [ 949.591783][ T1188] bridge0: port 2(bridge_slave_1) entered disabled state [ 949.828045][ T1188] bridge_slave_0: left allmulticast mode [ 949.828069][ T1188] bridge_slave_0: left promiscuous mode [ 949.828229][ T1188] bridge0: port 1(bridge_slave_0) entered disabled state [ 950.590488][T16944] netlink: 'syz.5.3076': attribute type 10 has an invalid length. [ 950.590508][T16944] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3076'. [ 951.127108][ T1188] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 951.216361][ T1188] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 951.277757][ T1188] bond0 (unregistering): Released all slaves [ 951.339065][T16931] bridge3: entered promiscuous mode [ 951.727874][T16944] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 951.830726][T16598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 952.176912][ T1188] hsr_slave_0: left promiscuous mode [ 952.195665][ T1188] hsr_slave_1: left promiscuous mode [ 952.200329][ T1188] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 952.247159][ T1188] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 953.439727][ T1188] team0 (unregistering): Port device team_slave_1 removed [ 953.486274][ T1188] team0 (unregistering): Port device team_slave_0 removed [ 953.741497][T16598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 953.943173][T16983] bridge2: entered promiscuous mode [ 953.946458][T16598] team0: Port device team_slave_0 added [ 953.972831][T16598] team0: Port device team_slave_1 added [ 953.972919][T16986] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3091'. [ 954.131653][T16598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 954.131670][T16598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 954.131690][T16598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 954.203320][T16598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 954.203336][T16598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 954.203362][T16598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 954.480038][T16598] hsr_slave_0: entered promiscuous mode [ 954.481470][T16598] hsr_slave_1: entered promiscuous mode [ 954.482892][T16598] debugfs: 'hsr0' already exists in 'hsr' [ 954.482916][T16598] Cannot create hsr debugfs directory [ 956.803289][T16843] bridge0: port 1(bridge_slave_0) entered blocking state [ 956.803499][T16843] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.803775][T16843] bridge_slave_0: entered allmulticast mode [ 956.902083][T16843] bridge_slave_0: entered promiscuous mode [ 957.014689][T17023] bridge2: entered promiscuous mode [ 957.015328][T16843] bridge0: port 2(bridge_slave_1) entered blocking state [ 957.028813][T16843] bridge0: port 2(bridge_slave_1) entered disabled state [ 957.029137][T16843] bridge_slave_1: entered allmulticast mode [ 957.034041][T16843] bridge_slave_1: entered promiscuous mode [ 957.570753][T16843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 957.601945][T16843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 957.751862][T16843] team0: Port device team_slave_0 added [ 957.781038][T16843] team0: Port device team_slave_1 added [ 958.020714][T16843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 958.020732][T16843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 958.020758][T16843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 958.070485][T16843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 958.070503][T16843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 958.070529][T16843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 960.389210][T16843] hsr_slave_0: entered promiscuous mode [ 960.404247][T16843] hsr_slave_1: entered promiscuous mode [ 960.419104][T16843] debugfs: 'hsr0' already exists in 'hsr' [ 960.419128][T16843] Cannot create hsr debugfs directory [ 961.435967][T17075] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3115'. [ 961.435992][T17075] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3115'. [ 961.870332][T17085] netlink: 'syz.3.3119': attribute type 2 has an invalid length. [ 961.870362][T17085] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3119'. [ 961.923260][T17087] netlink: 'syz.3.3119': attribute type 2 has an invalid length. [ 961.923282][T17087] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3119'. [ 963.619348][T17110] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3124'. [ 963.619371][T17110] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3124'. [ 964.400787][ T1188] bridge_slave_1: left allmulticast mode [ 964.400822][ T1188] bridge_slave_1: left promiscuous mode [ 964.401069][ T1188] bridge0: port 2(bridge_slave_1) entered disabled state [ 965.024105][ T1188] bridge_slave_0: left allmulticast mode [ 965.024141][ T1188] bridge_slave_0: left promiscuous mode [ 965.024382][ T1188] bridge0: port 1(bridge_slave_0) entered disabled state [ 965.373016][ T5596] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 965.414467][ T5596] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 965.431495][ T5596] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 965.433007][ T5596] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 965.456672][ T5596] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 966.256627][ T1188] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 966.376591][ T1188] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 967.391890][ T1188] bond0 (unregistering): Released all slaves [ 967.446522][T17177] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3133'. [ 967.446545][T17177] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3133'. [ 967.675699][T12239] Bluetooth: hci1: command tx timeout [ 968.636324][ T1188] hsr_slave_0: left promiscuous mode [ 968.710670][ T1188] hsr_slave_1: left promiscuous mode [ 968.711725][ T1188] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 968.776489][ T1188] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 969.753791][T12239] Bluetooth: hci1: command tx timeout [ 970.837104][ T1188] team0 (unregistering): Port device team_slave_1 removed [ 970.919110][ T1188] team0 (unregistering): Port device team_slave_0 removed [ 971.297800][ T5704] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 971.467503][ T5704] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 971.471463][ T5704] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 971.471491][ T5704] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 971.471510][ T5704] usb 6-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 971.471529][ T5704] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 971.471571][ T5704] usb 6-1: too many endpoints for config 0 interface 0 altsetting 48: 48, using maximum allowed: 30 [ 971.471606][ T5704] usb 6-1: config 0 interface 0 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 971.471632][ T5704] usb 6-1: config 0 interface 0 has no altsetting 0 [ 971.521391][T17257] random: crng reseeded on system resumption [ 971.571948][ T5704] usb 6-1: string descriptor 0 read error: -22 [ 971.572092][ T5704] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.618348][ T5704] usb 6-1: config 0 descriptor?? [ 971.650997][ T5704] hub 6-1:0.0: bad descriptor, ignoring hub [ 971.651036][ T5704] hub 6-1:0.0: probe with driver hub failed with error -5 [ 971.911219][T12239] Bluetooth: hci1: command tx timeout [ 972.727858][ T5704] usb 6-1: USB disconnect, device number 6 [ 972.837392][T17267] bridge1: left promiscuous mode [ 972.839913][T17267] ip6erspan0: left allmulticast mode [ 972.842316][T17267] bridge2: left promiscuous mode [ 972.844702][T17267] bridge3: left promiscuous mode [ 974.047379][ T5596] Bluetooth: hci1: command tx timeout [ 974.501873][T17299] random: crng reseeded on system resumption [ 975.561529][T17137] bridge0: port 1(bridge_slave_0) entered blocking state [ 975.561756][T17137] bridge0: port 1(bridge_slave_0) entered disabled state [ 975.561976][T17137] bridge_slave_0: entered allmulticast mode [ 975.564635][T17137] bridge_slave_0: entered promiscuous mode [ 975.601317][T17137] bridge0: port 2(bridge_slave_1) entered blocking state [ 975.601520][T17137] bridge0: port 2(bridge_slave_1) entered disabled state [ 975.601747][T17137] bridge_slave_1: entered allmulticast mode [ 975.604336][T17137] bridge_slave_1: entered promiscuous mode [ 975.672994][T17137] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 975.688440][T17137] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 975.737002][T17137] team0: Port device team_slave_0 added [ 975.739835][T17137] team0: Port device team_slave_1 added [ 975.759623][T12239] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 975.808888][T17137] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 975.808906][T17137] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 975.808930][T17137] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 975.871644][T17137] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 975.871661][T17137] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 975.871696][T17137] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 976.246022][ T201] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 976.409066][ T201] usb 4-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 976.425828][ T201] usb 4-1: config index 0 descriptor too short (expected 1307, got 27) [ 976.425854][ T201] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 976.425872][ T201] usb 4-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 976.425890][ T201] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 976.425920][ T201] usb 4-1: too many endpoints for config 0 interface 0 altsetting 48: 48, using maximum allowed: 30 [ 976.425955][ T201] usb 4-1: config 0 interface 0 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 976.425978][ T201] usb 4-1: config 0 interface 0 has no altsetting 0 [ 976.432992][ T201] usb 4-1: string descriptor 0 read error: -22 [ 976.433111][ T201] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.638821][ T201] usb 4-1: config 0 descriptor?? [ 976.641794][ T201] hub 4-1:0.0: bad descriptor, ignoring hub [ 976.641827][ T201] hub 4-1:0.0: probe with driver hub failed with error -5 [ 978.047040][T17137] hsr_slave_0: entered promiscuous mode [ 978.049115][T17137] hsr_slave_1: entered promiscuous mode [ 978.050490][T17137] debugfs: 'hsr0' already exists in 'hsr' [ 978.050514][T17137] Cannot create hsr debugfs directory [ 978.185931][ T5600] usb 4-1: USB disconnect, device number 7 [ 983.162309][T16843] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 983.214887][T16843] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 983.328211][T16843] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 983.501689][T16843] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 985.214568][T16843] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 985.721911][T16843] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 985.782897][T16843] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 985.840494][T16843] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 987.889607][T16843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 988.015354][T16843] 8021q: adding VLAN 0 to HW filter on device team0 [ 988.051431][T14038] bridge0: port 1(bridge_slave_0) entered blocking state [ 988.051565][T14038] bridge0: port 1(bridge_slave_0) entered forwarding state [ 988.347437][T16910] bridge0: port 2(bridge_slave_1) entered blocking state [ 988.347973][T16910] bridge0: port 2(bridge_slave_1) entered forwarding state [ 988.715588][T13908] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 988.885517][T13908] usb 6-1: Using ep0 maxpacket: 32 [ 988.886343][T13908] usb 6-1: New USB device found, idVendor=6103, idProduct=903e, bcdDevice=73.20 [ 988.887794][T13908] usb 6-1: config 0 has an invalid interface number: 148 but max is 0 [ 988.887817][T13908] usb 6-1: config 0 has no interface number 0 [ 988.887848][T13908] usb 6-1: config 0 interface 148 has no altsetting 0 [ 988.890765][T13908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.890789][T13908] usb 6-1: Product: syz [ 988.890803][T13908] usb 6-1: Manufacturer: syz [ 988.890817][T13908] usb 6-1: SerialNumber: syz [ 988.989393][T13908] usb 6-1: config 0 descriptor?? [ 990.327832][T13908] usb-storage 6-1:0.148: USB Mass Storage device detected [ 990.939650][T13908] usb 6-1: USB disconnect, device number 7 [ 993.470998][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.471066][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 996.719540][T16857] bridge_slave_1: left allmulticast mode [ 996.719576][T16857] bridge_slave_1: left promiscuous mode [ 996.719843][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 996.941794][T16857] bridge_slave_0: left allmulticast mode [ 996.941829][T16857] bridge_slave_0: left promiscuous mode [ 996.942083][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 997.614872][ T5596] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 997.677517][ T5596] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 997.685292][ T5596] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 997.690489][ T5596] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 997.713083][ T5596] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 999.905623][ T5596] Bluetooth: hci0: command tx timeout [ 1001.001833][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1001.070872][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1001.332423][T16857] bond0 (unregistering): Released all slaves [ 1002.399097][ T5596] Bluetooth: hci0: command tx timeout [ 1002.864753][ T37] audit: type=1326 audit(1002.665:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17651 comm="syz.5.3229" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa26fa8e0d9 code=0x0 [ 1006.003534][ T5596] Bluetooth: hci0: command tx timeout [ 1006.565639][T15187] usb 6-1: new low-speed USB device number 8 using dummy_hcd [ 1006.798853][T16857] hsr_slave_0: left promiscuous mode [ 1006.808241][T15187] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 1006.809604][T15187] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 1006.809629][T15187] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 1006.809648][T15187] usb 6-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 1006.809667][T15187] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1006.809700][T15187] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 1006.809735][T15187] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 246 [ 1006.837481][T15187] usb 6-1: string descriptor 0 read error: -22 [ 1006.837630][T15187] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.911788][T15187] usb 6-1: config 0 descriptor?? [ 1006.921444][T16857] hsr_slave_1: left promiscuous mode [ 1006.922468][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1006.940587][T15187] hub 6-1:0.0: bad descriptor, ignoring hub [ 1006.940619][T15187] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1007.007714][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1007.235888][T13910] usb 6-1: USB disconnect, device number 8 [ 1007.437858][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1007.497105][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1008.118445][T12239] Bluetooth: hci0: command tx timeout [ 1008.410099][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1013.440770][T17604] bridge0: port 1(bridge_slave_0) entered blocking state [ 1013.440987][T17604] bridge0: port 1(bridge_slave_0) entered disabled state [ 1013.441221][T17604] bridge_slave_0: entered allmulticast mode [ 1013.467948][T17604] bridge_slave_0: entered promiscuous mode [ 1013.472633][T17604] bridge0: port 2(bridge_slave_1) entered blocking state [ 1013.472864][T17604] bridge0: port 2(bridge_slave_1) entered disabled state [ 1013.473211][T17604] bridge_slave_1: entered allmulticast mode [ 1013.510717][T17604] bridge_slave_1: entered promiscuous mode [ 1013.582585][T17604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1013.604006][T17604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1013.654656][T17604] team0: Port device team_slave_0 added [ 1013.664489][T17604] team0: Port device team_slave_1 added [ 1013.795876][T17604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1013.795893][T17604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1013.795919][T17604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1013.852387][T17604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1013.852473][T17604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1013.852496][T17604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1016.659974][T17604] hsr_slave_0: entered promiscuous mode [ 1016.663393][T17604] hsr_slave_1: entered promiscuous mode [ 1016.666099][T17604] debugfs: 'hsr0' already exists in 'hsr' [ 1016.666126][T17604] Cannot create hsr debugfs directory [ 1017.006644][T17790] ip6erspan0: entered allmulticast mode [ 1018.096743][T17137] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1018.131269][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1018.144454][T17137] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1018.742958][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1019.256349][T17137] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1019.715789][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1019.726379][T17137] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1019.762822][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1020.782599][T17137] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1021.097295][T16857] bridge_slave_1: left allmulticast mode [ 1021.097332][T16857] bridge_slave_1: left promiscuous mode [ 1021.097619][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1021.633504][T16857] bridge_slave_0: left allmulticast mode [ 1021.633548][T16857] bridge_slave_0: left promiscuous mode [ 1021.633801][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1021.963718][T17845] netlink: 'syz.7.3268': attribute type 2 has an invalid length. [ 1021.963739][T17845] netlink: 132 bytes leftover after parsing attributes in process `syz.7.3268'. [ 1025.006863][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1025.067838][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1025.087499][T16857] bond0 (unregistering): Released all slaves [ 1025.127489][T17137] 8021q: adding VLAN 0 to HW filter on device team0 [ 1025.162990][T17846] ip6erspan0: entered allmulticast mode [ 1025.854814][T17606] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1025.916167][T17606] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1025.919430][T17606] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1026.020064][T17606] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1026.023263][T17606] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1026.709088][T16857] hsr_slave_0: left promiscuous mode [ 1026.755762][T16857] hsr_slave_1: left promiscuous mode [ 1026.756475][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1026.852158][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1028.222794][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1028.288550][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1028.458794][T12239] Bluetooth: hci3: command tx timeout [ 1029.482629][T17913] 9pnet: p9_errstr2errno: server reported unknown error 0x000000 [ 1030.474115][T12239] Bluetooth: hci3: command tx timeout [ 1032.420715][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1032.425203][T17950] hub 8-0:1.0: USB hub found [ 1032.441958][T17950] hub 8-0:1.0: 1 port detected [ 1032.547541][T12239] Bluetooth: hci3: command tx timeout [ 1034.626137][T12239] Bluetooth: hci3: command tx timeout [ 1034.659396][T17986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3297'. [ 1034.659420][T17986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3297'. [ 1037.721349][T17876] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.721474][T17876] bridge0: port 1(bridge_slave_0) entered disabled state [ 1037.721722][T17876] bridge_slave_0: entered allmulticast mode [ 1037.761247][T17876] bridge_slave_0: entered promiscuous mode [ 1037.808714][T17876] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.811049][T17876] bridge0: port 2(bridge_slave_1) entered disabled state [ 1037.813340][T17876] bridge_slave_1: entered allmulticast mode [ 1037.842837][T17876] bridge_slave_1: entered promiscuous mode [ 1039.554110][T18053] hub 8-0:1.0: USB hub found [ 1039.560880][T18051] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3306'. [ 1039.560905][T18051] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3306'. [ 1039.566108][T18053] hub 8-0:1.0: 1 port detected [ 1039.707523][T17876] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1039.779634][T17876] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1040.534184][T17876] team0: Port device team_slave_0 added [ 1040.754623][T17876] team0: Port device team_slave_1 added [ 1042.860245][T17876] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1042.860288][T17876] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1042.860314][T17876] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1042.869997][T17876] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1042.870015][T17876] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1042.870042][T17876] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1043.234741][T17876] hsr_slave_0: entered promiscuous mode [ 1043.247939][T17876] hsr_slave_1: entered promiscuous mode [ 1043.249603][T17876] debugfs: 'hsr0' already exists in 'hsr' [ 1043.249629][T17876] Cannot create hsr debugfs directory [ 1044.908189][T17604] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1044.965171][T17604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1045.964505][T17604] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1046.378888][T17604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1046.579336][T17604] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1046.624296][T17604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1047.612787][T17604] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1047.737641][T17604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1053.370589][T16857] bridge_slave_1: left allmulticast mode [ 1053.370626][T16857] bridge_slave_1: left promiscuous mode [ 1053.370909][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1053.629275][T16857] bridge_slave_0: left allmulticast mode [ 1053.629311][T16857] bridge_slave_0: left promiscuous mode [ 1053.629558][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1054.240163][T13910] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 1054.386842][T13910] usb 6-1: New USB device found, idVendor=046d, idProduct=c70e, bcdDevice= 0.00 [ 1054.387941][T13910] usb 6-1: config 0 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1054.387972][T13910] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1054.388000][T13910] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1054.392701][T13910] usb 6-1: config 0 descriptor?? [ 1054.843813][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.843978][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.906147][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1054.986167][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1055.048558][T16857] bond0 (unregistering): Released all slaves [ 1055.274406][T17604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1055.307855][T17604] 8021q: adding VLAN 0 to HW filter on device team0 [ 1055.308115][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.308154][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.308182][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.308217][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.308244][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.308269][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.308296][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.347133][T14453] bridge0: port 1(bridge_slave_0) entered blocking state [ 1055.347259][T14453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1055.372077][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.372120][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.372148][T13910] logitech-djreceiver 0003:046D:C70E.0004: unknown main item tag 0x0 [ 1055.565857][T13910] usb 6-1: USB disconnect, device number 9 [ 1058.656622][T14079] bridge0: port 2(bridge_slave_1) entered blocking state [ 1058.656720][T14079] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1058.733710][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1058.977299][T17606] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1059.040396][T17606] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1059.043873][T17606] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1059.070558][T17606] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1059.093446][T17606] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1059.725771][T16857] hsr_slave_0: left promiscuous mode [ 1060.454037][T16857] hsr_slave_1: left promiscuous mode [ 1060.455069][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1060.569529][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1061.058582][T18240] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1061.185687][T17606] Bluetooth: hci1: command tx timeout [ 1062.493081][T18246] random: crng reseeded on system resumption [ 1062.600764][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1062.637627][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1063.265496][T17606] Bluetooth: hci1: command tx timeout [ 1063.735835][ T5712] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 1064.144796][ T5712] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1064.428205][ T5712] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1064.428242][ T5712] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1064.428285][ T5712] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1064.431232][ T5712] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1064.431258][ T5712] usb 4-1: Product: syz [ 1064.431271][ T5712] usb 4-1: Manufacturer: syz [ 1064.431286][ T5712] usb 4-1: SerialNumber: syz [ 1064.610990][T18260] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1064.765152][T18268] Unsupported ieee802154 address type: 0 [ 1064.855287][T18260] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1065.345494][T17606] Bluetooth: hci1: command tx timeout [ 1065.469039][T18260] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1065.687104][ T5712] cdc_ncm 4-1:1.0: failed to get mac address [ 1065.938018][ T5712] cdc_ncm 4-1:1.0: bind() failure [ 1065.962977][ T5712] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1065.963772][ T5712] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1065.965214][ T5712] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 1065.995294][ T5712] usb 4-1: USB disconnect, device number 8 [ 1066.407800][T18292] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3364'. [ 1066.407838][T18292] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3364'. [ 1067.050303][T18301] random: crng reseeded on system resumption [ 1067.628162][T17606] Bluetooth: hci1: command tx timeout [ 1073.055605][T13910] usb 4-1: new low-speed USB device number 9 using dummy_hcd [ 1073.192618][T18213] bridge0: port 1(bridge_slave_0) entered blocking state [ 1073.207752][T18213] bridge0: port 1(bridge_slave_0) entered disabled state [ 1073.208022][T18213] bridge_slave_0: entered allmulticast mode [ 1073.212279][T18213] bridge_slave_0: entered promiscuous mode [ 1073.236806][T18213] bridge0: port 2(bridge_slave_1) entered blocking state [ 1073.237036][T18213] bridge0: port 2(bridge_slave_1) entered disabled state [ 1073.237618][T18213] bridge_slave_1: entered allmulticast mode [ 1073.240564][T18213] bridge_slave_1: entered promiscuous mode [ 1073.274200][T13910] usb 4-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 1073.294723][T13910] usb 4-1: config index 0 descriptor too short (expected 1307, got 27) [ 1073.294785][T13910] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 1073.294814][T13910] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1073.294864][T13910] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 1073.294908][T13910] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 1073.294935][T13910] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 1073.463014][T18213] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1073.521285][T18213] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1073.618457][T18213] team0: Port device team_slave_0 added [ 1073.672365][T18213] team0: Port device team_slave_1 added [ 1074.584958][T18213] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1074.584975][T18213] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1074.585059][T18213] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1074.636169][T18213] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1074.636187][T18213] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1074.636212][T18213] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1075.166471][T18213] hsr_slave_0: entered promiscuous mode [ 1075.187458][T18213] hsr_slave_1: entered promiscuous mode [ 1075.190403][T18213] debugfs: 'hsr0' already exists in 'hsr' [ 1075.190430][T18213] Cannot create hsr debugfs directory [ 1076.564408][T13910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.585885][T13910] usb 4-1: config 0 descriptor?? [ 1076.637167][T13910] usb 4-1: can't set config #0, error -71 [ 1076.685639][T13910] usb 4-1: USB disconnect, device number 9 [ 1078.191806][T18382] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3379'. [ 1081.857195][T17876] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1081.901399][T17876] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1081.903069][T17876] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1081.998276][T17876] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1082.006538][T17876] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1082.149659][T17876] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1083.162126][T17876] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1083.251695][T17876] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1083.940557][T18466] usb usb8: usbfs: process 18466 (syz.7.3393) did not claim interface 0 before use [ 1084.363786][T17876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1084.398562][T17876] 8021q: adding VLAN 0 to HW filter on device team0 [ 1084.426801][ T1188] bridge0: port 1(bridge_slave_0) entered blocking state [ 1084.426997][ T1188] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1084.500132][ T1188] bridge0: port 2(bridge_slave_1) entered blocking state [ 1084.500352][ T1188] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1086.245921][T16857] bridge_slave_1: left allmulticast mode [ 1086.245956][T16857] bridge_slave_1: left promiscuous mode [ 1086.246217][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1086.407373][T16857] bridge_slave_0: left allmulticast mode [ 1086.407408][T16857] bridge_slave_0: left promiscuous mode [ 1086.407675][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1086.510446][T12239] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1086.560645][T12239] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1086.562168][T12239] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1086.622626][T12239] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1086.637024][T12239] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1088.865673][T17606] Bluetooth: hci0: command tx timeout [ 1088.956283][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1089.077824][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1089.160759][T16857] bond0 (unregistering): Released all slaves [ 1089.292429][T18506] vlan2: entered promiscuous mode [ 1089.292452][T18506] bond0: entered promiscuous mode [ 1089.292465][T18506] bond_slave_0: entered promiscuous mode [ 1089.292696][T18506] bond_slave_1: entered promiscuous mode [ 1089.760343][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1091.817862][T17606] Bluetooth: hci0: command tx timeout [ 1093.284498][T16857] hsr_slave_0: left promiscuous mode [ 1093.305618][T16857] hsr_slave_1: left promiscuous mode [ 1093.306300][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1093.487461][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1094.169036][T17606] Bluetooth: hci0: command tx timeout [ 1094.627783][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1094.656609][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1096.243345][T17606] Bluetooth: hci0: command tx timeout [ 1100.081394][T18512] bridge0: port 1(bridge_slave_0) entered blocking state [ 1100.081603][T18512] bridge0: port 1(bridge_slave_0) entered disabled state [ 1100.081811][T18512] bridge_slave_0: entered allmulticast mode [ 1100.084467][T18512] bridge_slave_0: entered promiscuous mode [ 1100.089175][T18512] bridge0: port 2(bridge_slave_1) entered blocking state [ 1100.089446][T18512] bridge0: port 2(bridge_slave_1) entered disabled state [ 1100.089616][T18512] bridge_slave_1: entered allmulticast mode [ 1100.091717][T18512] bridge_slave_1: entered promiscuous mode [ 1101.314783][T18512] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1101.345062][T18512] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1101.483135][T18512] team0: Port device team_slave_0 added [ 1101.498435][T18512] team0: Port device team_slave_1 added [ 1101.798106][T18701] netlink: 'syz.7.3451': attribute type 83 has an invalid length. [ 1101.968692][T18512] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1101.968709][T18512] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1101.968731][T18512] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1102.034592][T18512] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1102.034609][T18512] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1102.034630][T18512] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1102.098596][ T201] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1102.266701][ T201] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1102.268045][ T201] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1102.268071][ T201] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1102.268097][ T201] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1102.274777][ T201] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1102.274805][ T201] usb 4-1: Product: syz [ 1102.274819][ T201] usb 4-1: Manufacturer: syz [ 1102.274833][ T201] usb 4-1: SerialNumber: syz [ 1103.284097][T18512] hsr_slave_0: entered promiscuous mode [ 1103.330131][T18512] hsr_slave_1: entered promiscuous mode [ 1103.330519][ T201] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1103.356657][T18512] debugfs: 'hsr0' already exists in 'hsr' [ 1103.356683][T18512] Cannot create hsr debugfs directory [ 1103.378994][ T201] usb 4-1: USB disconnect, device number 10 [ 1103.449804][ T201] usblp0: removed [ 1105.009658][T18750] random: crng reseeded on system resumption [ 1106.231250][T18765] netlink: 'syz.7.3462': attribute type 83 has an invalid length. [ 1106.370355][T18767] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3463'. [ 1106.509158][T18213] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1106.552278][T18213] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1106.554473][T18213] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1107.530251][T18213] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1107.545231][T18213] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1107.714997][T18213] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1107.921453][ T201] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1108.085515][ T201] usb 6-1: Using ep0 maxpacket: 16 [ 1108.087311][ T201] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1108.087362][ T201] usb 6-1: no configurations [ 1108.087374][ T201] usb 6-1: can't read configurations, error -22 [ 1109.052627][T18213] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1109.105619][ T201] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1109.153956][T18213] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1109.255641][ T201] usb 6-1: Using ep0 maxpacket: 16 [ 1109.256448][ T201] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1109.256509][ T201] usb 6-1: no configurations [ 1109.256520][ T201] usb 6-1: can't read configurations, error -22 [ 1109.256991][ T201] usb usb6-port1: attempt power cycle [ 1109.595460][ T201] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1109.617253][ T201] usb 6-1: Using ep0 maxpacket: 16 [ 1109.618026][ T201] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1109.618078][ T201] usb 6-1: no configurations [ 1109.618271][ T201] usb 6-1: can't read configurations, error -22 [ 1109.681633][T18803] netlink: 'syz.3.3471': attribute type 83 has an invalid length. [ 1109.755507][ T201] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1109.779007][ T201] usb 6-1: Using ep0 maxpacket: 16 [ 1109.779794][ T201] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1109.779847][ T201] usb 6-1: no configurations [ 1109.779860][ T201] usb 6-1: can't read configurations, error -22 [ 1109.780428][ T201] usb usb6-port1: unable to enumerate USB device [ 1109.881410][T18213] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1109.923225][T18213] 8021q: adding VLAN 0 to HW filter on device team0 [ 1109.947603][T15889] bridge0: port 1(bridge_slave_0) entered blocking state [ 1109.947847][T15889] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1109.988383][ T1206] bridge0: port 2(bridge_slave_1) entered blocking state [ 1109.988514][ T1206] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1110.351090][T18811] random: crng reseeded on system resumption [ 1114.053356][T18213] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1115.144534][T16857] bridge_slave_1: left allmulticast mode [ 1115.144569][T16857] bridge_slave_1: left promiscuous mode [ 1115.144846][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1115.340381][T18853] netlink: 'syz.5.3480': attribute type 83 has an invalid length. [ 1115.342622][T16857] bridge_slave_0: left allmulticast mode [ 1115.342655][T16857] bridge_slave_0: left promiscuous mode [ 1115.342889][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1116.113784][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.114603][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.884519][T18873] random: crng reseeded on system resumption [ 1117.507959][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1117.596355][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1117.638650][T16857] bond0 (unregistering): Released all slaves [ 1117.708916][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1120.880844][T12239] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1121.019476][T12239] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1121.052982][T12239] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1121.645938][T12239] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1121.649838][T12239] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1121.665236][T18906] netlink: 'syz.7.3489': attribute type 83 has an invalid length. [ 1122.042356][T16857] hsr_slave_0: left promiscuous mode [ 1122.071820][T16857] hsr_slave_1: left promiscuous mode [ 1122.083639][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1122.207903][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1123.580973][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1123.678501][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1123.825527][T17606] Bluetooth: hci3: command tx timeout [ 1124.552573][ T5249] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1124.645944][T18921] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1124.646149][T18921] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1124.751146][T18921] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1124.751283][T18921] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1124.864000][T18921] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1124.865730][T18921] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1125.039168][T18921] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1125.039263][T18921] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1125.208716][T18921] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1125.336784][T18921] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1125.336876][T18921] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1125.487038][T18921] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1126.105789][T18957] netlink: 'syz.7.3499': attribute type 83 has an invalid length. [ 1126.206074][ T31] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1126.496497][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 1126.497349][ T31] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1126.497402][ T31] usb 6-1: no configurations [ 1126.497414][ T31] usb 6-1: can't read configurations, error -22 [ 1126.631038][ T31] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1126.705536][T17606] Bluetooth: hci5: command 0x0406 tx timeout [ 1126.785518][T17606] Bluetooth: hci6: command 0x0406 tx timeout [ 1126.805487][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 1126.806313][ T31] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1126.806365][ T31] usb 6-1: no configurations [ 1126.806377][ T31] usb 6-1: can't read configurations, error -22 [ 1126.806698][ T31] usb usb6-port1: attempt power cycle [ 1126.866477][T17606] Bluetooth: hci2: command 0x0406 tx timeout [ 1127.105638][T17606] Bluetooth: hci0: command 0x0c1a tx timeout [ 1127.175558][ T31] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1127.196347][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 1127.200202][ T31] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1127.200256][ T31] usb 6-1: no configurations [ 1127.200268][ T31] usb 6-1: can't read configurations, error -22 [ 1127.383603][T17606] Bluetooth: hci3: command 0x040f tx timeout [ 1127.385950][ T31] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1127.406255][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 1127.410695][ T31] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1127.410749][ T31] usb 6-1: no configurations [ 1127.410761][ T31] usb 6-1: can't read configurations, error -22 [ 1127.411330][ T31] usb usb6-port1: unable to enumerate USB device [ 1128.788009][T17606] Bluetooth: hci5: command 0x0406 tx timeout [ 1129.409379][T17606] Bluetooth: hci6: command 0x0406 tx timeout [ 1129.409502][T17606] Bluetooth: hci2: command 0x0406 tx timeout [ 1129.431172][T17606] Bluetooth: hci0: command 0x0c1a tx timeout [ 1129.567413][T12239] Bluetooth: hci3: command 0x040f tx timeout [ 1129.795501][T19004] netlink: 'syz.5.3508': attribute type 83 has an invalid length. [ 1131.505645][T17606] Bluetooth: hci0: command 0x0c1a tx timeout [ 1131.737651][T18898] bridge0: port 1(bridge_slave_0) entered blocking state [ 1131.741058][T18898] bridge0: port 1(bridge_slave_0) entered disabled state [ 1131.741316][T18898] bridge_slave_0: entered allmulticast mode [ 1131.771584][T18898] bridge_slave_0: entered promiscuous mode [ 1131.784589][T18898] bridge0: port 2(bridge_slave_1) entered blocking state [ 1131.797522][T18898] bridge0: port 2(bridge_slave_1) entered disabled state [ 1131.797782][T18898] bridge_slave_1: entered allmulticast mode [ 1131.803623][T18898] bridge_slave_1: entered promiscuous mode [ 1131.863363][T17606] Bluetooth: hci3: command 0x040f tx timeout [ 1134.178220][T18898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1134.614422][T18898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1136.135646][T17606] Bluetooth: hci3: command 0x040f tx timeout [ 1136.268966][T18512] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1136.352847][T18512] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1136.418402][T18898] team0: Port device team_slave_0 added [ 1136.435665][T15187] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1136.976547][T15187] usb 6-1: Using ep0 maxpacket: 16 [ 1137.042636][T15187] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1137.042881][T15187] usb 6-1: no configurations [ 1137.042945][T15187] usb 6-1: can't read configurations, error -22 [ 1137.426815][T19063] netlink: 'syz.3.3518': attribute type 83 has an invalid length. [ 1137.475505][T15187] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1137.625545][T15187] usb 6-1: Using ep0 maxpacket: 16 [ 1137.641629][T15187] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1137.641686][T15187] usb 6-1: no configurations [ 1137.641698][T15187] usb 6-1: can't read configurations, error -22 [ 1137.644498][T15187] usb usb6-port1: attempt power cycle [ 1138.163184][T17606] Bluetooth: hci3: command 0x040f tx timeout [ 1138.764890][T19073] netlink: 'syz.3.3520': attribute type 2 has an invalid length. [ 1138.764916][T19073] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3520'. [ 1140.302171][T15187] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1140.431841][T15187] usb 6-1: device descriptor read/8, error -71 [ 1141.014407][T19098] netlink: 'syz.3.3528': attribute type 83 has an invalid length. [ 1142.240558][T19106] netlink: 'syz.3.3530': attribute type 2 has an invalid length. [ 1142.240583][T19106] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3530'. [ 1142.433990][T18512] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1143.330317][T18512] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1143.343562][T18898] team0: Port device team_slave_1 added [ 1143.442176][T18512] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1143.691822][T18512] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1143.769155][T18512] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1143.840875][T18512] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1143.865592][ T31] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1143.894391][T18898] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1143.894408][T18898] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1143.894433][T18898] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1143.907338][T18898] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1143.907357][T18898] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1143.907382][T18898] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1144.075584][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 1144.077083][ T31] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1144.077135][ T31] usb 4-1: no configurations [ 1144.077146][ T31] usb 4-1: can't read configurations, error -22 [ 1144.274915][ T31] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1144.951325][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 1144.952276][ T31] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1144.952333][ T31] usb 4-1: no configurations [ 1144.952346][ T31] usb 4-1: can't read configurations, error -22 [ 1144.953146][ T31] usb usb4-port1: attempt power cycle [ 1145.907204][ T31] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1146.159002][ T31] usb 4-1: device descriptor read/8, error -71 [ 1146.328069][T18898] hsr_slave_0: entered promiscuous mode [ 1146.329201][T18898] hsr_slave_1: entered promiscuous mode [ 1146.330215][T18898] debugfs: 'hsr0' already exists in 'hsr' [ 1146.330231][T18898] Cannot create hsr debugfs directory [ 1147.511173][T12239] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1147.550379][T12239] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1147.553400][T12239] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1147.562175][T12239] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1147.569693][T12239] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1150.204730][T12239] Bluetooth: hci0: command tx timeout [ 1150.895468][T13908] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1151.045485][T13908] usb 6-1: Using ep0 maxpacket: 16 [ 1151.046253][T13908] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1151.046290][T13908] usb 6-1: no configurations [ 1151.046302][T13908] usb 6-1: can't read configurations, error -22 [ 1152.256293][T12239] Bluetooth: hci0: command tx timeout [ 1152.735446][T13908] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1154.308552][T12239] Bluetooth: hci0: command tx timeout [ 1155.917667][T16857] bridge_slave_1: left allmulticast mode [ 1155.917703][T16857] bridge_slave_1: left promiscuous mode [ 1155.917958][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1156.100613][T16857] bridge_slave_0: left allmulticast mode [ 1156.100649][T16857] bridge_slave_0: left promiscuous mode [ 1156.100904][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1156.395623][T12239] Bluetooth: hci0: command tx timeout [ 1156.438653][T16857] ip6gretap0: left allmulticast mode [ 1156.438688][T16857] ip6gretap0: left promiscuous mode [ 1156.438925][T16857] bridge0: port 4(ip6gretap0) entered disabled state [ 1156.600935][T16857] veth1_to_hsr: left allmulticast mode [ 1156.600969][T16857] veth1_to_hsr: left promiscuous mode [ 1156.601196][T16857] bridge0: port 3(veth1_to_hsr) entered disabled state [ 1156.778827][T16857] bridge_slave_1: left allmulticast mode [ 1156.778864][T16857] bridge_slave_1: left promiscuous mode [ 1156.779395][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1156.888514][T16857] bridge_slave_0: left allmulticast mode [ 1156.888561][T16857] bridge_slave_0: left promiscuous mode [ 1156.888842][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1157.644897][T13908] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1157.845594][T13908] usb 4-1: Using ep0 maxpacket: 16 [ 1157.894735][T13908] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1157.894792][T13908] usb 4-1: no configurations [ 1157.894805][T13908] usb 4-1: can't read configurations, error -22 [ 1158.035520][T13908] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1158.205457][T13908] usb 4-1: Using ep0 maxpacket: 16 [ 1158.206213][T13908] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1158.206248][T13908] usb 4-1: no configurations [ 1158.206254][T13908] usb 4-1: can't read configurations, error -22 [ 1158.206598][T13908] usb usb4-port1: attempt power cycle [ 1158.316101][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1158.398883][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1158.417539][T16857] bond0 (unregistering): Released all slaves [ 1158.555723][T13908] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1158.576242][T13908] usb 4-1: Using ep0 maxpacket: 16 [ 1158.576970][T13908] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1158.577009][T13908] usb 4-1: no configurations [ 1158.577015][T13908] usb 4-1: can't read configurations, error -22 [ 1158.707588][T13908] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1158.726218][T13908] usb 4-1: Using ep0 maxpacket: 16 [ 1158.727333][T13908] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1158.727388][T13908] usb 4-1: no configurations [ 1158.727400][T13908] usb 4-1: can't read configurations, error -22 [ 1158.729925][T13908] usb usb4-port1: unable to enumerate USB device [ 1159.006125][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1159.086888][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1159.108450][T16857] bond0 (unregistering): Released all slaves [ 1159.183404][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1165.635483][T15187] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1165.790208][T15187] usb 6-1: Using ep0 maxpacket: 16 [ 1165.791212][T15187] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1165.791267][T15187] usb 6-1: no configurations [ 1165.791279][T15187] usb 6-1: can't read configurations, error -22 [ 1166.187079][T15187] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1167.324085][T19333] bridge1: left promiscuous mode [ 1167.326723][T19333] bridge2: left promiscuous mode [ 1167.329802][T19333] ip6erspan0: left allmulticast mode [ 1167.505571][T15187] usb 6-1: Using ep0 maxpacket: 16 [ 1167.507851][T15187] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1167.507907][T15187] usb 6-1: no configurations [ 1167.507919][T15187] usb 6-1: can't read configurations, error -22 [ 1167.513247][T15187] usb usb6-port1: attempt power cycle [ 1167.555737][T19161] bridge0: port 1(bridge_slave_0) entered blocking state [ 1167.555949][T19161] bridge0: port 1(bridge_slave_0) entered disabled state [ 1167.556203][T19161] bridge_slave_0: entered allmulticast mode [ 1167.559506][T19161] bridge_slave_0: entered promiscuous mode [ 1167.592641][T19161] bridge0: port 2(bridge_slave_1) entered blocking state [ 1167.592759][T19161] bridge0: port 2(bridge_slave_1) entered disabled state [ 1167.592992][T19161] bridge_slave_1: entered allmulticast mode [ 1167.601734][T19161] bridge_slave_1: entered promiscuous mode [ 1167.975498][T15187] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1167.996296][T15187] usb 6-1: Using ep0 maxpacket: 16 [ 1167.996925][T15187] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1167.996980][T15187] usb 6-1: no configurations [ 1167.996994][T15187] usb 6-1: can't read configurations, error -22 [ 1168.096622][T19341] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1168.125509][T15187] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1168.146304][T15187] usb 6-1: Using ep0 maxpacket: 16 [ 1168.147241][T15187] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1168.147294][T15187] usb 6-1: no configurations [ 1168.147306][T15187] usb 6-1: can't read configurations, error -22 [ 1168.155871][T15187] usb usb6-port1: unable to enumerate USB device [ 1168.272774][T19161] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1170.217351][T19161] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1171.506119][T19161] team0: Port device team_slave_0 added [ 1171.539191][T19161] team0: Port device team_slave_1 added [ 1171.696442][T16857] hsr_slave_0: left promiscuous mode [ 1171.746151][T16857] hsr_slave_1: left promiscuous mode [ 1171.747047][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1171.797533][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1171.815766][T15187] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1171.935602][T16857] hsr_slave_0: left promiscuous mode [ 1171.955580][T16857] hsr_slave_1: left promiscuous mode [ 1171.956291][T16857] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1171.956309][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1171.985628][T15187] usb 4-1: Using ep0 maxpacket: 16 [ 1171.986434][T15187] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1171.986469][T15187] usb 4-1: no configurations [ 1171.986476][T15187] usb 4-1: can't read configurations, error -22 [ 1172.006610][T16857] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1172.006639][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1172.125660][T15187] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1172.151597][T16857] veth1_macvtap: left promiscuous mode [ 1172.151704][T16857] veth0_macvtap: left promiscuous mode [ 1172.151967][T16857] veth1_vlan: left promiscuous mode [ 1172.152153][T16857] veth0_vlan: left promiscuous mode [ 1172.279429][T15187] usb 4-1: Using ep0 maxpacket: 16 [ 1172.280214][T15187] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1172.280256][T15187] usb 4-1: no configurations [ 1172.280263][T15187] usb 4-1: can't read configurations, error -22 [ 1172.280582][T15187] usb usb4-port1: attempt power cycle [ 1172.635523][T15187] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1172.656283][T15187] usb 4-1: Using ep0 maxpacket: 16 [ 1172.656903][T15187] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1172.656956][T15187] usb 4-1: no configurations [ 1172.656962][T15187] usb 4-1: can't read configurations, error -22 [ 1172.796226][T15187] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1172.814084][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1172.821078][T15187] usb 4-1: Using ep0 maxpacket: 16 [ 1172.833076][T15187] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1172.833146][T15187] usb 4-1: no configurations [ 1172.833157][T15187] usb 4-1: can't read configurations, error -22 [ 1172.833636][T15187] usb usb4-port1: unable to enumerate USB device [ 1172.907675][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1173.646043][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1173.687699][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1174.288698][T19161] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1174.288715][T19161] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1174.288736][T19161] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1174.299013][T19161] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1174.299030][T19161] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1174.299055][T19161] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1174.464404][T19379] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1174.862072][T19161] hsr_slave_0: entered promiscuous mode [ 1174.878916][T19161] hsr_slave_1: entered promiscuous mode [ 1177.541621][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.541689][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1179.309534][T17606] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1179.384972][T17606] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1179.407253][T17606] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1179.409336][T17606] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1179.412825][T17606] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1179.544073][T19438] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1180.282419][T19453] 9p: Bad value for 'rfdno' [ 1181.850155][T12239] Bluetooth: hci1: command tx timeout [ 1184.422824][T12239] Bluetooth: hci1: command tx timeout [ 1184.544268][T19495] hub 8-0:1.0: USB hub found [ 1184.544987][T19495] hub 8-0:1.0: 1 port detected [ 1186.098352][T19513] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1186.466479][T12239] Bluetooth: hci1: command tx timeout [ 1188.828561][T12239] Bluetooth: hci1: command tx timeout [ 1190.800856][T19602] hub 8-0:1.0: USB hub found [ 1190.801208][T19602] hub 8-0:1.0: 1 port detected [ 1192.010862][T19437] bridge0: port 1(bridge_slave_0) entered blocking state [ 1192.011067][T19437] bridge0: port 1(bridge_slave_0) entered disabled state [ 1192.011270][T19437] bridge_slave_0: entered allmulticast mode [ 1192.024170][T19437] bridge_slave_0: entered promiscuous mode [ 1192.033637][T19437] bridge0: port 2(bridge_slave_1) entered blocking state [ 1192.033932][T19437] bridge0: port 2(bridge_slave_1) entered disabled state [ 1192.034191][T19437] bridge_slave_1: entered allmulticast mode [ 1192.046293][T19437] bridge_slave_1: entered promiscuous mode [ 1192.316718][T19437] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1192.346546][T19437] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1193.200892][T19437] team0: Port device team_slave_0 added [ 1193.226497][T19437] team0: Port device team_slave_1 added [ 1194.384800][T19437] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1194.384814][T19437] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1194.384834][T19437] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1195.396460][T19437] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1195.396477][T19437] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1195.396502][T19437] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1198.629084][T19660] hub 8-0:1.0: USB hub found [ 1198.629444][T19660] hub 8-0:1.0: 1 port detected [ 1199.825982][ T201] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1199.987093][ T201] usb 4-1: Using ep0 maxpacket: 32 [ 1199.988170][ T201] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1199.990392][ T201] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1199.990507][ T201] usb 4-1: config 0 has no interface number 0 [ 1199.990562][ T201] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1199.993464][ T201] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1199.993488][ T201] usb 4-1: Product: syz [ 1199.993501][ T201] usb 4-1: Manufacturer: syz [ 1199.993515][ T201] usb 4-1: SerialNumber: syz [ 1200.017473][ T201] usb 4-1: config 0 descriptor?? [ 1200.299202][T19437] hsr_slave_0: entered promiscuous mode [ 1200.318134][T19437] hsr_slave_1: entered promiscuous mode [ 1200.320003][T19437] debugfs: 'hsr0' already exists in 'hsr' [ 1200.320020][T19437] Cannot create hsr debugfs directory [ 1200.436835][T19161] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1200.460851][T19161] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1200.524916][T19161] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1200.681096][T19161] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1200.730778][T19161] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1200.765561][T19161] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1201.384347][T19161] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1201.411612][T19161] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1201.678809][ T201] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 1203.244169][ T201] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1203.244198][ T201] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1203.244216][ T201] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1203.244232][ T201] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1203.244496][ T201] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1203.314012][ T201] usb 4-1: USB disconnect, device number 23 [ 1206.595683][T16857] bridge_slave_1: left allmulticast mode [ 1206.595717][T16857] bridge_slave_1: left promiscuous mode [ 1206.595990][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1206.777258][T16857] bridge_slave_0: left allmulticast mode [ 1206.777294][T16857] bridge_slave_0: left promiscuous mode [ 1206.777560][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1206.935515][T15187] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1207.085632][T16857] bridge_slave_1: left allmulticast mode [ 1207.085657][T16857] bridge_slave_1: left promiscuous mode [ 1207.085822][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1207.095972][T15187] usb 4-1: Using ep0 maxpacket: 32 [ 1207.097490][T15187] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1207.099878][T15187] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1207.099903][T15187] usb 4-1: config 0 has no interface number 0 [ 1207.099948][T15187] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1207.103814][T15187] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1207.103898][T15187] usb 4-1: Product: syz [ 1207.103912][T15187] usb 4-1: Manufacturer: syz [ 1207.103925][T15187] usb 4-1: SerialNumber: syz [ 1207.113090][T15187] usb 4-1: config 0 descriptor?? [ 1207.306917][T16857] bridge_slave_0: left allmulticast mode [ 1207.306962][T16857] bridge_slave_0: left promiscuous mode [ 1207.307204][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1207.706239][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1207.787311][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1208.662678][T16857] bond0 (unregistering): Released all slaves [ 1209.088180][T15187] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 1209.088211][T15187] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1209.088740][T15187] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1209.088764][T15187] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1209.088782][T15187] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1209.088799][T15187] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1209.089086][T15187] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1209.134816][T17606] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1209.182517][T17606] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1209.183996][T17606] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1209.190942][T17606] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1209.191663][T17606] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1209.327730][T15187] usb 4-1: USB disconnect, device number 24 [ 1209.769386][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1209.888262][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1209.973091][T16857] bond0 (unregistering): Released all slaves [ 1210.075558][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1211.363304][T12239] Bluetooth: hci3: command tx timeout [ 1213.316353][T16857] hsr_slave_0: left promiscuous mode [ 1213.395534][T16857] hsr_slave_1: left promiscuous mode [ 1213.396476][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1213.425503][T12239] Bluetooth: hci3: command tx timeout [ 1213.442964][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1213.575595][T16857] hsr_slave_0: left promiscuous mode [ 1213.597004][T16857] hsr_slave_1: left promiscuous mode [ 1213.599113][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1213.636898][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1214.457639][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1214.528235][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1215.505445][T12239] Bluetooth: hci3: command tx timeout [ 1215.909237][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1215.986835][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1218.070272][T12239] Bluetooth: hci3: command tx timeout [ 1220.478324][T19896] hub 8-0:1.0: USB hub found [ 1220.482071][T19896] hub 8-0:1.0: 1 port detected [ 1220.975506][ T201] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1221.135384][ T201] usb 8-1: Using ep0 maxpacket: 8 [ 1221.138904][ T201] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1221.138971][ T201] usb 8-1: New USB device found, idVendor=097b, idProduct=61f6, bcdDevice=d4.9a [ 1221.140510][ T201] usb 8-1: config 10 has an invalid interface number: 91 but max is 0 [ 1221.140535][ T201] usb 8-1: config 10 has an invalid descriptor of length 0, skipping remainder of the config [ 1221.140554][ T201] usb 8-1: config 10 has no interface number 0 [ 1221.140597][ T201] usb 8-1: config 10 interface 91 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1221.140624][ T201] usb 8-1: config 10 interface 91 has no altsetting 0 [ 1221.143268][ T201] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1221.143289][ T201] usb 8-1: Product: syz [ 1221.143301][ T201] usb 8-1: Manufacturer: syz [ 1221.143312][ T201] usb 8-1: SerialNumber: syz [ 1221.390712][ T201] usb 8-1: can't set config #10, error -71 [ 1221.539859][ T201] usb 8-1: USB disconnect, device number 4 [ 1222.865755][T19770] bridge0: port 1(bridge_slave_0) entered blocking state [ 1222.865887][T19770] bridge0: port 1(bridge_slave_0) entered disabled state [ 1222.866098][T19770] bridge_slave_0: entered allmulticast mode [ 1222.873993][T19770] bridge_slave_0: entered promiscuous mode [ 1222.956660][T19770] bridge0: port 2(bridge_slave_1) entered blocking state [ 1222.956771][T19770] bridge0: port 2(bridge_slave_1) entered disabled state [ 1222.957022][T19770] bridge_slave_1: entered allmulticast mode [ 1222.959565][T19770] bridge_slave_1: entered promiscuous mode [ 1223.153859][T19770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1224.213615][T19770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1226.347147][T19968] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3698'. [ 1227.578844][T19770] team0: Port device team_slave_0 added [ 1227.638869][T19770] team0: Port device team_slave_1 added [ 1227.820869][T19437] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1227.889537][T19437] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1227.900111][T19770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1227.900128][T19770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1227.900153][T19770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1227.911488][T19437] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1228.153959][T19437] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1228.155124][T19770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1228.155138][T19770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1228.155163][T19770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1228.199722][T20002] hub 8-0:1.0: USB hub found [ 1228.200825][T20002] hub 8-0:1.0: 1 port detected [ 1228.251782][T19437] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1228.334973][T19437] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1229.478392][T20013] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3707'. [ 1229.659293][T19437] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1229.843829][T19437] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1234.332796][T15187] hid_parser_main: 30 callbacks suppressed [ 1234.332877][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.332896][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.332911][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.332925][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.332939][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.332953][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.333925][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.333943][T15187] hid-generic 0000:0000:0001.0005: unknown main item tag 0x0 [ 1234.631074][T19770] hsr_slave_0: entered promiscuous mode [ 1234.632061][T15187] hid-generic 0000:0000:0001.0005: hidraw0: HID v0.10 Device [syz0] on syz1 [ 1234.656567][T19770] hsr_slave_1: entered promiscuous mode [ 1234.661624][T19770] debugfs: 'hsr0' already exists in 'hsr' [ 1234.661650][T19770] Cannot create hsr debugfs directory [ 1239.368359][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1239.368427][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1240.163089][T17606] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1240.206846][T17606] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1240.209312][T17606] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1240.212590][T17606] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1240.226223][T17606] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1242.406940][T12239] Bluetooth: hci0: command tx timeout [ 1244.855354][T12239] Bluetooth: hci0: command tx timeout [ 1245.997568][T16857] bridge_slave_1: left allmulticast mode [ 1245.997604][T16857] bridge_slave_1: left promiscuous mode [ 1245.997850][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1246.157070][T16857] bridge_slave_0: left allmulticast mode [ 1246.157105][T16857] bridge_slave_0: left promiscuous mode [ 1246.157398][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1246.875671][T12239] Bluetooth: hci0: command tx timeout [ 1248.566230][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1248.656776][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1248.697730][T16857] bond0 (unregistering): Released all slaves [ 1248.790745][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1249.239499][T12239] Bluetooth: hci0: command tx timeout [ 1253.377823][T20195] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3747'. [ 1253.517224][T16857] hsr_slave_0: left promiscuous mode [ 1253.555476][T16857] hsr_slave_1: left promiscuous mode [ 1253.556348][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1253.596170][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1253.986401][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1254.046188][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1259.154431][T20098] bridge0: port 1(bridge_slave_0) entered blocking state [ 1259.154663][T20098] bridge0: port 1(bridge_slave_0) entered disabled state [ 1259.154929][T20098] bridge_slave_0: entered allmulticast mode [ 1259.170339][T20098] bridge_slave_0: entered promiscuous mode [ 1259.188238][T20098] bridge0: port 2(bridge_slave_1) entered blocking state [ 1259.189666][T20098] bridge0: port 2(bridge_slave_1) entered disabled state [ 1259.189916][T20098] bridge_slave_1: entered allmulticast mode [ 1259.255560][T20098] bridge_slave_1: entered promiscuous mode [ 1259.452491][T20098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1259.483141][T20098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1259.638868][T20098] team0: Port device team_slave_0 added [ 1259.848788][T20098] team0: Port device team_slave_1 added [ 1261.463399][T20098] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1261.463414][T20098] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1261.463434][T20098] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1261.466599][T20098] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1261.466662][T20098] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1261.466683][T20098] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1262.037766][T20098] hsr_slave_0: entered promiscuous mode [ 1262.039293][T20098] hsr_slave_1: entered promiscuous mode [ 1265.964668][T19770] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1266.019639][T19770] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1266.021280][T19770] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1266.108709][T20352] netlink: 192 bytes leftover after parsing attributes in process `syz.5.3776'. [ 1266.304705][T19770] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1268.127580][T19770] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1268.203090][T19770] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1268.251366][T19770] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1268.312277][T19770] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1268.657831][T19770] kthread_run failed with err -4 [ 1271.171159][T17606] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1271.219577][T17606] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1271.240349][T17606] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1271.299317][T17606] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1271.300836][T17606] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1273.505522][T17606] Bluetooth: hci1: command tx timeout [ 1276.519298][ T5704] kernel read not supported for file /kmsg (pid: 5704 comm: kworker/1:3) [ 1276.555369][T17606] Bluetooth: hci1: command tx timeout [ 1278.625592][T17606] Bluetooth: hci1: command tx timeout [ 1280.705827][T17606] Bluetooth: hci1: command tx timeout [ 1282.781390][T13908] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1282.925585][T13908] usb 6-1: Using ep0 maxpacket: 8 [ 1282.930784][T13908] usb 6-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 1282.932265][T13908] usb 6-1: config index 0 descriptor too short (expected 5924, got 36) [ 1282.932291][T13908] usb 6-1: config 250 has an invalid interface number: 228 but max is -1 [ 1282.932311][T13908] usb 6-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 1282.932331][T13908] usb 6-1: config 250 has no interface number 0 [ 1282.932375][T13908] usb 6-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 1282.932400][T13908] usb 6-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1282.932424][T13908] usb 6-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1282.932445][T13908] usb 6-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 1282.932468][T13908] usb 6-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 1282.932494][T13908] usb 6-1: config 250 interface 228 has no altsetting 0 [ 1282.934668][T13908] usb 6-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 1282.934693][T13908] usb 6-1: Product: syz [ 1282.934707][T13908] usb 6-1: SerialNumber: syz [ 1283.897369][T13908] hub 6-1:250.228: bad descriptor, ignoring hub [ 1283.901138][T13908] hub 6-1:250.228: probe with driver hub failed with error -5 [ 1283.974594][T13908] usblp 6-1:250.228: usblp0: USB Bidirectional printer dev 28 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 1284.669004][T16857] bridge_slave_1: left allmulticast mode [ 1284.669041][T16857] bridge_slave_1: left promiscuous mode [ 1284.669321][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1284.738460][T13908] usb 6-1: USB disconnect, device number 28 [ 1284.806105][T13908] usblp0: removed [ 1284.887022][T16857] bridge_slave_0: left allmulticast mode [ 1284.887058][T16857] bridge_slave_0: left promiscuous mode [ 1284.887328][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1285.303144][T20522] binder: 20521:20522 ioctl 80106720 200000000640 returned -22 [ 1285.410553][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1285.486455][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1285.566982][T16857] bond0 (unregistering): Released all slaves [ 1285.672005][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1287.865931][T16857] hsr_slave_0: left promiscuous mode [ 1288.515560][T16857] hsr_slave_1: left promiscuous mode [ 1288.516622][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1288.547744][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1291.095082][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1291.148275][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1291.950193][ T37] audit: type=1326 audit(1291.755:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1291.951324][ T37] audit: type=1326 audit(1291.755:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1291.973162][ T37] audit: type=1326 audit(1291.775:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1291.973417][ T37] audit: type=1326 audit(1291.775:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1291.973948][ T37] audit: type=1326 audit(1291.775:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=84 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1292.284839][ T37] audit: type=1326 audit(1292.085:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1292.285136][ T37] audit: type=1326 audit(1292.085:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20573 comm="syz.5.3815" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa26fa8e0d9 code=0x7ffc0000 [ 1295.404611][T20396] bridge0: port 1(bridge_slave_0) entered blocking state [ 1295.404795][T20396] bridge0: port 1(bridge_slave_0) entered disabled state [ 1295.405045][T20396] bridge_slave_0: entered allmulticast mode [ 1295.431403][T20396] bridge_slave_0: entered promiscuous mode [ 1295.454947][T20396] bridge0: port 2(bridge_slave_1) entered blocking state [ 1295.468816][T20396] bridge0: port 2(bridge_slave_1) entered disabled state [ 1295.469073][T20396] bridge_slave_1: entered allmulticast mode [ 1295.471858][T20396] bridge_slave_1: entered promiscuous mode [ 1295.779529][T20396] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1295.799280][T20396] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1296.267274][T20645] vlan2: entered allmulticast mode [ 1296.267343][T20645] veth0_vlan: entered allmulticast mode [ 1296.923299][T20396] team0: Port device team_slave_0 added [ 1296.999101][T20396] team0: Port device team_slave_1 added [ 1297.068129][T20396] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1297.068151][T20396] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1297.068170][T20396] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1297.070209][T20396] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1297.070221][T20396] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1297.070240][T20396] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1297.106346][T20651] netlink: 'syz.3.3831': attribute type 16 has an invalid length. [ 1297.106369][T20651] netlink: 'syz.3.3831': attribute type 2 has an invalid length. [ 1297.106381][T20651] netlink: 64102 bytes leftover after parsing attributes in process `syz.3.3831'. [ 1297.247426][T20396] hsr_slave_0: entered promiscuous mode [ 1297.248959][T20396] hsr_slave_1: entered promiscuous mode [ 1297.249826][T20396] debugfs: 'hsr0' already exists in 'hsr' [ 1297.249849][T20396] Cannot create hsr debugfs directory [ 1300.416395][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.416472][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1302.512579][T20704] veth0: entered promiscuous mode [ 1302.573434][T20704] veth0: left promiscuous mode [ 1302.725373][ T5600] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1302.801614][T12239] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1302.840398][T12239] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1302.850591][T12239] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1302.869551][T12239] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1302.870799][T12239] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1302.928321][ T5600] usb 4-1: Using ep0 maxpacket: 8 [ 1303.027177][ T5600] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1303.027238][ T5600] usb 4-1: New USB device found, idVendor=0499, idProduct=1002, bcdDevice=68.be [ 1303.052695][ T5600] usb 4-1: config 10 has an invalid interface number: 188 but max is 0 [ 1303.052722][ T5600] usb 4-1: config 10 has an invalid descriptor of length 0, skipping remainder of the config [ 1303.052739][ T5600] usb 4-1: config 10 has no interface number 0 [ 1303.052766][ T5600] usb 4-1: too many endpoints for config 10 interface 188 altsetting 134: 238, using maximum allowed: 30 [ 1303.052801][ T5600] usb 4-1: config 10 interface 188 altsetting 134 endpoint 0xA has invalid wMaxPacketSize 0 [ 1303.052822][ T5600] usb 4-1: config 10 interface 188 altsetting 134 has 1 endpoint descriptor, different from the interface descriptor's value: 238 [ 1303.052845][ T5600] usb 4-1: config 10 interface 188 has no altsetting 0 [ 1303.078307][T20718] 9p: Bad value for 'rfdno' [ 1303.086787][ T5600] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1303.086814][ T5600] usb 4-1: Product: syz [ 1303.086827][ T5600] usb 4-1: Manufacturer: syz [ 1303.086840][ T5600] usb 4-1: SerialNumber: syz [ 1303.369592][ T5600] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1303.762460][ T5600] snd-usb-audio 4-1:10.188: probe with driver snd-usb-audio failed with error -2 [ 1303.772690][ T5600] usb 4-1: USB disconnect, device number 25 [ 1303.880676][T20712] udevd[20712]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:10.188/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1305.386515][T12239] Bluetooth: hci3: command tx timeout [ 1307.139970][T20765] binder: 20764:20765 ioctl 80106720 200000000640 returned -22 [ 1307.578856][T12239] Bluetooth: hci3: command tx timeout [ 1308.960363][T20777] 9p: Bad value for 'rfdno' [ 1309.595363][T12239] Bluetooth: hci3: command tx timeout [ 1313.252625][T12239] Bluetooth: hci3: command tx timeout [ 1313.550582][T20809] 9p: Bad value for 'rfdno' [ 1313.652166][T20714] bridge0: port 1(bridge_slave_0) entered blocking state [ 1313.652409][T20714] bridge0: port 1(bridge_slave_0) entered disabled state [ 1313.652655][T20714] bridge_slave_0: entered allmulticast mode [ 1313.700968][T20714] bridge_slave_0: entered promiscuous mode [ 1313.717357][T20714] bridge0: port 2(bridge_slave_1) entered blocking state [ 1313.717565][T20714] bridge0: port 2(bridge_slave_1) entered disabled state [ 1313.717813][T20714] bridge_slave_1: entered allmulticast mode [ 1313.751145][T20714] bridge_slave_1: entered promiscuous mode [ 1313.984227][T20714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1314.374869][T20714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1314.802872][T20714] team0: Port device team_slave_0 added [ 1314.816374][T20714] team0: Port device team_slave_1 added [ 1314.976914][T16857] bridge_slave_1: left allmulticast mode [ 1314.976950][T16857] bridge_slave_1: left promiscuous mode [ 1314.977207][T16857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1315.089971][T16857] bridge_slave_0: left allmulticast mode [ 1315.090006][T16857] bridge_slave_0: left promiscuous mode [ 1315.090255][T16857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1315.770460][T16857] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1315.932931][T16857] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1315.993351][T16857] bond0 (unregistering): Released all slaves [ 1316.366272][T20714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1316.366288][T20714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1316.366315][T20714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1316.413633][ T5600] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1316.575400][ T5600] usb 6-1: Using ep0 maxpacket: 8 [ 1316.576233][ T5600] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1316.576797][ T5600] usb 6-1: config 0 has no interfaces? [ 1316.577289][ T5600] usb 6-1: config 0 has no interfaces? [ 1316.577779][ T5600] usb 6-1: config 0 has no interfaces? [ 1316.580782][ T5600] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1316.580807][ T5600] usb 6-1: Product: syz [ 1316.580820][ T5600] usb 6-1: Manufacturer: syz [ 1316.580834][ T5600] usb 6-1: SerialNumber: syz [ 1316.649618][ T5600] usb 6-1: config 0 descriptor?? [ 1316.863540][T20826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1316.864186][T20826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1316.900770][ T5600] usb 6-1: USB disconnect, device number 29 [ 1317.196113][T20714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1317.196129][T20714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1317.196155][T20714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1317.471414][T20714] hsr_slave_0: entered promiscuous mode [ 1317.472235][T20714] hsr_slave_1: entered promiscuous mode [ 1317.472790][T20714] debugfs: 'hsr0' already exists in 'hsr' [ 1317.472805][T20714] Cannot create hsr debugfs directory [ 1317.475404][ T5600] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 1317.626762][ T5600] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1317.627942][ T5600] usb 6-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1317.627973][ T5600] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1317.627989][ T5600] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1317.628012][ T5600] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1317.635508][T13908] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1317.717149][T16857] hsr_slave_0: left promiscuous mode [ 1317.735700][T16857] hsr_slave_1: left promiscuous mode [ 1317.736685][T16857] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1317.770730][T16857] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1317.845433][T13908] usb 4-1: Using ep0 maxpacket: 16 [ 1317.847717][T13908] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1317.849018][T13908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1317.849044][T13908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1317.849100][T13908] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1317.849124][T13908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1317.985152][T13908] usb 4-1: config 0 descriptor?? [ 1318.137336][T20826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1318.142062][T20826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1318.164049][ T5600] aiptek 6-1:17.0: Aiptek using 400 ms programming speed [ 1318.265001][ T5600] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:17.0/input/input11 [ 1318.643251][T13908] microsoft 0003:045E:07DA.0006: ignoring exceeding usage max [ 1318.648947][T13908] microsoft 0003:045E:07DA.0006: ignoring exceeding usage max [ 1318.648968][T13908] microsoft 0003:045E:07DA.0006: usage index exceeded [ 1318.649285][T13908] microsoft 0003:045E:07DA.0006: item 0 0 2 2 parsing failed [ 1318.651099][T13908] microsoft 0003:045E:07DA.0006: parse failed [ 1318.651304][T13908] microsoft 0003:045E:07DA.0006: probe with driver microsoft failed with error -22 [ 1318.958973][T13908] usb 4-1: USB disconnect, device number 26 [ 1318.996555][ C0] aiptek 6-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1318.996619][ T5600] usb 6-1: USB disconnect, device number 30 [ 1321.086075][T16857] team0 (unregistering): Port device team_slave_1 removed [ 1321.180464][T16857] team0 (unregistering): Port device team_slave_0 removed [ 1321.472037][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1321.618369][T13908] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1321.766189][T13908] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1321.767731][T13908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1321.767778][T13908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1321.905778][T13908] usb 4-1: config 0 descriptor?? [ 1322.126904][T13908] usbhid 4-1:0.0: can't add hid device: -71 [ 1322.127021][T13908] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1322.241356][T13908] usb 4-1: USB disconnect, device number 27 [ 1322.735383][T13908] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1322.885335][T13908] usb 4-1: Using ep0 maxpacket: 16 [ 1322.886140][T13908] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1322.889284][T13908] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1322.889316][T13908] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1322.889349][T13908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1322.971743][T13908] usb 4-1: config 0 descriptor?? [ 1323.539799][T13908] mcp2221 0003:04D8:00DD.0007: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1323.674985][ C0] ================================================================== [ 1323.675005][ C0] BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x10b0/0x12a0 [ 1323.675251][ C0] Read of size 1 at addr ffff88805de47fff by task ktimers/0/16 [ 1323.675271][ C0] [ 1323.675294][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1323.675325][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1323.675346][ C0] Call Trace: [ 1323.675392][ C0] [ 1323.675464][ C0] dump_stack_lvl+0xe8/0x150 [ 1323.675593][ C0] print_address_description+0x55/0x1e0 [ 1323.675633][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.675697][ C0] print_report+0x58/0x70 [ 1323.675727][ C0] kasan_report+0x117/0x150 [ 1323.675836][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.675872][ C0] mcp2221_raw_event+0x10b0/0x12a0 [ 1323.675904][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1323.676002][ C0] ? down_trylock+0x50/0xb0 [ 1323.676057][ C0] __hid_input_report+0x421/0x580 [ 1323.676105][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 1323.676145][ C0] hid_irq_in+0x492/0x710 [ 1323.676245][ C0] __usb_hcd_giveback_urb+0x3b8/0x5f0 [ 1323.676335][ C0] dummy_timer+0xaac/0x4d50 [ 1323.676446][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 1323.676476][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1323.676503][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 1323.676531][ C0] __hrtimer_run_queues+0x3eb/0xaf0 [ 1323.676584][ C0] hrtimer_run_softirq+0x18f/0x260 [ 1323.676618][ C0] handle_softirqs+0x1d9/0x6c0 [ 1323.676704][ C0] run_ktimerd+0x69/0x100 [ 1323.676730][ C0] smpboot_thread_fn+0x57c/0xa80 [ 1323.676794][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 1323.676825][ C0] kthread+0x388/0x470 [ 1323.676909][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1323.676933][ C0] ? __pfx_kthread+0x10/0x10 [ 1323.676957][ C0] ret_from_fork+0x514/0xb70 [ 1323.677022][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1323.677050][ C0] ? __switch_to+0xc89/0x1420 [ 1323.677106][ C0] ? __pfx_kthread+0x10/0x10 [ 1323.677142][ C0] ret_from_fork_asm+0x1a/0x30 [ 1323.677182][ C0] [ 1323.677219][ C0] [ 1323.677224][ C0] Allocated by task 5596: [ 1323.677236][ C0] kasan_save_track+0x3e/0x80 [ 1323.677296][ C0] __kasan_slab_alloc+0x6c/0x80 [ 1323.677315][ C0] kmem_cache_alloc_node_noprof+0x3eb/0x670 [ 1323.677407][ C0] __alloc_skb+0x276/0x7a0 [ 1323.677505][ C0] hci_cmd_sync_alloc+0x3d/0x3a0 [ 1323.677568][ C0] hci_send_cmd+0x46/0x1a0 [ 1323.677620][ C0] hci_remote_features_evt+0x292/0x950 [ 1323.677710][ C0] hci_event_packet+0x6cd/0xf10 [ 1323.677728][ C0] hci_rx_work+0x3ee/0x1020 [ 1323.677747][ C0] process_scheduled_works+0xa8e/0x14e0 [ 1323.677796][ C0] worker_thread+0xa47/0xfb0 [ 1323.677817][ C0] kthread+0x388/0x470 [ 1323.677844][ C0] ret_from_fork+0x514/0xb70 [ 1323.677873][ C0] ret_from_fork_asm+0x1a/0x30 [ 1323.677906][ C0] [ 1323.677911][ C0] The buggy address belongs to the object at ffff88805de47a80 [ 1323.677911][ C0] which belongs to the cache skbuff_small_head of size 704 [ 1323.677929][ C0] The buggy address is located 703 bytes to the right of [ 1323.677929][ C0] allocated 704-byte region [ffff88805de47a80, ffff88805de47d40) [ 1323.678019][ C0] [ 1323.678025][ C0] The buggy address belongs to the physical page: [ 1323.678049][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805de44d00 pfn:0x5de44 [ 1323.678073][ C0] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1323.678089][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 1323.678109][ C0] page_type: f5(slab) [ 1323.678136][ C0] raw: 0080000000000240 ffff888140af9c80 ffffea00022a7c10 ffffea0000c8d210 [ 1323.678152][ C0] raw: ffff88805de44d00 0000000800130008 00000000f5000000 0000000000000000 [ 1323.678171][ C0] head: 0080000000000240 ffff888140af9c80 ffffea00022a7c10 ffffea0000c8d210 [ 1323.678187][ C0] head: ffff88805de44d00 0000000800130008 00000000f5000000 0000000000000000 [ 1323.678205][ C0] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 1323.678223][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 1323.678235][ C0] page dumped because: kasan: bad access detected [ 1323.678249][ C0] page_owner tracks the page as allocated [ 1323.678256][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9325, tgid 9322 (syz.1.1253), ts 289474739254, free_ts 288806500903 [ 1323.678293][ C0] post_alloc_hook+0x1f9/0x250 [ 1323.678380][ C0] get_page_from_freelist+0x262a/0x26a0 [ 1323.678402][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1323.678424][ C0] allocate_slab+0x79/0x5e0 [ 1323.678449][ C0] refill_objects+0x2d8/0x350 [ 1323.678477][ C0] __pcs_replace_empty_main+0x330/0x690 [ 1323.678498][ C0] kmem_cache_alloc_node_noprof+0x4dc/0x670 [ 1323.678528][ C0] __alloc_skb+0x276/0x7a0 [ 1323.678549][ C0] alloc_skb_with_frags+0xc6/0x760 [ 1323.678627][ C0] sock_alloc_send_pskb+0x884/0x9a0 [ 1323.678653][ C0] __ip_append_data+0x29ea/0x3cf0 [ 1323.678722][ C0] ip_make_skb+0x250/0x460 [ 1323.678741][ C0] udp_sendmsg+0x1937/0x2140 [ 1323.678797][ C0] sock_sendmsg_nosec+0x10e/0x180 [ 1323.678852][ C0] ____sys_sendmsg+0x565/0x870 [ 1323.678871][ C0] ___sys_sendmsg+0x2a5/0x360 [ 1323.678891][ C0] page last free pid 4943 tgid 4943 stack trace: [ 1323.678904][ C0] __free_frozen_pages+0x10e7/0x11c0 [ 1323.678934][ C0] __slab_free+0x252/0x2a0 [ 1323.678950][ C0] qlist_free_all+0x99/0x100 [ 1323.678981][ C0] kasan_quarantine_reduce+0x148/0x160 [ 1323.679009][ C0] __kasan_slab_alloc+0x22/0x80 [ 1323.679024][ C0] kmem_cache_alloc_node_noprof+0x3eb/0x670 [ 1323.679053][ C0] __alloc_skb+0x1d7/0x7a0 [ 1323.679071][ C0] alloc_skb_with_frags+0xc6/0x760 [ 1323.679092][ C0] sock_alloc_send_pskb+0x884/0x9a0 [ 1323.679128][ C0] unix_dgram_sendmsg+0x4da/0x17b0 [ 1323.679220][ C0] sock_sendmsg_nosec+0x13a/0x180 [ 1323.679247][ C0] __sys_sendto+0x41e/0x5d0 [ 1323.679266][ C0] __x64_sys_sendto+0xde/0x100 [ 1323.679285][ C0] do_syscall_64+0x174/0x580 [ 1323.679367][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1323.679405][ C0] [ 1323.679410][ C0] Memory state around the buggy address: [ 1323.679421][ C0] ffff88805de47e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1323.679438][ C0] ffff88805de47f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1323.679455][ C0] >ffff88805de47f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1323.679467][ C0] ^ [ 1323.679482][ C0] ffff88805de48000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1323.679498][ C0] ffff88805de48080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1323.679509][ C0] ================================================================== [ 1323.679592][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1323.679610][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1323.679634][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1323.679648][ C0] Call Trace: [ 1323.679661][ C0] [ 1323.679670][ C0] vpanic+0x56c/0xa60 [ 1323.679704][ C0] ? rcu_is_watching+0x15/0xb0 [ 1323.679772][ C0] ? __pfx_vpanic+0x10/0x10 [ 1323.679805][ C0] panic+0xc5/0xd0 [ 1323.679834][ C0] ? __pfx_panic+0x10/0x10 [ 1323.679865][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.679901][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.679927][ C0] check_panic_on_warn+0x89/0xb0 [ 1323.680020][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.680047][ C0] end_report+0x73/0x170 [ 1323.680070][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.680093][ C0] kasan_report+0x128/0x150 [ 1323.680124][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 1323.680154][ C0] mcp2221_raw_event+0x10b0/0x12a0 [ 1323.680183][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1323.680211][ C0] ? down_trylock+0x50/0xb0 [ 1323.680237][ C0] __hid_input_report+0x421/0x580 [ 1323.680272][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 1323.680301][ C0] hid_irq_in+0x492/0x710 [ 1323.680335][ C0] __usb_hcd_giveback_urb+0x3b8/0x5f0 [ 1323.680367][ C0] dummy_timer+0xaac/0x4d50 [ 1323.680426][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 1323.680456][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1323.680483][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 1323.680507][ C0] __hrtimer_run_queues+0x3eb/0xaf0 [ 1323.680540][ C0] hrtimer_run_softirq+0x18f/0x260 [ 1323.680572][ C0] handle_softirqs+0x1d9/0x6c0 [ 1323.680602][ C0] run_ktimerd+0x69/0x100 [ 1323.680631][ C0] smpboot_thread_fn+0x57c/0xa80 [ 1323.680663][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 1323.680693][ C0] kthread+0x388/0x470 [ 1323.680724][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1323.680752][ C0] ? __pfx_kthread+0x10/0x10 [ 1323.680783][ C0] ret_from_fork+0x514/0xb70 [ 1323.680815][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1323.680848][ C0] ? __switch_to+0xc89/0x1420 [ 1323.680877][ C0] ? __pfx_kthread+0x10/0x10 [ 1323.680910][ C0] ret_from_fork_asm+0x1a/0x30 [ 1323.680950][ C0] [ 1323.682193][ C0] Kernel Offset: disabled