last executing test programs: 16.636362773s ago: executing program 4 (id=984): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000700000008000400", @ANYRES32=r0, @ANYBLOB="06001500070000000c001680080001"], 0x38}}, 0x10) 16.011961804s ago: executing program 4 (id=987): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x7, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000001540)={0x0, 0xfffffffffffffe4d, &(0x7f0000001500)={&(0x7f0000000140)={0x14, 0x25, 0x1, 0x70bd2c, 0x25dfdbfb, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4000040) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x10, 0x2, 0x4) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000f01600800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000ac0201802800028008000340000000000900020073797a3100000000080003400000"], 0x17d4}}, 0x0) pipe2(&(0x7f0000000040), 0x0) r7 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x9, 0xde}}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0) socket(0x400000000010, 0x3, 0x0) 12.780312473s ago: executing program 3 (id=994): prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_mreqn(r1, 0x0, 0x20, 0x0, 0x300) r2 = socket$kcm(0x10, 0x2, 0x0) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x2, 0x3a) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_emit_ethernet(0x2a, &(0x7f00000007c0)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x73, 0x0, @dev={0xac, 0x14, 0x14, 0x40}, @multicast1=0xac1414aa}, {0x0, 0x0, 0x8}}}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) socket(0x10, 0x3, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='romfs\x00', 0x208402, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0x1c, 0x3, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) recvmsg(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0xfe33) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="5c0000001000ffff27bd7000fbdbdf250000", @ANYRES32=0x0, @ANYBLOB="715a0300231a05003c0012800b00010069703667726500002c0002801400060000000002000000000000000000000001"], 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x40040) 11.468153681s ago: executing program 0 (id=997): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0xf0f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313b, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0), 0x10, 0x1ff}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x0, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x3f46137792f68265) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x3f46137792f68265) ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0xc0089364, &(0x7f00000001c0)) syz_usb_connect(0x0, 0x56, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xc9, 0xd1, 0xc4, 0x8, 0x499, 0x500a, 0xe7b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x97, 0x0, 0x1, 0xd, 0xd5, 0xce, 0x0, [@uac_as={[@format_type_i_continuous={0x8}]}], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "a3f6d2fb5b"}]}}]}}, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x41, 0x6, 0xcf, 0x0, [@uac_as={[@format_type_i_discrete={0x8}]}], [{{0x9, 0x5, 0x2, 0x3}}]}}]}}]}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x24002, 0x0) 9.776071115s ago: executing program 4 (id=1002): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000072000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x0}, 0x68) r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) sendmsg$nl_route(r1, 0x0, 0x0) connect$llc(r0, &(0x7f0000000340)={0x1a, 0x322, 0x0, 0x0, 0x4, 0x90, @random="48bd00"}, 0x10) r2 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) bind$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[], 0x50}}, 0x0) syz_emit_ethernet(0x12, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffa98e8d6caaaaaaaaaa0004420043ea"], 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/locks\x00', 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="120100009e173610ef171e7206de01"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="880000001900010000000000000000001d01000005000d0001000000150003000000000000000000062e346aa0f998570000000015000200000000000002000003ef7506ecbef9700600000015000400000000000000000000000000000000010100000008000900", @ANYRES32=0x0, @ANYBLOB="0c000b00000000000000000008000e00", @ANYRES32=0x0, @ANYBLOB="080005"], 0x88}}, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="0000040000000b0f0667"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="13000000070000ac049664784364000000220000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') read$FUSE(r7, &(0x7f0000001780)={0x2020}, 0x2020) 8.632061308s ago: executing program 1 (id=1004): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) getpgid(0xffffffffffffffff) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x492492492492624, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 7.586945136s ago: executing program 0 (id=1007): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000045c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r3, &(0x7f00000046c0)={0x0, 0x0, &(0x7f0000004680)={&(0x7f0000004600)={0x3c, r4, 0x40d, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4800) 7.55997676s ago: executing program 3 (id=1008): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x28, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0xa, 0x2, 0x3, 0x0, 0x3, {[@md5sig={0x13, 0x12, "fbdf01e7a128b0781556302f67a10fa7"}]}}}}}}}}, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000100)={'broute\x00', 0x0, 0x0, 0x0, [0x7ff, 0xde, 0x7, 0x5, 0x76205717, 0x8], 0x1, &(0x7f0000000080)=[{}, {}, {}, {}, {}], 0x0, [{}]}, 0x88) 7.392504726s ago: executing program 2 (id=1009): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x0, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f00000003c0)={&(0x7f0000000200)=@name={0x1e, 0x2, 0x1, {{0x2}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x26040885}, 0x20000040) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c5602117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000000224e0000", 0x58}], 0x1) socket(0x20000000000000a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x2f, @loopback, 0x6}, {0xa, 0x4e20, 0x80, @empty, 0x4}, r6, 0x8}}, 0x48) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f00000003c0), r6, 0x2}}, 0x18) 7.313354927s ago: executing program 3 (id=1010): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000004c40)=ANY=[@ANYRESDEC], 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x20004000) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, 0x0, 0x2, 0xffffffffffffffff, 0x20}) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) (async) socket$netlink(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b24, &(0x7f0000000000)={'wlan0\x00'}) (async) r7 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000dc0)=ANY=[@ANYBLOB="12010000000000402f17370000000001000109022400010000a00009040000040300020009210000020122030009058103"], 0x0) (async) r8 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r8, 0x894b, &(0x7f0000000040)) syz_usb_control_io(r7, 0x0, 0x0) (async) syz_usb_control_io$hid(r7, &(0x7f0000000200)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="40300500"], 0x0, 0x0, 0x0}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r10 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) (async) getsockname$packet(r10, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x70b, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xe, 0x5}, {0x8, 0xb}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}]}}]}, 0x3c}}, 0x24000000) (async) r12 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r12, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000540)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="050427bd7000fedbdf2503000000080001003dc68250ca3cee67cc551ecd913dc28901410184c7de70025d1ba178ea0caeb346c3d6e306da9149b962bc01b0ba708f75b21479f36d513042af6668f6883c6530968a18ce47d8bb2d0de86f67450fef78253c32ed02cbbbedd94804c5f1de78d259de283985ea77e89b4778d730c4bc7e3c333a6ee1e6ec5d82db0fb9fb69813234b132855624fd1814445b02fba05e41e3ddc3ff2e9ddfed34434b5cad1fba74756f3689ca76747512a94ed48af50625a452afc333ccd34b60c38c9e0207219942f3df", @ANYRES32=r6, @ANYBLOB="04000280"], 0x20}, 0x1, 0x0, 0x0, 0x4000401}, 0x40448c0) 6.695835138s ago: executing program 2 (id=1011): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socket(0x24, 0x4, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={0x0}}, 0x20) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f000068b000/0x1000)=nil, 0x1000, 0x2000004, 0xe, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040), 0x8) 6.578443475s ago: executing program 0 (id=1012): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000100)={0x0, 0x2, 0x1, 0xd, 0x200, &(0x7f0000000180)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000000000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700007ffffbff00472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413fcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949e496f2e2a3c175858575713be5ee3fff4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff4175b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a2b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6d07002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b188cd35df2cd7963e43b7f9c03bebfb889c02f484f63520cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) 6.284308059s ago: executing program 2 (id=1013): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) mknodat$loop(0xffffffffffffff9c, 0x0, 0x6004, 0x1) openat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r3}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d6fe682c6100000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}, 0x1, 0x2000000}, 0x0) 5.682334885s ago: executing program 4 (id=1014): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000300)=0xc) prlimit64(r0, 0xe, &(0x7f0000000240)={0x804, 0x10001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001b00)=""/102392, 0x18ff8) r2 = socket$inet_sctp(0x2, 0x5, 0x84) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) ioctl$SOUND_MIXER_WRITE_RECSRC(0xffffffffffffffff, 0xc0044dff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_GET_CAP(r4, 0xc010640c, &(0x7f0000000100)={0x8}) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4044015}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000140)=@bpf_lsm={0x6, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x18}]}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xb4}}, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(0xffffffffffffffff, 0xc0044dff, &(0x7f0000000100)=0x400) syz_usb_connect(0x2, 0x60, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003c3d10a08dc17020250f10102030109024e000104e9000909042000000e0100ff0a240102000502010209240703deec9e701b789b22e603009d0924030106030501f90c24080201000dacf34b4491052404"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) sendmmsg$inet_sctp(r2, 0x0, 0x0, 0x10) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0x19, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000100)={0x28, 0x7, r5, 0x0, &(0x7f0000ff0000/0x10000)=nil, 0x10000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000180)={0x48, 0x5, r5}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r5}) bind$inet(r2, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', 0x8, 0x0) sched_setscheduler(0x0, 0x4, &(0x7f0000000180)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 5.590418804s ago: executing program 0 (id=1015): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x3, @empty, 0xfffffffe}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r1, 0x0, 0x200000000000b, &(0x7f0000000040)='\x00', 0x1) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='bbr\x00', 0x4) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00'}) socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) move_pages(0x0, 0xffffffffffffff55, 0x0, 0x0, 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000380)='jbd2_handle_stats\x00', r1, 0x0, 0x80000}, 0xfffffffffffffdf9) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000080050005000200000011000300686173683a69702c706f7274"], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e220000"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) socket$inet_tcp(0x2, 0x1, 0x0) 5.50272035s ago: executing program 1 (id=1016): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@polexpire={0xcc, 0x1b, 0x1, 0x0, 0x0, {{{@in6=@private0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x0, 0x0, 0x5b}}]}, 0xcc}, 0x1, 0x0, 0x3000000}, 0x0) 5.367839483s ago: executing program 2 (id=1017): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x5, 0x0) mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000f40)={0x1a}) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f00000000c0)={0x0, 0x6, 0x201a}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000004340)=""/102376, 0x18fe8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcdb) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close(r3) r5 = open(0x0, 0x0, 0x1a1) fcntl$setlease(r5, 0x400, 0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r8, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r9, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmsg$L2TP_CMD_SESSION_GET(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000007000000050013000000000014000800000000000000000000000000000000000c0016000000000100000000050012"], 0x44}}, 0x0) r10 = memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) write$binfmt_script(r10, &(0x7f0000000340)={'#! ', './file0'}, 0xb) execveat(r10, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 4.970320416s ago: executing program 0 (id=1018): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, &(0x7f0000000300)) r3 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000600)={0x2, @pix={0x8, 0x6, 0x34325842, 0x4, 0x6bb, 0xffffffff, 0x4, 0x6, 0x0, 0x1, 0x5, 0x5}}) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000100)={0x410001, 0x2, 0x4}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7000000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="a60a00000000000061118000000000001800000000000000000000000100000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) prlimit64(r0, 0xe, 0x0, &(0x7f00000000c0)) 3.754700953s ago: executing program 1 (id=1019): socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) getpid() r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)=@newqdisc={0x154, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x124, 0x2, [@TCA_CHOKE_MAX_P={0x8, 0x3, 0xfffffffd}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x64, 0x2, 0x3, 0x17, 0xd, 0x8, 0x1}}, @TCA_CHOKE_STAB={0x104, 0x2, "0d803dbd18a8fd5787bf9e4a19d32d4dcbd3aaaf037147549e678a80e3260688a71d81fa16a9a32eaebf05b4e55a8a48f04ee66dc58241451e66dac1ab45bd941a843206c59ce518e26c785411a2ae079ed156ea6283ba14e5b822f9cbe0fabd7538614322139c0845b476ff955f75c8e23a7681d4dc46ec368cf5e2f49320c5a6800c34a2f036f256306ac9a76d0b38c7872c5d01aad89d5c520239a7fa385e787385b3014d4a2b08193f2dfe509ee652871348d083dc21c6db55606af414d4ebd7543bb83a2ceedbaaae9813d1b85eb3fb8600e44539d233f68b0698414b63255e7aaf4f2b9c622494b1a403b862a9a97e8590392f69a4a71fe0112710e6a2"}]}}]}, 0x154}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20040442) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000080)='illinois\x00', 0x9) socket$nl_route(0x10, 0x3, 0x0) shutdown(r6, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) 3.544315275s ago: executing program 0 (id=1020): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000003c0)=0x6, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @remote}], 0x10) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000000280)=@caif=@dgm={0x25, 0x9, 0x9}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000500)="62042700ffff00000000002f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee844", 0x46}], 0x1}, 0x4008000) syz_usb_connect(0x2, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x59, 0x29, 0xa5, 0x20, 0x19d2, 0x1096, 0x27be, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x4, 0xd0, 0x3, [{{0x9, 0x4, 0x45, 0xa, 0x0, 0xff, 0xff, 0xff, 0x62}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x83e}}, {0x88, &(0x7f0000000240)=@string={0x88, 0x3, "08eeedbb560f1dad285d2a7be21b16b3af782a75ae95b93b3e69d6b0cb38b2c536f166ac272658dd935c77416e1ee2da25b18797ea0a3b573aa6e7f2a7b2afb1668344419be088b2ef2fb69a286ba143d592bb2366fa79eb11b9b04017b79098f8521588f3b20062cf166cb7b37a7183b7d0bab0371869285f49df8d7dfefd1c7faf8dd90e00"}}]}) 3.54371668s ago: executing program 3 (id=1021): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x0, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f00000003c0)={&(0x7f0000000200)=@name={0x1e, 0x2, 0x1, {{0x2}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x26040885}, 0x20000040) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c5602117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000000224e0000", 0x58}], 0x1) socket(0x20000000000000a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x2f, @loopback, 0x6}, {0xa, 0x4e20, 0x80, @empty, 0x4}, r6, 0x8}}, 0x48) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f00000003c0), r6, 0x2}}, 0x18) 2.30613733s ago: executing program 4 (id=1022): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000045c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r3, &(0x7f00000046c0)={0x0, 0x0, &(0x7f0000004680)={&(0x7f0000004600)={0x3c, r4, 0x40d, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4800) 2.241798478s ago: executing program 3 (id=1023): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = mq_open(&(0x7f0000000080)='!selin\xdb\xa1\x02\xbf\xd9l\xd7\xcd\xc05xse\xee\x0e\xcd\xce6\xbf\xfa;\xb9-a\xb8\xef\x8de\x14\xbc\x9ej\xa1q\xa2\xa5\t\x98\x8a\x8f>\xba', 0x6e93ebbbcc088cf2, 0x0, &(0x7f0000000300)={0x0, 0x1, 0xec, 0x8001}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0xf}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}}, 0x40004) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r2, 0x3ba0, &(0x7f0000000280)={0x48, 0x14}) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0xc0, &(0x7f0000000000)=0x5, 0x0, 0x4) mq_timedsend(r1, 0x0, 0x0, 0x9, 0x0) getsockname(r0, 0x0, &(0x7f00000001c0)) 2.235639619s ago: executing program 2 (id=1024): openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x1) timer_create(0x9, 0x0, 0x0) r0 = syz_io_uring_setup(0x88f, 0x0, &(0x7f0000000340)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, 0x0, 0x0, 0x4) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=ANY=[@ANYRES64=r0], &(0x7f0000000300), 0x1200) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r0, 0x47f6, 0x0, 0x2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000100)={0x5b, 0xa, 0x0, "93bba551042af768810fa32fa3ccbaf1121823a6dc898168d8b3c3945d8636cf"}) socket$nl_rdma(0x10, 0x3, 0x14) r5 = socket$l2tp6(0xa, 0x2, 0x73) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x101000) r6 = socket$qrtr(0x2a, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000440), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000380)={0x0, 0x7d, "485b6ebdd27c5fcb6a5f9167fb346319628107458db3d2444f285b221b72b74595b587a241721c7820037985c5c6edb2cccfbd0b269ec710576a90a371e9c12e35e279c78ae37f05472d1d405c5d963268dc01bc03544db345971e3aa638865eeccc9c77bdd36ef58b6515605d7a1d20185bfa6338dd19ca9c1e0236a2"}, &(0x7f0000000240)=0x85) read$msr(r7, &(0x7f0000032680)=""/102400, 0x19000) syz_emit_ethernet(0xbe, 0x0, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs\x00') pread64(r8, &(0x7f0000000280)=""/86, 0x56, 0x8f) socket$nl_generic(0x10, 0x3, 0x10) connect$qrtr(r6, 0x0, 0x0) bind$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x41000000}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x15c}}, 0x0) 2.203614292s ago: executing program 1 (id=1025): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x7b}, [@ldst={0x4}]}, &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0xffffff80}, 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) 1.875776796s ago: executing program 1 (id=1026): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0xf8ff}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) 1.299356626s ago: executing program 4 (id=1027): setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000940)=0x2, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001780)={0x6, 0x5, &(0x7f0000001580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000fff, 0x0, 0x0, 0x0, 0x8}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x5}]}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0xc, &(0x7f0000001600)=""/12, 0x41100, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000001640)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001680)={0x1, 0xf, 0x8, 0xffff0000}, 0x10, 0x0, 0x0, 0x6, 0x0, &(0x7f00000003c0)=[{0x3, 0x4, 0x9, 0x6}, {0x0, 0x5, 0xf, 0x3}, {0x5, 0x4, 0xc}, {0x1, 0x5, 0xe}, {0x4, 0x4, 0xd, 0x6}, {0x0, 0x5, 0xc, 0x5}], 0x10, 0x5}, 0x94) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000000)={0xbd6b, 0x10001, 0x1000, 0xf7ff, 0x0, "4ae23ae17df2e98c0064180009bad88f00", 0x6, 0xf7fffffa}) r0 = socket(0x2, 0x3, 0xff) connect$inet(r0, &(0x7f00000000c0)={0x2, 0xfffd, @local}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[], 0x14) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r4 = getpid() sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040880}, 0x20040000) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300d67a854a7a4124a91520800000000000000030000a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}, 0x1, 0x0, 0x1000000000000000, 0x4000000}, 0x4044010) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) sendmsg$key(0xffffffffffffffff, &(0x7f00005f5000)={0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r7, &(0x7f0000000340)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x2, 0x2, 0x8, "5a7ac6fe", "95d2315b"}}, 0x0}, 0x0) 200.325238ms ago: executing program 1 (id=1028): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x936, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000240)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000400100000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) 193.75599ms ago: executing program 2 (id=1029): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xd, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000780), r1) sendmsg$NFC_CMD_LLC_SET_PARAMS(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010a28bd7000fddbdf251000000005000f000400000008000100158743b0be5d8dbc5f99110c11efe44f5f84e768ae496db98366c6a50bc75920000eb43fec55a3a0263ad0823d0ee0fc7ea4481b5fbccb2a1e673cc99abbb0ce04a7d642194a0367bbed5c", @ANYRES32=0x0, @ANYBLOB="050010002a000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8010}, 0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'gre0\x00', 0x0}) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83}, 0x1c) sendto$packet(r3, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f00000001c0)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x4, r7}) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000140)={@loopback, 0x80, r7}) statx(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x400, 0x7ff, &(0x7f0000000140)) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sys_enter\x00'}, 0x10) close(r8) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$TUNSETOFFLOAD(r8, 0xc004743e, 0x110e22fff7) ioctl$TUNGETVNETLE(r8, 0x40047451, &(0x7f0000000180)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x58, &(0x7f0000000240)}, 0x10) r9 = landlock_create_ruleset(&(0x7f0000000000)={0x9782, 0x1}, 0x18, 0x0) landlock_restrict_self(r9, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r10, 0xc0045878, 0x0) 0s ago: executing program 3 (id=1030): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x24040808) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x7f, &(0x7f0000000080)=""/4057, 0x0) syz_emit_vhci(0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=r0, @ANYRESDEC=0x0]) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0) read$FUSE(r1, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r1, &(0x7f0000004300)="00e7a0633e8438bafa888b9b02144af32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd1d8dca68039fe5b2e1a8d7cdfc6d875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064daa2bac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060ac1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c272074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2447c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e1024a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b6732ced59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8b71fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3abe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b4dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a133791d3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba4850439ec125b708ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdd89e6b674f2c53e329e5f3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee3a5db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca36507002b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8098fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b3", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x130, 0x0, 0x403, {0xf929, 0x7, 0x0, '\x00', {0x1, 0x2, 0x8, 0x8, 0x0, r3, 0xa000, '\x00', 0x2, 0x5, 0x100000000, 0x3, {0x6, 0x6}, {0x20000000000004}, {0x100000000, 0xc}, {0x8, 0x80a02}, 0x8, 0x80000a, 0xf88e, 0x5}}}}) write$FUSE_INIT(r1, &(0x7f0000001200)={0x50, 0x0, r2}, 0x50) r4 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fc, 0x2301) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, 0x0) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x0, 0x40, &(0x7f0000000000)={0x4b5a9da54893e123, 0x14, 0x8, 0x2}, 0x8, 0x7, 0x200, 0x0, 0x0, 0x20000, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x100000, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',gr\x00\x00\x00\x00id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000180)={0x50, 0x0, r6, {0x7, 0x29, 0x4, 0xffffffff85000014, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x50) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) ioctl$EXT4_IOC_SETFSUUID(r0, 0x4008662c, &(0x7f00000010c0)={0x0, 0x0, "95cc8316b177b8aa6c6239e4aa54b1d8"}) syz_fuse_handle_req(r5, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r5, &(0x7f00000067c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b00", 0x2000, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="780000000000000002000000000000040000000000000000000000000000000004"], 0x0, 0x0, 0x0, 0x0}) getdents(r7, &(0x7f0000000700)=""/90, 0x20000) kernel console output (not intermixed with test programs): led with error -32 [ 128.675524][ T6364] bond_slave_0: entered promiscuous mode [ 128.681439][ T6364] bond_slave_1: entered promiscuous mode [ 128.681660][ T10] usb 5-1: USB disconnect, device number 7 [ 128.757442][ T6364] vlan2: entered promiscuous mode [ 128.757827][ T6362] fido_id[6362]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 128.777228][ T6364] bond0: entered promiscuous mode [ 130.250283][ T6379] FAULT_INJECTION: forcing a failure. [ 130.250283][ T6379] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 130.265192][ T6379] CPU: 0 UID: 0 PID: 6379 Comm: syz.4.121 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 130.265215][ T6379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 130.265232][ T6379] Call Trace: [ 130.265242][ T6379] [ 130.265249][ T6379] dump_stack_lvl+0x189/0x250 [ 130.265277][ T6379] ? __pfx____ratelimit+0x10/0x10 [ 130.265296][ T6379] ? __pfx_dump_stack_lvl+0x10/0x10 [ 130.265317][ T6379] ? __pfx__printk+0x10/0x10 [ 130.265341][ T6379] ? __might_fault+0xb0/0x130 [ 130.265371][ T6379] should_fail_ex+0x414/0x560 [ 130.265395][ T6379] _copy_from_user+0x2d/0xb0 [ 130.265422][ T6379] __sys_bpf+0x1ed/0x860 [ 130.265452][ T6379] ? __pfx___sys_bpf+0x10/0x10 [ 130.265492][ T6379] ? ksys_write+0x22a/0x250 [ 130.265512][ T6379] ? __pfx_ksys_write+0x10/0x10 [ 130.265526][ T6379] ? rcu_is_watching+0x15/0xb0 [ 130.265555][ T6379] __x64_sys_bpf+0x7c/0x90 [ 130.265580][ T6379] do_syscall_64+0xfa/0x3b0 [ 130.265600][ T6379] ? lockdep_hardirqs_on+0x9c/0x150 [ 130.265619][ T6379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.265638][ T6379] ? clear_bhb_loop+0x60/0xb0 [ 130.265659][ T6379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.265677][ T6379] RIP: 0033:0x7f2797f8ebe9 [ 130.265700][ T6379] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 130.265716][ T6379] RSP: 002b:00007f2798d94038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 130.265736][ T6379] RAX: ffffffffffffffda RBX: 00007f27981b6090 RCX: 00007f2797f8ebe9 [ 130.265750][ T6379] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 130.265762][ T6379] RBP: 00007f2798d94090 R08: 0000000000000000 R09: 0000000000000000 [ 130.265774][ T6379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.265785][ T6379] R13: 00007f27981b6128 R14: 00007f27981b6090 R15: 00007ffe28617c38 [ 130.265817][ T6379] [ 130.454918][ C0] vkms_vblank_simulate: vblank timer overrun [ 130.691797][ T977] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 131.338743][ T6388] xt_socket: unknown flags 0xc [ 131.370143][ T6393] netlink: 'syz.2.124': attribute type 10 has an invalid length. [ 131.383858][ T977] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 131.459627][ T977] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 131.473008][ T977] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 30768, setting to 64 [ 131.484533][ T977] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 131.530385][ T977] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 131.546837][ T977] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.570667][ T977] usb 2-1: Product: syz [ 131.575335][ T977] usb 2-1: Manufacturer: syz [ 131.581419][ T977] usb 2-1: SerialNumber: syz [ 131.593306][ T977] usb 2-1: config 0 descriptor?? [ 131.690920][ T977] input: KB Gear Tablet as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input8 [ 131.747408][ T6393] team0: Port device wlan1 added [ 131.822435][ T10] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 132.031314][ T10] usb 5-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 132.236310][ T10] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 132.370889][ T6399] syzkaller0: entered promiscuous mode [ 132.380307][ T10] usb 5-1: Product: syz [ 132.422132][ T6399] syzkaller0: entered allmulticast mode [ 132.523425][ T10] usb 5-1: SerialNumber: syz [ 132.540485][ T10] usb 5-1: config 0 descriptor?? [ 132.582378][ T10] imon_raw 5-1:0.0: IR endpoint missing [ 132.662262][ C1] kbtab 2-1:0.0: kbtab_irq - usb_submit_urb failed with result -1 [ 132.703689][ T6410] netlink: 104 bytes leftover after parsing attributes in process `syz.0.129'. [ 132.964676][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.973661][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.445218][ T5900] usb 5-1: USB disconnect, device number 8 [ 133.935740][ T5900] usb 2-1: USB disconnect, device number 2 [ 133.964552][ T6418] capability: warning: `syz.0.131' uses 32-bit capabilities (legacy support in use) [ 136.163440][ T6440] xt_socket: unknown flags 0xc [ 137.508742][ T6450] netlink: 20 bytes leftover after parsing attributes in process `syz.3.139'. [ 138.146051][ T6456] netlink: 'syz.2.142': attribute type 1 has an invalid length. [ 138.280968][ T6456] bond1: entered promiscuous mode [ 138.374766][ T6456] 8021q: adding VLAN 0 to HW filter on device bond1 [ 138.434456][ T6459] bond1: (slave dummy0): making interface the new active one [ 138.451661][ T6459] dummy0: entered promiscuous mode [ 138.480196][ T6459] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 138.611735][ T5892] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 138.905028][ T977] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 138.941876][ T5892] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 138.954310][ T5892] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 139.528948][ T977] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 139.551012][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 139.566974][ T5892] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 139.578770][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 139.590282][ T5892] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 139.601458][ T977] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 139.614593][ T5892] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 139.625591][ T977] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 139.634746][ T5892] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 139.644234][ T977] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.653135][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.792148][ T6484] syz.1.148: attempt to access beyond end of device [ 139.792148][ T6484] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 140.143895][ T977] usb 5-1: config 0 descriptor?? [ 140.198215][ T6461] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 140.222501][ T5892] hub 3-1:1.0: bad descriptor, ignoring hub [ 140.232773][ T5892] hub 3-1:1.0: probe with driver hub failed with error -5 [ 140.360226][ T5892] cdc_wdm 3-1:1.0: skipping garbage [ 140.392091][ T5892] cdc_wdm 3-1:1.0: skipping garbage [ 140.435783][ T5892] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 140.460266][ T5892] cdc_wdm 3-1:1.0: Unknown control protocol [ 140.517378][ T5892] usb 3-1: USB disconnect, device number 3 [ 140.633161][ T6491] netlink: 'syz.1.150': attribute type 11 has an invalid length. [ 140.636796][ T977] plantronics 0003:047F:FFFF.0003: ignoring exceeding usage max [ 140.649333][ T6491] netlink: 'syz.1.150': attribute type 11 has an invalid length. [ 140.657639][ T6491] netlink: 224 bytes leftover after parsing attributes in process `syz.1.150'. [ 141.164132][ T977] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 141.621766][ T6498] netlink: 4 bytes leftover after parsing attributes in process `syz.2.152'. [ 141.980187][ T6504] team_slave_0: entered promiscuous mode [ 141.986039][ T6504] team_slave_1: entered promiscuous mode [ 141.991872][ T6504] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 142.034511][ T6504] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 142.041041][ T6509] netlink: 80 bytes leftover after parsing attributes in process `syz.1.156'. [ 142.063419][ T6504] team0: Device macvtap1 is already an upper device of the team interface [ 142.085160][ T6504] team_slave_0: left promiscuous mode [ 142.090639][ T6504] team_slave_1: left promiscuous mode [ 142.096259][ T6504] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 142.374528][ T5932] usb 5-1: USB disconnect, device number 9 [ 143.847842][ T6529] syz.4.161: attempt to access beyond end of device [ 143.847842][ T6529] nbd4: rw=0, sector=0, nr_sectors = 2 limit=0 [ 144.879763][ T6535] xt_TPROXY: Can be used only with -p tcp or -p udp [ 145.534850][ T6542] syz.1.164: attempt to access beyond end of device [ 145.534850][ T6542] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 146.518139][ T6547] netlink: 60 bytes leftover after parsing attributes in process `syz.1.164'. [ 147.084682][ T6554] 9pnet_fd: Insufficient options for proto=fd [ 147.236288][ T6556] netlink: 'syz.2.169': attribute type 10 has an invalid length. [ 147.256965][ T6556] veth0_vlan: left promiscuous mode [ 147.267071][ T6556] veth0_vlan: entered promiscuous mode [ 147.277737][ T6556] team0: Device veth0_vlan failed to register rx_handler [ 147.360241][ T6558] FAULT_INJECTION: forcing a failure. [ 147.360241][ T6558] name failslab, interval 1, probability 0, space 0, times 1 [ 147.419725][ T6558] CPU: 1 UID: 0 PID: 6558 Comm: syz.1.170 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 147.419753][ T6558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 147.419764][ T6558] Call Trace: [ 147.419772][ T6558] [ 147.419780][ T6558] dump_stack_lvl+0x189/0x250 [ 147.419807][ T6558] ? __pfx____ratelimit+0x10/0x10 [ 147.419828][ T6558] ? __pfx_dump_stack_lvl+0x10/0x10 [ 147.419849][ T6558] ? __pfx__printk+0x10/0x10 [ 147.419889][ T6558] should_fail_ex+0x414/0x560 [ 147.419915][ T6558] should_failslab+0xa8/0x100 [ 147.419938][ T6558] __kmalloc_cache_noprof+0x70/0x3d0 [ 147.419957][ T6558] ? sctp_add_bind_addr+0x8c/0x370 [ 147.419985][ T6558] sctp_add_bind_addr+0x8c/0x370 [ 147.420013][ T6558] sctp_copy_local_addr_list+0x30b/0x4e0 [ 147.420041][ T6558] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 147.420064][ T6558] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 147.420091][ T6558] ? sctp_v4_is_any+0x35/0x60 [ 147.420113][ T6558] ? sctp_copy_one_addr+0x93/0x360 [ 147.420139][ T6558] sctp_bind_addr_copy+0xb3/0x3c0 [ 147.420163][ T6558] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 147.420187][ T6558] sctp_connect_new_asoc+0x2e0/0x690 [ 147.420218][ T6558] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 147.420240][ T6558] ? __local_bh_enable_ip+0x12d/0x1c0 [ 147.420268][ T6558] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 147.420289][ T6558] ? security_sctp_bind_connect+0x7e/0x2e0 [ 147.420314][ T6558] sctp_sendmsg+0x155c/0x2810 [ 147.420354][ T6558] ? __pfx_sctp_sendmsg+0x10/0x10 [ 147.420380][ T6558] ? __lock_acquire+0xab9/0xd20 [ 147.420423][ T6558] ? sock_rps_record_flow+0x19/0x410 [ 147.420449][ T6558] ? inet_sendmsg+0x2f4/0x370 [ 147.420474][ T6558] __sock_sendmsg+0x19c/0x270 [ 147.420501][ T6558] ____sys_sendmsg+0x505/0x830 [ 147.420534][ T6558] ? __pfx_____sys_sendmsg+0x10/0x10 [ 147.420571][ T6558] ? import_iovec+0x74/0xa0 [ 147.420599][ T6558] ___sys_sendmsg+0x21f/0x2a0 [ 147.420629][ T6558] ? __pfx____sys_sendmsg+0x10/0x10 [ 147.420697][ T6558] ? __fget_files+0x2a/0x420 [ 147.420717][ T6558] ? __fget_files+0x3a0/0x420 [ 147.420755][ T6558] __x64_sys_sendmsg+0x19b/0x260 [ 147.420787][ T6558] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 147.420827][ T6558] ? __pfx_ksys_write+0x10/0x10 [ 147.420852][ T6558] ? do_syscall_64+0xbe/0x3b0 [ 147.420877][ T6558] do_syscall_64+0xfa/0x3b0 [ 147.420897][ T6558] ? lockdep_hardirqs_on+0x9c/0x150 [ 147.420917][ T6558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.420937][ T6558] ? clear_bhb_loop+0x60/0xb0 [ 147.420960][ T6558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.420979][ T6558] RIP: 0033:0x7f459e98ebe9 [ 147.420995][ T6558] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 147.421012][ T6558] RSP: 002b:00007f459cbee038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 147.421032][ T6558] RAX: ffffffffffffffda RBX: 00007f459ebb5fa0 RCX: 00007f459e98ebe9 [ 147.421047][ T6558] RDX: 0000000000008001 RSI: 0000200000000540 RDI: 0000000000000003 [ 147.421059][ T6558] RBP: 00007f459cbee090 R08: 0000000000000000 R09: 0000000000000000 [ 147.421071][ T6558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 147.421083][ T6558] R13: 00007f459ebb6038 R14: 00007f459ebb5fa0 R15: 00007ffc3a1f74e8 [ 147.421122][ T6558] [ 148.344656][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 148.863076][ T6575] fuse: Bad value for 'user_id' [ 148.868258][ T6575] fuse: Bad value for 'user_id' [ 148.981008][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 148.995073][ T6574] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 149.062292][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 149.070384][ T10] usb 4-1: config 0 has no interface number 0 [ 149.121216][ T10] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 149.155368][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.185585][ T10] usb 4-1: Product: syz [ 149.978912][ T10] usb 4-1: Manufacturer: syz [ 149.991341][ T10] usb 4-1: SerialNumber: syz [ 150.174374][ T10] usb 4-1: config 0 descriptor?? [ 150.442559][ T10] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 150.455277][ T10] usb 4-1: selecting invalid altsetting 1 [ 150.461138][ T10] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 150.512674][ T10] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 150.558771][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 150.587219][ T10] usb 4-1: media controller created [ 150.599748][ T6590] capability: warning: `syz.4.180' uses deprecated v2 capabilities in a way that may be insecure [ 150.688453][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 150.979547][ T6600] ======================================================= [ 150.979547][ T6600] WARNING: The mand mount option has been deprecated and [ 150.979547][ T6600] and is ignored by this kernel. Remove the mand [ 150.979547][ T6600] option from the mount to silence this warning. [ 150.979547][ T6600] ======================================================= [ 151.074544][ T6600] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 151.816074][ T6603] netlink: 28 bytes leftover after parsing attributes in process `syz.1.181'. [ 151.853942][ T10] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 151.888519][ T10] zl10353_read_register: readreg error (reg=127, ret==-110) [ 152.434607][ T10] usb 4-1: USB disconnect, device number 6 [ 152.737866][ T5892] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 153.262825][ T5892] usb 5-1: Using ep0 maxpacket: 16 [ 153.288640][ T5892] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 153.310049][ T5892] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.319388][ T5892] usb 5-1: Product: syz [ 153.332887][ T5892] usb 5-1: Manufacturer: syz [ 153.337547][ T5892] usb 5-1: SerialNumber: syz [ 153.377692][ T5892] r8152-cfgselector 5-1: Unknown version 0x0000 [ 153.395484][ T5892] r8152-cfgselector 5-1: config 0 descriptor?? [ 153.831754][ T6624] fuse: Bad value for 'user_id' [ 153.836711][ T6624] fuse: Bad value for 'user_id' [ 154.224679][ T6625] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 154.622224][ T6606] Bluetooth: MGMT ver 1.23 [ 154.633381][ T5892] r8152-cfgselector 5-1: USB disconnect, device number 10 [ 156.010364][ T6641] syz.1.194: attempt to access beyond end of device [ 156.010364][ T6641] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 157.071730][ T6641] netlink: 60 bytes leftover after parsing attributes in process `syz.1.194'. [ 158.553179][ T6659] netlink: 8 bytes leftover after parsing attributes in process `syz.0.198'. [ 159.828655][ T6671] netlink: 340 bytes leftover after parsing attributes in process `syz.0.203'. [ 160.683874][ T6676] syz.4.201 uses obsolete (PF_INET,SOCK_PACKET) [ 160.873953][ T6678] binder: BINDER_SET_CONTEXT_MGR already set [ 160.879996][ T6678] binder: 6677:6678 ioctl 4018620d 200000000040 returned -16 [ 161.891752][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 161.940480][ T6687] uprobe: syz.2.205:6687 failed to unregister, leaking uprobe [ 162.511806][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 162.691954][ T10] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 162.801663][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.828850][ T10] usb 1-1: Product: syz [ 162.835878][ T6694] netlink: 20 bytes leftover after parsing attributes in process `syz.3.208'. [ 163.054972][ T10] usb 1-1: Manufacturer: syz [ 163.059608][ T10] usb 1-1: SerialNumber: syz [ 163.448937][ T10] r8152-cfgselector 1-1: Unknown version 0x0000 [ 163.464832][ T10] r8152-cfgselector 1-1: config 0 descriptor?? [ 163.761408][ T10] r8152-cfgselector 1-1: Unknown version 0x0000 [ 163.781975][ T10] r8152-cfgselector 1-1: bad CDC descriptors [ 163.826214][ T10] r8152-cfgselector 1-1: USB disconnect, device number 7 [ 163.950023][ T6711] binder: 6710:6711 ioctl 400c620e 200000000000 returned -22 [ 164.110984][ T6709] netlink: 'syz.0.214': attribute type 10 has an invalid length. [ 164.111026][ T6709] team0: Device dummy0 is up. Set it down before adding it as a team port [ 164.248022][ T6718] netlink: 144 bytes leftover after parsing attributes in process `syz.2.215'. [ 164.898002][ T6719] mmap: syz.1.218 (6719): VmData 37597184 exceed data ulimit 5. Update limits or use boot option ignore_rlimit_data. [ 166.151690][ T5841] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 166.151820][ T5842] Bluetooth: hci0: command 0x0c1a tx timeout [ 166.471788][ T10] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 166.651887][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 166.673754][ T10] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 166.683247][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.691309][ T10] usb 3-1: Product: syz [ 166.708505][ T10] usb 3-1: Manufacturer: syz [ 166.725205][ T10] usb 3-1: SerialNumber: syz [ 166.761739][ T10] r8152-cfgselector 3-1: Unknown version 0x0000 [ 166.778101][ T10] r8152-cfgselector 3-1: config 0 descriptor?? [ 167.025797][ T6746] syz.3.225: attempt to access beyond end of device [ 167.025797][ T6746] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 167.569419][ T10] r8152-cfgselector 3-1: USB disconnect, device number 4 [ 167.595473][ T6748] evm: overlay not supported [ 167.732875][ T6750] FAULT_INJECTION: forcing a failure. [ 167.732875][ T6750] name failslab, interval 1, probability 0, space 0, times 0 [ 167.747604][ T6750] CPU: 1 UID: 0 PID: 6750 Comm: syz.0.227 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 167.747628][ T6750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 167.747639][ T6750] Call Trace: [ 167.747646][ T6750] [ 167.747654][ T6750] dump_stack_lvl+0x189/0x250 [ 167.747680][ T6750] ? __pfx____ratelimit+0x10/0x10 [ 167.747698][ T6750] ? __pfx_dump_stack_lvl+0x10/0x10 [ 167.747715][ T6750] ? __pfx__printk+0x10/0x10 [ 167.747748][ T6750] should_fail_ex+0x414/0x560 [ 167.747772][ T6750] should_failslab+0xa8/0x100 [ 167.747793][ T6750] __kmalloc_cache_noprof+0x70/0x3d0 [ 167.747812][ T6750] ? sctp_add_bind_addr+0x8c/0x370 [ 167.747835][ T6750] sctp_add_bind_addr+0x8c/0x370 [ 167.747861][ T6750] sctp_copy_local_addr_list+0x30b/0x4e0 [ 167.747887][ T6750] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 167.747903][ T6750] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 167.747925][ T6750] ? sctp_v4_is_any+0x35/0x60 [ 167.747946][ T6750] ? sctp_copy_one_addr+0x93/0x360 [ 167.747971][ T6750] sctp_bind_addr_copy+0xb3/0x3c0 [ 167.747995][ T6750] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 167.748019][ T6750] sctp_connect_new_asoc+0x2e0/0x690 [ 167.748042][ T6750] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 167.748056][ T6750] ? __local_bh_enable_ip+0x12d/0x1c0 [ 167.748071][ T6750] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 167.748082][ T6750] ? security_sctp_bind_connect+0x7e/0x2e0 [ 167.748096][ T6750] sctp_sendmsg+0x155c/0x2810 [ 167.748117][ T6750] ? __pfx_sctp_sendmsg+0x10/0x10 [ 167.748131][ T6750] ? __lock_acquire+0xab9/0xd20 [ 167.748150][ T6750] ? sock_rps_record_flow+0x19/0x410 [ 167.748176][ T6750] ? inet_sendmsg+0x2f4/0x370 [ 167.748189][ T6750] __sock_sendmsg+0x19c/0x270 [ 167.748210][ T6750] ____sys_sendmsg+0x505/0x830 [ 167.748230][ T6750] ? __pfx_____sys_sendmsg+0x10/0x10 [ 167.748250][ T6750] ? import_iovec+0x74/0xa0 [ 167.748266][ T6750] ___sys_sendmsg+0x21f/0x2a0 [ 167.748283][ T6750] ? __pfx____sys_sendmsg+0x10/0x10 [ 167.748319][ T6750] ? __fget_files+0x2a/0x420 [ 167.748330][ T6750] ? __fget_files+0x3a0/0x420 [ 167.748347][ T6750] __x64_sys_sendmsg+0x19b/0x260 [ 167.748364][ T6750] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 167.748385][ T6750] ? __pfx_ksys_write+0x10/0x10 [ 167.748397][ T6750] ? do_syscall_64+0xbe/0x3b0 [ 167.748411][ T6750] do_syscall_64+0xfa/0x3b0 [ 167.748421][ T6750] ? lockdep_hardirqs_on+0x9c/0x150 [ 167.748432][ T6750] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.748442][ T6750] ? clear_bhb_loop+0x60/0xb0 [ 167.748455][ T6750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.748464][ T6750] RIP: 0033:0x7f984838ebe9 [ 167.748475][ T6750] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.748483][ T6750] RSP: 002b:00007f9849284038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 167.748495][ T6750] RAX: ffffffffffffffda RBX: 00007f98485b5fa0 RCX: 00007f984838ebe9 [ 167.748502][ T6750] RDX: 0000000000008001 RSI: 0000200000000540 RDI: 0000000000000003 [ 167.748509][ T6750] RBP: 00007f9849284090 R08: 0000000000000000 R09: 0000000000000000 [ 167.748514][ T6750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 167.748520][ T6750] R13: 00007f98485b6038 R14: 00007f98485b5fa0 R15: 00007fff5d5c0f98 [ 167.748537][ T6750] [ 168.072678][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.079736][ T5900] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 168.440242][ T5900] usb 4-1: unable to get BOS descriptor or descriptor too short [ 168.455665][ T5900] usb 4-1: not running at top speed; connect to a high speed hub [ 168.486992][ T5900] usb 4-1: config 3 has an invalid interface number: 106 but max is 0 [ 168.516935][ T5900] usb 4-1: config 3 has an invalid descriptor of length 250, skipping remainder of the config [ 168.537687][ T5900] usb 4-1: config 3 has no interface number 0 [ 168.547839][ T5900] usb 4-1: config 3 interface 106 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 168.569330][ T5900] usb 4-1: config 3 interface 106 has no altsetting 0 [ 168.581044][ T5900] usb 4-1: New USB device found, idVendor=1346, idProduct=2011, bcdDevice=ea.8a [ 168.591372][ T5900] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.599805][ T5900] usb 4-1: Product: syz [ 168.605644][ T5900] usb 4-1: Manufacturer: syz [ 168.610269][ T5900] usb 4-1: SerialNumber: syz [ 168.887412][ T6763] netlink: 'syz.0.229': attribute type 13 has an invalid length. [ 168.909537][ T6763] veth0_macvtap: left promiscuous mode [ 168.923551][ T6767] loop8: detected capacity change from 0 to 8 [ 168.931728][ T6763] macvtap0: entered allmulticast mode [ 168.934637][ T6763] macvtap0: refused to change device tx_queue_len [ 169.145369][ T6767] Dev loop8: unable to read RDB block 8 [ 169.145438][ T6767] loop8: unable to read partition table [ 169.145645][ T6767] loop8: partition table beyond EOD, truncated [ 169.145666][ T6767] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 169.415852][ T6768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 170.262087][ T6768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 171.219286][ T6786] xt_TPROXY: Can be used only with -p tcp or -p udp [ 171.249558][ T6786] vlan2: entered promiscuous mode [ 171.250214][ T6786] vlan2: entered allmulticast mode [ 171.250252][ T6786] hsr_slave_1: entered allmulticast mode [ 172.409614][ T5900] usb 4-1: USB disconnect, device number 7 [ 173.881375][ T6793] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 173.916262][ T6814] overlay: Unknown parameter '/' [ 174.269523][ T6814] process 'syz.0.241' launched '/dev/fd/7' with NULL argv: empty string added [ 176.171326][ T6832] syz.4.248: attempt to access beyond end of device [ 176.171326][ T6832] nbd4: rw=0, sector=0, nr_sectors = 2 limit=0 [ 176.520303][ T6830] fuse: Bad value for 'user_id' [ 176.525403][ T6830] fuse: Bad value for 'user_id' [ 176.676639][ T6831] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 176.939889][ T6836] i2c i2c-0: Invalid block write size 34 [ 176.950516][ T6836] netlink: 'syz.2.249': attribute type 1 has an invalid length. [ 176.956868][ T6838] xt_hashlimit: max too large, truncated to 1048576 [ 177.241878][ T5953] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 177.578546][ T6836] 8021q: adding VLAN 0 to HW filter on device bond2 [ 177.685791][ T5953] usb 5-1: Using ep0 maxpacket: 8 [ 177.711652][ T5953] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 177.768098][ T5953] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 177.804568][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.846859][ T5953] usb 5-1: config 0 descriptor?? [ 177.878194][ T5953] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 177.902928][ T6849] binder: 6848:6849 ioctl 8933 200000000240 returned -22 [ 178.393125][ T5953] gspca_vc032x: reg_r err -110 [ 178.410154][ T5953] vc032x 5-1:0.0: probe with driver vc032x failed with error -110 [ 178.743551][ T6854] netlink: 8 bytes leftover after parsing attributes in process `syz.0.255'. [ 179.582235][ T6861] netlink: 'syz.1.256': attribute type 10 has an invalid length. [ 179.752657][ T6866] netlink: 4528 bytes leftover after parsing attributes in process `syz.2.258'. [ 179.820978][ T6866] netlink: 8 bytes leftover after parsing attributes in process `syz.2.258'. [ 179.856643][ T6866] netlink: 4528 bytes leftover after parsing attributes in process `syz.2.258'. [ 180.842951][ T10] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 180.951035][ T6882] fuse: Bad value for 'user_id' [ 180.959831][ T6882] fuse: Bad value for 'user_id' [ 182.118206][ T6892] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 182.131290][ T10] usb 4-1: New USB device found, idVendor=76e8, idProduct=ff47, bcdDevice=a6.d1 [ 182.159124][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.173507][ T5900] usb 5-1: USB disconnect, device number 11 [ 182.216510][ T10] usb 4-1: Product: syz [ 182.220821][ T10] usb 4-1: Manufacturer: syz [ 182.279709][ T10] usb 4-1: SerialNumber: syz [ 182.438940][ T6899] netlink: 12 bytes leftover after parsing attributes in process `syz.1.264'. [ 182.732038][ T10] usb 4-1: config 0 descriptor?? [ 182.852559][ T6903] netlink: 24 bytes leftover after parsing attributes in process `syz.2.267'. [ 183.303592][ T6913] loop8: detected capacity change from 0 to 7 [ 183.793494][ T6913] Dev loop8: unable to read RDB block 7 [ 183.799149][ T6913] loop8: AHDI p1 p2 p3 [ 183.803415][ T6913] loop8: partition table partially beyond EOD, truncated [ 183.810606][ T6913] loop8: p1 start 1601398130 is beyond EOD, truncated [ 183.817426][ T6913] loop8: p2 start 1702059890 is beyond EOD, truncated [ 184.325412][ T43] usb 4-1: USB disconnect, device number 8 [ 184.572404][ T6923] syz.4.271: attempt to access beyond end of device [ 184.572404][ T6923] nbd4: rw=0, sector=0, nr_sectors = 2 limit=0 [ 185.520858][ T6920] netlink: 60 bytes leftover after parsing attributes in process `syz.4.271'. [ 185.798214][ T5932] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 185.854025][ T6936] netlink: 14 bytes leftover after parsing attributes in process `syz.0.276'. [ 186.017376][ T5932] usb 3-1: Using ep0 maxpacket: 32 [ 186.033278][ T5932] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 186.072547][ T5932] usb 3-1: config 0 has no interface number 0 [ 186.439450][ T5932] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 186.482500][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.513596][ T6946] netlink: 44 bytes leftover after parsing attributes in process `syz.1.278'. [ 186.531982][ T5932] usb 3-1: Product: syz [ 186.536219][ T5932] usb 3-1: Manufacturer: syz [ 186.540900][ T5932] usb 3-1: SerialNumber: syz [ 186.596648][ T5932] usb 3-1: config 0 descriptor?? [ 186.625288][ T5932] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 186.652088][ T5932] usb 3-1: selecting invalid altsetting 1 [ 186.670677][ T5932] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 186.703108][ T5932] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 186.732526][ T5932] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 186.767776][ T5932] usb 3-1: media controller created [ 186.820731][ T5932] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 186.968893][ T6936] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 187.007431][ T6936] bond_slave_0: left promiscuous mode [ 187.048018][ T6936] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 187.086687][ T6936] bond_slave_1: left promiscuous mode [ 187.124411][ T6936] bond0 (unregistering): Released all slaves [ 187.226210][ T6943] veth1_macvtap: left promiscuous mode [ 187.242841][ T6943] macsec0: entered promiscuous mode [ 187.292431][ T6961] netlink: 28 bytes leftover after parsing attributes in process `syz.4.282'. [ 187.964985][ T6931] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 189.012111][ T5932] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 189.021961][ T5932] zl10353_read_register: readreg error (reg=127, ret==-32) [ 189.871495][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 189.871512][ T30] audit: type=1326 audit(1755806892.952:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 189.944899][ T30] audit: type=1326 audit(1755806892.952:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=79 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 189.993225][ T30] audit: type=1326 audit(1755806892.952:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 190.010682][ T5932] usb 3-1: USB disconnect, device number 5 [ 190.080186][ T30] audit: type=1326 audit(1755806892.992:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=233 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 190.215895][ T6992] xt_TPROXY: Can be used only with -p tcp or -p udp [ 190.866737][ T6992] vlan2: entered promiscuous mode [ 190.872108][ T6992] vlan2: entered allmulticast mode [ 190.877269][ T6992] hsr_slave_1: entered allmulticast mode [ 190.952642][ T30] audit: type=1326 audit(1755806892.992:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 191.352314][ T30] audit: type=1326 audit(1755806892.992:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 191.461684][ T30] audit: type=1326 audit(1755806892.992:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 191.529815][ T30] audit: type=1326 audit(1755806892.992:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 191.775990][ T30] audit: type=1326 audit(1755806892.992:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 191.906410][ T30] audit: type=1326 audit(1755806892.992:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6980 comm="syz.0.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 192.120057][ T7012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.296'. [ 192.129266][ T7012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.296'. [ 193.768005][ T7028] netlink: 28 bytes leftover after parsing attributes in process `syz.2.301'. [ 194.464498][ T7033] xt_cluster: node mask cannot exceed total number of nodes [ 194.912407][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 196.460171][ T7056] syz.0.308: attempt to access beyond end of device [ 196.460171][ T7056] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 197.785771][ T7063] netlink: 'syz.4.310': attribute type 11 has an invalid length. [ 197.793676][ T7063] netlink: 'syz.4.310': attribute type 11 has an invalid length. [ 197.801413][ T7063] netlink: 224 bytes leftover after parsing attributes in process `syz.4.310'. [ 198.186708][ T7056] netlink: 60 bytes leftover after parsing attributes in process `syz.0.308'. [ 198.197785][ T7075] netlink: 'syz.2.313': attribute type 1 has an invalid length. [ 198.871148][ T7079] bond3: (slave gretap1): making interface the new active one [ 198.901471][ T7079] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 198.908893][ T7089] IPVS: set_ctl: invalid protocol: 29 0.0.0.0:20000 [ 204.145678][ T7147] IPv6: NLM_F_CREATE should be specified when creating new route [ 204.168135][ T5900] libceph: connect (1)[c::]:6789 error -101 [ 204.182829][ T43] libceph: connect (1)[c::]:6789 error -101 [ 204.189115][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 204.243948][ T5900] libceph: mon0 (1)[c::]:6789 connect error [ 204.523150][ T5900] libceph: connect (1)[c::]:6789 error -101 [ 204.529289][ T5953] libceph: connect (1)[c::]:6789 error -101 [ 204.536176][ T5953] libceph: mon0 (1)[c::]:6789 connect error [ 204.585939][ T5900] libceph: mon0 (1)[c::]:6789 connect error [ 205.261977][ T5900] libceph: connect (1)[c::]:6789 error -101 [ 205.280469][ T5900] libceph: mon0 (1)[c::]:6789 connect error [ 205.352688][ T5953] libceph: connect (1)[c::]:6789 error -101 [ 205.361926][ T5953] libceph: mon0 (1)[c::]:6789 connect error [ 205.362643][ T7143] ceph: No mds server is up or the cluster is laggy [ 205.401786][ T7150] ceph: No mds server is up or the cluster is laggy [ 206.928234][ T7166] Bluetooth: hci3: command 0x0406 tx timeout [ 206.941205][ T7166] Bluetooth: hci0: command 0x0c1a tx timeout [ 206.952030][ T7166] Bluetooth: hci1: command 0x0406 tx timeout [ 206.958532][ T5837] Bluetooth: hci4: command 0x0405 tx timeout [ 206.966724][ T7166] Bluetooth: hci2: command 0x0406 tx timeout [ 206.968958][ T7184] netlink: 'syz.1.339': attribute type 11 has an invalid length. [ 206.980609][ T7184] netlink: 'syz.1.339': attribute type 11 has an invalid length. [ 206.988711][ T7184] netlink: 224 bytes leftover after parsing attributes in process `syz.1.339'. [ 207.029182][ T7181] xt_TPROXY: Can be used only with -p tcp or -p udp [ 208.367758][ T7202] binder: BINDER_SET_CONTEXT_MGR already set [ 208.452463][ T7202] binder: 7201:7202 ioctl 4018620d 200000000040 returned -16 [ 210.309737][ T7219] syz.3.349: attempt to access beyond end of device [ 210.309737][ T7219] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 212.758419][ T7252] xt_bpf: check failed: parse error [ 212.767815][ T7252] overlayfs: failed to resolve './file1/file0': -2 [ 213.216328][ T7262] --map-set only usable from mangle table [ 214.213663][ T7266] xt_TCPMSS: Only works on TCP SYN packets [ 214.657181][ T5900] IPVS: starting estimator thread 0... [ 214.772055][ T7270] IPVS: using max 48 ests per chain, 115200 per kthread [ 215.252086][ T7267] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 220.201474][ T7325] netlink: 'syz.3.379': attribute type 1 has an invalid length. [ 220.211673][ T7325] netlink: 4 bytes leftover after parsing attributes in process `syz.3.379'. [ 220.500006][ T7331] netlink: 28 bytes leftover after parsing attributes in process `syz.4.380'. [ 220.921254][ T7335] xt_hashlimit: max too large, truncated to 1048576 [ 221.153492][ T6007] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 222.373515][ T6007] usb 1-1: Using ep0 maxpacket: 16 [ 222.383917][ T6007] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 222.403959][ T6007] usb 1-1: can't read configurations, error -61 [ 222.612059][ T6007] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 223.411727][ T10] IPVS: starting estimator thread 0... [ 223.501771][ T6007] usb 1-1: Using ep0 maxpacket: 16 [ 223.535016][ T6007] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 223.547633][ T6007] usb 1-1: can't read configurations, error -61 [ 223.554826][ T7361] IPVS: using max 30 ests per chain, 72000 per kthread [ 223.665634][ T6007] usb usb1-port1: attempt power cycle [ 223.983485][ T7359] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 224.916625][ T7359] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 224.977750][ T7359] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 225.021992][ T7359] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 225.060576][ T7359] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 225.066827][ T7359] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 225.078788][ T7359] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 225.091855][ T7359] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 225.141205][ T7359] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 225.196749][ T7359] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 225.283548][ T7378] syz.0.392: attempt to access beyond end of device [ 225.283548][ T7378] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 225.730316][ T7382] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 225.751736][ T5842] Bluetooth: hci0: command 0x0c1a tx timeout [ 225.759411][ T7359] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 225.961421][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 226.458364][ T7390] fuse: Bad value for 'user_id' [ 226.463496][ T7390] fuse: Bad value for 'user_id' [ 226.573078][ T9] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 226.666701][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 226.681686][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 226.710150][ T7390] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 226.712862][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 226.753336][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 226.777899][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.805922][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 226.815161][ T10] usb 3-1: Product: syz [ 226.819344][ T10] usb 3-1: Manufacturer: syz [ 226.851448][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.883724][ T10] usb 3-1: SerialNumber: syz [ 227.044738][ T5842] Bluetooth: hci2: command 0x0406 tx timeout [ 227.077188][ T9] usb 4-1: config 0 descriptor?? [ 227.161883][ T5842] Bluetooth: hci3: command 0x0406 tx timeout [ 227.168784][ T5842] Bluetooth: hci1: command 0x0406 tx timeout [ 227.191887][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 227.832455][ T5841] Bluetooth: hci0: command 0x0c1a tx timeout [ 227.882007][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 228.011740][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 228.041537][ T10] usb 3-1: 0:2 : does not exist [ 228.224931][ T9] usb 4-1: USB disconnect, device number 9 [ 228.943184][ T10] usb 3-1: USB disconnect, device number 6 [ 229.111892][ T5841] Bluetooth: hci2: command 0x0406 tx timeout [ 229.191910][ T5841] Bluetooth: hci1: command 0x0406 tx timeout [ 229.191925][ T5842] Bluetooth: hci3: command 0x0406 tx timeout [ 229.271792][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 229.637157][ T6069] udevd[6069]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 229.935733][ T5841] Bluetooth: hci0: command 0x0c1a tx timeout [ 231.943017][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 231.943029][ T30] audit: type=1326 audit(1755806935.032:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7410 comm="syz.0.403" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 232.072243][ T7439] fuse: Bad value for 'user_id' [ 232.077220][ T7439] fuse: Bad value for 'user_id' [ 232.241736][ T30] audit: type=1326 audit(1755806935.032:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7410 comm="syz.0.403" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f984838ebe9 code=0x7ffc0000 [ 232.362111][ T7441] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 232.653501][ T7443] netlink: 'syz.1.410': attribute type 21 has an invalid length. [ 232.666193][ T7443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.410'. [ 233.461279][ T7452] xt_CT: You must specify a L4 protocol and not use inversions on it [ 235.908081][ T43] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 235.991785][ T6007] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 236.185458][ T7475] binder: BINDER_SET_CONTEXT_MGR already set [ 236.219158][ T7475] binder: 7474:7475 ioctl 4018620d 200000000040 returned -16 [ 236.255652][ T6007] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 236.264112][ T6007] usb 2-1: config 0 has no interface number 0 [ 236.271410][ T6007] usb 2-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 236.296033][ T6007] usb 2-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 236.319722][ T6007] usb 2-1: config 0 interface 255 has no altsetting 0 [ 236.349139][ T6007] usb 2-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 236.369426][ T6007] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.392280][ T6007] usb 2-1: config 0 descriptor?? [ 236.405095][ T6007] ums-realtek 2-1:0.255: USB Mass Storage device detected [ 237.346551][ T6007] usb 2-1: USB disconnect, device number 3 [ 237.668325][ T7491] syz.1.423: attempt to access beyond end of device [ 237.668325][ T7491] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 238.709574][ T7500] syz.1.427: attempt to access beyond end of device [ 238.709574][ T7500] nbd1: rw=6144, sector=128, nr_sectors = 8 limit=0 [ 238.715382][ T5922] libceph: connect (1)[c::]:6789 error -101 [ 238.725499][ T7500] gfs2: error -5 reading superblock [ 238.733353][ T5922] libceph: mon0 (1)[c::]:6789 connect error [ 238.840710][ T6007] libceph: connect (1)[c::]:6789 error -101 [ 238.853016][ T6007] libceph: mon0 (1)[c::]:6789 connect error [ 239.003249][ T5922] libceph: connect (1)[c::]:6789 error -101 [ 239.234185][ T5922] libceph: mon0 (1)[c::]:6789 connect error [ 239.338540][ T7494] ceph: No mds server is up or the cluster is laggy [ 239.347229][ T7502] ceph: No mds server is up or the cluster is laggy [ 239.590859][ T7514] netlink: 12 bytes leftover after parsing attributes in process `syz.1.428'. [ 239.614920][ T7514] syz.1.428: attempt to access beyond end of device [ 239.614920][ T7514] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 240.600388][ T7524] netlink: 'syz.4.431': attribute type 1 has an invalid length. [ 241.048017][ T5900] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 241.338081][ T7527] bond1: (slave gretap1): making interface the new active one [ 241.353259][ T5900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 241.370199][ T5900] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 241.388381][ T7527] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 241.402938][ T5900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 241.934422][ T5900] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 241.951019][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.960701][ T5900] usb 3-1: Product: syz [ 241.969895][ T5900] usb 3-1: Manufacturer: syz [ 241.974872][ T5900] usb 3-1: SerialNumber: syz [ 241.989990][ T5900] usb 3-1: config 0 descriptor?? [ 242.149945][ T7519] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 242.171887][ T7519] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 242.190955][ T5900] usb 3-1: ucan: probing device on interface #0 [ 243.272741][ T5900] ucan 3-1:0.0 can0: registered device [ 243.556115][ T5900] ucan 3-1:0.0 can0: firmware string: w [ 243.760572][ T7557] syz.4.441: attempt to access beyond end of device [ 243.760572][ T7557] nbd4: rw=0, sector=0, nr_sectors = 2 limit=0 [ 244.231495][ T7567] netlink: 12 bytes leftover after parsing attributes in process `syz.4.444'. [ 244.772794][ T7563] netlink: 4528 bytes leftover after parsing attributes in process `syz.3.443'. [ 246.089502][ T7563] netlink: 8 bytes leftover after parsing attributes in process `syz.3.443'. [ 246.188316][ T5922] usb 3-1: USB disconnect, device number 8 [ 246.392223][ T5900] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 246.610340][ T5900] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 246.728551][ T7585] Invalid source name [ 246.732693][ T7585] UBIFS error (pid: 7585): cannot open "./file0", error -22 [ 246.760764][ T7585] binder: 7579:7585 ioctl 40046210 0 returned -14 [ 246.786930][ T7585] netlink: 4 bytes leftover after parsing attributes in process `syz.4.446'. [ 247.284242][ T7585] team0: Port device team_slave_1 removed [ 247.973747][ T9] libceph: connect (1)[c::]:6789 error -101 [ 247.979774][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 248.016823][ T6007] libceph: connect (1)[c::]:6789 error -101 [ 248.034006][ T6007] libceph: mon0 (1)[c::]:6789 connect error [ 248.323177][ T6007] libceph: connect (1)[c::]:6789 error -101 [ 248.325933][ T5922] libceph: connect (1)[c::]:6789 error -101 [ 248.329270][ T6007] libceph: mon0 (1)[c::]:6789 connect error [ 248.341849][ T5922] libceph: mon0 (1)[c::]:6789 connect error [ 248.424082][ T7609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.451'. [ 248.859409][ T9] libceph: connect (1)[c::]:6789 error -101 [ 248.958090][ T7594] ceph: No mds server is up or the cluster is laggy [ 248.959624][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 248.965689][ T7598] ceph: No mds server is up or the cluster is laggy [ 249.425476][ T6007] libceph: connect (1)[c::]:6789 error -101 [ 249.566465][ T6007] libceph: mon0 (1)[c::]:6789 connect error [ 249.576076][ T12] Bluetooth: (null): Too short H5 packet [ 249.594427][ T12] Bluetooth: (null): Invalid header checksum [ 249.602982][ T12] Bluetooth: (null): Invalid header checksum [ 249.714640][ T12] Bluetooth: (null): Invalid header checksum [ 250.062804][ T1163] Bluetooth: (null): Invalid header checksum [ 250.068921][ T1163] Bluetooth: (null): Invalid header checksum [ 250.113459][ T1163] Bluetooth: (null): Invalid header checksum [ 250.141710][ T1163] Bluetooth: (null): Invalid header checksum [ 250.281198][ T6916] Bluetooth: (null): Invalid header checksum [ 251.161172][ T7625] xt_bpf: check failed: parse error [ 251.168319][ T7625] overlayfs: failed to resolve './file1/file0': -2 [ 253.158194][ T5900] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 253.693460][ T5900] usb 1-1: Using ep0 maxpacket: 16 [ 254.005049][ T5900] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 254.032581][ T5900] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.073607][ T5900] usb 1-1: Product: syz [ 254.153453][ T5900] usb 1-1: Manufacturer: syz [ 254.255148][ T5900] usb 1-1: SerialNumber: syz [ 254.277624][ T5900] r8152-cfgselector 1-1: Unknown version 0x0000 [ 254.361685][ T5900] r8152-cfgselector 1-1: config 0 descriptor?? [ 255.240165][ T10] r8152-cfgselector 1-1: USB disconnect, device number 11 [ 255.862649][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.034305][ T7672] sctp: [Deprecated]: syz.4.467 (pid 7672) Use of int in maxseg socket option. [ 256.034305][ T7672] Use struct sctp_assoc_value instead [ 256.329716][ T7683] --map-set only usable from mangle table [ 257.913496][ T7702] netlink: 'syz.2.477': attribute type 21 has an invalid length. [ 257.922408][ T7702] FAULT_INJECTION: forcing a failure. [ 257.922408][ T7702] name failslab, interval 1, probability 0, space 0, times 0 [ 257.935580][ T7702] CPU: 0 UID: 0 PID: 7702 Comm: syz.2.477 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 257.935609][ T7702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 257.935618][ T7702] Call Trace: [ 257.935626][ T7702] [ 257.935633][ T7702] dump_stack_lvl+0x189/0x250 [ 257.935670][ T7702] ? irqentry_exit+0x74/0x90 [ 257.935692][ T7702] ? __pfx_dump_stack_lvl+0x10/0x10 [ 257.935723][ T7702] ? dump_stack+0x9/0x20 [ 257.935751][ T7702] should_fail_ex+0x414/0x560 [ 257.935869][ T7702] should_failslab+0xa8/0x100 [ 257.935917][ T7702] __kmalloc_noprof+0xcb/0x4f0 [ 257.935937][ T7702] ? fib_trie_table+0x33/0x1d0 [ 257.935967][ T7702] fib_trie_table+0x33/0x1d0 [ 257.935994][ T7702] fib_new_table+0x135/0x2d0 [ 257.936015][ T7702] inet_rtm_newroute+0x115/0x210 [ 257.936036][ T7702] ? __lock_acquire+0xab9/0xd20 [ 257.936056][ T7702] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 257.936107][ T7702] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 257.936129][ T7702] rtnetlink_rcv_msg+0x7cc/0xb70 [ 257.936159][ T7702] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 257.936183][ T7702] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 257.936206][ T7702] ? ref_tracker_free+0x63a/0x7d0 [ 257.936225][ T7702] ? __copy_skb_header+0xa7/0x550 [ 257.936247][ T7702] ? __pfx_ref_tracker_free+0x10/0x10 [ 257.936268][ T7702] ? irqentry_exit+0x74/0x90 [ 257.936298][ T7702] netlink_rcv_skb+0x205/0x470 [ 257.936327][ T7702] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 257.936354][ T7702] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 257.936400][ T7702] ? netlink_deliver_tap+0x2e/0x1b0 [ 257.936426][ T7702] ? netlink_deliver_tap+0x2e/0x1b0 [ 257.936462][ T7702] netlink_unicast+0x75c/0x8e0 [ 257.936499][ T7702] netlink_sendmsg+0x805/0xb30 [ 257.936537][ T7702] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.936573][ T7702] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 257.936592][ T7702] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.936620][ T7702] __sock_sendmsg+0x21c/0x270 [ 257.936642][ T7702] ____sys_sendmsg+0x505/0x830 [ 257.936677][ T7702] ? __pfx_____sys_sendmsg+0x10/0x10 [ 257.936717][ T7702] ? import_iovec+0x74/0xa0 [ 257.936748][ T7702] ___sys_sendmsg+0x21f/0x2a0 [ 257.936776][ T7702] ? __pfx____sys_sendmsg+0x10/0x10 [ 257.936837][ T7702] ? __fget_files+0x2a/0x420 [ 257.936857][ T7702] ? __fget_files+0x3a0/0x420 [ 257.936913][ T7702] __x64_sys_sendmsg+0x19b/0x260 [ 257.936946][ T7702] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 257.936985][ T7702] ? __pfx_ksys_write+0x10/0x10 [ 257.937000][ T7702] ? rcu_is_watching+0x15/0xb0 [ 257.937027][ T7702] ? do_syscall_64+0xbe/0x3b0 [ 257.937053][ T7702] do_syscall_64+0xfa/0x3b0 [ 257.937073][ T7702] ? lockdep_hardirqs_on+0x9c/0x150 [ 257.937091][ T7702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.937110][ T7702] ? clear_bhb_loop+0x60/0xb0 [ 257.937134][ T7702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.937152][ T7702] RIP: 0033:0x7fa966b8ebe9 [ 257.937179][ T7702] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 257.937194][ T7702] RSP: 002b:00007fa9679bf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 257.937215][ T7702] RAX: ffffffffffffffda RBX: 00007fa966db6090 RCX: 00007fa966b8ebe9 [ 257.937228][ T7702] RDX: 0000000000048084 RSI: 00002000000002c0 RDI: 0000000000000005 [ 257.937241][ T7702] RBP: 00007fa9679bf090 R08: 0000000000000000 R09: 0000000000000000 [ 257.937253][ T7702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.937264][ T7702] R13: 00007fa966db6128 R14: 00007fa966db6090 R15: 00007ffc6165a1f8 [ 257.937296][ T7702] [ 258.286015][ C0] vkms_vblank_simulate: vblank timer overrun [ 258.753960][ T7708] netlink: 12 bytes leftover after parsing attributes in process `syz.0.476'. [ 258.812563][ T7709] syz.0.476: attempt to access beyond end of device [ 258.812563][ T7709] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 259.638836][ T7713] fuse: Bad value for 'user_id' [ 259.644136][ T7713] fuse: Bad value for 'user_id' [ 263.521802][ T6007] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 264.757278][ T6007] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 264.787321][ T6007] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 264.912358][ T6007] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 264.922834][ T6007] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.942474][ T6007] usb 3-1: config 0 descriptor?? [ 266.277630][ T6007] cm6533_jd 0003:0D8C:0022.0005: unknown main item tag 0x0 [ 266.309349][ T6007] cm6533_jd 0003:0D8C:0022.0005: unknown main item tag 0x0 [ 266.347539][ T6007] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0D8C:0022.0005/input/input10 [ 266.901097][ T6007] cm6533_jd 0003:0D8C:0022.0005: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.2-1/input0 [ 267.295945][ T5892] usb 3-1: USB disconnect, device number 9 [ 267.780803][ T7780] fido_id[7780]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 268.523997][ T7787] netlink: 104 bytes leftover after parsing attributes in process `syz.3.499'. [ 270.045331][ T7801] syz.1.503: attempt to access beyond end of device [ 270.045331][ T7801] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 270.246847][ T7802] netlink: 60 bytes leftover after parsing attributes in process `syz.1.503'. [ 270.654406][ T5922] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 270.936905][ T7808] syz.3.504: attempt to access beyond end of device [ 270.936905][ T7808] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 271.177744][ T7808] netlink: 60 bytes leftover after parsing attributes in process `syz.3.504'. [ 271.312450][ T5922] usb 5-1: Using ep0 maxpacket: 16 [ 271.331758][ T5922] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 271.360178][ T7812] xt_bpf: check failed: parse error [ 271.367286][ T7812] overlayfs: failed to resolve './file1/file0': -2 [ 271.381735][ T5922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 271.400857][ T5922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 271.412767][ T5922] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 271.438157][ T5922] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 271.459548][ T5922] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 271.471539][ T5922] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 271.489788][ T5922] usb 5-1: Manufacturer: syz [ 271.508505][ T5922] usb 5-1: config 0 descriptor?? [ 271.857125][ T7818] netlink: 'syz.2.508': attribute type 10 has an invalid length. [ 271.865362][ T7818] veth0_vlan: left promiscuous mode [ 271.871383][ T7818] veth0_vlan: entered promiscuous mode [ 271.878492][ T7818] team0: Device veth0_vlan failed to register rx_handler [ 272.271678][ T5922] rc_core: IR keymap rc-hauppauge not found [ 272.277779][ T5922] Registered IR keymap rc-empty [ 272.285788][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 272.453090][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 272.573094][ T5900] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 272.585839][ T5922] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 273.226222][ T5922] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input11 [ 273.311804][ T5900] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 273.361413][ T7832] netlink: 92 bytes leftover after parsing attributes in process `syz.0.511'. [ 273.416824][ T5900] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 273.605707][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 273.617818][ T5900] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 273.640658][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 273.661666][ T5900] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 273.669714][ T5900] usb 4-1: Manufacturer: syz [ 273.697583][ T5900] usb 4-1: config 0 descriptor?? [ 273.702696][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.104528][ T7841] netlink: 12 bytes leftover after parsing attributes in process `syz.3.510'. [ 274.113591][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.132881][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.210142][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.278698][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.301700][ T5900] rc_core: IR keymap rc-hauppauge not found [ 274.307754][ T5900] Registered IR keymap rc-empty [ 274.332720][ T5900] rc rc1: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1 [ 274.362018][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.394258][ T5900] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1/input12 [ 274.412472][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.430660][ T7850] warning: `syz.2.519' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 274.671115][ T5922] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 274.688049][ T5900] usb 4-1: USB disconnect, device number 10 [ 274.704830][ T5922] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 274.720264][ T5922] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 274.881379][ T7863] --map-set only usable from mangle table [ 275.329223][ T5922] usb 5-1: USB disconnect, device number 12 [ 275.401883][ T7853] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 275.474303][ T6007] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 275.492916][ T7865] netlink: 'syz.3.520': attribute type 21 has an invalid length. [ 275.502016][ T7865] netlink: 'syz.3.520': attribute type 15 has an invalid length. [ 276.173733][ T6007] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 276.444179][ T6007] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.640647][ T6007] usb 2-1: config 0 descriptor?? [ 276.675210][ T6007] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 276.675265][ T7874] xt_hashlimit: max too large, truncated to 1048576 [ 277.083149][ T6007] gspca_cpia1: usb_control_msg 03, error -32 [ 277.600523][ T7892] IPv6: addrconf: prefix option has invalid lifetime [ 277.771202][ T5841] Bluetooth: hci3: unexpected event for opcode 0x0c2d [ 278.648357][ T6007] gspca_cpia1: usb_control_msg 03, error -71 [ 278.752765][ T7892] netlink: 12 bytes leftover after parsing attributes in process `syz.4.528'. [ 278.850549][ T6007] gspca_cpia1: usb_control_msg 01, error -71 [ 278.856958][ T6007] cpia1 2-1:0.0: only firmware version 1 is supported (got: 0) [ 278.884807][ T6007] usb 2-1: USB disconnect, device number 4 [ 278.916284][ T7892] netlink: 8 bytes leftover after parsing attributes in process `syz.4.528'. [ 280.390848][ T7910] syz.0.533: attempt to access beyond end of device [ 280.390848][ T7910] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 281.883283][ T5841] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 281.894088][ T5841] Bluetooth: hci3: Injecting HCI hardware error event [ 281.908367][ T5841] Bluetooth: hci3: hardware error 0x00 [ 281.994773][ T7904] netlink: 60 bytes leftover after parsing attributes in process `syz.0.533'. [ 283.013652][ T7945] netlink: 'syz.4.541': attribute type 4 has an invalid length. [ 283.992223][ T5841] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 285.620396][ T7975] xt_TPROXY: Can be used only with -p tcp or -p udp [ 286.748006][ T7992] xt_bpf: check failed: parse error [ 286.766740][ T7992] overlayfs: failed to resolve './file1/file0': -2 [ 286.853016][ T7986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.555'. [ 287.131707][ T7986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.555'. [ 290.140954][ T8033] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 290.562780][ T5900] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 290.758262][ T8026] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 290.914541][ T5900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.091730][ T5900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.188710][ T5900] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 291.266462][ T5900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.257390][ T5900] usb 3-1: config 0 descriptor?? [ 292.391727][ T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 292.571922][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 292.745532][ T8030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.770397][ T9] usb 5-1: device descriptor read/all, error -71 [ 292.799534][ T8030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.926345][ T8030] netlink: 44 bytes leftover after parsing attributes in process `syz.2.565'. [ 293.425093][ T8055] fuse: Bad value for 'fd' [ 293.511816][ T8056] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 294.416379][ T5900] usbhid 3-1:0.0: can't add hid device: -71 [ 294.422752][ T5900] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 294.452534][ T5900] usb 3-1: USB disconnect, device number 10 [ 295.078029][ T8084] --map-set only usable from mangle table [ 295.106809][ T5953] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 295.617662][ T8087] bond_slave_0: entered promiscuous mode [ 295.623434][ T8087] bond_slave_1: entered promiscuous mode [ 295.642656][ T8087] vlan3: entered promiscuous mode [ 295.652790][ T8087] bond0: entered promiscuous mode [ 295.720898][ T5953] usb 2-1: device descriptor read/64, error -71 [ 295.853292][ T8090] netlink: 'syz.0.580': attribute type 1 has an invalid length. [ 296.028254][ T5953] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 296.091300][ T8095] fuse: Bad value for 'user_id' [ 296.097631][ T8095] fuse: Bad value for 'user_id' [ 296.475559][ T5953] usb 2-1: device descriptor read/64, error -71 [ 296.637715][ T5953] usb usb2-port1: attempt power cycle [ 297.041759][ T5953] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 297.085093][ T5953] usb 2-1: device descriptor read/8, error -71 [ 297.351962][ T5953] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 297.361172][ T8106] fuse: Bad value for 'fd' [ 297.440388][ T5953] usb 2-1: device descriptor read/8, error -71 [ 297.531852][ T8075] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 297.673982][ T5953] usb usb2-port1: unable to enumerate USB device [ 297.999825][ T8114] netlink: 5128 bytes leftover after parsing attributes in process `syz.1.587'. [ 298.009163][ T8114] netlink: 5128 bytes leftover after parsing attributes in process `syz.1.587'. [ 298.018238][ T8114] netlink: 640 bytes leftover after parsing attributes in process `syz.1.587'. [ 299.142420][ T8121] Can't find ip_set type hash:ip, [ 299.160788][ T8129] netlink: 12 bytes leftover after parsing attributes in process `syz.4.591'. [ 300.152230][ T8140] team_slave_0: entered promiscuous mode [ 300.157957][ T8140] team_slave_1: entered promiscuous mode [ 300.185672][ T8140] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 300.202477][ T8140] team0: Device macvtap0 is already an upper device of the team interface [ 300.278320][ T8140] team_slave_0: left promiscuous mode [ 300.283881][ T8140] team_slave_1: left promiscuous mode [ 300.560925][ T8150] netlink: 4 bytes leftover after parsing attributes in process `syz.3.596'. [ 301.574494][ T8155] fuse: Bad value for 'fd' [ 301.660122][ T8155] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 301.851653][ T8162] netlink: 8 bytes leftover after parsing attributes in process `syz.1.602'. [ 302.738408][ T8167] Can't find ip_set type hash:ip, [ 304.252735][ T8181] comedi comedi2: comedi_config --init_data is deprecated [ 305.062710][ T8190] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 305.523888][ T8204] netlink: 'syz.2.611': attribute type 21 has an invalid length. [ 305.532590][ T8204] netlink: 8 bytes leftover after parsing attributes in process `syz.2.611'. [ 308.233511][ T8215] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 308.934411][ T8219] netlink: 'syz.3.616': attribute type 11 has an invalid length. [ 308.942270][ T8219] netlink: 'syz.3.616': attribute type 11 has an invalid length. [ 308.950136][ T8219] netlink: 224 bytes leftover after parsing attributes in process `syz.3.616'. [ 309.329733][ T8230] netlink: 'syz.3.619': attribute type 32 has an invalid length. [ 309.403185][ T8231] netlink: 4 bytes leftover after parsing attributes in process `syz.1.617'. [ 309.940180][ T8230] netlink: 8 bytes leftover after parsing attributes in process `syz.3.619'. [ 310.081022][ T8233] binder: BINDER_SET_CONTEXT_MGR already set [ 310.511214][ T8230] (unnamed net_device) (uninitialized): option coupled_control: invalid value (46) [ 310.550910][ T8233] binder: 8229:8233 ioctl 4018620d 200000000040 returned -16 [ 314.956525][ T8272] xt_TPROXY: Can be used only with -p tcp or -p udp [ 315.521849][ T5900] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 315.854629][ T5900] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 315.887377][ T5900] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 315.927390][ T5900] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 315.940080][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.196078][ T8270] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 316.500405][ T5900] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 316.818936][ T8285] netlink: 4528 bytes leftover after parsing attributes in process `syz.4.633'. [ 316.857546][ T8285] netlink: 8 bytes leftover after parsing attributes in process `syz.4.633'. [ 316.867516][ T8285] netlink: 4528 bytes leftover after parsing attributes in process `syz.4.633'. [ 316.882518][ T6007] usb 2-1: USB disconnect, device number 9 [ 317.278980][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 323.307610][ T8315] netlink: 4268 bytes leftover after parsing attributes in process `syz.3.641'. [ 323.319170][ T8315] netlink: 4268 bytes leftover after parsing attributes in process `syz.3.641'. [ 324.077133][ T8312] netlink: 'syz.1.640': attribute type 21 has an invalid length. [ 324.092558][ T8312] netlink: 8 bytes leftover after parsing attributes in process `syz.1.640'. [ 324.172668][ T8319] netlink: 5128 bytes leftover after parsing attributes in process `syz.2.642'. [ 324.181861][ T8319] netlink: 5128 bytes leftover after parsing attributes in process `syz.2.642'. [ 324.190907][ T8319] netlink: 640 bytes leftover after parsing attributes in process `syz.2.642'. [ 324.417601][ T8314] netlink: 8 bytes leftover after parsing attributes in process `syz.0.643'. [ 324.427111][ T8314] netlink: 8 bytes leftover after parsing attributes in process `syz.0.643'. [ 324.526322][ T8324] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 326.510734][ T8347] netlink: 4 bytes leftover after parsing attributes in process `syz.3.648'. [ 327.870273][ T8358] fuse: Bad value for 'user_id' [ 327.875348][ T8358] fuse: Bad value for 'user_id' [ 328.032104][ T8360] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 328.293965][ T5922] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 328.431835][ T5922] usb 5-1: device descriptor read/64, error -71 [ 329.402126][ T5922] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 329.681984][ T5922] usb 5-1: device descriptor read/64, error -71 [ 329.813125][ T5922] usb usb5-port1: attempt power cycle [ 330.461882][ T5922] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 330.502369][ T5922] usb 5-1: device descriptor read/8, error -71 [ 330.726058][ T8366] binfmt_misc: register: failed to install interpreter file ./file1 [ 330.745494][ T8397] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 330.745494][ T8397] The task syz.0.660 (8397) triggered the difference, watch for misbehavior. [ 330.774450][ T5922] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 331.020955][ T5922] usb 5-1: device not accepting address 18, error -71 [ 331.039501][ T5922] usb usb5-port1: unable to enumerate USB device [ 331.653488][ T8404] netlink: 4 bytes leftover after parsing attributes in process `syz.1.661'. [ 332.755364][ T8408] xt_hashlimit: max too large, truncated to 1048576 [ 334.182303][ T9] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 334.345977][ T9] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 334.634162][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.643586][ T9] usb 1-1: Product: syz [ 334.647791][ T9] usb 1-1: Manufacturer: syz [ 334.653000][ T9] usb 1-1: SerialNumber: syz [ 334.678798][ T9] usb 1-1: config 0 descriptor?? [ 334.706214][ T9] imon_raw 1-1:0.0: IR endpoint missing [ 336.269562][ T8443] netlink: 'syz.2.673': attribute type 11 has an invalid length. [ 336.277545][ T8443] netlink: 'syz.2.673': attribute type 11 has an invalid length. [ 336.337405][ T8443] netlink: 224 bytes leftover after parsing attributes in process `syz.2.673'. [ 336.505676][ T9] usb 1-1: USB disconnect, device number 12 [ 336.575745][ T8450] netlink: 4 bytes leftover after parsing attributes in process `syz.1.675'. [ 338.988311][ T8459] netlink: 340 bytes leftover after parsing attributes in process `syz.3.678'. [ 339.012375][ T8459] netlink: 48 bytes leftover after parsing attributes in process `syz.3.678'. [ 339.776320][ T8469] syz.3.681: attempt to access beyond end of device [ 339.776320][ T8469] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 340.541674][ T5892] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 340.721601][ T5892] usb 2-1: Using ep0 maxpacket: 16 [ 340.748415][ T5892] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 340.956188][ T5892] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 340.967995][ T5892] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 1794, setting to 1024 [ 340.979454][ T5892] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 340.989632][ T5892] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 341.699015][ T5892] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 341.774615][ T5892] usb 2-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 341.816122][ T8485] netlink: 'syz.4.688': attribute type 10 has an invalid length. [ 341.834560][ T8485] veth0_vlan: left promiscuous mode [ 341.843287][ T8485] veth0_vlan: entered promiscuous mode [ 341.851324][ T8485] team0: Device veth0_vlan failed to register rx_handler [ 341.923201][ T5892] usb 2-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice=c6.c3 [ 341.933914][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.942254][ T5892] usb 2-1: Product: syz [ 341.946587][ T5892] usb 2-1: Manufacturer: syz [ 341.951358][ T5892] usb 2-1: SerialNumber: syz [ 341.977096][ T5892] usb 2-1: config 0 descriptor?? [ 342.007728][ T8474] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 342.047464][ T5892] iuu_phoenix 2-1:0.0: iuu_phoenix converter detected [ 342.225548][ T8486] sctp: failed to load transform for md5: -4 [ 342.257747][ T5892] usb 2-1: iuu_phoenix converter now attached to ttyUSB0 [ 343.472069][ T8501] xt_bpf: check failed: parse error [ 343.478844][ T8501] overlayfs: failed to resolve './file1/file0': -2 [ 343.495667][ T5922] usb 2-1: USB disconnect, device number 10 [ 343.592189][ T5922] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 343.613439][ T5922] iuu_phoenix 2-1:0.0: device disconnected [ 343.670173][ T8510] bond_slave_0: entered promiscuous mode [ 343.675949][ T8510] bond_slave_1: entered promiscuous mode [ 343.737238][ T8510] vlan2: entered promiscuous mode [ 343.764898][ T8510] bond0: entered promiscuous mode [ 343.868859][ T8517] netlink: 'syz.3.696': attribute type 11 has an invalid length. [ 343.887746][ T8517] netlink: 'syz.3.696': attribute type 11 has an invalid length. [ 343.904481][ T8517] netlink: 224 bytes leftover after parsing attributes in process `syz.3.696'. [ 344.727155][ T8524] binder: 8523:8524 ioctl 400c620e 200000000000 returned -22 [ 344.898904][ T8527] xt_hashlimit: max too large, truncated to 1048576 [ 346.516996][ T8543] nbd: socks must be embedded in a SOCK_ITEM attr [ 346.527249][ T8543] block nbd0: shutting down sockets [ 347.427703][ T8548] loop9: detected capacity change from 0 to 7 [ 347.442829][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 347.450960][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 347.561074][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 347.571904][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 347.579913][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 347.590802][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 348.274336][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 348.284653][ T8548] ldm_validate_partition_table(): Disk read failed. [ 348.291340][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 348.300655][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 348.310690][ T8548] Buffer I/O error on dev loop9, logical block 0, async page read [ 348.320496][ T8548] Dev loop9: unable to read RDB block 0 [ 348.329996][ T8548] loop9: unable to read partition table [ 348.337441][ T8548] loop9: partition table beyond EOD, truncated [ 348.364641][ T8548] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 348.364641][ T8548] ) failed (rc=-5) [ 348.859423][ T8561] syz.0.709: attempt to access beyond end of device [ 348.859423][ T8561] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 351.484247][ T8570] netlink: 60 bytes leftover after parsing attributes in process `syz.0.709'. [ 352.817866][ T8587] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 353.047448][ T8592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.717'. [ 353.057472][ T8592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.717'. [ 353.866243][ T8594] netlink: 92 bytes leftover after parsing attributes in process `syz.1.718'. [ 353.875526][ T8594] netlink: 24 bytes leftover after parsing attributes in process `syz.1.718'. [ 353.884471][ T8594] netlink: 24 bytes leftover after parsing attributes in process `syz.1.718'. [ 354.083054][ T8601] netlink: 'syz.1.722': attribute type 10 has an invalid length. [ 354.154845][ T8601] syz_tun: entered promiscuous mode [ 354.187253][ T8601] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 354.382002][ T5900] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 354.466382][ T8612] overlayfs: failed to decode file handle (len=6, type=251, flags=0, err=-22) [ 355.464375][ T5900] usb 5-1: Using ep0 maxpacket: 8 [ 355.560988][ T5900] usb 5-1: unable to get BOS descriptor or descriptor too short [ 356.192916][ T5900] usb 5-1: config 4 interface 0 has no altsetting 0 [ 356.213681][ T5900] usb 5-1: string descriptor 0 read error: -22 [ 356.220384][ T5900] usb 5-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 356.298286][ T5900] usb 5-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 356.460841][ T5900] usb 5-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 357.269909][ T5900] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 357.465287][ T5900] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 358.148797][ T5900] usb 5-1: media controller created [ 358.281598][ T5953] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 358.461684][ T5900] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 358.498295][ T5953] usb 1-1: config 0 has no interfaces? [ 358.506083][ T5953] usb 1-1: New USB device found, idVendor=056a, idProduct=0045, bcdDevice= 0.00 [ 358.542889][ T5900] zl10353_read_register: readreg error (reg=127, ret==0) [ 358.545371][ T5953] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.029127][ T5953] usb 1-1: config 0 descriptor?? [ 359.083741][ T5900] usb 5-1: USB disconnect, device number 19 [ 359.210093][ T8640] netlink: 4 bytes leftover after parsing attributes in process `syz.4.734'. [ 359.261234][ T8627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.285868][ T5922] usb 1-1: USB disconnect, device number 13 [ 359.322137][ T8627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.460059][ T8646] xt_bpf: check failed: parse error [ 359.475414][ T8646] overlayfs: failed to resolve './file1/file0': -2 [ 361.169638][ T8666] netlink: 268 bytes leftover after parsing attributes in process `syz.3.740'. [ 361.179659][ T8666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.740'. [ 361.970746][ T8671] fuse: Bad value for 'user_id' [ 361.976354][ T8671] fuse: Bad value for 'user_id' [ 362.103183][ T8672] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 363.224457][ T8686] netlink: 8 bytes leftover after parsing attributes in process `syz.1.746'. [ 363.660154][ T8687] xt_TPROXY: Can be used only with -p tcp or -p udp [ 363.866174][ T8691] netlink: 4 bytes leftover after parsing attributes in process `syz.1.748'. [ 364.054348][ T8697] syz.1.752: attempt to access beyond end of device [ 364.054348][ T8697] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 364.129021][ T8700] netlink: 60 bytes leftover after parsing attributes in process `syz.1.752'. [ 366.825540][ T8722] xt_CT: You must specify a L4 protocol and not use inversions on it [ 368.952048][ T8733] fuse: Bad value for 'user_id' [ 369.201474][ T8733] fuse: Bad value for 'user_id' [ 369.584302][ T8738] netlink: 4268 bytes leftover after parsing attributes in process `syz.0.761'. [ 370.706132][ T8733] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 370.868484][ T8746] netlink: 4 bytes leftover after parsing attributes in process `syz.1.762'. [ 371.666862][ T8760] netlink: 24 bytes leftover after parsing attributes in process `syz.0.769'. [ 372.183724][ T8766] tmpfs: Bad value for 'mpol' [ 372.191383][ T8766] tmpfs: Bad value for 'mpol' [ 372.471146][ T8778] netlink: 5128 bytes leftover after parsing attributes in process `syz.4.770'. [ 372.481046][ T8778] netlink: 5128 bytes leftover after parsing attributes in process `syz.4.770'. [ 372.490221][ T8778] netlink: 640 bytes leftover after parsing attributes in process `syz.4.770'. [ 372.499901][ T8756] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 372.508646][ T8756] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 372.515318][ T8756] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 372.534539][ T8756] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 373.138060][ T8781] netlink: 12 bytes leftover after parsing attributes in process `syz.0.772'. [ 374.316376][ T5841] Bluetooth: hci0: command 0x0c1a tx timeout [ 374.322771][ T8756] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 374.447714][ T8796] random: crng reseeded on system resumption [ 374.551976][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 374.558111][ T5842] Bluetooth: hci1: command 0x0406 tx timeout [ 374.558139][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 375.912258][ T8814] netlink: 4 bytes leftover after parsing attributes in process `syz.2.778'. [ 376.391917][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 377.340950][ T8839] --map-set only usable from mangle table [ 378.593220][ T24] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 379.012896][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.651943][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 379.947066][ T24] usb 2-1: device descriptor read/all, error -71 [ 379.960762][ T8855] netlink: 5128 bytes leftover after parsing attributes in process `syz.3.786'. [ 379.970693][ T8855] netlink: 5128 bytes leftover after parsing attributes in process `syz.3.786'. [ 379.979973][ T8855] netlink: 640 bytes leftover after parsing attributes in process `syz.3.786'. [ 380.261907][ T5907] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 380.275976][ T8862] ptm ptm1: ldisc open failed (-12), clearing slot 1 [ 380.939483][ T5907] usb 1-1: Using ep0 maxpacket: 32 [ 380.952883][ T5907] usb 1-1: config 0 has an invalid interface number: 169 but max is 0 [ 380.982330][ T5907] usb 1-1: config 0 has no interface number 0 [ 381.001678][ T5907] usb 1-1: config 0 interface 169 has no altsetting 0 [ 381.039723][ T5907] usb 1-1: New USB device found, idVendor=0781, idProduct=0001, bcdDevice= 2.00 [ 381.070225][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.096175][ T5907] usb 1-1: Product: syz [ 381.100471][ T5907] usb 1-1: Manufacturer: syz [ 381.124850][ T5907] usb 1-1: SerialNumber: syz [ 381.127574][ T8868] XFS (nullb0): Invalid superblock magic number [ 381.136213][ T5907] usb 1-1: config 0 descriptor?? [ 382.040995][ T8885] netlink: 24 bytes leftover after parsing attributes in process `syz.1.793'. [ 383.175372][ T8901] binder: BINDER_SET_CONTEXT_MGR already set [ 383.181491][ T8901] binder: 8900:8901 ioctl 4018620d 2000000000c0 returned -16 [ 384.511483][ T5907] usb-storage 1-1:0.169: USB Mass Storage device detected [ 384.565202][ T5907] usb-storage 1-1:0.169: Quirks match for vid 0781 pid 0001: 1 [ 384.744408][ T5907] usb 1-1: USB disconnect, device number 14 [ 385.104534][ T8915] No control pipe specified [ 385.417811][ T8917] netlink: 'syz.2.799': attribute type 10 has an invalid length. [ 385.448554][ T8917] netlink: 40 bytes leftover after parsing attributes in process `syz.2.799'. [ 385.492455][ T8917] team0: entered promiscuous mode [ 385.497518][ T8917] team_slave_0: entered promiscuous mode [ 385.503468][ T8917] team_slave_1: entered promiscuous mode [ 385.509293][ T8917] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 385.516792][ T8917] team0: entered allmulticast mode [ 385.522644][ T8917] team_slave_0: entered allmulticast mode [ 385.557423][ T8917] team_slave_1: entered allmulticast mode [ 385.572095][ T8917] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 385.591963][ T8917] bridge0: port 3(team0) entered blocking state [ 385.598551][ T8917] bridge0: port 3(team0) entered disabled state [ 385.613760][ T8917] bridge0: port 3(team0) entered blocking state [ 385.620499][ T8917] bridge0: port 3(team0) entered forwarding state [ 386.932673][ T8933] binder: BINDER_SET_CONTEXT_MGR already set [ 386.938717][ T8933] binder: 8931:8933 ioctl 4018620d 200000000040 returned -16 [ 388.407713][ T8946] netlink: 148 bytes leftover after parsing attributes in process `syz.4.809'. [ 388.451704][ T8946] netlink: 40 bytes leftover after parsing attributes in process `syz.4.809'. [ 388.592536][ T8953] netlink: 5128 bytes leftover after parsing attributes in process `syz.0.808'. [ 388.601996][ T8953] netlink: 5128 bytes leftover after parsing attributes in process `syz.0.808'. [ 388.611101][ T8953] netlink: 640 bytes leftover after parsing attributes in process `syz.0.808'. [ 388.713932][ T5907] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 388.778297][ T8954] [U]  [ 388.842048][ T43] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 388.893776][ T5907] usb 5-1: unable to get BOS descriptor or descriptor too short [ 388.913933][ T5907] usb 5-1: config 1 has an invalid interface number: 83 but max is 0 [ 388.931719][ T5907] usb 5-1: config 1 has no interface number 0 [ 388.946453][ T5907] usb 5-1: config 1 interface 83 altsetting 4 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 388.976926][ T5907] usb 5-1: config 1 interface 83 has no altsetting 0 [ 389.007188][ T5907] usb 5-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=a2.c5 [ 389.021795][ T5907] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.041045][ T5907] usb 5-1: Product: syz [ 389.050826][ T5907] usb 5-1: Manufacturer: syz [ 389.069553][ T5907] usb 5-1: SerialNumber: syz [ 389.181645][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 389.209266][ T43] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 389.218611][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.244367][ T43] usb 4-1: Product: syz [ 389.248670][ T43] usb 4-1: Manufacturer: syz [ 389.274321][ T43] usb 4-1: SerialNumber: syz [ 389.302581][ T43] usb 4-1: config 0 descriptor?? [ 389.314009][ T43] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 389.329880][ T5907] usb 5-1: probing VID:PID(2201:012C) [ 389.340851][ T43] usb 4-1: setting power ON [ 389.355494][ T5907] usb 5-1: vub300 testing UNKNOWN EndPoint(0) 08 [ 389.366356][ T43] dvb-usb: bulk message failed: -22 (2/0) [ 389.373664][ T5907] usb 5-1: vub300 ignoring EndPoint(0) 08 [ 389.398457][ T5907] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs [ 389.408056][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 389.443551][ T43] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 389.463386][ T5907] vub300 5-1:1.83: probe with driver vub300 failed with error -22 [ 389.472119][ T43] usb 4-1: media controller created [ 389.502128][ T5907] usb 5-1: USB disconnect, device number 20 [ 389.604248][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 389.702400][ T43] usb 4-1: selecting invalid altsetting 6 [ 389.708412][ T43] usb 4-1: digital interface selection failed (-22) [ 389.731709][ T43] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 389.761961][ T43] usb 4-1: setting power OFF [ 389.767020][ T43] dvb-usb: bulk message failed: -22 (2/0) [ 389.791573][ T43] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 389.800925][ T43] (NULL device *): no alternate interface [ 389.977120][ T43] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 390.484359][ T5892] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 390.597556][ T43] usb 4-1: USB disconnect, device number 11 [ 390.751818][ T5892] usb 3-1: Using ep0 maxpacket: 32 [ 390.779069][ T5892] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 390.829075][ T30] audit: type=1326 audit(1755807093.912:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb2beb8ebe9 code=0x7ffc0000 [ 390.869254][ T5892] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 390.890023][ T30] audit: type=1326 audit(1755807093.912:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb2beb8ebe9 code=0x7ffc0000 [ 390.923341][ T30] audit: type=1326 audit(1755807093.912:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb2beb8ebe9 code=0x7ffc0000 [ 390.951661][ T5892] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 391.036711][ T8983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.816'. [ 391.108168][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.534001][ T30] audit: type=1326 audit(1755807093.912:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb2beb8ebe9 code=0x7ffc0000 [ 391.555432][ T30] audit: type=1326 audit(1755807093.912:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb2beb8ebe9 code=0x7ffc0000 [ 391.573320][ T5892] usb 3-1: config 0 descriptor?? [ 391.614030][ T5892] hub 3-1:0.0: USB hub found [ 391.663509][ T30] audit: type=1326 audit(1755807093.952:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb2beb8d550 code=0x7ffc0000 [ 391.685952][ T30] audit: type=1326 audit(1755807093.952:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7fb2beb90417 code=0x7ffc0000 [ 391.782451][ T30] audit: type=1326 audit(1755807093.952:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb2beb8ebe9 code=0x7ffc0000 [ 391.880929][ T5892] hub 3-1:0.0: 2 ports detected [ 392.282773][ T30] audit: type=1326 audit(1755807093.952:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7fb2beb90417 code=0x7ffc0000 [ 392.489507][ T30] audit: type=1326 audit(1755807093.952:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8973 comm="syz.3.818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fb2beb8d84a code=0x7ffc0000 [ 393.129550][ T5892] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 393.171954][ T5892] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 393.236183][ T5953] libceph: connect (1)[c::]:6789 error -101 [ 393.245676][ T6007] libceph: connect (1)[c::]:6789 error -101 [ 393.256682][ T43] libceph: connect (1)[c::]:6789 error -101 [ 393.277416][ T5953] libceph: mon0 (1)[c::]:6789 connect error [ 393.285283][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 393.301925][ T5892] usbhid 3-1:0.0: can't add hid device: -71 [ 393.383368][ T6007] libceph: mon0 (1)[c::]:6789 connect error [ 393.414197][ T9001] ceph: No mds server is up or the cluster is laggy [ 393.423049][ T5892] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 393.442679][ T8999] ceph: No mds server is up or the cluster is laggy [ 394.196397][ T9015] fuse: Bad value for 'user_id' [ 394.201335][ T9015] fuse: Bad value for 'user_id' [ 394.275716][ T6007] libceph: connect (1)[c::]:6789 error -101 [ 394.286458][ T9015] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 394.489530][ T9003] ceph: No mds server is up or the cluster is laggy [ 394.536340][ T6007] libceph: mon0 (1)[c::]:6789 connect error [ 394.544009][ T5953] libceph: connect (1)[c::]:6789 error -101 [ 394.550083][ T5953] libceph: mon0 (1)[c::]:6789 connect error [ 394.556664][ T43] libceph: connect (1)[c::]:6789 error -101 [ 394.566853][ T5892] usb 3-1: USB disconnect, device number 11 [ 394.602041][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 394.679520][ T9019] netlink: 12 bytes leftover after parsing attributes in process `syz.2.827'. [ 395.500078][ T24] libceph: connect (1)[c::]:6789 error -101 [ 395.514100][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 395.523973][ T24] libceph: connect (1)[c::]:6789 error -101 [ 395.533267][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 396.362850][ T9033] netlink: 'syz.2.831': attribute type 1 has an invalid length. [ 397.130838][ T9044] netlink: 8 bytes leftover after parsing attributes in process `syz.4.833'. [ 397.519635][ T9050] netlink: 5128 bytes leftover after parsing attributes in process `syz.3.832'. [ 397.530190][ T9050] netlink: 5128 bytes leftover after parsing attributes in process `syz.3.832'. [ 397.539345][ T9050] netlink: 640 bytes leftover after parsing attributes in process `syz.3.832'. [ 400.080464][ T9068] syz.2.839: attempt to access beyond end of device [ 400.080464][ T9068] nbd2: rw=0, sector=0, nr_sectors = 2 limit=0 [ 400.349108][ T9070] netlink: 60 bytes leftover after parsing attributes in process `syz.2.839'. [ 405.688991][ T9112] syzkaller0: entered promiscuous mode [ 405.695227][ T9112] syzkaller0: entered allmulticast mode [ 409.430716][ T9] libceph: connect (1)[c::]:6789 error -101 [ 409.486996][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 409.517884][ T5907] libceph: connect (1)[c::]:6789 error -101 [ 409.533590][ T5907] libceph: mon0 (1)[c::]:6789 connect error [ 409.562729][ T5907] libceph: connect (1)[c::]:6789 error -101 [ 409.568994][ T5907] libceph: mon0 (1)[c::]:6789 connect error [ 409.814689][ T9150] netlink: 'syz.3.861': attribute type 10 has an invalid length. [ 409.842153][ T5907] libceph: connect (1)[c::]:6789 error -101 [ 409.848601][ T5907] libceph: mon0 (1)[c::]:6789 connect error [ 409.855408][ T9] libceph: connect (1)[c::]:6789 error -101 [ 409.861899][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 409.893667][ T9] libceph: connect (1)[c::]:6789 error -101 [ 410.231635][ T9134] ceph: No mds server is up or the cluster is laggy [ 410.271033][ T9138] ceph: No mds server is up or the cluster is laggy [ 410.321833][ T9141] ceph: No mds server is up or the cluster is laggy [ 410.375777][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 410.714555][ T9159] fuse: Bad value for 'user_id' [ 410.719595][ T9159] fuse: Bad value for 'user_id' [ 410.808614][ T9160] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 414.016822][ T9187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.871'. [ 414.791771][ T9189] syz.0.869: attempt to access beyond end of device [ 414.791771][ T9189] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 414.928911][ T9192] netlink: 60 bytes leftover after parsing attributes in process `syz.0.869'. [ 415.162364][ T9194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.872'. [ 415.173710][ T9194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.872'. [ 416.183817][ T9211] netlink: 'syz.2.876': attribute type 4 has an invalid length. [ 416.241732][ T9213] netlink: 'syz.2.876': attribute type 4 has an invalid length. [ 418.006354][ T9237] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 418.813554][ T5907] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 419.040701][ T5900] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 419.226700][ T5907] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 419.254708][ T5900] usb 5-1: Using ep0 maxpacket: 32 [ 419.282204][ T5907] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 419.304651][ T5900] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 419.348141][ T9251] xt_bpf: check failed: parse error [ 419.354968][ T9251] overlayfs: failed to resolve './file1/file0': -2 [ 419.362092][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 419.387200][ T5900] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 419.428319][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 419.438684][ T5900] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 419.455115][ T5907] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 419.468861][ T5900] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.513522][ T5900] usb 5-1: config 0 descriptor?? [ 419.522256][ T5907] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 419.533171][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.541354][ T5907] usb 2-1: Product: syz [ 419.552878][ T5900] hub 5-1:0.0: USB hub found [ 419.560499][ T5907] usb 2-1: Manufacturer: syz [ 419.575332][ T5907] usb 2-1: SerialNumber: syz [ 419.610350][ T5907] usb 2-1: config 0 descriptor?? [ 419.630179][ T5907] garmin_gps 2-1:0.0: Garmin GPS usb/tty converter detected [ 419.656216][ T5907] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 419.679242][ T5907] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 419.874007][ T5900] hub 5-1:0.0: 2 ports detected [ 419.909955][ T9025] usb 2-1: USB disconnect, device number 13 [ 419.928708][ T9025] garmin_gps 2-1:0.0: device disconnected [ 420.035604][ T9259] FAULT_INJECTION: forcing a failure. [ 420.035604][ T9259] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 420.048896][ T9259] CPU: 1 UID: 0 PID: 9259 Comm: syz.3.888 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 420.048921][ T9259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 420.048942][ T9259] Call Trace: [ 420.048954][ T9259] [ 420.048964][ T9259] dump_stack_lvl+0x189/0x250 [ 420.048991][ T9259] ? irqentry_exit+0x74/0x90 [ 420.049014][ T9259] ? __pfx_dump_stack_lvl+0x10/0x10 [ 420.049067][ T9259] should_fail_ex+0x414/0x560 [ 420.049093][ T9259] _copy_from_user+0x2d/0xb0 [ 420.049121][ T9259] do_sock_getsockopt+0x17d/0x450 [ 420.049148][ T9259] ? lockdep_hardirqs_on+0x9c/0x150 [ 420.049170][ T9259] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 420.049211][ T9259] __x64_sys_getsockopt+0x1a5/0x250 [ 420.049250][ T9259] do_syscall_64+0xfa/0x3b0 [ 420.049273][ T9259] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.049291][ T9259] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 420.049309][ T9259] ? clear_bhb_loop+0x60/0xb0 [ 420.049332][ T9259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.049351][ T9259] RIP: 0033:0x7fb2beb8ebe9 [ 420.049369][ T9259] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 420.049386][ T9259] RSP: 002b:00007fb2bfa9c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 420.049408][ T9259] RAX: ffffffffffffffda RBX: 00007fb2bedb6180 RCX: 00007fb2beb8ebe9 [ 420.049423][ T9259] RDX: 000000000000007d RSI: 0000000000000084 RDI: 0000000000000006 [ 420.049435][ T9259] RBP: 00007fb2bfa9c090 R08: 00002000000007c0 R09: 0000000000000000 [ 420.049448][ T9259] R10: 0000200000000700 R11: 0000000000000246 R12: 0000000000000001 [ 420.049461][ T9259] R13: 00007fb2bedb6218 R14: 00007fb2bedb6180 R15: 00007ffe5e748db8 [ 420.049492][ T9259] [ 420.564178][ T9263] team_slave_0: entered promiscuous mode [ 420.569956][ T9263] team_slave_1: entered promiscuous mode [ 420.610606][ T9263] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 420.623512][ T9263] team0: Device macvtap1 is already an upper device of the team interface [ 420.637145][ T9263] team_slave_0: left promiscuous mode [ 420.642746][ T9263] team_slave_1: left promiscuous mode [ 420.955146][ T5900] hub 5-1:0.0: hub_hub_status failed (err = -32) [ 420.975338][ T5900] hub 5-1:0.0: config failed, can't get hub status (err -32) [ 421.016409][ T5900] usbhid 5-1:0.0: can't add hid device: -32 [ 421.039967][ T5900] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 421.151764][ T5907] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 421.313991][ T5907] usb 1-1: config 0 has an invalid interface number: 216 but max is 0 [ 421.337827][ T5907] usb 1-1: config 0 has no interface number 0 [ 421.549091][ T5907] usb 1-1: config 0 interface 216 altsetting 4 bulk endpoint 0x8F has invalid maxpacket 64 [ 421.930909][ T9025] usb 5-1: USB disconnect, device number 21 [ 421.933049][ T5907] usb 1-1: config 0 interface 216 altsetting 4 endpoint 0x1 has invalid wMaxPacketSize 0 [ 421.970662][ T5907] usb 1-1: config 0 interface 216 has no altsetting 0 [ 421.994363][ T5907] usb 1-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=c1.2e [ 422.025585][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.074383][ T5907] usb 1-1: config 0 descriptor?? [ 422.090520][ T9273] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 422.109648][ T5907] usb 1-1: NFC: intf ffff888029d9e000 id ffffffff8eb3fac0 [ 422.983565][ T5907] usb 1-1: USB disconnect, device number 15 [ 425.898926][ T9326] o2cb: This node has not been configured. [ 425.905378][ T9326] o2cb: Cluster check failed. Fix errors before retrying. [ 425.914229][ T9326] (syz.2.907,9326,0):user_dlm_register:674 ERROR: status = -22 [ 425.922163][ T9326] (syz.2.907,9326,0):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "bus" [ 427.999747][ T9025] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 428.151893][ T9025] usb 3-1: Using ep0 maxpacket: 16 [ 428.252434][ T9327] random: crng reseeded on system resumption [ 428.289838][ T9025] usb 3-1: unable to get BOS descriptor or descriptor too short [ 428.299337][ T9025] usb 3-1: config 7 interface 0 has no altsetting 0 [ 428.310052][ T9025] usb 3-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice=8f.26 [ 428.320134][ T9025] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.328963][ T9025] usb 3-1: Product: syz [ 428.338053][ T9025] usb 3-1: Manufacturer: syz [ 428.351383][ T9025] usb 3-1: SerialNumber: syz [ 430.085728][ T9025] usb 3-1: USB disconnect, device number 12 [ 430.513353][ T9386] tmpfs: Unknown parameter 'quot' [ 430.520707][ T9386] syz.2.922: attempt to access beyond end of device [ 430.520707][ T9386] nbd2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 430.534320][ T9386] SQUASHFS error: Failed to read block 0x0: -5 [ 430.540563][ T9386] unable to read squashfs_super_block [ 431.679066][ T9377] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 431.687107][ T9377] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 431.694718][ T9377] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 431.702326][ T9377] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 432.542170][ T5900] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 432.801881][ T5900] usb 1-1: Invalid ep0 maxpacket: 64 [ 433.051530][ T5900] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 433.431708][ T5841] Bluetooth: hci0: command 0x0c1a tx timeout [ 433.437906][ T9380] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 433.502552][ T5900] usb 1-1: Invalid ep0 maxpacket: 64 [ 433.514381][ T5900] usb usb1-port1: attempt power cycle [ 433.652384][ T9424] xt_TPROXY: Can be used only with -p tcp or -p udp [ 434.273299][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 434.273329][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 434.285794][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 434.371766][ T5907] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 434.562205][ T5900] usb 1-1: new low-speed USB device number 18 using dummy_hcd [ 434.598532][ T5900] usb 1-1: Invalid ep0 maxpacket: 64 [ 434.656003][ T5907] usb 4-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 434.680678][ T5907] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 434.711117][ T5907] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 434.720382][ T9433] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 434.740770][ T5900] usb 1-1: new low-speed USB device number 19 using dummy_hcd [ 434.743718][ T24] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 434.752259][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.766691][ T5900] usb 1-1: Invalid ep0 maxpacket: 64 [ 434.772808][ T5900] usb usb1-port1: unable to enumerate USB device [ 434.805396][ T5907] aiptek 4-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 435.043891][ T24] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 435.486378][ T9439] netlink: 'syz.2.938': attribute type 11 has an invalid length. [ 435.512566][ T9439] netlink: 'syz.2.938': attribute type 11 has an invalid length. [ 435.512864][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 435.528477][ T9439] netlink: 224 bytes leftover after parsing attributes in process `syz.2.938'. [ 436.477248][ T9455] netlink: 92 bytes leftover after parsing attributes in process `syz.0.942'. [ 436.531454][ T5907] usb 4-1: USB disconnect, device number 12 [ 437.405153][ T9462] netlink: 8 bytes leftover after parsing attributes in process `syz.1.945'. [ 440.213596][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.537803][ T9487] uprobe: syz.4.951:9487 failed to unregister, leaking uprobe [ 442.458469][ T9517] netlink: 340 bytes leftover after parsing attributes in process `syz.4.959'. [ 442.524604][ T9517] netlink: 48 bytes leftover after parsing attributes in process `syz.4.959'. [ 442.644093][ T9521] netlink: 4 bytes leftover after parsing attributes in process `syz.1.957'. [ 442.654184][ T9521] netlink: 4268 bytes leftover after parsing attributes in process `syz.1.957'. [ 442.982113][ T5892] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 443.315840][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.539465][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 443.597198][ T5892] usb 1-1: New USB device found, idVendor=04e7, idProduct=0030, bcdDevice= 0.00 [ 443.606523][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.625962][ T5892] usb 1-1: config 0 descriptor?? [ 444.780636][ T9520] netlink: 8 bytes leftover after parsing attributes in process `syz.0.960'. [ 445.334897][ T5892] elo 0003:04E7:0030.0006: item fetching failed at offset 5/7 [ 445.350462][ T5892] elo 0003:04E7:0030.0006: parse failed [ 445.405858][ T5892] elo 0003:04E7:0030.0006: probe with driver elo failed with error -22 [ 445.544908][ T9542] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 445.559084][ T5900] usb 1-1: USB disconnect, device number 20 [ 446.522288][ T9561] syz.2.969: attempt to access beyond end of device [ 446.522288][ T9561] nbd2: rw=0, sector=0, nr_sectors = 2 limit=0 [ 446.548377][ T9564] netlink: 4528 bytes leftover after parsing attributes in process `syz.4.971'. [ 446.560982][ T9564] netlink: 8 bytes leftover after parsing attributes in process `syz.4.971'. [ 446.570389][ T9564] netlink: 4528 bytes leftover after parsing attributes in process `syz.4.971'. [ 446.615892][ T9566] netlink: 60 bytes leftover after parsing attributes in process `syz.2.969'. [ 446.842587][ T9571] random: crng reseeded on system resumption [ 447.758781][ T9582] netlink: 5128 bytes leftover after parsing attributes in process `syz.1.968'. [ 447.768202][ T9582] netlink: 5128 bytes leftover after parsing attributes in process `syz.1.968'. [ 447.777371][ T9582] netlink: 640 bytes leftover after parsing attributes in process `syz.1.968'. [ 448.307387][ T9587] binder: 9584:9587 ioctl 400c620e 200000000000 returned -22 [ 448.714865][ T9589] xt_CT: You must specify a L4 protocol and not use inversions on it [ 448.798100][ T9591] netlink: 144 bytes leftover after parsing attributes in process `syz.3.976'. [ 449.527624][ T9593] netlink: 180 bytes leftover after parsing attributes in process `syz.3.978'. [ 449.623051][ T9596] netlink: 8 bytes leftover after parsing attributes in process `syz.1.979'. [ 450.431614][ T5922] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 450.591589][ T5922] usb 4-1: Using ep0 maxpacket: 16 [ 450.605081][ T5922] usb 4-1: no configurations [ 450.613134][ T5922] usb 4-1: can't read configurations, error -22 [ 450.791734][ T5922] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 450.956290][ T5922] usb 4-1: Using ep0 maxpacket: 16 [ 450.972273][ T5922] usb 4-1: no configurations [ 451.029463][ T5922] usb 4-1: can't read configurations, error -22 [ 451.681794][ T5922] usb usb4-port1: attempt power cycle [ 452.181600][ T5922] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 452.212307][ T5922] usb 4-1: Using ep0 maxpacket: 16 [ 452.220369][ T5922] usb 4-1: no configurations [ 452.911590][ T5922] usb 4-1: can't read configurations, error -22 [ 453.511792][ T5900] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 453.542755][ T9632] netlink: 5128 bytes leftover after parsing attributes in process `syz.4.987'. [ 453.552010][ T9632] netlink: 5128 bytes leftover after parsing attributes in process `syz.4.987'. [ 453.561272][ T9632] netlink: 640 bytes leftover after parsing attributes in process `syz.4.987'. [ 453.824511][ T9631] netlink: 8 bytes leftover after parsing attributes in process `syz.1.991'. [ 454.293591][ T5900] usb 3-1: Using ep0 maxpacket: 16 [ 454.329794][ T5900] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 454.357206][ T5900] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 454.390775][ T5900] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 454.404983][ T5900] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 455.349391][ T9642] fuse: Bad value for 'user_id' [ 455.355359][ T9642] fuse: Bad value for 'user_id' [ 455.477575][ T9645] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 455.896262][ T5900] usb 3-1: string descriptor 0 read error: -71 [ 455.955074][ T5900] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 456.139256][ T9646] syz.3.994: attempt to access beyond end of device [ 456.139256][ T9646] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 456.389556][ T5900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 456.544446][ T9656] binder: BINDER_SET_CONTEXT_MGR already set [ 456.550609][ T9656] binder: 9648:9656 ioctl 4018620d 200000000040 returned -16 [ 457.074449][ T43] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 457.131173][ T5900] usb 3-1: can't set config #1, error -71 [ 457.167438][ T9658] netlink: 60 bytes leftover after parsing attributes in process `syz.3.994'. [ 457.189703][ T5900] usb 3-1: USB disconnect, device number 13 [ 457.281989][ T43] usb 1-1: Using ep0 maxpacket: 8 [ 457.299333][ T43] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 457.346030][ T9662] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1000'. [ 457.411626][ T43] usb 1-1: config 0 has no interface number 1 [ 457.725576][ T43] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 457.753325][ T43] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 457.773917][ T43] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 457.786239][ T43] usb 1-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 457.797264][ T43] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 457.797314][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 457.797339][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 457.810006][ T43] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 457.843452][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.852552][ T43] usb 1-1: Product: syz [ 457.856786][ T43] usb 1-1: Manufacturer: syz [ 457.861450][ T43] usb 1-1: SerialNumber: syz [ 457.940174][ T9669] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1003'. [ 458.021867][ T24] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 458.394030][ T43] usb 1-1: config 0 descriptor?? [ 458.399963][ T9653] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 458.414749][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 458.443810][ T43] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 458.451660][ T24] usb 5-1: no configurations [ 458.457298][ T24] usb 5-1: can't read configurations, error -22 [ 458.495993][ T43] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 458.534416][ T43] usb 1-1: invalid MIDI in EP 0 [ 458.631629][ T24] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 458.827084][ T43] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 458.837138][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 458.858638][ T24] usb 5-1: no configurations [ 458.876488][ T43] usb 1-1: USB disconnect, device number 21 [ 458.884625][ T24] usb 5-1: can't read configurations, error -22 [ 458.917146][ T9678] xt_CT: You must specify a L4 protocol and not use inversions on it [ 458.921306][ T24] usb usb5-port1: attempt power cycle [ 459.083906][ T9683] udevd[9683]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 459.421916][ T24] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 459.466177][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 459.575727][ T24] usb 5-1: no configurations [ 459.580822][ T24] usb 5-1: can't read configurations, error -22 [ 460.386895][ T24] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 460.412447][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 460.418945][ T24] usb 5-1: no configurations [ 460.440202][ T9695] bridge_slave_0: left allmulticast mode [ 460.454728][ T24] usb 5-1: can't read configurations, error -22 [ 460.484033][ T9695] bridge_slave_0: left promiscuous mode [ 460.513080][ T24] usb usb5-port1: unable to enumerate USB device [ 460.543800][ T9695] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.588026][ T9695] bridge_slave_1: left allmulticast mode [ 460.588054][ T9695] bridge_slave_1: left promiscuous mode [ 460.590348][ T9695] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.625210][ T9695] bond0: (slave bond_slave_0): Releasing backup interface [ 460.626661][ T9695] bond_slave_0: left promiscuous mode [ 460.647671][ T9695] bond0: (slave bond_slave_1): Releasing backup interface [ 460.655492][ T9695] bond_slave_1: left promiscuous mode [ 460.763364][ T9695] team0: Port device team_slave_0 removed [ 460.800034][ T9695] team0: Port device team_slave_1 removed [ 461.324713][ T9695] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 461.344012][ T9695] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 461.411213][ T9695] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 461.441623][ T9695] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 461.558505][ T9711] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1015'. [ 462.671588][ T5900] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 463.718951][ T5900] usb 5-1: unable to get BOS descriptor or descriptor too short [ 463.727792][ T5900] usb 5-1: not running at top speed; connect to a high speed hub [ 463.759789][ T5900] usb 5-1: config 4 has an invalid interface number: 32 but max is 0 [ 464.315378][ T5900] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 464.606058][ T5900] usb 5-1: config 4 has no interface number 0 [ 464.629643][ T5900] usb 5-1: string descriptor 0 read error: -71 [ 464.641450][ T5900] usb 5-1: New USB device found, idVendor=17dc, idProduct=0202, bcdDevice=f1.50 [ 464.656417][ T5900] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.690312][ T5900] usb 5-1: can't set config #4, error -71 [ 464.752889][ T5900] usb 5-1: USB disconnect, device number 26 [ 464.851663][ T24] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 464.960159][ T9738] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 465.328079][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 465.463740][ T24] usb 1-1: not running at top speed; connect to a high speed hub [ 465.529599][ T24] usb 1-1: config 3 has an invalid interface number: 69 but max is 0 [ 465.553264][ T24] usb 1-1: config 3 has no interface number 0 [ 465.564750][ T24] usb 1-1: config 3 interface 69 has no altsetting 0 [ 465.595561][ T24] usb 1-1: New USB device found, idVendor=19d2, idProduct=1096, bcdDevice=27.be [ 465.643089][ T9738] bond1: entered promiscuous mode [ 465.677407][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.686410][ T24] usb 1-1: Product: syz [ 465.689092][ T9738] bond1: entered allmulticast mode [ 465.690590][ T24] usb 1-1: Manufacturer: 믭བ괝崨笪ᯢ댖碯甪閮㮹椾냖㣋얲걦☧岓䅷Ṯ넥鞇૪圻꘺늧놯荦䅄늈⿯骶欨䎡鋕⎻辶뤑䂰뜗颐勸蠕닳戀ᛏ띬窳荱킷낺ᠷ⡩䥟跟ﹽ᳽꽿 [ 465.722892][ T24] usb 1-1: SerialNumber: syz [ 465.836235][ T9738] 8021q: adding VLAN 0 to HW filter on device bond1 [ 466.782898][ T24] option 1-1:3.69: GSM modem (1-port) converter detected [ 466.933892][ T9753] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1029'. [ 467.782842][ T24] usb 1-1: USB disconnect, device number 22 [ 467.796814][ T24] option 1-1:3.69: device disconnected [ 469.024180][ T5900] af_packet: tpacket_rcv: packet too big, clamped from 74 to 4294967286. macoff=82 [ 469.029083][ T9758] fuse: Bad value for 'user_id' [ 469.134019][ T9758] fuse: Bad value for 'user_id' [ 469.205663][ T9758] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. Connection to 10.128.1.203 closed by remote host. [ 470.487361][ T9624] bond0: (slave syz_tun): Releasing backup interface [ 470.498701][ T9624] syz_tun (unregistering): left promiscuous mode [ 470.817748][ T1140] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.910505][ T1140] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.987597][ T1140] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.086804][ T1140] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.568103][ T1140] bond0 (unregistering): Released all slaves [ 471.658469][ T1140] bond1 (unregistering): Released all slaves [ 471.974153][ T1140] hsr_slave_0: left promiscuous mode [ 471.993782][ T1140] veth1_macvtap: left promiscuous mode [ 471.999795][ T1140] veth0_macvtap: left promiscuous mode [ 472.006641][ T1140] veth1_vlan: left promiscuous mode [ 473.208802][ T1140] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.290443][ T1140] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.370086][ T1140] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.446576][ T1140] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.564509][ T1140] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.636538][ T1140] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.678787][ T1140] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.767019][ T1140] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.859476][ T1140] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.919359][ T1140] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.979552][ T1140] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.056060][ T1140] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.199423][ T1140] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.267377][ T1140] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.339770][ T1140] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.418009][ T1140] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.500145][ T1140] bridge0: port 3(team0) entered disabled state [ 474.509658][ T1140] bridge_slave_1: left allmulticast mode [ 474.515362][ T1140] bridge_slave_1: left promiscuous mode [ 474.521041][ T1140] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.530195][ T1140] bridge_slave_0: left allmulticast mode [ 474.536714][ T1140] bridge_slave_0: left promiscuous mode [ 474.542869][ T1140] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.554856][ T1140] bridge_slave_1: left allmulticast mode [ 474.560520][ T1140] bridge_slave_1: left promiscuous mode [ 474.566687][ T1140] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.575690][ T1140] bridge_slave_0: left allmulticast mode [ 474.581333][ T1140] bridge_slave_0: left promiscuous mode [ 474.587344][ T1140] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.597546][ T1140] bridge_slave_1: left allmulticast mode [ 474.603520][ T1140] bridge_slave_1: left promiscuous mode [ 474.609231][ T1140] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.618947][ T1140] bridge_slave_0: left allmulticast mode [ 474.624730][ T1140] bridge_slave_0: left promiscuous mode [ 474.630417][ T1140] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.644569][ T1140] bridge_slave_1: left allmulticast mode [ 474.650226][ T1140] bridge_slave_1: left promiscuous mode [ 474.656112][ T1140] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.665382][ T1140] bridge_slave_0: left allmulticast mode [ 474.671020][ T1140] bridge_slave_0: left promiscuous mode [ 474.676753][ T1140] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.909106][ T1140] bond3 (unregistering): (slave gretap1): Releasing active interface [ 475.115728][ T1140] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 475.124667][ T1140] bond_slave_0: left promiscuous mode [ 475.133841][ T1140] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 475.142843][ T1140] bond_slave_1: left promiscuous mode [ 475.150421][ T1140] bond0 (unregistering): Released all slaves [ 475.242637][ T1140] bond1 (unregistering): (slave dummy0): Releasing active interface [ 475.251326][ T1140] dummy0: left promiscuous mode [ 475.258316][ T1140] bond1 (unregistering): Released all slaves [ 475.347892][ T1140] bond2 (unregistering): Released all slaves [ 475.362457][ T1140] bond3 (unregistering): Released all slaves [ 475.376379][ T1140] bond4 (unregistering): Released all slaves [ 475.488093][ T1140] bond1 (unregistering): (slave gretap1): Releasing active interface [ 475.664924][ T1140] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 475.675550][ T1140] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 475.685460][ T1140] bond0 (unregistering): Released all slaves [ 475.699329][ T1140] bond1 (unregistering): Released all slaves [ 476.026695][ T1140] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.035791][ T1140] bond_slave_0: left promiscuous mode [ 476.044959][ T1140] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.054018][ T1140] bond_slave_1: left promiscuous mode [ 476.060284][ T1140] bond0 (unregistering): Released all slaves [ 476.443539][ T1140] [ 476.445875][ T1140] ====================================================== [ 476.452894][ T1140] WARNING: possible circular locking dependency detected [ 476.459918][ T1140] 6.16.0-syzkaller #0 Not tainted [ 476.464934][ T1140] ------------------------------------------------------ [ 476.471931][ T1140] kworker/u8:5/1140 is trying to acquire lock: [ 476.478078][ T1140] ffff888011464e00 (team->team_lock_key#4){+.+.}-{4:4}, at: team_del_slave+0x32/0x1c0 [ 476.487715][ T1140] [ 476.487715][ T1140] but task is already holding lock: [ 476.495164][ T1140] ffff888028c28768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 476.505506][ T1140] [ 476.505506][ T1140] which lock already depends on the new lock. [ 476.505506][ T1140] [ 476.516079][ T1140] [ 476.516079][ T1140] the existing dependency chain (in reverse order) is: [ 476.525083][ T1140] [ 476.525083][ T1140] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 476.532801][ T1140] lock_acquire+0x120/0x360 [ 476.537807][ T1140] __mutex_lock+0x182/0xe80 [ 476.542811][ T1140] ieee80211_open+0xed/0x1f0 [ 476.547905][ T1140] __dev_open+0x470/0x880 [ 476.552754][ T1140] netif_open+0xaa/0x170 [ 476.557507][ T1140] dev_open+0x125/0x260 [ 476.562164][ T1140] team_add_slave+0xb36/0x2840 [ 476.567427][ T1140] do_set_master+0x530/0x6d0 [ 476.572531][ T1140] do_setlink+0xcf0/0x41c0 [ 476.577461][ T1140] rtnl_newlink+0x160b/0x1c70 [ 476.582651][ T1140] rtnetlink_rcv_msg+0x7cc/0xb70 [ 476.588101][ T1140] netlink_rcv_skb+0x205/0x470 [ 476.593370][ T1140] netlink_unicast+0x75c/0x8e0 [ 476.598633][ T1140] netlink_sendmsg+0x805/0xb30 [ 476.603937][ T1140] __sock_sendmsg+0x21c/0x270 [ 476.609119][ T1140] ____sys_sendmsg+0x505/0x830 [ 476.614389][ T1140] ___sys_sendmsg+0x21f/0x2a0 [ 476.619569][ T1140] __x64_sys_sendmsg+0x19b/0x260 [ 476.625009][ T1140] do_syscall_64+0xfa/0x3b0 [ 476.630074][ T1140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.636478][ T1140] [ 476.636478][ T1140] -> #0 (team->team_lock_key#4){+.+.}-{4:4}: [ 476.644626][ T1140] validate_chain+0xb9b/0x2140 [ 476.649892][ T1140] __lock_acquire+0xab9/0xd20 [ 476.655076][ T1140] lock_acquire+0x120/0x360 [ 476.660089][ T1140] __mutex_lock+0x182/0xe80 [ 476.665107][ T1140] team_del_slave+0x32/0x1c0 [ 476.670208][ T1140] team_device_event+0x285/0xa20 [ 476.675646][ T1140] notifier_call_chain+0x1b3/0x3e0 [ 476.681263][ T1140] unregister_netdevice_many_notify+0x15d8/0x2320 [ 476.688191][ T1140] unregister_netdevice_queue+0x33c/0x380 [ 476.694414][ T1140] _cfg80211_unregister_wdev+0x165/0x590 [ 476.700545][ T1140] ieee80211_remove_interfaces+0x49a/0x6d0 [ 476.706864][ T1140] ieee80211_unregister_hw+0x5d/0x2c0 [ 476.712754][ T1140] mac80211_hwsim_del_radio+0x275/0x460 [ 476.718993][ T1140] hwsim_exit_net+0x584/0x640 [ 476.724184][ T1140] ops_undo_list+0x497/0x990 [ 476.729286][ T1140] cleanup_net+0x4c5/0x800 [ 476.734206][ T1140] process_scheduled_works+0xade/0x17b0 [ 476.740342][ T1140] worker_thread+0x8a0/0xda0 [ 476.745432][ T1140] kthread+0x70e/0x8a0 [ 476.750010][ T1140] ret_from_fork+0x3fc/0x770 [ 476.755118][ T1140] ret_from_fork_asm+0x1a/0x30 [ 476.760389][ T1140] [ 476.760389][ T1140] other info that might help us debug this: [ 476.760389][ T1140] [ 476.770709][ T1140] Possible unsafe locking scenario: [ 476.770709][ T1140] [ 476.778160][ T1140] CPU0 CPU1 [ 476.783511][ T1140] ---- ---- [ 476.788861][ T1140] lock(&rdev->wiphy.mtx); [ 476.793353][ T1140] lock(team->team_lock_key#4); [ 476.800818][ T1140] lock(&rdev->wiphy.mtx); [ 476.807834][ T1140] lock(team->team_lock_key#4); [ 476.812775][ T1140] [ 476.812775][ T1140] *** DEADLOCK *** [ 476.812775][ T1140] [ 476.820915][ T1140] 5 locks held by kworker/u8:5/1140: [ 476.826268][ T1140] #0: ffff88801b2fb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 476.837133][ T1140] #1: ffffc90003d7fbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 476.847653][ T1140] #2: ffffffff8f4fd310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 476.856964][ T1140] #3: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 [ 476.866799][ T1140] #4: ffff888028c28768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 476.877603][ T1140] [ 476.877603][ T1140] stack backtrace: [ 476.883482][ T1140] CPU: 0 UID: 0 PID: 1140 Comm: kworker/u8:5 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 476.883497][ T1140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 476.883505][ T1140] Workqueue: netns cleanup_net [ 476.883525][ T1140] Call Trace: [ 476.883531][ T1140] [ 476.883538][ T1140] dump_stack_lvl+0x189/0x250 [ 476.883552][ T1140] ? __pfx_dump_stack_lvl+0x10/0x10 [ 476.883563][ T1140] ? __pfx__printk+0x10/0x10 [ 476.883576][ T1140] ? print_lock_name+0xde/0x100 [ 476.883588][ T1140] print_circular_bug+0x2ee/0x310 [ 476.883602][ T1140] check_noncircular+0x134/0x160 [ 476.883615][ T1140] validate_chain+0xb9b/0x2140 [ 476.883627][ T1140] ? lockdep_hardirqs_on+0x9c/0x150 [ 476.883640][ T1140] __lock_acquire+0xab9/0xd20 [ 476.883650][ T1140] ? team_del_slave+0x32/0x1c0 [ 476.883664][ T1140] lock_acquire+0x120/0x360 [ 476.883672][ T1140] ? team_del_slave+0x32/0x1c0 [ 476.883686][ T1140] ? __mutex_trylock_common+0x153/0x260 [ 476.883698][ T1140] __mutex_lock+0x182/0xe80 [ 476.883710][ T1140] ? team_del_slave+0x32/0x1c0 [ 476.883722][ T1140] ? rcu_is_watching+0x15/0xb0 [ 476.883734][ T1140] ? team_del_slave+0x32/0x1c0 [ 476.883747][ T1140] ? __pfx___mutex_lock+0x10/0x10 [ 476.883758][ T1140] ? bond_netdev_event+0xd9/0xe80 [ 476.883773][ T1140] ? __pfx___mutex_lock+0x10/0x10 [ 476.883783][ T1140] ? __pfx_bond_netdev_event+0x10/0x10 [ 476.883799][ T1140] team_del_slave+0x32/0x1c0 [ 476.883813][ T1140] team_device_event+0x285/0xa20 [ 476.883823][ T1140] notifier_call_chain+0x1b3/0x3e0 [ 476.883837][ T1140] unregister_netdevice_many_notify+0x15d8/0x2320 [ 476.883852][ T1140] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 476.883864][ T1140] ? __lock_acquire+0xab9/0xd20 [ 476.883877][ T1140] unregister_netdevice_queue+0x33c/0x380 [ 476.883888][ T1140] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 476.883900][ T1140] _cfg80211_unregister_wdev+0x165/0x590 [ 476.883917][ T1140] ieee80211_remove_interfaces+0x49a/0x6d0 [ 476.883929][ T1140] ? __pfx_synchronize_rcu+0x10/0x10 [ 476.883941][ T1140] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 476.883953][ T1140] ? rcu_is_watching+0x15/0xb0 [ 476.883964][ T1140] ieee80211_unregister_hw+0x5d/0x2c0 [ 476.883981][ T1140] mac80211_hwsim_del_radio+0x275/0x460 [ 476.883997][ T1140] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 476.884014][ T1140] hwsim_exit_net+0x584/0x640 [ 476.884027][ T1140] ? __pfx_hwsim_exit_net+0x10/0x10 [ 476.884041][ T1140] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 476.884061][ T1140] ops_undo_list+0x497/0x990 [ 476.884076][ T1140] ? __pfx_ops_undo_list+0x10/0x10 [ 476.884091][ T1140] cleanup_net+0x4c5/0x800 [ 476.884105][ T1140] ? __pfx_cleanup_net+0x10/0x10 [ 476.884119][ T1140] ? _raw_spin_unlock_irq+0x23/0x50 [ 476.884127][ T1140] ? process_scheduled_works+0x9ef/0x17b0 [ 476.884137][ T1140] ? process_scheduled_works+0x9ef/0x17b0 [ 476.884147][ T1140] process_scheduled_works+0xade/0x17b0 [ 476.884163][ T1140] ? __pfx_process_scheduled_works+0x10/0x10 [ 476.884176][ T1140] worker_thread+0x8a0/0xda0 [ 476.884192][ T1140] kthread+0x70e/0x8a0 [ 476.884206][ T1140] ? __pfx_worker_thread+0x10/0x10 [ 476.884216][ T1140] ? __pfx_kthread+0x10/0x10 [ 476.884228][ T1140] ? _raw_spin_unlock_irq+0x23/0x50 [ 476.884237][ T1140] ? lockdep_hardirqs_on+0x9c/0x150 [ 476.884246][ T1140] ? __pfx_kthread+0x10/0x10 [ 476.884258][ T1140] ret_from_fork+0x3fc/0x770 [ 476.884268][ T1140] ? __pfx_ret_from_fork+0x10/0x10 [ 476.884278][ T1140] ? __switch_to_asm+0x39/0x70 [ 476.884290][ T1140] ? __switch_to_asm+0x33/0x70 [ 476.884301][ T1140] ? __pfx_kthread+0x10/0x10 [ 476.884313][ T1140] ret_from_fork_asm+0x1a/0x30 [ 476.884329][ T1140] [ 477.236314][ T1140] mac80211_hwsim hwsim3 wlan1 (unregistering): left promiscuous mode [ 477.244917][ T1140] mac80211_hwsim hwsim3 wlan1 (unregistering): left allmulticast mode [ 477.253713][ T1140] team0: Port device wlan1 removed [ 477.765331][ T1140] hsr_slave_0: left promiscuous mode [ 477.771317][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.778846][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.786628][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.794118][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.804612][ T1140] hsr_slave_0: left promiscuous mode [ 477.810243][ T1140] hsr_slave_1: left promiscuous mode [ 477.815919][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.823366][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.831329][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.838771][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.848033][ T1140] hsr_slave_0: left promiscuous mode [ 477.853768][ T1140] hsr_slave_1: left promiscuous mode [ 477.859385][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.866972][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.874654][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.882110][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.892545][ T1140] hsr_slave_0: left promiscuous mode [ 477.898328][ T1140] hsr_slave_1: left promiscuous mode [ 477.903976][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.911347][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.919734][ T1140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.927248][ T1140] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.940499][ T1140] veth1_macvtap: left promiscuous mode [ 477.946149][ T1140] veth0_macvtap: left promiscuous mode [ 477.951906][ T1140] veth1_vlan: left promiscuous mode [ 477.957760][ T1140] veth1_macvtap: left promiscuous mode [ 477.963302][ T1140] veth0_macvtap: left promiscuous mode [ 477.968843][ T1140] veth1_vlan: left promiscuous mode [ 477.974740][ T1140] veth1_vlan: left promiscuous mode [ 477.980050][ T1140] veth0_vlan: left promiscuous mode [ 477.985934][ T1140] veth1_vlan: left promiscuous mode [ 477.991173][ T1140] veth0_vlan: left promiscuous mode [ 478.249226][ T1140] team_slave_1 (unregistering): left promiscuous mode [ 478.256070][ T1140] team_slave_1 (unregistering): left allmulticast mode [ 478.263405][ T1140] team0 (unregistering): Port device team_slave_1 removed [ 478.284999][ T1140] team_slave_0 (unregistering): left promiscuous mode [ 478.291989][ T1140] team_slave_0 (unregistering): left allmulticast mode [ 478.299289][ T1140] team0 (unregistering): Port device team_slave_0 removed [ 478.537433][ T1140] team0 (unregistering): Port device team_slave_0 removed [ 478.718541][ T1140] team0 (unregistering): Port device team_slave_1 removed [ 478.729142][ T1140] team0 (unregistering): Port device team_slave_0 removed [ 478.942506][ T1140] team0 (unregistering): Port device team_slave_1 removed [ 478.967857][ T1140] team0 (unregistering): Port device team_slave_0 removed