last executing test programs: 6.326846082s ago: executing program 1 (id=3639): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') fchdir(r0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) 6.088458648s ago: executing program 1 (id=3641): ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x141802, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r1, 0xc0884113, &(0x7f00000000c0)={0x1, 0x0, 0x8000200, 0xe7b, 0xe8, 0x8, 0x8000, 0xa9c7, 0x0, 0x8, 0x9, 0x3}) 5.612388849s ago: executing program 0 (id=3646): socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000001800)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@bloom_filter={0x1e, 0x0, 0x8, 0x6, 0x10400, r1, 0xc0000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x3, 0x43}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x10, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x1000}, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x219a2, 0x201}, [@IFLA_IFNAME={0x14, 0x3, 'team0\x00'}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0xffffffc0, 0x6, 0x1}}]}]}]}, 0x4c}}, 0x20084084) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000003c0)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000002880)=@raw={'raw\x00', 0x3c1, 0x3, 0x13c0, 0x11e0, 0xc8, 0x8, 0x4000000, 0x5803, 0x11e0, 0x2e8, 0x2e8, 0x12f0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1198, 0x11e0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x81, 0x8, 0xe, 'syz0\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1420) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000000604"], 0x0, 0x26}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000000)=[{0x30, 0x0, 0xfd, 0x5ae9}, {0x28, 0x7f, 0x6, 0xfffff010}, {0x6, 0x4, 0x3, 0x1000}]}, 0x10) sendmmsg$inet(r5, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)='*s', 0x2}], 0x1}}], 0x1, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "173e6335a79630de1125f32bfd49b77c2d01a8ac6334c2bd", "5c341f44cbb52d9d51c5ea017cd89c9cf84a0b6ec3606f3e97d850427a78e750"}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fffffff}, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFBR(r8, 0x8940, &(0x7f0000000080)=@generic={0x2, 0x6, 0xf0}) r9 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x5b8, 0x0, 0xffffffff, 0xffffffff, 0x260, 0xffffffff, 0x4e8, 0xffffffff, 0xffffffff, 0x4e8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xffffffff], [], 'veth0_to_bridge\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0x238, 0x260, 0x0, {}, [@common=@rt={{0x138}, {0x5, [0x7, 0x7], 0x100, 0x20, 0x5, [@remote, @empty, @mcast2, @remote, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, @ipv4={'\x00', '\xff\xff', @private=0x6}, @dev={0xfe, 0x80, '\x00', 0x2f}, @private1={0xfc, 0x1, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0, @private2], 0x5}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x618) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRESOCT, @ANYRESHEX], &(0x7f0000000200)='GPL\x00', 0x800000, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r10, 0x18000000000002a0, 0x28, 0x0, &(0x7f0000000000)="b9fe0307681f4c8c989a14f088a8650186dda8c6e96fd9d5a77080d1016acfeb01579fc3d2549014", 0x0, 0x9e, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.60925935s ago: executing program 2 (id=3647): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x2, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x20000000, 0xfffffffc, 0x7ff}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4811}, 0x40884) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) close(r4) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)}], 0x1}, 0x4005) 5.336534447s ago: executing program 4 (id=3651): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x40f00, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x2000040) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2}}, 0x26) getsockopt(r4, 0x111, 0xfffffffd, 0x0, 0x0) 5.227684344s ago: executing program 2 (id=3652): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x3, 0x400, 0x80, 0x89, 0x0, 0x3, 0x8d], 0x100000, 0x100}) syz_usb_connect_ath9k(0x3, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 4.788512734s ago: executing program 3 (id=3654): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x40f00, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mount$9p_virtio(&(0x7f00000001c0), 0x0, 0x0, 0x8c, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0xc002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000080)=0x40000) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = syz_open_dev$sndctrl(&(0x7f00000000c0), 0x800, 0x430000) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54}, 0x9c) 4.146676073s ago: executing program 0 (id=3655): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x68}}, 0x0) 3.03179755s ago: executing program 4 (id=3656): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x5, 0xc0103) ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000200)=[@ioring_restriction_register_op={0x0, 0x1e}], 0x1) r1 = socket(0x10, 0x80003, 0x0) write(r1, &(0x7f0000000000)="240000001a005f0214f9f4e6ff0804000a00", 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x403, 0xfffffffc, 0x3f, {0x0, 0x0, 0x0, 0x0, 0x88adfda7, 0xa90}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x40}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000300)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x653988b496406357, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r6, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x778e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) recvfrom(r5, &(0x7f00000023c0)=""/231, 0xe7, 0x20, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtaction={0x74, 0x30, 0xb, 0x0, 0x0, {}, [{0x60, 0x1, [@m_skbmod={0x5c, 0x1, 0x0, 0x0, {{0xb}, {0x32, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24}, @TCA_SKBMOD_ETYPE={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 2.738818022s ago: executing program 0 (id=3657): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.613247944s ago: executing program 0 (id=3658): syz_init_net_socket$llc(0x1a, 0x802, 0x0) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') name_to_handle_at(r0, &(0x7f0000000080)='./mnt\x00', &(0x7f00000000c0)=ANY=[], 0x0, 0x1400) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="03000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r3}, 0x0, &(0x7f00000002c0)=r4}, 0x20) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000035000900fffffffffddbdf25020000000c0001"], 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) ioctl(r1, 0x8b32, &(0x7f0000000040)) 2.552791007s ago: executing program 1 (id=3659): r0 = syz_open_dev$ndb(&(0x7f0000000480), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000008000000180100002520732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000f98500000006000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000740)="ba37bc6e74cc160f3f46dd21efc8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x1c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000300)={r2, &(0x7f0000000240)="9795679a6bce772b7a7a0bb0ecaed3278718305ba6a9046b3fea157cc4f08a68b63da6d30aa53fd1f6200774ea79c8abd9996ad3187a8282cbe90af965643b917c2414a7649c53ade8a741a5cd91dc9252b8822fbcaee533d66d819af21e2698ea61d1b4001bec21288685cf1fac689f19f64165514d955683d1dde9b63a7fd8da21f13823e0c53edb72eb4072a25c762b51e117d117b8e196455e6cb598e2608df7a3a39364d3d0289e7775dc1bcb2f49064e"}, 0x20) ioctl$NBD_DISCONNECT(r0, 0xab08) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x2, @empty}, 0x1c) socket$unix(0x1, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) 2.009495744s ago: executing program 3 (id=3660): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x24000058) 1.811266105s ago: executing program 2 (id=3661): ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x101, 0x0, 0xf, 0x0, 0x0}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 1.704849099s ago: executing program 0 (id=3662): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000010880)=ANY=[@ANYBLOB="0200000004000000080000000c"], 0x50) close(0x3) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newtaction={0x6c, 0x30, 0x871a15abc695f91d, 0x0, 0x80000, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xcc1}, @TCA_VLAN_PARMS={0x5, 0x2, {{0x3468802, 0x7, 0x1, 0x3, 0x80000000}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x4c}}, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000a40)={@fallback, r4, 0x2f}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r4, 0x0, 0x25, 0x19, @void}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000001c0)={0x81}, 0x8) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000001640)=ANY=[@ANYBLOB="18000000000000000000000000000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff8500000004000000954759ed1fe2d1d95eb67b64bd614bf89df82316ea5cd4db3193a45b61961c7685e022d70760041e62896c735e971e35eaf1e5a331ae04ce6a1407c4acf7d493d0a39b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x31, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00'}, 0x18) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, 0x0, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb807e0000000000000000000009fe70ba83a7a66e67a0bae5cfaccbbb81e28d7b568daf133e50b", @ANYRESHEX, @ANYRESOCT=r6], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030c000000007d1c4509000067f70000008500000003000000950000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r8, r2}, 0xc) recvmsg(r5, &(0x7f00000049c0)={0x0, 0x0, &(0x7f0000004880)=[{&(0x7f0000000580)=""/191, 0xbf}, {&(0x7f0000000640)=""/239, 0xef}, {&(0x7f0000000740)=""/31, 0x1f}, {&(0x7f0000000780)=""/4, 0x4}, {&(0x7f00000007c0)=""/123, 0x7b}, {&(0x7f0000003880)=""/4096, 0x1000}], 0x6, &(0x7f0000004900)=""/167, 0xa7}, 0x10022) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001040)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fbdbdf250300000008000100"], 0x70}}, 0x4004) 1.704335744s ago: executing program 3 (id=3663): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xfff9, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x1}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x54, 0x2c, 0xf3f, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xf}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_basic={{0xa}, {0x24, 0x2, [@TCA_BASIC_EMATCHES={0x20, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x45aa, 0x2, 0x6}, {0x1001}}}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20041090}, 0x810) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x4}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000600)}], 0x1}, 0x4c00c) 1.521456345s ago: executing program 1 (id=3664): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={0x34, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xfffd}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "ea69"}]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000805}, 0x8090) 1.439964527s ago: executing program 1 (id=3665): socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000001800)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@bloom_filter={0x1e, 0x0, 0x8, 0x6, 0x10400, r1, 0xc0000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x3, 0x43}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x10, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x1000}, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x219a2, 0x201}, [@IFLA_IFNAME={0x14, 0x3, 'team0\x00'}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0xffffffc0, 0x6, 0x1}}]}]}]}, 0x4c}}, 0x20084084) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000003c0)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000002880)=@raw={'raw\x00', 0x3c1, 0x3, 0x13c0, 0x11e0, 0xc8, 0x8, 0x4000000, 0x5803, 0x11e0, 0x2e8, 0x2e8, 0x12f0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1198, 0x11e0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x81, 0x8, 0xe, 'syz0\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1420) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000000604"], 0x0, 0x26}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000000)=[{0x30, 0x0, 0xfd, 0x5ae9}, {0x28, 0x7f, 0x6, 0xfffff010}, {0x6, 0x4, 0x3, 0x1000}]}, 0x10) sendmmsg$inet(r5, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)='*s', 0x2}], 0x1}}], 0x1, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "173e6335a79630de1125f32bfd49b77c2d01a8ac6334c2bd", "5c341f44cbb52d9d51c5ea017cd89c9cf84a0b6ec3606f3e97d850427a78e750"}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fffffff}, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFBR(r8, 0x8940, &(0x7f0000000080)=@generic={0x2, 0x6, 0xf0}) r9 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x5b8, 0x0, 0xffffffff, 0xffffffff, 0x260, 0xffffffff, 0x4e8, 0xffffffff, 0xffffffff, 0x4e8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xffffffff], [], 'veth0_to_bridge\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0x238, 0x260, 0x0, {}, [@common=@rt={{0x138}, {0x5, [0x7, 0x7], 0x100, 0x20, 0x5, [@remote, @empty, @mcast2, @remote, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, @ipv4={'\x00', '\xff\xff', @private=0x6}, @dev={0xfe, 0x80, '\x00', 0x2f}, @private1={0xfc, 0x1, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0, @private2], 0x5}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x618) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRESOCT, @ANYRESHEX], &(0x7f0000000200)='GPL\x00', 0x800000, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r10, 0x18000000000002a0, 0x28, 0x0, &(0x7f0000000000)="b9fe0307681f4c8c989a14f088a8650186dda8c6e96fd9d5a77080d1016acfeb01579fc3d2549014", 0x0, 0x9e, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.429504996s ago: executing program 4 (id=3666): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) 1.360407041s ago: executing program 3 (id=3667): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x68}}, 0x0) 1.238405127s ago: executing program 3 (id=3668): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000000000000000"], 0x6c}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c0800002c0007012bbd700000000000097c00000c00018006000600843b000009000280040071008c0000000800e400", @ANYRES32, @ANYBLOB="2d0529800c00f800030000000000000004006080fa003b800400df00c1becb03dbe55b6c782cebd6a7bc78a21d1bc9f3c1bd441ada5266780599eaf18965bbfcc07c2037129672275c399e1e03f8a0664d807385cc4d566f230400db800400498096d9641e8b1887b25501b11ecd71313a47df368b078d7b825bff33b9eab3964d7b2394b1950c7aeaba6014fe2cd33c89fd070ce0f1f306494a44adf6609d8ad55a5080b36b05cb0b9a57833b14fcd62c0aba0ac67f03b20e87ba6f3610a5bd1d3369ae014c8036c1e596b800991698810ff706e98871c17ad581b0695476273ac6c33a7a51d4a44a5b95684befe95ef49b03458bce89d87355f35b766b242b9f98b661269bb9255d836fb4e30d0000c72ec5561adf6112ca278273b4af42597e7bfa1f5c228f13161b34517c92bc352c017afac22d14047e6fbdc61536f9e51738ea935cb2a577ec2b788433bc13a9e976cfee267f36d988b766a29632c84c94d4cf31d780ef683293d7eacfc93f248d137affcae7cffa699237ea9c74919850dc164f1483f3f352bf7dd787191705b26936e1d090526b6ac5765df318f160cc84b15b94c662cf92611c9eb0b92bfbd3512bffed96a4150d653e130625b6ae5a78da2c4b9c70c736a224b18d89222095fbc4c61bcad1eb73be9c6efaaae48f871223694999b2a925a37138be8220008180cc20e57a92076b2308", @ANYRES32], 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0xc000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000060000008000000042000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000e2b"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000540), &(0x7f0000000080), 0x619, r1}, 0x38) 1.17973887s ago: executing program 3 (id=3669): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000340)=ANY=[@ANYBLOB="0014af"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000cc0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) 796.607655ms ago: executing program 2 (id=3670): bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=r3, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 490.295264ms ago: executing program 0 (id=3671): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x48) socket$unix(0x1, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r1) r2 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001100)={0x0, 0x0, 0x0}, 0x80) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) sendmsg$NL80211_CMD_SET_STATION(r1, 0x0, 0x4000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601fcff00000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00000500070088000000060005404e"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 375.574759ms ago: executing program 2 (id=3672): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x9) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 343.142014ms ago: executing program 4 (id=3673): ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x470}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f00000c1000/0x2000)=nil, 0x2000}) 251.531654ms ago: executing program 1 (id=3674): r0 = syz_open_dev$ndb(&(0x7f0000000480), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000008000000180100002520732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000f98500000006000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000740)="ba37bc6e74cc160f3f46dd21efc8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x1c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000300)={r2, &(0x7f0000000240)="9795679a6bce772b7a7a0bb0ecaed3278718305ba6a9046b3fea157cc4f08a68b63da6d30aa53fd1f6200774ea79c8abd9996ad3187a8282cbe90af965643b917c2414a7649c53ade8a741a5cd91dc9252b8822fbcaee533d66d819af21e2698ea61d1b4001bec21288685cf1fac689f19f64165514d955683d1dde9b63a7fd8da21f13823e0c53edb72eb4072a25c762b51e117d117b8e196455e6cb598e2608df7a3a39364d3d0289e7775dc1bcb2f49064e"}, 0x20) ioctl$NBD_DISCONNECT(r0, 0xab08) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x2, @empty}, 0x1c) socket$unix(0x1, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) 137.552925ms ago: executing program 4 (id=3675): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={0x34, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xfffd}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "ea69"}]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000805}, 0x8090) 135.295306ms ago: executing program 2 (id=3676): userfaultfd(0x80001) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = syz_open_dev$video4linux(&(0x7f0000000300), 0xff, 0x8002) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f00000016c0)={0x0, 0x0, {0x6, 0x7, 0x5, 0x93a}}) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='cdg', 0x3) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r4, &(0x7f0000000040)='\x00', 0x1, 0x20040045, &(0x7f0000000140)={0xa, 0x4001, 0xfffb, @loopback, 0xfffffffd}, 0x1c) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000500)={&(0x7f0000305000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=""/60, 0x3c}, &(0x7f0000000540)=0x40) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc980000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000006c0003806800008008000340000000025c000b802c0001800a0001006c696d69740000001c0002800c00024000000000000000030c00014000000000000100002c0001800a0001006c696d69740000001c0002800c00024000000000800000000c000140000000000000000814000000110001"], 0xfc}, 0x1, 0x0, 0x0, 0x4000850}, 0x844) clock_adjtime(0x0, &(0x7f0000000100)={0x105f0827e8, 0x20000000000000ff, 0x100000000000, 0x0, 0x858, 0x6, 0x0, 0x0, 0x20000, 0xb207, 0xde1, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffc0001, 0x0, 0x6, 0x3}) 0s ago: executing program 4 (id=3677): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xfff9, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x1}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x54, 0x2c, 0xf3f, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xf}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_basic={{0xa}, {0x24, 0x2, [@TCA_BASIC_EMATCHES={0x20, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x45aa, 0x2, 0x6}, {0x1001}}}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20041090}, 0x810) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x4}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000600)}], 0x1}, 0x4c00c) kernel console output (not intermixed with test programs): ce team_slave_0 added [ 316.981941][ T5480] 8021q: adding VLAN 0 to HW filter on device eth2 [ 317.006729][T13954] team0: Port device team_slave_1 added [ 317.414109][ T30] audit: type=1400 audit(1776407570.075:740): avc: denied { connect } for pid=14120 comm="syz.3.2813" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 318.465278][T13954] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 318.506408][T13954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.599156][ T5812] Bluetooth: hci5: command tx timeout [ 318.619843][T13954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 318.692694][T13954] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 318.715171][T13954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.789840][T13954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 318.816470][T14146] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input13 [ 319.211427][T13954] hsr_slave_0: entered promiscuous mode [ 319.244148][T13954] hsr_slave_1: entered promiscuous mode [ 319.297176][T13954] debugfs: 'hsr0' already exists in 'hsr' [ 319.444067][T13954] Cannot create hsr debugfs directory [ 320.775770][ T797] libceph: connect (1)[c::]:6789 error -101 [ 320.871766][ T797] libceph: mon0 (1)[c::]:6789 connect error [ 321.168434][T14204] ceph: No mds server is up or the cluster is laggy [ 321.311795][ T5480] 8021q: adding VLAN 0 to HW filter on device eth3 [ 321.437320][ T30] audit: type=1400 audit(1776407573.793:741): avc: denied { ioctl } for pid=14214 comm="syz.1.2840" path="socket:[43903]" dev="sockfs" ino=43903 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 322.256015][ T79] hsr_slave_0: left promiscuous mode [ 322.293855][ T79] hsr_slave_1: left promiscuous mode [ 322.310018][ T79] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 322.330448][ T79] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 322.356687][T14245] loop2: detected capacity change from 0 to 1 [ 322.369944][ T79] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 322.397470][ T79] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 322.407563][T14245] Dev loop2: unable to read RDB block 1 [ 322.429264][T14245] loop2: AHDI p1 p2 p3 [ 322.443045][T14245] loop2: partition table partially beyond EOD, truncated [ 322.465063][T14245] loop2: p1 start 1601398130 is beyond EOD, truncated [ 322.611611][T14245] loop2: p2 start 1702059890 is beyond EOD, truncated [ 322.643850][ T5185] Dev loop2: unable to read RDB block 1 [ 322.652046][ T79] veth1_macvtap: left promiscuous mode [ 322.661863][ T5185] loop2: AHDI p1 p2 p3 [ 322.667799][ T79] veth0_macvtap: left promiscuous mode [ 322.684391][ T5185] loop2: partition table partially beyond EOD, truncated [ 322.707566][ T79] veth1_vlan: left promiscuous mode [ 322.727151][ T5185] loop2: p1 start 1601398130 is beyond EOD, truncated [ 322.744778][ T79] veth0_vlan: left promiscuous mode [ 322.768810][ T5185] loop2: p2 start 1702059890 is beyond EOD, truncated [ 324.867034][T14276] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2851'. [ 325.187461][ T79] team0 (unregistering): Port device team_slave_1 removed [ 325.203446][ T79] team0 (unregistering): Port device team_slave_0 removed [ 325.443604][T14264] tipc: Cannot configure node identity twice [ 326.111484][T14299] syzkaller0: entered promiscuous mode [ 326.117962][T14299] syzkaller0: entered allmulticast mode [ 326.215407][T14311] qrtr: Invalid version 0 [ 326.792537][ T5877] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 327.011558][ T5877] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 327.023203][ T5877] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.031937][ T5877] usb 3-1: Product: syz [ 327.036487][ T5877] usb 3-1: Manufacturer: syz [ 327.041525][ T5877] usb 3-1: SerialNumber: syz [ 327.522684][ T5877] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 327.537196][ T5877] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 327.550210][ T5877] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 327.563243][ T5877] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 327.578859][ T5877] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 327.596167][ T5877] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 327.615503][ T5877] usb 3-1: USB disconnect, device number 18 [ 328.304308][ T79] IPVS: stop unused estimator thread 0... [ 328.483461][T14347] qrtr: Invalid version 0 [ 328.700653][ T30] audit: type=1400 audit(1776407580.492:742): avc: denied { getopt } for pid=14353 comm="syz.4.2875" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 328.930339][T14366] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input14 [ 329.068193][T13954] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 329.196954][T13954] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 329.247967][T13954] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 329.290569][T13954] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 329.327625][T13954] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 329.386674][T13954] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 329.499807][T13954] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 330.499841][T13954] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 330.637991][T14391] syzkaller0: entered promiscuous mode [ 330.643924][T14391] syzkaller0: entered allmulticast mode [ 330.780902][T14421] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2887'. [ 332.248595][T14399] syzkaller0: entered promiscuous mode [ 332.254745][T14399] syzkaller0: entered allmulticast mode [ 332.444547][T14458] syzkaller0: entered promiscuous mode [ 332.464667][T14458] syzkaller0: entered allmulticast mode [ 332.508366][T13954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 332.525654][T14465] netlink: 'syz.2.2893': attribute type 1 has an invalid length. [ 332.659238][T14470] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2893'. [ 332.710701][T14468] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 332.749465][T14468] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 332.787060][T14470] 8021q: adding VLAN 0 to HW filter on device bond8 [ 332.899484][T14478] fuse: Invalid rootmode [ 332.916053][T13954] 8021q: adding VLAN 0 to HW filter on device team0 [ 332.931596][T14480] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2896'. [ 332.969493][T14480] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2896'. [ 332.980047][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.987597][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 332.999846][T14480] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2896'. [ 333.011199][ T1085] bridge0: port 2(bridge_slave_1) entered blocking state [ 333.018796][ T1085] bridge0: port 2(bridge_slave_1) entered forwarding state [ 333.429698][T14489] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2898'. [ 335.525285][T14517] syzkaller0: entered promiscuous mode [ 335.537334][T14517] syzkaller0: entered allmulticast mode [ 335.645747][T14530] syzkaller0: entered promiscuous mode [ 335.653080][T14530] syzkaller0: entered allmulticast mode [ 336.025852][T14548] netlink: 'syz.1.2908': attribute type 39 has an invalid length. [ 336.358726][T14556] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2911'. [ 336.488425][T13954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 336.576947][T14563] syzkaller0: entered promiscuous mode [ 336.587780][T14563] syzkaller0: entered allmulticast mode [ 336.668977][T14569] loop2: detected capacity change from 0 to 1 [ 336.678031][T14569] Dev loop2: unable to read RDB block 1 [ 336.684128][T14569] loop2: AHDI p1 p2 p3 [ 336.689957][T14569] loop2: partition table partially beyond EOD, truncated [ 336.697996][T14569] loop2: p1 start 1601398130 is beyond EOD, truncated [ 336.719738][T14569] loop2: p2 start 1702059890 is beyond EOD, truncated [ 336.837424][T13954] veth0_vlan: entered promiscuous mode [ 336.910010][T13954] veth1_vlan: entered promiscuous mode [ 336.935471][ T30] audit: type=1800 audit(1776407588.095:743): pid=14572 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2917" name="bus" dev="tmpfs" ino=2967 res=0 errno=0 [ 337.209831][T13954] veth0_macvtap: entered promiscuous mode [ 337.239650][T13954] veth1_macvtap: entered promiscuous mode [ 337.276985][T13954] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 337.301783][T13954] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 337.341913][T14508] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.353518][T14587] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2922'. [ 337.372585][T14508] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.416866][T14508] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.440489][T14592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2923'. [ 337.444496][T14508] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.648225][T14597] loop2: detected capacity change from 0 to 1 [ 337.669053][T14597] Dev loop2: unable to read RDB block 1 [ 337.677375][T14597] loop2: AHDI p1 p2 p3 [ 337.681746][T14597] loop2: partition table partially beyond EOD, truncated [ 337.694994][T14508] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.695926][T14597] loop2: p1 start 1601398130 is beyond EOD, [ 337.710710][T14597] truncated [ 337.711298][T14508] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.726003][T14597] loop2: p2 start 1702059890 is beyond EOD, truncated [ 337.769517][ T5185] Dev loop2: unable to read RDB block 1 [ 337.776886][T14600] syzkaller0: entered promiscuous mode [ 337.779434][ T5185] loop2: AHDI p1 p2 p3 [ 337.782934][T14600] syzkaller0: entered allmulticast mode [ 337.790137][ T5185] loop2: partition table partially beyond EOD, truncated [ 337.801031][ T5185] loop2: p1 start 1601398130 is beyond EOD, truncated [ 337.804718][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.816663][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.818177][ T5185] loop2: p2 start 1702059890 is beyond EOD, truncated [ 337.839997][ T30] audit: type=1400 audit(1776407588.925:744): avc: denied { mounton } for pid=13954 comm="syz-executor" path="/root/syzkaller.COOJ5B/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 337.882826][ T30] audit: type=1400 audit(1776407588.962:745): avc: denied { mounton } for pid=13954 comm="syz-executor" path="/root/syzkaller.COOJ5B/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 337.914906][ T30] audit: type=1400 audit(1776407588.962:746): avc: denied { mounton } for pid=13954 comm="syz-executor" path="/root/syzkaller.COOJ5B/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=46150 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 338.007209][ T30] audit: type=1400 audit(1776407588.999:747): avc: denied { mounton } for pid=13954 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 338.231488][ T30] audit: type=1800 audit(1776407589.285:748): pid=14607 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.2930" name="bus" dev="tmpfs" ino=2877 res=0 errno=0 [ 339.480995][T14623] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2936'. [ 339.530889][ T5816] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 339.545102][ T5816] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 339.554448][ T5816] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 339.563206][ T5816] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 339.577270][ T5816] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 339.863748][T14637] loop2: detected capacity change from 0 to 1 [ 339.893788][T14637] Dev loop2: unable to read RDB block 1 [ 339.895104][T14629] 8021q: VLANs not supported on ip_vti0 [ 339.906957][T14637] loop2: AHDI p1 p2 p3 [ 339.914916][T14637] loop2: partition table partially beyond EOD, truncated [ 339.924640][T14637] loop2: p1 start 1601398130 is beyond EOD, truncated [ 339.932387][T14637] loop2: p2 start 1702059890 is beyond EOD, truncated [ 339.980715][T14625] lo speed is unknown, defaulting to 1000 [ 340.006745][T14625] gre0 speed is unknown, defaulting to 1000 [ 340.973726][ T5819] bond0: (slave syz_tun): Releasing backup interface [ 341.255743][T14508] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.370664][T14670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2953'. [ 341.392581][T14670] vlan2: entered promiscuous mode [ 341.398410][T14670] bond0: entered promiscuous mode [ 341.403468][T14670] bond_slave_0: entered promiscuous mode [ 341.409327][T14670] bond_slave_1: entered promiscuous mode [ 341.415425][T14670] vlan2: entered allmulticast mode [ 341.420776][T14670] bond0: entered allmulticast mode [ 341.426137][T14670] bond_slave_0: entered allmulticast mode [ 341.431947][T14670] bond_slave_1: entered allmulticast mode [ 341.486522][T14508] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.511877][T14670] gretap1: entered promiscuous mode [ 341.517331][T14670] gretap1: entered allmulticast mode [ 341.523246][T14670] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 341.837775][ T5816] Bluetooth: hci4: command tx timeout [ 341.885097][ T0] NOHZ tick-stop error: local softirq work is pending, handler #04!!! [ 341.950123][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 342.972097][T14508] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.040090][T14688] syzkaller0: entered promiscuous mode [ 343.046264][T14688] syzkaller0: entered allmulticast mode [ 343.166072][T14508] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.176859][ T10] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 343.265498][T14625] chnl_net:caif_netlink_parms(): no params data found [ 343.682493][T14707] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2963'. [ 343.986344][T14625] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.991158][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 343.995915][T14625] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.003960][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 344.020620][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 344.030336][ T10] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 344.042086][ T10] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 344.056263][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 344.067940][ T10] usb 4-1: config 1 interface 1 has no altsetting 0 [ 344.085598][ T5816] Bluetooth: hci4: command tx timeout [ 344.118985][ T10] usb 4-1: string descriptor 0 read error: -22 [ 344.125732][ T10] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 344.128757][T14625] bridge_slave_0: entered allmulticast mode [ 344.135394][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.191130][T14625] bridge_slave_0: entered promiscuous mode [ 344.230696][T14625] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.252835][T14625] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.289186][T14625] bridge_slave_1: entered allmulticast mode [ 344.315262][T14625] bridge_slave_1: entered promiscuous mode [ 344.377495][T14625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.392450][T14625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.437712][T14625] team0: Port device team_slave_0 added [ 344.445661][T14625] team0: Port device team_slave_1 added [ 344.472725][T14625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 344.479863][T14625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.506513][T14625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 344.519678][T14625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 344.526669][T14625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.553445][T14625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 344.688751][T14625] hsr_slave_0: entered promiscuous mode [ 344.698111][T14625] hsr_slave_1: entered promiscuous mode [ 344.717121][T14625] debugfs: 'hsr0' already exists in 'hsr' [ 344.723212][T14625] Cannot create hsr debugfs directory [ 345.527555][ T10] usb 4-1: 2:0: failed to get current value for ch 1 (-71) [ 345.546264][T14508] bridge_slave_1: left allmulticast mode [ 345.550907][ T10] usb 4-1: Warning! Unlikely small volume range (=233), linear volume or custom curve? [ 345.553845][T14508] bridge_slave_1: left promiscuous mode [ 345.572442][T14508] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.572542][ T10] usb 4-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/233/1 [ 345.590211][T14508] bridge_slave_0: left allmulticast mode [ 345.596314][T14508] bridge_slave_0: left promiscuous mode [ 345.602044][T14508] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.687545][ T10] usb 4-1: USB disconnect, device number 27 [ 345.869052][T14508] bond5 (unregistering): (slave bridge1): Releasing active interface [ 346.008917][T14508] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 346.019599][T14508] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 346.030204][T14508] bond0 (unregistering): Released all slaves [ 346.041535][T14508] bond1 (unregistering): Released all slaves [ 346.061638][T14508] bond2 (unregistering): Released all slaves [ 346.080262][T14508] bond3 (unregistering): Released all slaves [ 346.095125][T14508] bond4 (unregistering): Released all slaves [ 346.117188][T14508] bond5 (unregistering): Released all slaves [ 346.134746][T14508] bond6 (unregistering): Released all slaves [ 346.149683][T14508] bond7 (unregistering): Released all slaves [ 346.164837][T14508] bond8 (unregistering): Released all slaves [ 346.311234][T14508] tipc: Disabling bearer [ 346.328717][T14508] tipc: Left network mode [ 346.354638][ T5816] Bluetooth: hci4: command tx timeout [ 346.456777][T14737] fuse: Unknown parameter 'use00000000000000000000' [ 346.505130][ T24] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 346.637919][T14745] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2975'. [ 346.654655][T14745] syzkaller1: entered promiscuous mode [ 346.660219][T14745] syzkaller1: entered allmulticast mode [ 346.693015][ T24] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 346.703422][ T24] usb 4-1: config 0 has no interface number 0 [ 346.717539][ T24] usb 4-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 346.738898][ T24] usb 4-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 346.771216][ T24] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 346.808893][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.841588][ T24] usb 4-1: Product: syz [ 346.871073][ T24] usb 4-1: Manufacturer: syz [ 346.895885][ T24] usb 4-1: SerialNumber: syz [ 346.931666][ T24] usb 4-1: config 0 descriptor?? [ 346.962937][T14732] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 346.999538][ T24] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 347.032675][ T24] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -22 [ 347.270328][T14508] hsr_slave_0: left promiscuous mode [ 347.277403][T14508] hsr_slave_1: left promiscuous mode [ 347.290889][T14508] veth1_macvtap: left promiscuous mode [ 347.297228][T14508] veth0_macvtap: left promiscuous mode [ 347.302844][T14508] veth1_vlan: left promiscuous mode [ 347.310201][T14508] veth0_vlan: left promiscuous mode [ 347.696988][T14508] team_slave_1 (unregistering): left allmulticast mode [ 347.786058][T14508] team0 (unregistering): Port device team_slave_1 removed [ 347.803271][T14508] team_slave_0 (unregistering): left allmulticast mode [ 347.811173][T14508] team0 (unregistering): Port device team_slave_0 removed [ 347.936894][T14774] netlink: 'syz.0.2981': attribute type 10 has an invalid length. [ 347.973490][ T797] lo speed is unknown, defaulting to 1000 [ 347.980267][T14401] smbdirect: ib_dev[syz2] removed [ 347.980568][ T797] syz2: Port: 1 Link DOWN [ 347.994934][T14774] syz_tun: entered promiscuous mode [ 348.022733][T14774] syz_tun: entered allmulticast mode [ 348.030934][T14774] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 348.056083][T14774] "syz.0.2981" (14774) uses obsolete ecb(arc4) skcipher [ 348.071393][T14625] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 348.094233][T14625] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 348.110135][T14773] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2981'. [ 348.124108][T14625] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 348.163597][T14625] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 348.185507][T14625] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 348.224665][T14625] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 348.364568][T14625] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 348.385254][T14625] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 349.438722][T14508] IPVS: stop unused estimator thread 0... [ 349.458770][ T5816] Bluetooth: hci4: command tx timeout [ 349.561930][T14801] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2986'. [ 349.629898][T14808] syzkaller1: entered promiscuous mode [ 349.643382][ T797] usb 4-1: USB disconnect, device number 28 [ 349.656583][T14808] syzkaller1: entered allmulticast mode [ 349.925471][T14625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 350.021393][T14625] 8021q: adding VLAN 0 to HW filter on device team0 [ 350.054271][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.062029][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 350.067784][ T24] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 350.159877][T14829] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2916680627 (46666890032 ns) > initial count (16865692240 ns). Using initial count to start timer. [ 350.178695][T14824] 8021q: adding VLAN 0 to HW filter on device bond10 [ 350.233777][ T79] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.241489][ T79] bridge0: port 2(bridge_slave_1) entered forwarding state [ 350.264092][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 350.279704][ T24] usb 2-1: config 0 has no interfaces? [ 350.300252][ T24] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 350.318512][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.344127][ T24] usb 2-1: Product: syz [ 350.363851][ T24] usb 2-1: Manufacturer: syz [ 350.379812][ T24] usb 2-1: SerialNumber: syz [ 350.405051][ T24] usb 2-1: config 0 descriptor?? [ 350.608749][T14836] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2994'. [ 350.640035][T14836] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2994'. [ 350.672801][T14836] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2994'. [ 350.903773][T14625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 351.048549][T14625] veth0_vlan: entered promiscuous mode [ 351.089587][T14625] veth1_vlan: entered promiscuous mode [ 351.154694][T14625] veth0_macvtap: entered promiscuous mode [ 351.175323][T14625] veth1_macvtap: entered promiscuous mode [ 351.218289][T14625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 351.235818][T14625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 351.290757][ T79] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.304110][ T79] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.549264][ T29] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 352.162038][ T79] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.252274][ T79] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.874479][ T29] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 352.889291][ T29] usb 1-1: config 0 has no interface number 0 [ 352.895451][ T29] usb 1-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 352.907682][ T29] usb 1-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 352.921044][ T29] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 352.932498][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.941992][ T29] usb 1-1: Product: syz [ 352.946222][ T29] usb 1-1: Manufacturer: syz [ 352.951301][ T29] usb 1-1: SerialNumber: syz [ 352.977102][ T29] usb 1-1: config 0 descriptor?? [ 352.992029][T14851] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 353.054180][ T29] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 353.095519][ T24] usb 2-1: USB disconnect, device number 23 [ 353.101650][ T29] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -22 [ 353.186822][T14864] 8021q: adding VLAN 0 to HW filter on device bond5 [ 353.270385][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.290776][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.342956][ T3588] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.369369][ T3588] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.555473][ T30] audit: type=1400 audit(1776407603.412:749): avc: denied { setopt } for pid=14870 comm="syz.4.3004" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 354.566645][ T5812] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 354.576006][ T5812] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 354.596880][ T5812] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 354.603253][ T29] usb 1-1: USB disconnect, device number 15 [ 354.621687][ T5812] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 354.634077][ T5812] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 355.184241][ T29] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 355.379769][ T29] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 355.390094][ T29] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 355.403421][ T29] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 355.412850][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.660564][ T29] usb 3-1: usb_control_msg returned -32 [ 355.671839][ T29] usbtmc 3-1:16.0: can't read capabilities [ 355.755573][T14911] netlink: 'syz.0.3013': attribute type 10 has an invalid length. [ 355.938575][T14914] "syz.0.3013" (14914) uses obsolete ecb(arc4) skcipher [ 356.013751][T14915] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3013'. [ 356.304114][ T29] usb 3-1: USB disconnect, device number 19 [ 356.316171][ T5818] bond0: (slave syz_tun): Releasing backup interface [ 356.495588][T14898] gre0 speed is unknown, defaulting to 1000 [ 356.585643][T14925] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3015'. [ 356.611158][T14925] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3015'. [ 356.650073][T14925] erspan0: entered promiscuous mode [ 356.675926][T14925] gretap0: entered promiscuous mode [ 356.917951][ T5812] Bluetooth: hci3: command tx timeout [ 357.024061][T14941] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3023'. [ 357.066902][T14941] syzkaller1: entered promiscuous mode [ 357.073038][T14941] syzkaller1: entered allmulticast mode [ 357.254897][T14950] 8021q: adding VLAN 0 to HW filter on device bond6 [ 357.486750][T14898] chnl_net:caif_netlink_parms(): no params data found [ 357.807664][T14971] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 357.936608][T14401] bond9 (unregistering): (slave gretap1): Releasing backup interface [ 357.966992][ T30] audit: type=1400 audit(1776407607.490:750): avc: denied { create } for pid=14982 comm="syz.0.3034" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 357.988713][T14401] gretap1 (unregistering): left promiscuous mode [ 357.995680][T14401] gretap1 (unregistering): left allmulticast mode [ 358.086091][ T30] audit: type=1400 audit(1776407607.601:751): avc: denied { lock } for pid=14982 comm="syz.0.3034" path="socket:[48364]" dev="sockfs" ino=48364 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 358.111323][T14988] xt_l2tp: missing protocol rule (udp|l2tpip) [ 358.330652][ T30] audit: type=1400 audit(1776407607.601:752): avc: denied { setopt } for pid=14982 comm="syz.0.3034" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 358.949830][ T1085] smc: removing ib device syz1 [ 359.092732][ T1085] smbdirect: ib_dev[syz1] removed [ 359.171540][ T5812] Bluetooth: hci3: command tx timeout [ 359.245969][T14401] bond0 (unregistering): Released all slaves [ 359.283929][T14401] bond1 (unregistering): Released all slaves [ 359.362508][T14401] bond2 (unregistering): Released all slaves [ 359.414680][T15008] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3036'. [ 359.472774][T14401] bond3 (unregistering): Released all slaves [ 359.503861][T14401] bond4 (unregistering): Released all slaves [ 359.580202][T14401] bond5 (unregistering): Released all slaves [ 359.612676][T14401] bond6 (unregistering): Released all slaves [ 359.635076][T14401] bond7 (unregistering): Released all slaves [ 359.658266][T14401] bond8 (unregistering): Released all slaves [ 359.687041][T14401] bond9 (unregistering): Released all slaves [ 359.713129][T14401] bond10 (unregistering): Released all slaves [ 359.981770][T15001] pim6reg: entered allmulticast mode [ 360.003950][ T5480] 8021q: adding VLAN 0 to HW filter on device eth1 [ 360.102374][T15009] syzkaller1: entered promiscuous mode [ 360.119819][T15009] syzkaller1: entered allmulticast mode [ 360.504778][T14898] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.524970][T14898] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.424425][T14898] bridge_slave_0: entered allmulticast mode [ 361.430922][ T5812] Bluetooth: hci3: command tx timeout [ 361.449321][T14898] bridge_slave_0: entered promiscuous mode [ 361.463309][T14898] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.471243][T14898] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.480904][T14898] bridge_slave_1: entered allmulticast mode [ 361.508383][T14898] bridge_slave_1: entered promiscuous mode [ 362.556494][T15040] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 363.525210][T15088] random: crng reseeded on system resumption [ 363.680044][ T5812] Bluetooth: hci3: command tx timeout [ 365.283056][T14898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.303433][ T5480] 8021q: adding VLAN 0 to HW filter on device eth2 [ 365.311677][T15103] tipc: Started in network mode [ 365.318911][T15103] tipc: Node identity 266c5bc73def, cluster identity 4711 [ 365.326801][T15103] tipc: Enabled bearer , priority 0 [ 365.347006][T14401] tipc: Disabling bearer [ 365.366013][T14401] tipc: Disabling bearer [ 365.374830][T14401] tipc: Left network mode [ 365.377775][T15104] syzkaller0: entered promiscuous mode [ 365.400888][T15104] syzkaller0: entered allmulticast mode [ 365.442969][T14898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.534854][T15111] tipc: Resetting bearer [ 365.615512][T15111] tipc: Disabling bearer [ 365.720923][T15120] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 365.723820][T14898] team0: Port device team_slave_0 added [ 365.773192][T14898] team0: Port device team_slave_1 added [ 365.901254][T14898] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 365.909301][T14898] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 365.946530][T14898] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 365.962450][T14898] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 365.974951][T14898] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.007546][T14898] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.605061][T14898] hsr_slave_0: entered promiscuous mode [ 366.627859][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 366.641371][T14898] hsr_slave_1: entered promiscuous mode [ 366.697055][T14898] debugfs: 'hsr0' already exists in 'hsr' [ 366.736754][T14898] Cannot create hsr debugfs directory [ 367.155893][T14401] hsr_slave_0: left promiscuous mode [ 367.169151][T14401] hsr_slave_1: left promiscuous mode [ 367.534222][ T5480] 8021q: adding VLAN 0 to HW filter on device eth3 [ 368.218291][T15187] loop2: detected capacity change from 0 to 1 [ 368.269716][T15187] Dev loop2: unable to read RDB block 1 [ 368.289027][T15187] loop2: unable to read partition table [ 368.311028][T15187] loop2: partition table beyond EOD, truncated [ 368.335041][T15187] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 368.844069][T15185] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 369.134106][T14401] IPVS: stop unused estimator thread 0... [ 369.768538][ T30] audit: type=1800 audit(1776407618.387:753): pid=15230 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.3087" name="bus" dev="tmpfs" ino=3074 res=0 errno=0 [ 369.921474][T14898] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 369.962800][T14898] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 369.982762][T14898] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 370.018024][T14898] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 370.036450][T15247] fuse: Bad value for 'fd' [ 370.049489][T15240] bond7: (slave bridge1): Enslaving as an active interface with an up link [ 370.087562][T14898] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 370.118520][T14898] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 370.139026][T14898] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 370.170608][T14898] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 370.452256][T14898] 8021q: adding VLAN 0 to HW filter on device bond0 [ 370.480596][T14898] 8021q: adding VLAN 0 to HW filter on device team0 [ 370.512136][T14508] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.519320][T14508] bridge0: port 1(bridge_slave_0) entered forwarding state [ 370.559086][T14508] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.566827][T14508] bridge0: port 2(bridge_slave_1) entered forwarding state [ 370.651463][ T30] audit: type=1400 audit(1776407619.208:754): avc: denied { bind } for pid=15278 comm="syz.3.3098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 370.718393][ T30] audit: type=1400 audit(1776407619.264:755): avc: denied { nlmsg_read } for pid=15278 comm="syz.3.3098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 370.825819][T15268] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 371.184775][T14898] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.212324][ T30] audit: type=1800 audit(1776407619.716:756): pid=15297 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.3099" name="bus" dev="tmpfs" ino=139 res=0 errno=0 [ 371.964021][T15312] netlink: 'syz.0.3102': attribute type 1 has an invalid length. [ 372.005233][T15312] netlink: 1820 bytes leftover after parsing attributes in process `syz.0.3102'. [ 372.040043][T15312] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3102'. [ 372.047981][T15315] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3103'. [ 372.083533][T15315] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3103'. [ 372.106290][T15315] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3103'. [ 372.379854][T14898] veth0_vlan: entered promiscuous mode [ 372.434067][T14898] veth1_vlan: entered promiscuous mode [ 372.484647][T15332] fuse: Bad value for 'fd' [ 372.544788][T14898] veth0_macvtap: entered promiscuous mode [ 372.559564][T14898] veth1_macvtap: entered promiscuous mode [ 372.594964][T14898] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 372.634458][T14898] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 372.663093][ T3522] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.691481][ T3522] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.718248][ T3522] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.738520][ T3522] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.935014][ T3522] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.961159][ T3522] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 373.038823][ T1085] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 373.050686][ T1085] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 373.134021][T15354] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 373.237104][T15359] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3112'. [ 373.305631][ T30] audit: type=1800 audit(1776407621.644:757): pid=15362 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.3114" name="bus" dev="overlay" ino=271 res=0 errno=0 [ 373.399114][T15367] netlink: 'syz.0.3115': attribute type 1 has an invalid length. [ 373.408947][T15367] netlink: 1820 bytes leftover after parsing attributes in process `syz.0.3115'. [ 373.418538][T15367] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3115'. [ 373.621753][T15371] syzkaller0: entered promiscuous mode [ 373.659397][T15371] syzkaller0: entered allmulticast mode [ 373.745160][ T30] audit: type=1800 audit(1776407622.050:758): pid=15374 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.3118" name="bus" dev="tmpfs" ino=156 res=0 errno=0 [ 374.004967][ T5816] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 374.086814][ T5816] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 374.096789][ T5816] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 374.107298][ T5816] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 374.114890][ T5816] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 374.924433][T15399] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3124'. [ 375.075372][T15385] chnl_net:caif_netlink_parms(): no params data found [ 375.275718][T15413] fuse: Unknown parameter '0x0000000000000003' [ 375.330124][T15416] netlink: 'syz.2.3127': attribute type 10 has an invalid length. [ 375.346400][T15417] loop2: detected capacity change from 0 to 1 [ 375.353429][T15416] syz_tun: entered promiscuous mode [ 375.366712][T15417] Dev loop2: unable to read RDB block 1 [ 375.373171][T15416] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 375.382583][T15417] loop2: AHDI p1 p2 p3 p4 [ 375.400349][T15417] loop2: partition table partially beyond EOD, truncated [ 375.412088][T15414] "syz.2.3127" (15414) uses obsolete ecb(arc4) skcipher [ 375.420022][T15417] loop2: p1 start 1601398130 is beyond EOD, truncated [ 375.430041][T15414] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3127'. [ 375.445140][T15417] loop2: p2 start 1702059890 is beyond EOD, truncated [ 375.448048][T15385] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.461395][T15385] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.467790][T15417] loop2: p3 start 10750 is beyond EOD, truncated [ 375.481448][T15385] bridge_slave_0: entered allmulticast mode [ 375.489460][T15385] bridge_slave_0: entered promiscuous mode [ 375.499286][T15385] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.510464][T15385] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.521026][T15385] bridge_slave_1: entered allmulticast mode [ 375.536092][T15385] bridge_slave_1: entered promiscuous mode [ 375.623367][ T29] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 375.644383][T15385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 375.678809][T15385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 375.784235][T15385] team0: Port device team_slave_0 added [ 375.802932][ T29] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 375.823971][T15385] team0: Port device team_slave_1 added [ 375.834443][ T29] usb 5-1: config 0 has no interface number 0 [ 375.848115][ T29] usb 5-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 375.867314][ T29] usb 5-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 375.874103][T15439] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1500) ! [ 375.903251][ T29] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 375.922814][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.945143][ T29] usb 5-1: Product: syz [ 375.951992][T15439] syzkaller0: entered promiscuous mode [ 375.952547][ T29] usb 5-1: Manufacturer: syz [ 375.957885][T15439] syzkaller0: entered allmulticast mode [ 375.973157][T15385] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 375.978664][ T29] usb 5-1: SerialNumber: syz [ 375.981250][T15385] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.023088][T15385] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 376.029236][ T29] usb 5-1: config 0 descriptor?? [ 376.037574][T15385] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 376.046349][T15385] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.076408][T15385] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 376.085496][T15420] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 376.095343][T15420] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 376.122821][ T24] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 376.298195][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 959 [ 376.325399][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 376.343643][ T5812] Bluetooth: hci2: command tx timeout [ 376.363647][T15420] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 376.363974][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 376.375165][T15420] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 376.383523][ T24] usb 3-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice=e5.38 [ 376.397007][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.406602][ T24] usb 3-1: Product: syz [ 376.410852][ T24] usb 3-1: Manufacturer: syz [ 376.415889][ T24] usb 3-1: SerialNumber: syz [ 376.424134][ T24] usb 3-1: config 0 descriptor?? [ 376.431753][T15440] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 376.625838][ T29] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 376.637095][ T29] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 376.785050][T15440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.812590][T15440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.840734][ T9] usb 3-1: USB disconnect, device number 20 [ 376.866395][ T29] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 376.878017][ T29] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -32 [ 377.730469][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.738772][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.483515][T15385] hsr_slave_0: entered promiscuous mode [ 378.490176][T15385] hsr_slave_1: entered promiscuous mode [ 378.499061][T15385] debugfs: 'hsr0' already exists in 'hsr' [ 378.504790][T15385] Cannot create hsr debugfs directory [ 378.592922][ T5812] Bluetooth: hci2: command tx timeout [ 378.695545][ T29] usb 5-1: USB disconnect, device number 16 [ 378.791997][T15385] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.865361][T15482] fuse: Unknown parameter '0x0000000000000003' [ 378.871776][T15480] __nla_validate_parse: 1 callbacks suppressed [ 378.871791][T15480] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3147'. [ 378.901592][T15483] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3144'. [ 379.056035][T15385] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.140489][ T30] audit: type=1400 audit(1776407627.033:759): avc: denied { read } for pid=15485 comm="syz.2.3148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 379.206963][T15385] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.340058][T15385] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 380.338444][ T24] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 380.530592][ T24] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 380.538812][ T24] usb 1-1: config 0 has no interface number 0 [ 380.545224][ T24] usb 1-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 380.556077][ T24] usb 1-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 380.569373][ T24] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 380.578478][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.586479][ T24] usb 1-1: Product: syz [ 380.590975][ T24] usb 1-1: Manufacturer: syz [ 380.595696][ T24] usb 1-1: SerialNumber: syz [ 380.614626][ T24] usb 1-1: config 0 descriptor?? [ 380.620312][T15503] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 380.627545][T15503] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 380.851021][ T5812] Bluetooth: hci2: command tx timeout [ 380.870430][T15503] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 380.877686][T15503] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 381.105530][ T24] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 381.117211][ T24] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 381.352660][ T24] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 381.363878][ T24] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -32 [ 381.721706][T15522] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3157'. [ 381.785568][T15525] netlink: 'syz.4.3158': attribute type 10 has an invalid length. [ 381.802429][T15525] syz_tun: entered promiscuous mode [ 381.824026][T15525] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 381.835224][T15385] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 381.857327][T15385] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 381.872645][T15385] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 381.896321][T15385] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 381.909816][T15525] "syz.4.3158" (15525) uses obsolete ecb(arc4) skcipher [ 381.933274][T15385] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 381.949817][T15385] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 381.957893][T15525] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3158'. [ 381.958614][T15385] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 382.466267][T15534] fuse: Unknown parameter '0x0000000000000003' [ 382.681943][T15385] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 382.993166][T15385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 383.050569][T15385] 8021q: adding VLAN 0 to HW filter on device team0 [ 383.101832][ T5812] Bluetooth: hci2: command tx timeout [ 383.366997][ T5863] usb 1-1: USB disconnect, device number 16 [ 385.066637][T14401] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.073805][T14401] bridge0: port 1(bridge_slave_0) entered forwarding state [ 385.112882][T14401] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.120040][T14401] bridge0: port 2(bridge_slave_1) entered forwarding state [ 385.159060][T15585] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3168'. [ 385.378509][ T30] audit: type=1800 audit(1776407632.781:760): pid=15592 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.3170" name="bus" dev="tmpfs" ino=339 res=0 errno=0 [ 385.807823][T15385] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 385.814880][ T5863] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 385.961369][T15385] veth0_vlan: entered promiscuous mode [ 385.993469][ T5863] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 386.015164][T15385] veth1_vlan: entered promiscuous mode [ 386.020935][ T5863] usb 1-1: config 0 has no interface number 0 [ 386.035760][ T5863] usb 1-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 386.080581][ T5863] usb 1-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 386.130283][ T5863] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 386.182349][T15385] veth0_macvtap: entered promiscuous mode [ 386.188263][ T5863] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.196746][ T5863] usb 1-1: Product: syz [ 386.200861][T15385] veth1_macvtap: entered promiscuous mode [ 386.221884][ T5863] usb 1-1: Manufacturer: syz [ 386.230132][ T5863] usb 1-1: SerialNumber: syz [ 386.254597][T15385] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 386.274563][T15385] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 386.275928][ T5863] usb 1-1: config 0 descriptor?? [ 386.317751][T15602] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 386.326711][T15602] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 386.361138][ T1085] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.407056][ T1085] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.437423][ T1085] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.464179][ T1085] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.531897][T15612] netlink: 'syz.4.3178': attribute type 10 has an invalid length. [ 386.562511][T15602] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 386.573671][T15602] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 386.737426][T15613] "syz.4.3178" (15613) uses obsolete ecb(arc4) skcipher [ 386.758801][ T1085] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.767056][ T24] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 386.774184][ T1085] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.791253][T15615] syzkaller0: entered promiscuous mode [ 386.798541][T15615] syzkaller0: entered allmulticast mode [ 386.805094][ T5863] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 386.817024][ T5863] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 386.852015][T15612] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3178'. [ 386.862956][T14401] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.873928][T14401] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.937691][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 386.964658][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 387.001052][ T24] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 387.025106][ T24] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 387.040691][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 387.051607][ T5863] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 387.063934][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 387.068870][T15619] sch_tbf: peakrate 11 is lower than or equals to rate 996173156578218475 ! [ 387.072734][ T5863] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -32 [ 387.106168][ T24] usb 3-1: SerialNumber: syz [ 387.184156][T15619] syzkaller0: entered promiscuous mode [ 387.193877][T15619] syzkaller0: entered allmulticast mode [ 387.266638][T15627] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3182'. [ 387.276928][T15627] block nbd0: not configured, cannot reconfigure [ 387.367214][ T5863] usb 3-1: USB disconnect, device number 21 [ 387.418812][ T30] audit: type=1800 audit(1776407634.664:761): pid=15629 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.3183" name="bus" dev="tmpfs" ino=23 res=0 errno=0 [ 387.745858][ T30] audit: type=1400 audit(1776407634.977:762): avc: denied { sqpoll } for pid=15637 comm="syz.1.3187" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 388.054913][ T24] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 388.138271][T15646] input: syz0 as /devices/virtual/input/input15 [ 388.227451][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 388.243219][ T24] usb 2-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 388.270765][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.279183][ T24] usb 2-1: Product: syz [ 388.286587][ T24] usb 2-1: Manufacturer: syz [ 388.291714][ T24] usb 2-1: SerialNumber: syz [ 388.301271][ T24] usb 2-1: config 0 descriptor?? [ 388.311290][ T24] visor 2-1:0.0: Sony Clie 3.5 converter detected [ 388.763225][ T24] usb 2-1: clie_3_5_startup: get interface number bad return length: 0 [ 388.771784][ T24] visor 2-1:0.0: probe with driver visor failed with error -5 [ 388.865291][ T5863] usb 1-1: USB disconnect, device number 17 [ 389.018989][ T5892] usb 2-1: USB disconnect, device number 24 [ 389.498801][ T30] audit: type=1800 audit(1776407636.592:763): pid=15666 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.3194" name="bus" dev="tmpfs" ino=124 res=0 errno=0 [ 390.042070][T15680] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 390.156192][ T30] audit: type=1400 audit(1776407637.081:764): avc: denied { mount } for pid=15673 comm="syz.0.3198" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 390.261493][ T30] audit: type=1400 audit(1776407637.090:765): avc: denied { mounton } for pid=15673 comm="syz.0.3198" path="/67/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 390.404178][ T30] audit: type=1400 audit(1776407637.118:766): avc: denied { read } for pid=15673 comm="syz.0.3198" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 390.482322][ T30] audit: type=1400 audit(1776407637.118:767): avc: denied { read } for pid=15673 comm="syz.0.3198" name="/" dev="overlay" ino=4611686018427387905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 390.510278][ T30] audit: type=1400 audit(1776407637.118:768): avc: denied { open } for pid=15673 comm="syz.0.3198" path="/67/file0" dev="overlay" ino=4611686018427387905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 390.536354][ T30] audit: type=1400 audit(1776407637.118:769): avc: denied { read } for pid=15673 comm="syz.0.3198" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 390.586558][T15683] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3200'. [ 390.598215][T15683] block nbd0: not configured, cannot reconfigure [ 391.080714][ T29] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 391.106740][ T5816] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 391.125414][ T5816] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 391.136505][ T5816] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 391.148970][ T5816] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 391.153333][T15693] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2916680627 (46666890032 ns) > initial count (16865692240 ns). Using initial count to start timer. [ 391.179999][ T5816] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 391.264557][ T29] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 391.291405][ T29] usb 3-1: config 0 has no interface number 0 [ 391.329104][ T29] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 391.359711][ T29] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 391.384470][ T29] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 391.411166][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.432282][ T29] usb 3-1: Product: syz [ 391.438372][ T29] usb 3-1: Manufacturer: syz [ 391.458941][ T29] usb 3-1: SerialNumber: syz [ 391.484874][ T29] usb 3-1: config 0 descriptor?? [ 391.519704][T15686] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 391.537607][T15686] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 391.611904][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.731840][T15719] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3214'. [ 391.741504][T15719] block nbd0: not configured, cannot reconfigure [ 391.764853][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.786221][T15686] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 391.805255][T15686] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 391.927894][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.000554][T15695] chnl_net:caif_netlink_parms(): no params data found [ 392.042536][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.054168][ T29] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 392.069920][ T29] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 392.240437][T15695] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.247699][T15695] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.256442][T15695] bridge_slave_0: entered allmulticast mode [ 392.265557][T15695] bridge_slave_0: entered promiscuous mode [ 392.273912][T15695] bridge0: port 2(bridge_slave_1) entered blocking state [ 392.289963][T15695] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.306145][ T29] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 392.317399][T15695] bridge_slave_1: entered allmulticast mode [ 392.327077][T15695] bridge_slave_1: entered promiscuous mode [ 392.333439][ T29] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -32 [ 392.501126][T15695] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 392.515487][T15695] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 392.625640][T15695] team0: Port device team_slave_0 added [ 392.659370][T15695] team0: Port device team_slave_1 added [ 392.765293][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 392.765309][ T30] audit: type=1400 audit(1776407639.600:773): avc: denied { bind } for pid=15748 comm="syz.4.3226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 392.785731][T15695] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 392.798840][T15695] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 392.830660][T15695] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 392.850494][T15695] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 392.866617][T15695] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 392.895530][T15695] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 392.999902][ T29] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 393.364468][ T29] usb 1-1: Using ep0 maxpacket: 8 [ 393.371051][ T29] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 393.387620][ T29] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 393.404492][ T13] bond7 (unregistering): (slave bridge1): Releasing backup interface [ 393.412770][ T29] usb 1-1: config 0 interface 0 has no altsetting 0 [ 393.419607][ T29] usb 1-1: New USB device found, idVendor=20a0, idProduct=4287, bcdDevice= 0.00 [ 393.428669][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.437010][ T5816] Bluetooth: hci1: command tx timeout [ 393.448786][ T29] usb 1-1: config 0 descriptor?? [ 393.462053][ T13] bond0 (unregistering): Released all slaves [ 393.475174][ T13] bond1 (unregistering): Released all slaves [ 393.504993][ T13] bond2 (unregistering): Released all slaves [ 393.524406][ T13] bond3 (unregistering): Released all slaves [ 393.541502][ T13] bond4 (unregistering): Released all slaves [ 393.566333][ T13] bond5 (unregistering): Released all slaves [ 393.586108][ T13] bond6 (unregistering): Released all slaves [ 393.610618][ T13] bond7 (unregistering): Released all slaves [ 393.749793][T15695] hsr_slave_0: entered promiscuous mode [ 393.770722][T15695] hsr_slave_1: entered promiscuous mode [ 393.784829][T15695] debugfs: 'hsr0' already exists in 'hsr' [ 393.790726][T15695] Cannot create hsr debugfs directory [ 393.810611][ T13] tipc: Left network mode [ 393.927398][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 393.951758][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 393.986767][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.005604][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.036414][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.053279][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.077585][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.107182][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.127712][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.146494][ T29] hid-u2fzero 0003:20A0:4287.0004: unknown main item tag 0x0 [ 394.176352][ T29] hid-u2fzero 0003:20A0:4287.0004: hidraw0: USB HID vff.fa Device [HID 20a0:4287] on usb-dummy_hcd.0-1/input0 [ 394.262323][ T981] usb 3-1: USB disconnect, device number 22 [ 395.039187][ T29] hid-u2fzero 0003:20A0:4287.0004: NitroKey U2F LED initialised [ 395.068091][ T29] hid-u2fzero 0003:20A0:4287.0004: NitroKey U2F RNG initialised [ 395.097003][T15779] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3233'. [ 395.123319][T15779] block nbd0: not configured, cannot reconfigure [ 395.126236][ T29] usb 1-1: USB disconnect, device number 18 [ 395.143412][T15780] netlink: 'syz.1.3234': attribute type 1 has an invalid length. [ 395.190941][T15780] netlink: 1828 bytes leftover after parsing attributes in process `syz.1.3234'. [ 395.204974][T15780] netlink: 5 bytes leftover after parsing attributes in process `syz.1.3234'. [ 395.399475][ T30] audit: type=1400 audit(1776407642.036:774): avc: denied { getopt } for pid=15787 comm="syz.1.3235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 395.454587][T15788] tipc: Enabled bearer , priority 0 [ 395.465832][T15788] syzkaller0: entered promiscuous mode [ 395.486850][T15788] syzkaller0: entered allmulticast mode [ 395.617643][T15788] tipc: Resetting bearer [ 395.673137][ T5816] Bluetooth: hci1: command tx timeout [ 395.679554][T15786] tipc: Resetting bearer [ 395.766452][T15786] tipc: Disabling bearer [ 395.801410][ T13] hsr_slave_0: left promiscuous mode [ 395.810742][ T13] hsr_slave_1: left promiscuous mode [ 395.854737][ T13] veth1_macvtap: left promiscuous mode [ 395.871016][ T13] veth0_macvtap: left promiscuous mode [ 395.877221][ T13] veth1_vlan: left promiscuous mode [ 395.884679][ T13] veth0_vlan: left promiscuous mode [ 396.117377][ T981] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 396.444776][ T981] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 396.494389][ T981] usb 2-1: config 0 has no interface number 0 [ 396.521883][ T981] usb 2-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 396.549721][ T981] usb 2-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 396.586946][ T981] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 396.596738][ T981] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 396.605472][ T981] usb 2-1: Product: syz [ 396.610032][ T981] usb 2-1: Manufacturer: syz [ 396.615073][ T981] usb 2-1: SerialNumber: syz [ 396.629942][ T981] usb 2-1: config 0 descriptor?? [ 396.636463][T15805] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 396.644790][T15805] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 396.776552][T15813] syzkaller0: entered promiscuous mode [ 396.787788][T15813] syzkaller0: entered allmulticast mode [ 396.883219][T15805] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 397.037122][T15805] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 397.058148][ T30] audit: type=1400 audit(1776407643.568:775): avc: denied { lock } for pid=15823 comm="syz.4.3244" path="socket:[51968]" dev="sockfs" ino=51968 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 397.122458][T15826] netlink: 'syz.2.3245': attribute type 1 has an invalid length. [ 397.130985][T15826] netlink: 1828 bytes leftover after parsing attributes in process `syz.2.3245'. [ 397.142914][T15826] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3245'. [ 397.181628][T15695] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 397.190680][ T13] IPVS: stop unused estimator thread 0... [ 397.226761][T15695] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 397.251049][T15695] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 397.269696][ T981] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 397.290189][T15695] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 397.306501][ T981] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 397.335827][T15695] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 397.378130][T15695] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 397.410052][T15695] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 397.454862][T15695] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 397.515035][T15840] syzkaller0: entered promiscuous mode [ 397.542680][T15840] syzkaller0: entered allmulticast mode [ 397.569056][ T981] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 397.591747][ T981] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -32 [ 397.665316][T15836] syzkaller0: entered promiscuous mode [ 397.672565][T15836] syzkaller0: entered allmulticast mode [ 397.927270][ T5816] Bluetooth: hci1: command tx timeout [ 398.321756][T15863] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3251'. [ 398.331994][T15863] block nbd0: not configured, cannot reconfigure [ 400.181434][ T5816] Bluetooth: hci1: command tx timeout [ 400.370910][ T5892] usb 2-1: USB disconnect, device number 25 [ 401.420094][T15695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 401.526266][T15886] syzkaller0: entered promiscuous mode [ 401.545791][T15886] syzkaller0: entered allmulticast mode [ 401.569126][T15695] 8021q: adding VLAN 0 to HW filter on device team0 [ 401.611103][ T3544] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.618845][ T3544] bridge0: port 1(bridge_slave_0) entered forwarding state [ 401.663570][ T3544] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.671401][ T3544] bridge0: port 2(bridge_slave_1) entered forwarding state [ 401.749760][T15695] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 402.155931][ T5863] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 402.158402][ T981] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 402.255971][T15910] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3266'. [ 402.258777][T15695] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 402.276788][T15910] block nbd0: not configured, cannot reconfigure [ 402.309052][T15695] veth0_vlan: entered promiscuous mode [ 402.320347][T15695] veth1_vlan: entered promiscuous mode [ 402.341792][ T5863] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 402.355020][ T5863] usb 2-1: config 0 has no interface number 0 [ 402.360275][ T981] usb 5-1: Using ep0 maxpacket: 16 [ 402.362630][T15695] veth0_macvtap: entered promiscuous mode [ 402.375520][ T981] usb 5-1: config 0 has an invalid interface number: 27 but max is 0 [ 402.378099][ T5863] usb 2-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 402.386098][ T981] usb 5-1: config 0 has no interface number 0 [ 402.396770][ T5863] usb 2-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 402.416964][ T5863] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 402.426162][ T981] usb 5-1: too many endpoints for config 0 interface 27 altsetting 205: 241, using maximum allowed: 30 [ 402.426230][ T981] usb 5-1: config 0 interface 27 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 241 [ 402.438226][ T5863] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.457755][ T981] usb 5-1: config 0 interface 27 has no altsetting 0 [ 402.459964][T15695] veth1_macvtap: entered promiscuous mode [ 402.469168][ T981] usb 5-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 402.485284][ T981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.497625][T15695] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 402.501723][ T981] usb 5-1: config 0 descriptor?? [ 402.520276][T15695] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 402.531869][ T5863] usb 2-1: Product: syz [ 402.541999][ T5863] usb 2-1: Manufacturer: syz [ 402.549926][ T981] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 402.558907][ T5863] usb 2-1: SerialNumber: syz [ 402.561471][ T3588] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.576123][ T5863] usb 2-1: config 0 descriptor?? [ 402.585917][T15894] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 402.587026][ T3588] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.603462][T15894] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 402.645479][ T3588] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.656604][ T3588] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.757891][ T30] audit: type=1326 audit(1776407648.827:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 402.810618][T15869] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.835851][T15869] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.837023][ T30] audit: type=1326 audit(1776407648.827:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 402.887801][ T30] audit: type=1326 audit(1776407648.827:778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 402.899035][T15912] syzkaller0: entered promiscuous mode [ 402.914595][T15894] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 402.921080][T15912] syzkaller0: entered allmulticast mode [ 402.926238][T15894] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 402.939660][ T30] audit: type=1326 audit(1776407648.827:779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 402.967349][ T30] audit: type=1326 audit(1776407648.827:781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 402.992965][ T30] audit: type=1326 audit(1776407648.827:780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 403.019768][ T981] gspca_sonixj: reg_r err -32 [ 403.025997][ T30] audit: type=1326 audit(1776407648.827:782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 403.055740][ T981] sonixj 5-1:0.27: probe with driver sonixj failed with error -32 [ 403.076516][ T30] audit: type=1326 audit(1776407648.827:783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 403.107678][ T30] audit: type=1326 audit(1776407648.827:784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4e1979c4ab code=0x7ffc0000 [ 403.145954][ T30] audit: type=1326 audit(1776407648.827:785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15895 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1979c819 code=0x7ffc0000 [ 403.187737][ T5863] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 403.200222][ T5863] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 403.429179][ T5863] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 403.441419][ T5863] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -32 [ 404.844949][T14401] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.869504][ T24] usb 2-1: USB disconnect, device number 26 [ 404.888422][ T981] usb 5-1: USB disconnect, device number 17 [ 404.981827][T14401] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.283812][T15935] devpts: Unknown parameter '»»»»»»ÿÿÿÿÿÿ`' [ 405.773719][ T5884] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 405.977579][ T5884] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.029105][ T5884] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 406.091580][ T5884] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.129839][ T5884] usb 1-1: config 0 descriptor?? [ 406.180878][ T5884] pwc: Askey VC010 type 2 USB webcam detected. [ 406.508045][T15954] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3277'. [ 406.530353][T15954] block nbd0: not configured, cannot reconfigure [ 406.648989][ T5884] pwc: recv_control_msg error -32 req 02 val 2b00 [ 406.668183][ T5884] pwc: recv_control_msg error -32 req 02 val 2700 [ 406.693571][ T5884] pwc: recv_control_msg error -32 req 02 val 2c00 [ 406.706000][ T981] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 406.707025][ T5884] pwc: recv_control_msg error -32 req 04 val 1000 [ 406.721343][ T5884] pwc: recv_control_msg error -32 req 04 val 1300 [ 406.728742][ T5884] pwc: recv_control_msg error -32 req 04 val 1400 [ 406.736851][ T5884] pwc: recv_control_msg error -32 req 02 val 2000 [ 406.745713][ T5884] pwc: recv_control_msg error -32 req 02 val 2100 [ 406.766235][ T5884] pwc: recv_control_msg error -32 req 04 val 1500 [ 406.915613][ T981] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 406.924772][ T981] usb 5-1: config 0 has no interface number 0 [ 406.931344][ T981] usb 5-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 406.943022][ T981] usb 5-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 406.961073][ T981] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 406.971093][ T981] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.980524][ T981] usb 5-1: Product: syz [ 406.984975][ T981] usb 5-1: Manufacturer: syz [ 406.989915][ T981] usb 5-1: SerialNumber: syz [ 406.993482][ T5884] pwc: recv_control_msg error -71 req 02 val 2400 [ 407.002631][ T981] usb 5-1: config 0 descriptor?? [ 407.005492][ T5884] pwc: recv_control_msg error -71 req 02 val 2600 [ 407.008856][T15953] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 407.026962][T15953] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 407.034490][ T5884] pwc: recv_control_msg error -71 req 02 val 2900 [ 407.047711][ T5884] pwc: recv_control_msg error -71 req 02 val 2800 [ 407.055577][ T5884] pwc: recv_control_msg error -71 req 04 val 1100 [ 407.062468][ T5884] pwc: recv_control_msg error -71 req 04 val 1200 [ 407.093961][ T5884] pwc: Registered as video103. [ 407.111180][ T5884] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input16 [ 407.165288][ T5884] usb 1-1: USB disconnect, device number 19 [ 407.300087][T15953] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 407.310986][T15953] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 407.548017][ T981] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 407.551626][ T5863] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 407.573082][ T981] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 407.746324][ T5863] usb 4-1: Using ep0 maxpacket: 16 [ 407.770369][ T5863] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 407.783578][ T5863] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.807726][ T5863] usb 4-1: Product: syz [ 407.816322][ T5863] usb 4-1: Manufacturer: syz [ 407.826205][ T981] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 407.831556][ T5863] usb 4-1: SerialNumber: syz [ 407.870352][ T981] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -61 [ 407.883691][ T5863] usb 4-1: config 0 descriptor?? [ 407.911936][ T5863] visor 4-1:0.0: Sony Clie 3.5 converter detected [ 408.062857][T15991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3294'. [ 408.223910][T15994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3295'. [ 408.343641][ T5863] usb 4-1: clie_3_5_startup: get interface number bad return length: 0 [ 408.353830][ T5863] visor 4-1:0.0: probe with driver visor failed with error -5 [ 408.489010][T16003] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3297'. [ 408.499468][T16003] block nbd0: not configured, cannot reconfigure [ 408.600016][ T981] usb 4-1: USB disconnect, device number 29 [ 409.714339][ T5863] usb 5-1: USB disconnect, device number 18 [ 410.419779][T15996] syzkaller0: entered promiscuous mode [ 410.425539][T15996] syzkaller0: entered allmulticast mode [ 410.816383][ T5863] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 411.041569][ T5863] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 411.073796][ T5863] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 411.111080][ T5863] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 411.141885][ T5863] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 411.178469][ T5863] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 411.219478][ T5863] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 411.248019][ T5863] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 411.267293][ T5863] usb 2-1: Product: syz [ 411.271762][ T5863] usb 2-1: Manufacturer: syz [ 411.294199][ T5863] cdc_wdm 2-1:1.0: skipping garbage [ 411.319808][ T5863] cdc_wdm 2-1:1.0: skipping garbage [ 411.350119][ T5863] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 411.375874][ T5863] cdc_wdm 2-1:1.0: Unknown control protocol [ 411.554206][T16052] netlink: 'syz.4.3312': attribute type 39 has an invalid length. [ 412.135310][ T30] kauditd_printk_skb: 879 callbacks suppressed [ 412.135326][ T30] audit: type=1400 audit(1776407657.473:1665): avc: denied { read write } for pid=16038 comm="syz.1.3307" name="cdc-wdm0" dev="devtmpfs" ino=3107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 412.137372][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -EPIPE [ 412.142034][ T30] audit: type=1400 audit(1776407657.473:1666): avc: denied { open } for pid=16038 comm="syz.1.3307" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 412.201015][ T5863] usb 2-1: USB disconnect, device number 27 [ 412.875199][T16056] tipc: Enabling of bearer rejected, failed to enable media [ 412.966131][T16056] syzkaller0: entered promiscuous mode [ 412.972233][T16056] syzkaller0: entered allmulticast mode [ 413.111357][T16063] netlink: 'syz.0.3315': attribute type 1 has an invalid length. [ 413.145777][T16063] netlink: 2088 bytes leftover after parsing attributes in process `syz.0.3315'. [ 413.176107][T16063] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3315'. [ 413.225829][T16072] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3316'. [ 413.244827][T16074] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3320'. [ 413.335422][T16075] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3317'. [ 413.357618][T16075] block nbd0: not configured, cannot reconfigure [ 415.599086][T16115] syzkaller0: entered promiscuous mode [ 415.605382][T16115] syzkaller0: entered allmulticast mode [ 415.652850][T16117] netlink: 'syz.3.3327': attribute type 39 has an invalid length. [ 415.845901][T16122] tipc: Started in network mode [ 415.863042][T16122] tipc: Node identity 5a25a3607a95, cluster identity 4711 [ 415.910339][T16122] tipc: Enabled bearer , priority 0 [ 415.940738][T16126] syzkaller0: entered promiscuous mode [ 415.966702][T16126] syzkaller0: entered allmulticast mode [ 416.026427][T16120] tipc: Resetting bearer [ 416.398255][T16120] tipc: Disabling bearer [ 416.483375][T16136] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3333'. [ 416.504704][T16136] block nbd0: not configured, cannot reconfigure [ 416.597926][T16141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3337'. [ 416.709005][ T5863] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 416.930184][ T5863] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 416.957533][ T5863] usb 3-1: config 0 has no interface number 0 [ 416.982179][ T5863] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 417.092541][ T5863] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 417.099170][T16147] hpfs: Bad magic ... probably not HPFS [ 417.169695][ T5863] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 417.362579][ T5863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.399052][ T5863] usb 3-1: Product: syz [ 417.431996][ T5863] usb 3-1: Manufacturer: syz [ 417.463237][ T5863] usb 3-1: SerialNumber: syz [ 417.488668][ T5863] usb 3-1: config 0 descriptor?? [ 417.498710][T16150] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3339'. [ 417.517795][T16134] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 417.542368][T16134] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 417.786332][T16134] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 417.794385][T16134] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 418.034465][ T5863] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 418.047898][ T5863] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 418.288031][ T5863] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 418.299179][ T5863] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -61 [ 419.579338][T16178] tipc: Enabled bearer , priority 0 [ 419.589047][T16178] syzkaller0: entered promiscuous mode [ 419.595155][T16178] syzkaller0: entered allmulticast mode [ 419.613637][ T5884] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 419.637640][T16177] tipc: Resetting bearer [ 419.657368][T16177] tipc: Disabling bearer [ 419.729080][T16187] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3349'. [ 419.738309][T16187] block nbd0: not configured, cannot reconfigure [ 419.751906][ T5877] usb 3-1: USB disconnect, device number 23 [ 419.776144][ T5884] usb 4-1: Using ep0 maxpacket: 32 [ 419.789636][ T5884] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 419.799285][ T5884] usb 4-1: config 0 has no interface number 0 [ 419.805674][ T5884] usb 4-1: config 0 interface 184 has no altsetting 0 [ 419.828078][ T5884] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 419.838523][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.847330][ T5884] usb 4-1: Product: syz [ 419.851611][ T5884] usb 4-1: Manufacturer: syz [ 419.856553][ T5884] usb 4-1: SerialNumber: syz [ 419.871236][ T5884] usb 4-1: config 0 descriptor?? [ 420.470086][ T5877] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 420.604304][T16204] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3355'. [ 420.634065][ T5877] usb 2-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 420.646795][ T5877] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 420.658746][ T5877] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 420.662298][ T5884] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 420.683961][ T5877] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 420.685107][ T5884] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 420.696568][ T5877] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.704226][ T5884] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 420.716588][T16198] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 420.729111][ T5884] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 420.777047][ T5884] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 420.790894][ T5884] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 420.801197][ T5884] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -32 [ 420.844412][ T5884] usb 4-1: USB disconnect, device number 30 [ 420.989938][ T5870] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 421.163400][ T5870] usb 5-1: Using ep0 maxpacket: 16 [ 421.170204][ T5870] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 421.180346][ T5870] usb 5-1: config 0 has no interfaces? [ 421.185849][ T5870] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 421.194946][ T5870] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.215231][ T5870] usb 5-1: config 0 descriptor?? [ 421.895239][ T5877] aiptek 2-1:17.0: Aiptek using 400 ms programming speed [ 421.909478][ T5877] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input17 [ 421.966020][ T5877] usb 2-1: USB disconnect, device number 28 [ 421.966119][ C0] aiptek 2-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 422.209126][T16236] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3365'. [ 422.219959][T16236] block nbd0: not configured, cannot reconfigure [ 422.809483][T16245] syzkaller0: entered promiscuous mode [ 422.817107][T16245] syzkaller0: entered allmulticast mode [ 423.127098][ T5877] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 423.199576][ T30] audit: type=1400 audit(1776407667.687:1667): avc: denied { transfer } for pid=16258 comm="syz.2.3376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 423.330943][ T5877] usb 4-1: Using ep0 maxpacket: 8 [ 423.360808][ T5877] usb 4-1: config 1 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 1560, setting to 1024 [ 423.385620][ T5877] usb 4-1: config 1 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 423.409748][ T5877] usb 4-1: config 1 interface 0 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 423.436444][ T5877] usb 4-1: config 1 interface 0 has no altsetting 0 [ 423.473529][ T5877] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 423.493420][ T5877] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.554992][ T5877] usb 4-1: Product: syz [ 423.562348][ T5877] usb 4-1: Manufacturer: syz [ 423.567423][ T5877] usb 4-1: SerialNumber: syz [ 423.585808][T16247] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 423.691435][T16271] syzkaller0: entered promiscuous mode [ 423.703926][T16271] syzkaller0: entered allmulticast mode [ 424.075385][ T5870] usb 5-1: string descriptor 0 read error: -71 [ 424.345943][ T5870] usb 5-1: USB disconnect, device number 19 [ 424.545635][T16281] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3384'. [ 424.557730][T16281] block nbd0: not configured, cannot reconfigure [ 424.691028][T16288] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3388'. [ 424.722174][T16288] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.730730][T16288] bridge0: port 1(bridge_slave_0) entered disabled state [ 424.772493][ T5877] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 425.209622][T16300] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3393'. [ 425.230341][T16300] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3393'. [ 425.244428][T16291] Scaler: ================= START STATUS ================= [ 425.252214][T16291] Scaler: ================== END STATUS ================== [ 425.416562][T16302] syzkaller0: entered promiscuous mode [ 425.480834][T16302] syzkaller0: entered allmulticast mode [ 425.594802][T16291] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3389'. [ 425.717763][ T5877] usb 4-1: USB disconnect, device number 31 [ 426.552715][T16291] syz.1.3389 (16291): drop_caches: 2 [ 427.263461][T16324] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3400'. [ 427.337675][T16324] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.347689][T16324] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.530881][T16330] netlink: 'syz.4.3402': attribute type 10 has an invalid length. [ 427.564613][T16330] "syz.4.3402" (16330) uses obsolete ecb(arc4) skcipher [ 427.577477][T16330] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3402'. [ 427.631062][T16337] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3405'. [ 427.671331][T16337] block nbd0: not configured, cannot reconfigure [ 427.951758][ T5877] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 428.142941][ T5877] usb 3-1: Using ep0 maxpacket: 8 [ 428.158069][ T5877] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 428.170531][ T5877] usb 3-1: config 0 has no interfaces? [ 428.179905][ T5877] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 428.190500][ T5877] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.199543][ T5877] usb 3-1: Product: syz [ 428.204337][ T5877] usb 3-1: Manufacturer: syz [ 428.213121][ T5877] usb 3-1: SerialNumber: syz [ 428.217355][T16364] Scaler: ================= START STATUS ================= [ 428.222833][ T5877] usb 3-1: config 0 descriptor?? [ 428.229544][T16364] Scaler: ================== END STATUS ================== [ 428.366525][T16367] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3417'. [ 428.377848][T16367] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.385236][T16367] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.435549][T16369] netlink: 'syz.3.3418': attribute type 10 has an invalid length. [ 428.451846][T16369] syz_tun: entered promiscuous mode [ 428.485659][T16369] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 428.519877][T16369] "syz.3.3418" (16369) uses obsolete ecb(arc4) skcipher [ 428.530477][T16369] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3418'. [ 428.639310][ T9] usb 3-1: USB disconnect, device number 24 [ 428.899145][T16386] bond_slave_0: entered promiscuous mode [ 428.906416][T16386] bond_slave_1: entered promiscuous mode [ 428.942096][T16386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3425'. [ 428.952108][T16386] bond_slave_0: left promiscuous mode [ 428.957533][T16386] bond_slave_1: left promiscuous mode [ 429.034991][T16391] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3428'. [ 429.113817][T16397] block nbd0: not configured, cannot reconfigure [ 429.174227][T16399] netlink: 'syz.0.3432': attribute type 10 has an invalid length. [ 429.616791][ T5884] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 429.779448][ T5884] usb 5-1: Using ep0 maxpacket: 32 [ 429.784782][T16425] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.792058][T16425] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.802018][ T5884] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 429.814589][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 429.826286][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 429.838824][ T5884] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 429.848112][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.862663][ T5884] usb 5-1: config 0 descriptor?? [ 429.880478][T16403] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 429.904059][ T5884] hub 5-1:0.0: USB hub found [ 430.121764][ T30] audit: type=1400 audit(1776407674.072:1668): avc: denied { open } for pid=16430 comm="syz.3.3445" path="/dev/ptyqa" dev="devtmpfs" ino=129 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 430.190143][ T5884] hub 5-1:0.0: 2 ports detected [ 430.223762][ T30] audit: type=1400 audit(1776407674.100:1669): avc: denied { ioctl } for pid=16430 comm="syz.3.3445" path="/dev/ptyqa" dev="devtmpfs" ino=129 ioctlcmd=0x5437 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 430.878683][T16403] netlink: 'syz.4.3434': attribute type 10 has an invalid length. [ 430.885982][T16438] netlink: 'syz.2.3448': attribute type 10 has an invalid length. [ 430.921361][T16403] team0: Device wg1 is of different type [ 430.976278][ T5884] hub 5-1:0.0: hub_hub_status failed (err = -71) [ 430.990419][T16438] __nla_validate_parse: 3 callbacks suppressed [ 430.990435][T16438] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3448'. [ 431.009946][ T5884] hub 5-1:0.0: config failed, can't get hub status (err -71) [ 431.026038][ T5884] usbhid 5-1:0.0: can't add hid device: -71 [ 431.032143][ T5884] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 431.072899][ T5884] usb 5-1: USB disconnect, device number 20 [ 431.346810][T16456] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3455'. [ 431.369556][T16456] block nbd0: not configured, cannot reconfigure [ 431.927572][T16473] netlink: 'syz.3.3461': attribute type 39 has an invalid length. [ 432.105750][T16480] syzkaller0: entered promiscuous mode [ 432.112823][T16480] syzkaller0: entered allmulticast mode [ 432.425246][T16485] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3466'. [ 433.189813][T16512] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3475'. [ 433.230319][T16512] block nbd0: not configured, cannot reconfigure [ 433.244319][T16513] syzkaller0: entered promiscuous mode [ 433.377223][T16513] syzkaller0: entered allmulticast mode [ 433.574697][T16522] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3478'. [ 435.364782][T16542] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3483'. [ 435.901790][T16554] syzkaller0: entered promiscuous mode [ 435.918700][T16554] syzkaller0: entered allmulticast mode [ 436.021264][T16559] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3492'. [ 436.054020][T16559] block nbd0: not configured, cannot reconfigure [ 436.742523][ T5863] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 436.953951][ T5863] usb 4-1: Using ep0 maxpacket: 16 [ 436.972679][ T5863] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 437.031008][ T5863] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.073340][ T5863] usb 4-1: Product: syz [ 437.085041][ T5863] usb 4-1: Manufacturer: syz [ 437.097973][ T5863] usb 4-1: SerialNumber: syz [ 437.118933][ T5863] usb 4-1: config 0 descriptor?? [ 437.184206][ T5863] visor 4-1:0.0: Sony Clie 3.5 converter detected [ 437.574081][ T5863] usb 4-1: clie_3_5_startup: get interface number bad return length: 0 [ 437.594992][ T5863] visor 4-1:0.0: probe with driver visor failed with error -5 [ 437.798669][ T9] usb 4-1: USB disconnect, device number 32 [ 438.191157][T16600] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3510'. [ 438.223910][T16600] block nbd0: not configured, cannot reconfigure [ 438.570377][ T30] audit: type=1400 audit(1776407681.860:1670): avc: denied { create } for pid=16605 comm="syz.4.3512" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 439.222740][T16602] syzkaller0: entered promiscuous mode [ 439.237774][T16602] syzkaller0: entered allmulticast mode [ 441.693420][T16641] fuse: Unknown parameter 'grou00000000000000000000' [ 442.196383][T16618] syzkaller0: entered promiscuous mode [ 442.201989][T16618] syzkaller0: entered allmulticast mode [ 443.283408][ T30] audit: type=1400 audit(1776407685.698:1671): avc: denied { execute } for pid=16648 comm="syz.2.3522" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=56335 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 444.317892][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 444.331883][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.921614][ T5812] Bluetooth: hci0: command 0xfc11 tx timeout [ 444.929631][ T5816] Bluetooth: hci0: Entering manufacturer mode failed (-110) [ 445.648037][T16668] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.655186][T16668] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.663929][T16668] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.671077][T16668] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.788948][T16689] syzkaller0: entered promiscuous mode [ 445.794765][T16689] syzkaller0: entered allmulticast mode [ 446.182591][T16707] Scaler: ================= START STATUS ================= [ 446.191187][T16707] Scaler: ================== END STATUS ================== [ 446.208209][ T30] audit: type=1400 audit(1776407688.918:1672): avc: denied { watch } for pid=16712 comm="syz.2.3539" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="tmpfs" ino=1202 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 446.313410][ T5877] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 446.511391][ T5877] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 446.533456][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.543039][ T5877] usb 2-1: Product: syz [ 446.557821][ T5877] usb 2-1: Manufacturer: syz [ 446.571661][ T5877] usb 2-1: SerialNumber: syz [ 446.593519][ T5877] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 446.709286][ T9] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 447.185249][ T5884] usb 2-1: USB disconnect, device number 29 [ 448.052004][ T9] usb 2-1: Service connection timeout for: 256 [ 448.058613][ T9] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 448.106865][ T9] ath9k_htc: Failed to initialize the device [ 448.131348][ T5884] usb 2-1: ath9k_htc: USB layer deinitialized [ 448.448204][ T30] audit: type=1400 audit(1776407690.985:1673): avc: denied { getopt } for pid=16732 comm="syz.0.3548" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 449.840035][ T5884] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 450.051001][T16760] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 450.100117][ T5884] usb 2-1: Using ep0 maxpacket: 32 [ 450.111662][ T5884] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 450.121877][ T5884] usb 2-1: config 0 has no interface number 0 [ 450.128334][ T5884] usb 2-1: config 0 interface 184 has no altsetting 0 [ 450.137611][ T5884] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 450.147476][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.155977][ T5884] usb 2-1: Product: syz [ 450.160290][ T5884] usb 2-1: Manufacturer: syz [ 450.164951][ T5884] usb 2-1: SerialNumber: syz [ 450.191647][ T5884] usb 2-1: config 0 descriptor?? [ 450.858715][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 450.923742][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 451.294865][T16772] hub 8-0:1.0: USB hub found [ 451.300778][T16772] hub 8-0:1.0: 1 port detected [ 451.448603][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 451.510304][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 451.669515][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 451.768574][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 451.846158][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 451.901305][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 451.962220][ T5884] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 452.000148][ T5884] usb 2-1: USB disconnect, device number 30 [ 452.088939][T16768] Scaler: ================= START STATUS ================= [ 452.097745][T16768] Scaler: ================== END STATUS ================== [ 452.509542][ T30] audit: type=1400 audit(1776407694.722:1674): avc: denied { watch } for pid=16783 comm="syz.2.3567" path="/119/file0" dev="tmpfs" ino=632 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 452.791416][ T30] audit: type=1400 audit(1776407694.722:1675): avc: denied { watch_sb watch_reads } for pid=16783 comm="syz.2.3567" path="/119/file0" dev="tmpfs" ino=632 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 453.169529][T16807] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3572'. [ 453.402483][ T30] audit: type=1400 audit(1776407695.553:1676): avc: denied { mounton } for pid=16809 comm="syz.2.3573" path="/120/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 453.458624][ T30] audit: type=1400 audit(1776407695.571:1677): avc: denied { map } for pid=16811 comm="syz.4.3574" path="socket:[56692]" dev="sockfs" ino=56692 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 453.569748][ T30] audit: type=1400 audit(1776407695.709:1678): avc: denied { unmount } for pid=14625 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 453.577699][T16819] syzkaller0: entered promiscuous mode [ 453.595566][T16819] syzkaller0: entered allmulticast mode [ 454.020579][T16835] fuse: Unknown parameter 'group_id00000000000000000000' [ 454.034605][ T5884] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 454.199537][ T5884] usb 2-1: Using ep0 maxpacket: 32 [ 454.217618][ T5884] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 454.247209][ T5884] usb 2-1: config 0 has no interface number 0 [ 454.283367][ T5884] usb 2-1: config 0 interface 184 has no altsetting 0 [ 454.334237][ T5884] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 454.417789][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.460888][ T5884] usb 2-1: Product: syz [ 454.478149][T16838] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3585'. [ 454.487394][ T5884] usb 2-1: Manufacturer: syz [ 454.498590][ T5884] usb 2-1: SerialNumber: syz [ 454.704107][ T5884] usb 2-1: config 0 descriptor?? [ 455.076246][T16844] Scaler: ================= START STATUS ================= [ 455.083787][T16844] Scaler: ================== END STATUS ================== [ 455.199811][T16844] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3587'. [ 455.397831][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 455.443371][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 455.617602][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 455.645099][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 455.669351][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 455.680828][ T5884] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 455.691212][ T5884] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 455.712641][ T5884] usb 2-1: USB disconnect, device number 31 [ 455.771388][ T30] audit: type=1400 audit(1776407697.739:1679): avc: denied { write } for pid=16856 comm="syz.2.3590" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 455.855146][T16861] syzkaller0: entered promiscuous mode [ 455.871075][ T30] audit: type=1400 audit(1776407697.813:1680): avc: denied { ioctl } for pid=16862 comm="syz.0.3592" path="socket:[56798]" dev="sockfs" ino=56798 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 455.877503][T16861] syzkaller0: entered allmulticast mode [ 455.916314][T16863] syzkaller0: entered promiscuous mode [ 455.922111][T16863] syzkaller0: entered allmulticast mode [ 456.044044][T16866] syzkaller0: entered promiscuous mode [ 456.223222][T16876] fuse: Unknown parameter 'group_id00000000000000000000' [ 456.528795][T16874] Scaler: ================= START STATUS ================= [ 456.543760][T16874] Scaler: ================== END STATUS ================== [ 456.632492][T16874] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3599'. [ 457.074397][T16900] syzkaller0: entered promiscuous mode [ 457.080074][T16900] syzkaller0: entered allmulticast mode [ 457.257332][T16908] syzkaller0: entered promiscuous mode [ 457.263533][T16908] syzkaller0: entered allmulticast mode [ 457.442821][T16912] syzkaller0: entered promiscuous mode [ 457.467089][ T30] audit: type=1400 audit(1776407699.308:1681): avc: denied { view } for pid=16913 comm="syz.1.3612" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 457.637721][T16921] 8021q: adding VLAN 0 to HW filter on device bond1 [ 457.653846][T16921] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3615'. [ 457.690638][T16926] fuse: Unknown parameter 'group_id00000000000000000000' [ 457.699826][T16921] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 457.757585][T16928] syzkaller0: entered promiscuous mode [ 457.766407][T16928] syzkaller0: entered allmulticast mode [ 458.131051][ T5870] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 458.304324][ T5870] usb 2-1: Using ep0 maxpacket: 16 [ 458.311288][ T5870] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 458.321621][ T5870] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 458.335973][ T5870] usb 2-1: config 1 has no interface number 1 [ 458.342234][ T5870] usb 2-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 458.353199][ T5870] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 458.366406][ T5870] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 458.382761][ T5870] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 458.393913][ T5870] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.409122][ T5870] usb 2-1: Product: syz [ 458.417843][ T5870] usb 2-1: Manufacturer: syz [ 458.427739][ T5870] usb 2-1: SerialNumber: syz [ 458.485577][T16943] syzkaller0: entered promiscuous mode [ 458.514187][T16943] syzkaller0: entered allmulticast mode [ 458.546703][ T5870] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 458.777194][ T30] audit: type=1400 audit(1776407700.517:1682): avc: denied { listen } for pid=16945 comm="syz.2.3624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 458.797486][ T30] audit: type=1400 audit(1776407700.517:1683): avc: denied { accept } for pid=16945 comm="syz.2.3624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 458.834633][ T5816] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 458.834768][T16953] syzkaller0: entered promiscuous mode [ 458.848899][ T5816] CPU: 1 UID: 0 PID: 5816 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 458.848924][ T5816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 458.848935][ T5816] Workqueue: hci4 hci_rx_work [ 458.848955][ T5816] Call Trace: [ 458.848960][ T5816] [ 458.848967][ T5816] dump_stack_lvl+0x100/0x190 [ 458.848989][ T5816] sysfs_warn_dup.cold+0x1c/0x28 [ 458.849011][ T5816] sysfs_create_dir_ns+0x24b/0x2b0 [ 458.849037][ T5816] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 458.849061][ T5816] ? find_held_lock+0x2b/0x80 [ 458.849084][ T5816] ? kobject_add_internal+0x25f/0x930 [ 458.849104][ T5816] ? kobject_add_internal+0x25f/0x930 [ 458.849126][ T5816] ? do_raw_spin_unlock+0x145/0x1e0 [ 458.849148][ T5816] kobject_add_internal+0x2c8/0x930 [ 458.849175][ T5816] kobject_add+0x16a/0x1e0 [ 458.849194][ T5816] ? __pfx_kobject_add+0x10/0x10 [ 458.849211][ T5816] ? class_to_subsys+0x10f/0x150 [ 458.849232][ T5816] ? kobject_put+0xb9/0x640 [ 458.849247][ T5816] ? _raw_spin_unlock+0x28/0x50 [ 458.849277][ T5816] device_add+0x294/0x1920 [ 458.849295][ T5816] ? __pfx_dev_set_name+0x10/0x10 [ 458.849315][ T5816] ? __pfx_device_add+0x10/0x10 [ 458.849333][ T5816] ? mgmt_send_event_skb+0x2fb/0x460 [ 458.849357][ T5816] hci_conn_add_sysfs+0x1a3/0x260 [ 458.849376][ T5816] le_conn_complete_evt+0x11eb/0x1f60 [ 458.849399][ T5816] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 458.849421][ T5816] hci_le_conn_complete_evt+0x23c/0x3a0 [ 458.849438][ T5816] ? skb_pull_data+0x15f/0x1e0 [ 458.849462][ T5816] hci_le_meta_evt+0x34a/0x5f0 [ 458.849479][ T5816] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 458.849498][ T5816] hci_event_packet+0x51c/0xcd0 [ 458.849514][ T5816] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 458.849532][ T5816] ? __pfx_hci_event_packet+0x10/0x10 [ 458.849550][ T5816] ? kcov_remote_start+0x374/0x660 [ 458.849566][ T5816] ? lockdep_hardirqs_on+0x78/0x100 [ 458.849589][ T5816] hci_rx_work+0x451/0xfc0 [ 458.849610][ T5816] process_one_work+0xa0e/0x1980 [ 458.849642][ T5816] ? __pfx_process_one_work+0x10/0x10 [ 458.849669][ T5816] ? __pfx_hci_rx_work+0x10/0x10 [ 458.849687][ T5816] worker_thread+0x5ef/0xe50 [ 458.849714][ T5816] ? kthread+0x13a/0x450 [ 458.849729][ T5816] ? __pfx_worker_thread+0x10/0x10 [ 458.849746][ T5816] kthread+0x370/0x450 [ 458.849762][ T5816] ? __pfx_kthread+0x10/0x10 [ 458.849780][ T5816] ret_from_fork+0x72b/0xd50 [ 458.849799][ T5816] ? __pfx_ret_from_fork+0x10/0x10 [ 458.849819][ T5816] ? __switch_to+0x800/0x1100 [ 458.849841][ T5816] ? __pfx_kthread+0x10/0x10 [ 458.849862][ T5816] ret_from_fork_asm+0x1a/0x30 [ 458.849895][ T5816] [ 458.850149][ T5816] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 459.139915][ T5816] Bluetooth: hci4: failed to register connection device [ 459.181884][ T5870] usb 2-1: USB disconnect, device number 32 [ 459.566830][T16962] syzkaller0: entered promiscuous mode [ 459.580740][T16962] syzkaller0: entered allmulticast mode [ 460.840463][ T30] audit: type=1400 audit(1776407702.417:1684): avc: denied { name_bind } for pid=16976 comm="syz.3.3634" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 461.488115][T16986] syzkaller0: entered promiscuous mode [ 461.494425][T16986] syzkaller0: entered allmulticast mode [ 461.731769][ T30] audit: type=1400 audit(1776407703.220:1685): avc: denied { associate } for pid=16989 comm="syz.1.3639" name="blkio.bfq.time" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 462.056942][ T30] audit: type=1400 audit(1776407703.543:1686): avc: denied { read } for pid=16991 comm="syz.0.3640" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 462.107735][ T30] audit: type=1400 audit(1776407703.571:1687): avc: denied { open } for pid=16991 comm="syz.0.3640" path="/152/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 462.153027][T16993] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 462.164835][T16992] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 462.177669][T16993] block device autoloading is deprecated and will be removed. [ 462.199748][T16992] block device autoloading is deprecated and will be removed. [ 462.301312][T17004] syzkaller0: entered promiscuous mode [ 462.307360][T17004] syzkaller0: entered allmulticast mode [ 462.445707][T17010] syzkaller0: entered promiscuous mode [ 462.466002][T17010] syzkaller0: entered allmulticast mode [ 462.560791][T17016] syzkaller0: entered promiscuous mode [ 462.567396][T17016] syzkaller0: entered allmulticast mode [ 462.869184][ T30] audit: type=1400 audit(1776407704.291:1688): avc: denied { getopt } for pid=17017 comm="syz.4.3651" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 462.986259][ T5863] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 463.201765][ T5863] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 463.307136][ T5816] Bluetooth: hci5: command 0x0406 tx timeout [ 463.399415][ T5863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.454890][ T5863] usb 3-1: Product: syz [ 463.481219][ T5863] usb 3-1: Manufacturer: syz [ 463.778018][ T5863] usb 3-1: SerialNumber: syz [ 463.805414][ T5863] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 464.868420][ T5870] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 465.148040][ T5863] usb 3-1: USB disconnect, device number 25 [ 465.326199][T17037] netlink: 'syz.0.3658': attribute type 1 has an invalid length. [ 465.452454][T17040] block nbd1: NBD_DISCONNECT [ 465.990888][ T5816] Bluetooth: hci4: command 0x0406 tx timeout [ 466.143671][T17033] Scaler: ================= START STATUS ================= [ 466.161778][ T5870] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 466.179475][ T5870] ath9k_htc: Failed to initialize the device [ 466.192137][ T5863] usb 3-1: ath9k_htc: USB layer deinitialized [ 466.241660][T17033] Scaler: ================== END STATUS ================== [ 466.298858][T17043] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3656'. [ 466.419009][T17053] syzkaller0: entered promiscuous mode [ 466.432771][T17053] syzkaller0: entered allmulticast mode [ 466.476738][T17056] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3662'. [ 466.504774][T17056] block nbd0: not configured, cannot reconfigure [ 467.029284][ T5870] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 467.223267][ T5870] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 467.304401][ T5870] usb 4-1: config 0 has no interface number 0 [ 467.353342][T17071] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3670'. [ 467.363376][ T5870] usb 4-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 467.404916][T17071] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.412138][T17071] bridge0: port 2(bridge_slave_1) entered forwarding state [ 467.422518][T17071] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.430438][T17071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 467.441309][ T5870] usb 4-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 467.467168][ T5870] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 467.478056][ T5870] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.498915][ T30] audit: type=1400 audit(1776407708.553:1689): avc: denied { accept } for pid=17072 comm="syz.0.3671" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 467.592252][ T5870] usb 4-1: Product: syz [ 467.600949][ T5870] usb 4-1: Manufacturer: syz [ 467.612252][ T5870] usb 4-1: SerialNumber: syz [ 467.620286][ T5870] usb 4-1: config 0 descriptor?? [ 467.642294][T17068] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 467.658789][T17068] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 467.832767][T17081] block nbd1: NBD_DISCONNECT [ 467.914901][T17068] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 467.952076][T17068] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 468.112414][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 470.084893][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 470.139081][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 470.247458][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 470.258295][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 470.344994][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 527.548557][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 581.973860][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 581.980863][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5185/1:b..l [ 581.989301][ C1] rcu: (detected by 1, t=10502 jiffies, g=92985, q=741 ncpus=2) [ 581.997006][ C1] task:udevd state:R running task stack:24008 pid:5185 tgid:5185 ppid:1 task_flags:0x400140 flags:0x00080000 [ 582.010924][ C1] Call Trace: [ 582.014371][ C1] [ 582.017294][ C1] __schedule+0x10e9/0x6820 [ 582.021802][ C1] ? kernel_text_address+0x8d/0x100 [ 582.027013][ C1] ? __pfx___schedule+0x10/0x10 [ 582.031863][ C1] ? rcu_is_watching+0x12/0xc0 [ 582.036625][ C1] preempt_schedule_irq+0x50/0x90 [ 582.041647][ C1] irqentry_exit+0x1fe/0x790 [ 582.046232][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 582.052205][ C1] RIP: 0010:lock_release+0x19e/0x310 [ 582.057484][ C1] Code: ff 65 0f c1 05 1b fc 2d 12 83 f8 01 0f 85 28 01 00 00 9c 58 f6 c4 02 0f 85 13 01 00 00 41 f7 c6 00 02 00 00 0f 85 c0 00 00 00 <48> 8b 44 24 10 65 48 2b 05 6d b4 2d 12 0f 85 4e 01 00 00 48 83 c4 [ 582.077084][ C1] RSP: 0018:ffffc900034f7948 EFLAGS: 00000206 [ 582.083139][ C1] RAX: 0000000000000046 RBX: ffffffff8e7e6ee0 RCX: ffffc900034f7954 [ 582.091099][ C1] RDX: 0000000000000000 RSI: ffffffff8df28a0d RDI: ffffffff8c1be760 [ 582.099057][ C1] RBP: ffffffff81b8256e R08: 0000000000000001 R09: 0000000000000007 [ 582.107036][ C1] R10: 0000000000000200 R11: 0000000000017557 R12: ffff888036630000 [ 582.114997][ C1] R13: ffffc900034f7a00 R14: 0000000000000202 R15: 0000000000000001 [ 582.122958][ C1] ? unwind_next_frame+0x3be/0x2090 [ 582.128167][ C1] unwind_next_frame+0x3c3/0x2090 [ 582.133194][ C1] ? kasan_save_stack+0x30/0x50 [ 582.138043][ C1] ? ktime_get+0x9f/0x320 [ 582.142364][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 582.148516][ C1] arch_stack_walk+0x94/0xf0 [ 582.153108][ C1] ? kasan_save_track+0x14/0x30 [ 582.157958][ C1] ? __fput+0x68d/0xb50 [ 582.162104][ C1] stack_trace_save+0x8e/0xc0 [ 582.166779][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 582.172151][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 582.177347][ C1] ? rcu_is_watching+0x12/0xc0 [ 582.182106][ C1] kasan_save_stack+0x30/0x50 [ 582.186777][ C1] ? kasan_save_stack+0x30/0x50 [ 582.191660][ C1] kasan_save_track+0x14/0x30 [ 582.196361][ C1] __kasan_kmalloc+0xaa/0xb0 [ 582.200956][ C1] kmem_cache_free+0x41e/0x6c0 [ 582.205720][ C1] ? percpu_counter_add_batch+0xb9/0x230 [ 582.211355][ C1] __fput+0x68d/0xb50 [ 582.215333][ C1] fput_close_sync+0x118/0x250 [ 582.220088][ C1] ? __pfx_fput_close_sync+0x10/0x10 [ 582.225372][ C1] __x64_sys_close+0x8b/0x120 [ 582.230043][ C1] do_syscall_64+0x10b/0xf80 [ 582.234621][ C1] ? clear_bhb_loop+0x40/0x90 [ 582.239290][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.245170][ C1] RIP: 0033:0x7f53f2315a67 [ 582.249574][ C1] RSP: 002b:00007ffdd2675238 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 582.257973][ C1] RAX: ffffffffffffffda RBX: 0000556e5a2a7970 RCX: 00007f53f2315a67 [ 582.265933][ C1] RDX: 000000000001a2e1 RSI: 00007f53f23f1b20 RDI: 000000000000000d [ 582.273892][ C1] RBP: 0000556e5a261dd0 R08: 00000000000122a0 R09: 0000000000000000 [ 582.281853][ C1] R10: 0000000000000003 R11: 0000000000000202 R12: 0000556e5a275170 [ 582.289810][ C1] R13: 00000000000000ff R14: 0000556e34dd3be0 R15: 00007ffdd26754b0 [ 582.297781][ C1] [ 582.300791][ C1] rcu: rcu_preempt kthread timer wakeup didn't happen for 10484 jiffies! g92985 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 582.313097][ C1] rcu: Possible timer handling issue on cpu=0 timer-softirq=28412 [ 582.320967][ C1] rcu: rcu_preempt kthread starved for 10485 jiffies! g92985 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 [ 582.332315][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 582.342354][ C1] rcu: RCU grace-period kthread stack dump: [ 582.348224][ C1] task:rcu_preempt state:I stack:27848 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 582.360130][ C1] Call Trace: [ 582.363397][ C1] [ 582.366331][ C1] __schedule+0x10e9/0x6820 [ 582.370849][ C1] ? __pfx___schedule+0x10/0x10 [ 582.375699][ C1] ? find_held_lock+0x2b/0x80 [ 582.380372][ C1] ? schedule+0x2bf/0x390 [ 582.384700][ C1] schedule+0xdd/0x390 [ 582.388772][ C1] schedule_timeout+0x127/0x280 [ 582.393621][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 582.398990][ C1] ? __pfx_process_timeout+0x10/0x10 [ 582.404276][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 582.410078][ C1] ? prepare_to_swait_event+0xdf/0x4a0 [ 582.415561][ C1] rcu_gp_fqs_loop+0x1a9/0x900 [ 582.420327][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 582.425604][ C1] ? __pfx_rcu_gp_init+0x10/0x10 [ 582.430534][ C1] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 582.435727][ C1] rcu_gp_kthread+0x179/0x230 [ 582.440394][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 582.445581][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 582.451397][ C1] ? __kthread_parkme+0x18c/0x230 [ 582.456432][ C1] ? kthread+0x13a/0x450 [ 582.460665][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 582.465858][ C1] kthread+0x370/0x450 [ 582.469925][ C1] ? __pfx_kthread+0x10/0x10 [ 582.474512][ C1] ret_from_fork+0x72b/0xd50 [ 582.479105][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 582.484215][ C1] ? __switch_to+0x800/0x1100 [ 582.488891][ C1] ? __pfx_kthread+0x10/0x10 [ 582.493475][ C1] ret_from_fork_asm+0x1a/0x30 [ 582.498248][ C1] [ 582.501258][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 582.507565][ C1] Sending NMI from CPU 1 to CPUs 0: [ 582.512756][ C0] NMI backtrace for cpu 0 [ 582.512768][ C0] CPU: 0 UID: 0 PID: 17091 Comm: syz.2.3676 Not tainted syzkaller #0 PREEMPT(full) [ 582.512783][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 582.512791][ C0] RIP: 0010:__lock_acquire+0x43/0x2630 [ 582.512808][ C0] Code: e1 2d 12 4c 89 64 24 68 4c 8b a4 24 a8 00 00 00 85 db 0f 84 58 03 00 00 48 8b 07 49 89 fa 48 3d c0 57 19 94 0f 84 46 03 00 00 <44> 8b 1d d6 a2 89 0c 89 f3 41 89 d7 41 89 ce 45 85 db 0f 84 0b 03 [ 582.512820][ C0] RSP: 0000:ffffc90005057bc8 EFLAGS: 00000002 [ 582.512832][ C0] RAX: ffffffff9b221c40 RBX: 0000000000000001 RCX: 0000000000000002 [ 582.512840][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e7e6ee0 [ 582.512848][ C0] RBP: ffffffff8e7e6ee0 R08: 0000000000000000 R09: 0000000000000001 [ 582.512855][ C0] R10: ffffffff8e7e6ee0 R11: 0000000000000001 R12: 0000000000000000 [ 582.512863][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 582.512871][ C0] FS: 00007f04093ff6c0(0000) GS:ffff8881242f8000(0000) knlGS:0000000000000000 [ 582.512884][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 582.512893][ C0] CR2: 00007f04093feff8 CR3: 0000000066d7f000 CR4: 00000000003526f0 [ 582.512901][ C0] Call Trace: [ 582.512906][ C0] [ 582.512911][ C0] ? do_raw_spin_lock+0x128/0x260 [ 582.512928][ C0] ? do_raw_spin_lock+0x128/0x260 [ 582.512945][ C0] lock_acquire+0x1b1/0x370 [ 582.512958][ C0] ? advance_sched+0x688/0xc80 [ 582.512970][ C0] ? advance_sched+0x62b/0xc80 [ 582.512983][ C0] advance_sched+0x699/0xc80 [ 582.512993][ C0] ? advance_sched+0x688/0xc80 [ 582.513006][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 582.513022][ C0] ? __pfx_advance_sched+0x10/0x10 [ 582.513033][ C0] __hrtimer_run_queues+0x470/0xa00 [ 582.513054][ C0] hrtimer_interrupt+0x3e5/0x940 [ 582.513074][ C0] __sysvec_apic_timer_interrupt+0x10b/0x460 [ 582.513092][ C0] sysvec_apic_timer_interrupt+0x51/0xc0 [ 582.513113][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 582.513127][ C0] RIP: 0033:0x7f040859c819 [ 582.513138][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.513149][ C0] RSP: 002b:00007f04093ff028 EFLAGS: 00000246 [ 582.513159][ C0] RAX: 0000000000000005 RBX: 00007f0408816270 RCX: 00007f040859c819 [ 582.513167][ C0] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 582.513174][ C0] RBP: 00007f0408632c91 R08: 0000000000000000 R09: 0000000000000000 [ 582.513182][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 582.513189][ C0] R13: 00007f0408816308 R14: 00007f0408816270 R15: 00007ffdaeb1e688 [ 582.513202][ C0]