last executing test programs: 8.016330729s ago: executing program 3 (id=2484): openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) io_setup(0x6, &(0x7f0000001380)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000080)={0x0, 0x40}, 0xe) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) r3 = socket$inet(0x2, 0x80001, 0x84) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000640)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x7a, &(0x7f0000000080)={r4}, &(0x7f0000000840)=0x18) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x419, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_DELCHAIN={0x1c, 0x5, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_CHAIN_FLAGS={0x8}]}, @NFT_MSG_DELCHAIN={0x214, 0x5, 0xa, 0x0, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_USERDATA={0xe7, 0xc, "6f0281cac8fabb8914f347cbbb7ba64b8628a228ad705dcd107e69775b7b2a783a46ab0f9f687179afc701c638eee5ad3125222f486c1ef56039b678dbac9ff26f7cb7a995485db2eb0f8df5b41eda20f8cf3e156059de4b45fee2a18faf9fd711380c2da1b5d9ed0747a1cfb7c4e2a9b36d890cb5b5b1d49124fbf3ffaaf22d6e85c643ab6ced5a12e4fa717710b27cbb4dc9b427fe3937fe2a487383925deedd0f5954e9d083a9b5b35e33898a41c5d3348505e051acf440a13186b0732804bda23492ff22d26f1f375a98fcbfc97c63dddd51e28a04a4c01da02a946b7448e0312c"}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x9c, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'batadv0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'geneve0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1dc9ffc2}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x79b4bbb0}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth0_to_team\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_DEV={0x14, 0x3, 'ip6erspan0\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_DEV={0x14, 0x3, 'dvmrp0\x00'}]}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x50, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'erspan0\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x235dba4c}, @NFTA_HOOK_DEV={0x14, 0x3, 'macvlan0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'pimreg\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}]}]}], {0x14}}, 0x258}, 0x1, 0x0, 0x0, 0x810}, 0x800) syz_usb_control_io$uac1(r5, &(0x7f0000000180)={0x14, &(0x7f00000000c0)={0x0, 0x0, 0x44, {0x44, 0x0, "6491b6fe452d8a7e812506ee78c86df6d592688fb64ac94cca2e3a6e2da5e4c797b424c534b53025036d14bc4018abc4660109116fa2e8a7e43fd63c2d3ce8aa40c2"}}, 0x0}, 0x0) 6.814784009s ago: executing program 0 (id=2491): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x29, &(0x7f0000000580)=0x2d5a, 0x4) sendmmsg$inet6(r0, &(0x7f0000001000)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0x1c, 0x0}}, {{&(0x7f0000000140)={0xa, 0x4e24, 0x8, @local, 0xf4}, 0x1c, &(0x7f0000000dc0)=[{&(0x7f00000001c0)="8ae2d5e47ce2993234daaeb28de9a6c3899b7e66314835e634e4d36ac611798650040dc9a1273c4b2b2d7d85cafd75fba673c04a1cc95c959fc6185398da2043f5903b309b4c9c9a4653bf2cb4a645c5360172c3f38b8334c0d65765d2a48607f268cba35d6fdaaa569d96221122dac967dde5a1f9fb170e518a793fd30b2c816382f44200f1889f4e74ac2465461cfa", 0x90}, {&(0x7f0000000340)="ac0108a76b03c6189aa0f51155bf624bc08f390e5648f81af62d", 0x1a}, {&(0x7f0000000380)="60cf01e5b96a57ed3742e3ce8244a97a78980bd81451ad7881e2fa20d0f4a96c82ba47d91faaf9f37194a0f1d36169d0180e946039b03ef83814792e0dc049ccc1e8dd160f7ab35dd6826fb455009a9e4d0e1819dd897a33384a72acaa3d991ed0dc648d2bfb259309c718f2d2e374103d42c3cbdbebe1efcea1308c62de6eae9316d5525f6eede1e032b924eba34aedc5d473cf5d9f06728ac75d2ddf051b7866afeccac7f161838eecf146", 0xac}, {&(0x7f0000000ac0)="dd7570f1e954dafe9856415a58d08be709eb3a10d2536d4abf189db2dfe3778066dc2479e57498077dbe326f69877dc043a092e401d8074cc63bc5293f8dfb205c84c2ba9926cf30fede5273df64293a5a9f66d18bbb7a7b9d14b52cf0662ad49c674bc60f4dc079be9e054c4837ca8c3af63d4f063985c0138907ebb531a2fc8f17fb20eff7091f05321465a7a2cb35c7c200118a699cb3dd096efd0e1f33f68c08833c488ac9d7ae564b30f6252fc90e5d89e5cf3ad531a050ae18bfa5ff08252bf3a5c9f9579f97219838769d", 0xce}, {&(0x7f0000000bc0)="27e119142d73707c60cbc9705bf0240fae396bf072e12390b87c98c4981e3393308cb8aa04cad30c15f71a5bbd5295a65b3b9468ad6124965e3d9f7f30b0965879f4d6223189c1337d2aac216a4911370ef904b2f990b975ec96237ddd597326d99d6f96aed02da744d6860743a7c0b6d4dcc2804e74a1921afbf2dde5d2c1565df686ad24a903f1d536b84583eb312cc36b092efb9525d23baad73e1240f33b794cecc00a65cfca4917441f53644bf0bceb8050f8c2250f88362c51fc4e9c7af931a721f89f", 0xc6}, {&(0x7f0000000cc0)="4aae059cb320f52a0ec0a1c478f3fbd523642b1dd0e0575b0968f5b3e1b60ff0391ab33aceaa42a66861f920e74eb3834acfe8b34e6b8ae073ccc474f34b112cc18a0bd70633c7d5bc4152c46c6ba890d9f9d731a4bde5f88b507a6b253efa132830edc432bd81a249a696347ffe0c5788a4c59856716682bfc9bf64d3f42e5d772f7262a5c1d39a3cc0b20e137890d4adb70e00d9f8a54de34c6320e7719aa8a6ba0e20274738fb4c6ccc36b543b86fa104650c5f202765c0a68971aff8307f0b41fbb0b4b037c64fdfda", 0xcb}, {&(0x7f0000000440)}], 0x7, &(0x7f0000000e40)=[@tclass={{0x14, 0x29, 0x43, 0x4}}, @dstopts={{0x20, 0x29, 0x37, {0x3c, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0x2000000}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x5}}, @hopopts={{0xd8, 0x29, 0x36, {0x33, 0x17, '\x00', [@generic={0x11, 0xa1, "ec5957448861d5b176b94d1caa213db3cacdf0299d53743e2a132fd70ec05bfb9a7c1b3f1607b10213cb55f16c47a32218b6b62ca054143c82527dc709a080f66f9a7fe1fbd8bb6e00008bb0dd82860063c3cd93f87d2691682cd70dcef6c7e647abef784974178de8190a2731c66934d4da4442d39446431f551d8e401a0a8718e06c661f4ebb6f474ac4a07b9c592789c217046a16c696edcdd5116be8b5b451"}, @calipso={0x7, 0x18, {0x1, 0x4, 0xc1, 0x30, [0x4b0, 0x9]}}]}}}, @tclass={{0x14, 0x29, 0x43, 0x1636}}, @dstopts={{0x48, 0x29, 0x37, {0x4, 0x5, '\x00', [@jumbo={0xc2, 0x4, 0x7}, @calipso={0x7, 0x10, {0x1, 0x2, 0x6, 0x0, [0x7f]}}, @hao={0xc9, 0x10, @loopback}]}}}], 0x188}}], 0x2, 0x40) syz_open_dev$media(&(0x7f00000004c0), 0xa5e, 0x400000) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000280)={0x0, @in={{0x2, 0x2, @broadcast}}, 0x27be, 0xffff}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @private2}}}, 0x90) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000640)={'filter\x00', 0x7, 0x4, 0x3f8, 0x100, 0x0, 0x0, 0x310, 0x310, 0x310, 0x4, 0x0, {[{{@arp={@dev, @multicast1, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_hsr\x00', 'syz_tun\x00', {}, {}, 0x2, 0x81}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "e22a239a6bb651a9837df08bc7f880efe7126f5d56b33dd54f5db150ee26"}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@local, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}}}, {{@arp={@local, @local, 0x0, 0x0, 0x0, 0x0, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, {@mac=@dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'batadv_slave_1\x00', 'erspan0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "9695d92849c79fac2d070731112f73924a493f1567e5d8b4cd2c5f35f67b"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x448) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x200010, 0x0) ioctl$BTRFS_IOC_DEFRAG(r3, 0x50009402, 0x0) r4 = creat(&(0x7f0000000180)='./file0\x00', 0x20) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000000)={0x0, r4}) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000), 0x8) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000600)={0x2, 0x2}, 0x4) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup3(r8, r7, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x3, 0x7}, 0x4) 6.360236288s ago: executing program 0 (id=2492): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='fdinfo\x00') syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="2e6876c4dc081f97ef02ca03034507e3c19b15d9e35ea870ee7d8bfbdc168879d3f4219e3a7776d21d903355aa34ae4a7d8b2a7321cd589779486ff3e103fb2a16ade281c3aac41d3c5c91ec625fe150c639fd906a120391f296b00a83fa0dee00c5fcd5a4468482e30fe0bf114c92ec84c60868330130ae91de7ea2a82c662ddf5f9e1075a0ec9ab262f0", @ANYRES8=r0], 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000001900)=""/102386, 0x18ff2}], 0x1, 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000280), 0x3, 0x8000) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f00000000c0)={0x80000000, 0x0, &(0x7f0000000300)=[{}, {{}, {0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_ENUM_ENTITIES(0xffffffffffffffff, 0xc1007c01, &(0x7f0000001640)={r3}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000080)={{0x80000000, r4, 0x6, [0x0, 0x5]}, {r3, 0x0, 0x0, [0x5, 0x5]}, 0x2, [0x4, 0x1]}) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000180)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r5, 0x402c5342, &(0x7f0000000000)={0x0, 0x8a, 0x43b, {0x0, 0x10000}, 0x6}) socket$l2tp6(0xa, 0x2, 0x73) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xff16) sendmsg$kcm(r1, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000380)='net/rt_acct\x00') fanotify_init(0x8, 0x0) fanotify_mark(r0, 0x1, 0x8, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r6, 0x800454e0, &(0x7f0000000100)) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007fc0), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r8, &(0x7f0000000580)=[{&(0x7f00000004c0)=""/174, 0xae}], 0x1, 0x0, 0x0) 5.926383112s ago: executing program 1 (id=2494): socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x3, 0x10) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @private=0xa010101}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x57) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f00000024c0), 0x802, 0x0) read(r1, &(0x7f0000002940)=""/179, 0xb3) socket$tipc(0x1e, 0x5, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) socket$inet6(0xa, 0x6, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x0) 5.90248115s ago: executing program 3 (id=2495): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x0, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x5, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0x9c}}, 0x0) 5.760652123s ago: executing program 0 (id=2496): socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a1202, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x20001400) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0xf, {[@global=@item_4={0x3, 0x1, 0x0, "c9c0e2f5"}, @local=@item_4={0x3, 0x2, 0x0, "71b9a7ab"}, @main=@item_4={0x3, 0x0, 0xb, "1000090e"}]}}, 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) ioctl$HIDIOCGREPORTINFO(r2, 0xc00c4809, &(0x7f0000000640)={0x3, 0x200}) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r3, 0x402, 0x80000007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6}]}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = socket(0x2, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000100)) listen(r5, 0x0) epoll_wait(r6, &(0x7f0000000080)=[{}], 0x1, 0xffffffff) epoll_ctl$EPOLL_CTL_MOD(r6, 0x3, r5, &(0x7f0000000000)={0x2000a219}) r7 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r7, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4) setsockopt$inet6_mreq(r7, 0x29, 0x1d, &(0x7f0000000200)={@empty}, 0x14) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[@ANYBLOB="bbd28ddcfbbbaaaaaaaaaa0086dd60003a0400043a00f58000000000000000000000000000bbff020000000000000000000000000001"], 0x0) pwritev(r4, &(0x7f00000007c0)=[{&(0x7f00000001c0)='3', 0x1}], 0x1, 0x0, 0x0) 5.459468145s ago: executing program 4 (id=2498): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffe, 0x0, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x5761, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000000706010200000000000000000000fd000500010007000000080006c0"], 0x24}}, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000200), 0x208e24b) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000002340)={&(0x7f0000000000), 0x10, 0x0}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000580)={'#! ', './file0', [{0x20, '/proc/sys/net/ipv4/vs/cache_bypass\x00'}], 0xa, "15bf3158f3b4c5beaa8a9ea511953cef08b81dedc6989a86c441759f9143160456a26319d35748b0fa16e646523ab5bd24785a1acbae1d23a93b9e516d3c74821654c0362f19a9637c363623"}, 0x7b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020000000900010073797a3000000000aa000300"], 0x1e4}}, 0x0) write$binfmt_misc(r5, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r4, 0x0, r6, 0x0, 0x7fff, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) getpgrp(0x0) r8 = creat(&(0x7f0000000080)='./file1\x00', 0x8) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f0000000100)={0x18, 0x0, {0x0, @random="124614b395af", 'geneve0\x00'}}) ioctl$BTRFS_IOC_SET_FEATURES(r8, 0x40309439, &(0x7f00000000c0)={0x2, 0x2, 0x2}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c0002800c00200000000000000000000c002100000000000000000043ca90"], 0x4c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) 5.404599179s ago: executing program 2 (id=2499): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) syz_io_uring_setup(0x6865, &(0x7f00000000c0), 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$tipc(0x1e, 0x2, 0x0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14}, 0x14}}, 0x0) socket$inet6(0xa, 0x80002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x80002, 0x0) socket$tipc(0x1e, 0x2, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff09", @ANYRES8=r0, @ANYBLOB="05", @ANYRES16=r0, @ANYRES8, @ANYRES16=r1, @ANYRES16=r2], 0x0) 4.986078457s ago: executing program 3 (id=2500): r0 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000f00), &(0x7f0000000f40)=0x4) 4.924351956s ago: executing program 1 (id=2501): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000400)={r3}, 0x14) (async) syz_io_uring_setup(0x7279, &(0x7f0000000080), 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700), 0x48) (async) userfaultfd(0x80001) (async) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) (async) r4 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_disconnect(r4) (async) r5 = syz_usb_connect(0x0, 0x4a, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_control_io(r5, 0x0, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000440)={&(0x7f00000003c0)=[{0x0, 0xc801, 0x0, 0xffffffffffffffff}], 0x1}) (async) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x12) (async) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x11) (async) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) (async) ioctl$UI_DEV_CREATE(r7, 0x5501) (async) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000180)={0x5, 0x7, {0x0}, {0xffffffffffffffff}, 0x2, 0x100}) fcntl$setown(r7, 0x8, r8) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) 4.80439311s ago: executing program 3 (id=2502): r0 = gettid() timer_create(0x6, &(0x7f0000000500)={0x0, 0x36, 0x4, @thr={&(0x7f0000000380)="87270000000009000000006aba350600", &(0x7f00000003c0)="5625b32033b685d5f55dda033f4ebec255d1a94f9b52fbcb857fe30f4dae26f308d583f10580f127dab9170beb6e812b2a2576356a2f790840a4917c8d4f42eb50dcfb40d986e076279b9eaa5dcbccd5840af79fb076a354edb54fda7c2d0a957ae4e845d959cd7fb00e4d986db3c32f1ea0e80cc40e2b7031222afcf3ba7dead5fdc17e850617b7654091894bdcfaf2247d8f5cf7c6ab28310b589e735318"}}, &(0x7f0000bbdffc)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'rose0\x00', 0x112}) pread64(r1, &(0x7f0000000a80)=""/4096, 0x1000, 0x69a) sched_setparam(r0, &(0x7f00000002c0)=0x1) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff008}, {0x16}]}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r2 = eventfd(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='net/llc/socket\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000080)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB='8-N:'], 0x6a) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x3ece996) ioctl(r6, 0x6, &(0x7f0000000540)="4deeb3ac5a34873c68e45496be5cb6c649b168321fedbe64bc47f576489809a0d3f4c9a8bd0ffe57194fb3a1e551fda41c13972743a8b22eabd6cc2b2886e3fbf9db7ff13a2b3ee2f9c24c86c6e54a67b7cc306185c33b2cfea60363ac70369b17ed9a19f16a7b19ed0b7c20823b4d13913a3853336b1d3c8af6ffae23d87220665d52b84a43ef64aff06812485f79489b6c33763661259940") mbind(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x4, 0x0, 0x0, 0x1) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000340)={0x0, r2, 0x9, 0x6b66, 0x81, 0x442}) writev(r2, &(0x7f0000000a40)=[{&(0x7f00000004c0)="df015be2a1043cce", 0x8}], 0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r3, 0x40046411, &(0x7f0000000300)=0x5) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r8, 0xc048aec8, &(0x7f0000000080)={0x2, 0x0, @ioapic={0x0, 0x0, 0x0, 0x0, 0x0, [{}, {}, {}, {0x0, 0x0, 0x0, '\x00', 0x40}, {0x2}, {0x5, 0x0, 0x0, '\x00', 0xfd}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, '\x00', 0xf}, {}, {}, {0xff}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x4}]}}) r9 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r9, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r9, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000640)=""/172, 0xac}], 0x1, &(0x7f0000000a40)=""/124, 0x7c}}], 0x1, 0x0, 0x0) sendmsg$tipc(r9, &(0x7f0000000200)={&(0x7f0000000c00)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000040)='\v', 0x57}], 0x1}, 0x0) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000000)="aba732e9970a72a4", 0x8}], 0x1) syz_usb_connect(0x0, 0x4b, &(0x7f00000004c0)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009050e2181a50f1ccc10"], 0x0) 4.732858832s ago: executing program 4 (id=2503): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r2, 0xfff) syz_emit_ethernet(0x4a, &(0x7f0000000440)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000180)={@local, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "dd690b", 0x44, 0x2f, 0x0, @private0, @private1, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100}, {0x0, 0x0, 0x0, 0x0, 0x100}}}}}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0000ce", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x6, 0x0, 0x0, 0x0, 0x0, {[@window={0x3, 0x3}]}}}}}}}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000004c0)={0x34, r4, 0x135, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_QOS_MAP={0x16, 0xc7, {[{0x0, 0xff}, {}, {}, {}, {}], "040ded930dde6d5a"}}]}, 0x34}}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r5, 0x29, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB='\x00+'], 0x168) listen(r5, 0x2) mknodat$null(0xffffffffffffff9c, 0x0, 0x0, 0x103) syz_emit_ethernet(0x76, &(0x7f00000005c0)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x40, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x10, 0xc2, 0x0, 0x0, 0x0, {[@timestamp={0x22, 0xa}, @sack_perm={0x4, 0x2}, @mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0xf, 0x0, 0x4, "bece9292e5c3372a86ed2d"}]}}}}}}}}, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e00000020000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000003c0000000a000000fe8000000000000000000000000000aa0000000001000000000000000000000000000000ff010000000000000000000000000001000000002b0000000a000000fe8800000000000000000000000000010000000000000000000000000000000000000000ff020000000000000000000000000001000000003200000002000000fe8000000000000000000000000000000000000004"], 0x254}}, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)={'#! ', './file0', [{0x20, '\x00'}, {0x20, '\x00'}, {0x20, '\x00'}, {0x20, 'team0\x00'}], 0xa, "1b5e2fa21b135f35b0388575defe003f2895f42f4854a3739280969c89eb3d8fc4242911e2cde579b50070b13e1d7f2082ae1d548d2923c689bd60de9c28a2866b8ddb2bc3a799f0f057cbc3aa83517ec06fe66922597e"}, 0x6f) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{}], 0x1}, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r8 = eventfd(0x0) writev(r8, &(0x7f0000000a40)=[{&(0x7f00000004c0)="df015be2a1043cce", 0x8}], 0x1) 4.678610795s ago: executing program 1 (id=2504): bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sysvipc/msg\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x8000000000000000, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mremap(&(0x7f00004f8000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000f99000/0x3000)=nil) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r4 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr, 0x80, 0x0}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x41}, 0x18) fsetxattr$system_posix_acl(r6, &(0x7f0000000340)='system.posix_acl_access\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000001000000000000000400fffe0000000000000000000000000000000000000000baee2780088f1de2b5a906666249249144a02acbd8958e33bb80506310cf17ffced7eece7f6417a1ade79ef5a99de1d4e456234135de41708c94900fc0537fb54ca7a9f53c2c53444ca6cd10e724a61bd07b202f7b974173c9b569b74299b17570b5f7293f0c2209ad64fea18ee07b30419b"], 0x24, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000000)={0x8075, {0xf, 0x950, 0x8, 0x4d1, 0x7003, 0x1}}) read$nci(r6, &(0x7f0000000040)=""/32, 0x20) write(r5, &(0x7f0000001b40)="29000000140005b7ff000000040860eb0101b6ff02150014a1e7100596d3134a613e8fa794bd570400", 0x29) 4.404659672s ago: executing program 4 (id=2505): r0 = fsopen(&(0x7f0000000380)='hfsplus\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, &(0x7f0000000080)='silent\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0x8000000, &(0x7f00000000c0)='nomand\x00', 0x0, 0x0) 4.243380305s ago: executing program 4 (id=2506): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='fscache_invalidate\x00'}, 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x0, 0x4, 0x4, 0x0, 0x1014}, 0x48) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000039c0)=ANY=[@ANYBLOB="3800000018000100000000000000000002000000000000000000000014001680100008800c000280060001000000000008001e0005000000de7690cefed12f5b"], 0x38}}, 0x8010) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$TCFLSH(r3, 0x400455c8, 0x0) r5 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x2000, 0x0, 0x7}) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) syz_usb_disconnect(r6) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0) ioctl$EVIOCRMFF(r6, 0x4004550f, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0) fsetxattr$trusted_overlay_upper(r4, &(0x7f0000003940), &(0x7f0000003a00)=ANY=[@ANYBLOB="f3fa1e0e0546da6e11c267eb2671be91735a72742ba98aa200000000000000cf560000000000001528f9a306841d11ecf34f361413e222138da61950b10ff4b19e7e39cbe40b063bff63af0e2aa308e993"], 0x1e, 0x2) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x180, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000080)='=', 0x1, 0x800b5eb) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa041}, 0x0, 0x0, 0x0, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100) setsockopt$inet6_int(0xffffffffffffffff, 0x3a, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000007940)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRES16=r0, @ANYRES32=r2, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000", @ANYRES32=0x0, @ANYBLOB="a005000000000000000000002400000000000000840000000700000094"], 0x98}, 0x4040080) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) 3.921484142s ago: executing program 2 (id=2507): bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) r0 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000002300), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000040ecffff7f00000000000000850000000c0000009500000000000a6682f08a000000e2dd39d1a88073c9479e9a907c994a09566dbbf1acd717fd83e985be33d8ef246cc4127ed247d35d238f671bc6c8a3d87944f1e6cb4082687905ba8112df4f033094c6620ed86d419d9e0c9477aad30aeb621b22642efc3581f1f66fcafb238b9800fe8548aa7216e135ee8487402c6b9d338fbbb3d93a5f4b28679933490af177ae3b5ab1ddfb30d861d7d23e20d362cf5e8237ffb792fc19da30c74ea15047b6ea85b4b0bf03b4fd449f5167801af2f09903b2cb2686b62ff116e6ba89d355675381106b46aa36ba452f5e00e62f379e1524ef"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x90) preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r2, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="020000000300000000000000040000000000000010000000000000002000000000000000c98d65e478ca0723599d622036f3e31d393e3393308b0b302aee6e5a1ae06d1d59252818333274ec274a807d"], 0x24, 0x0) socket$key(0xf, 0x3, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000940)=ANY=[@ANYBLOB="02000000000000000000000000000000fe88000000000000000100"/58, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0x180}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x1, 0x40, 0x40}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000180), 0x0, r4}, 0x38) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@gettaction={0xb8, 0x32, 0x200, 0x0, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x10, 0x3ffe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2000004}, @action_gd=@TCA_ACT_TAB={0x4}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x8241}, @action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0xc, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x14, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0xb8}}, 0x20000010) syz_genetlink_get_family_id$tipc2(0x0, r1) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ed5696c5820fae0000000000000080beef911d564c90c200", 0x18) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) sendmmsg$unix(r5, &(0x7f0000006b40)=[{{&(0x7f00000050c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x8001}}, {{&(0x7f0000000540)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1000"/16], 0x10}}], 0x2, 0x8) socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000000), 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b4050000000000007110410000000000060000000000000095000000000000000a09413d5f51619461c3975cb605511a37bbcbf12e1d963842"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x90ff}, 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000340)={r7, 0xffffffffffffffff, 0x1e, 0x0, @void}, 0x10) 3.708449799s ago: executing program 1 (id=2508): pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) r2 = add_key$user(0x0, &(0x7f00000001c0)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0x10) r3 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xd3, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) sched_getscheduler(0x0) writev(r4, &(0x7f00000010c0), 0x0) r5 = io_uring_setup(0x489e, &(0x7f0000000240)={0x0, 0x0, 0x800}) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r6, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r6, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r7 = inotify_init() inotify_add_watch(r7, &(0x7f0000000000)='.\x00', 0x400017e) close_range(r5, 0xffffffffffffffff, 0x0) 2.899789903s ago: executing program 2 (id=2509): r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000040)={0xb, {0xa, 0x4, 0x6, 0xbe9}}) syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x102) (async) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x102) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f00000000c0)=""/254) r2 = userfaultfd(0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000001c0)=0x0) prlimit64(r3, 0x4, &(0x7f0000000200)={0x4a, 0x6}, &(0x7f0000000240)) (async) prlimit64(r3, 0x4, &(0x7f0000000200)={0x4a, 0x6}, &(0x7f0000000240)) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r2, 0x40049366, &(0x7f0000000280)=0x1) ppoll(&(0x7f00000002c0)=[{r0, 0x2}, {r2, 0x4100}, {r0}, {r2, 0x504}, {r0, 0x1400}, {r1}], 0x6, &(0x7f0000000300)={0x77359400}, &(0x7f0000000340)={[0x4]}, 0x8) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000003c0)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000440)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}, 0xc6}, {0xa, 0x4e24, 0x1449, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, r5, 0x101}}, 0x48) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000440)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}, 0xc6}, {0xa, 0x4e24, 0x1449, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, r5, 0x101}}, 0x48) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r2, {0x5}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r2, {0x5}}, './file0\x00'}) write$P9_RWRITE(r6, &(0x7f0000000500)={0xb, 0x77, 0x1, 0x3}, 0xb) getsockopt$inet6_mreq(r6, 0x29, 0x15, &(0x7f0000000580)={@private1, 0x0}, &(0x7f00000005c0)=0x14) sendmsg$nl_route_sched_retired(r6, &(0x7f0000001000)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x800004}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000600)=@deltclass={0x9a4, 0x29, 0x4, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xffff, 0xfff4}, {0x3, 0xf}, {0x2, 0xfffd}}, [@c_cbq={{0x8}, {0x14, 0x2, [@TCA_CBQ_WRROPT={0x10, 0x2, {0xf3, 0x1, 0x6, 0x80, 0x1, 0x3}}]}}, @c_cbq={{0x8}, {0x894, 0x2, [@TCA_CBQ_WRROPT={0x10, 0x2, {0x7, 0x7, 0x3, 0x9f, 0x6b, 0x6}}, @TCA_CBQ_RATE={0x10, 0x5, {0xc, 0x1, 0x74, 0x2, 0x606, 0x6f}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x85, 0x8, 0xe8, 0xc0, 0xffff, 0x2}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x34, 0x0, 0x1, 0x40, 0x9, 0x6, 0x200, 0x2}}, @TCA_CBQ_RATE={0x10, 0x5, {0xa6, 0x2, 0x4, 0x4d0f, 0x617, 0x7}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x2, 0x8, 0x8, 0x4, 0x4, 0x7}}, @TCA_CBQ_RTAB={0x404, 0x6, [0x8, 0x1, 0x100, 0x9, 0x6, 0x9, 0x184, 0xd, 0x0, 0x7f, 0x0, 0x7fffffff, 0x3, 0x7, 0x200, 0x9, 0xf, 0x6, 0x0, 0x7, 0x6, 0x5, 0x3, 0x4, 0x401, 0x6, 0x5, 0x40, 0x3, 0x9, 0xef5c, 0x4, 0x3, 0x3, 0x1, 0x2, 0x8, 0xfffffff7, 0xe6, 0x8, 0xffff, 0x0, 0x8, 0xb, 0x5, 0x6, 0x0, 0x5, 0x400, 0x3, 0x5, 0xfffffff8, 0x1, 0xc6d, 0x72d8630e, 0x3, 0x7, 0x6, 0x7, 0x5b, 0x1, 0xf1, 0x62, 0x6, 0xfff, 0xc, 0x7f, 0x6, 0x800, 0x6, 0x6, 0x7, 0x0, 0x6, 0x9, 0x5, 0x6, 0x63c9, 0x0, 0x800, 0x6, 0x388, 0x4, 0x5, 0x7, 0x2, 0x6, 0xf, 0x1, 0x3ff, 0x401, 0x2, 0x3, 0x1, 0x6d, 0x7, 0x5, 0x41d1, 0x8, 0xff, 0x7ff, 0xf, 0x6, 0x2, 0x4, 0x4, 0x6, 0xfff, 0x3, 0x53, 0x2, 0x56, 0x80000001, 0xf, 0x5, 0xfffffffd, 0x6, 0xc, 0x4, 0xffff, 0x1, 0xa52, 0x401, 0x7ff, 0xa, 0xb, 0x6, 0x3, 0xfffffff8, 0x3, 0x3ff, 0x6, 0x5, 0x4, 0xea, 0x81, 0x9, 0xffff8000, 0xe, 0x5, 0x4, 0x7, 0x4, 0x0, 0x5, 0x40, 0xfffffff8, 0x4, 0x8, 0x1, 0x4041, 0x27, 0x9bc, 0x1, 0x2, 0x10, 0xa, 0x7fff, 0xfffffffc, 0x5, 0x3, 0x5, 0x0, 0x1, 0x7f, 0x0, 0x8, 0x0, 0x779, 0x7, 0x200, 0x8, 0x1, 0x1fc, 0x6, 0x7, 0x9, 0x0, 0x1ff, 0x2, 0xfffffe9b, 0x4, 0x8, 0x9, 0x401, 0x1, 0x2, 0x6, 0x2, 0x5, 0x80000001, 0x1, 0xffffffff, 0xcbb6, 0xe3, 0x10000, 0x8, 0x3, 0x86, 0x1, 0x1, 0x2, 0x2, 0xd, 0x5, 0x4, 0x1, 0x100000, 0xe, 0x3, 0x0, 0x5, 0x7, 0x8, 0x1, 0x0, 0x8001, 0x9, 0x9, 0x4, 0x90, 0x1, 0x9, 0x5, 0xd690, 0x0, 0x0, 0xffffffff, 0xfffffc00, 0x4, 0x0, 0x6, 0x8001, 0x8, 0x8, 0xb, 0xfffffffe, 0x7, 0xfffffffa, 0xfce1, 0xfffffff8, 0x0, 0x8, 0x8, 0x400, 0x2, 0xe3, 0x3, 0x1000, 0x9, 0x4, 0x0, 0x1, 0x0, 0x100000, 0x14]}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x5, 0x7, 0x4, 0xe5, 0xdd1, 0x2}}, @TCA_CBQ_RATE={0x10, 0x5, {0x1, 0x2, 0x1ff, 0x0, 0xb357, 0xb8}}, @TCA_CBQ_RTAB={0x404, 0x6, [0xe321, 0x40, 0x356a6e72, 0xfffffffc, 0xfff, 0x8, 0x2, 0x7, 0x5f8, 0x5a7c, 0x4, 0x3ff, 0xffff, 0x3, 0x400, 0x5, 0x9, 0x3, 0xc, 0x7, 0x200, 0x401, 0x8, 0xb, 0x2, 0x4, 0xfffffffe, 0x4, 0x1, 0xfffffffb, 0x8, 0x6, 0x3, 0x7, 0x200, 0xfa2a, 0x10000, 0x9fc, 0x800, 0x9, 0x8, 0x0, 0x7, 0x4, 0xfffffff9, 0x1, 0x6, 0x5, 0xfff, 0x4, 0x2, 0x9, 0xa, 0x1000, 0x1, 0x5, 0x8000, 0x40, 0x5, 0x1, 0xfffffe01, 0x1ff, 0x0, 0x6bdc, 0x9e, 0xfffffffe, 0x5, 0x100, 0x10, 0x1, 0xc, 0xbc, 0x1, 0x5, 0x0, 0x5, 0x4, 0x90c, 0x7, 0xfffffff8, 0x101, 0xdf8, 0x80, 0x92, 0x8000, 0xab6, 0x6, 0x3, 0x9, 0x8, 0x5, 0x4, 0x8, 0x1, 0x6, 0x3, 0xe44f, 0x10000, 0x7, 0x10, 0x3, 0x4, 0x0, 0x6, 0x905d, 0x3, 0x1, 0x5, 0x2, 0x9, 0x401, 0xfffffffb, 0x8, 0x9, 0x8, 0x1, 0x7, 0x3, 0x4, 0x5, 0x20bf, 0x2, 0xd, 0x0, 0xc, 0x4, 0x7, 0x6, 0x0, 0x2, 0x8, 0x7, 0x64ca, 0xfffffffa, 0x8000, 0x4, 0x400, 0x9, 0x400, 0x30fc, 0x401, 0x9, 0x9, 0x638c, 0x8000, 0x7, 0x10000, 0x6, 0x9, 0x8, 0xff, 0x5, 0xe, 0x1000, 0x9, 0xde4d, 0x101, 0x1, 0x56, 0x8f5e, 0xe1, 0x779, 0xc, 0x6, 0xff, 0x0, 0x9, 0xb, 0x33b, 0x9, 0x5, 0x2, 0x9, 0x8, 0x3, 0x1, 0x2, 0x1, 0x8, 0x3, 0x8000, 0x5bf, 0x6, 0x401, 0x1e6, 0xffff8000, 0x1, 0xfffffff4, 0x7, 0x41c, 0x5, 0x5, 0x0, 0x8000, 0x0, 0x3, 0xe0000000, 0x7a2, 0xffff, 0x7, 0xfffffff7, 0x8, 0xfffffffd, 0x9, 0x7, 0xffff, 0xe, 0x0, 0x2, 0x9, 0xc1, 0xf0, 0x2, 0x2, 0x4, 0x0, 0x2, 0x4, 0x40, 0xc4, 0x9, 0x4, 0x6, 0x3, 0x3, 0xe4f2, 0x9, 0x101, 0x2, 0x3, 0x99, 0x800, 0x5, 0xc02, 0x7, 0x6, 0x6, 0x9, 0x8, 0x8, 0xffffffc0, 0x3, 0x2, 0x7, 0x8, 0x4, 0x25, 0x400, 0x2, 0x7, 0x7c1, 0x10, 0xffff, 0xc0000000, 0x1, 0x2]}]}}, @c_cbq={{0x8}, {0x84, 0x2, [@TCA_CBQ_LSSOPT={0x18, 0x1, {0x1a, 0x2, 0x11, 0x5, 0x400, 0x4, 0xa, 0x1}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x0, 0x7, 0x6, 0xd4, 0x4, 0xfff}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0xb, 0x1, 0x0, 0x8, 0x1, 0x7}}, @TCA_CBQ_RATE={0x10, 0x5, {0x4, 0x2, 0x2, 0x7, 0x1, 0x7fffffff}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x22, 0x1, 0x5, 0xf, 0x7ff, 0x8ee, 0x200, 0x5}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0xfff3, 0xfff1}, 0x3, 0x7}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0x0, 0x6}, 0x9, 0x40000000}}]}}, @c_cbq={{0x8}, {0x34, 0x2, [@TCA_CBQ_RATE={0x10, 0x5, {0x6, 0x1, 0x7, 0x6, 0x9, 0x3}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x8, 0x8, 0x2, 0x4c, 0x9, 0xb975}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x4, 0x6, 0x7, 0xb, 0x3, 0xfffffff7}}]}}]}, 0x9a4}, 0x1, 0x0, 0x0, 0x4094}, 0x80) (async) sendmsg$nl_route_sched_retired(r6, &(0x7f0000001000)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x800004}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000600)=@deltclass={0x9a4, 0x29, 0x4, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xffff, 0xfff4}, {0x3, 0xf}, {0x2, 0xfffd}}, [@c_cbq={{0x8}, {0x14, 0x2, [@TCA_CBQ_WRROPT={0x10, 0x2, {0xf3, 0x1, 0x6, 0x80, 0x1, 0x3}}]}}, @c_cbq={{0x8}, {0x894, 0x2, [@TCA_CBQ_WRROPT={0x10, 0x2, {0x7, 0x7, 0x3, 0x9f, 0x6b, 0x6}}, @TCA_CBQ_RATE={0x10, 0x5, {0xc, 0x1, 0x74, 0x2, 0x606, 0x6f}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x85, 0x8, 0xe8, 0xc0, 0xffff, 0x2}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x34, 0x0, 0x1, 0x40, 0x9, 0x6, 0x200, 0x2}}, @TCA_CBQ_RATE={0x10, 0x5, {0xa6, 0x2, 0x4, 0x4d0f, 0x617, 0x7}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x2, 0x8, 0x8, 0x4, 0x4, 0x7}}, @TCA_CBQ_RTAB={0x404, 0x6, [0x8, 0x1, 0x100, 0x9, 0x6, 0x9, 0x184, 0xd, 0x0, 0x7f, 0x0, 0x7fffffff, 0x3, 0x7, 0x200, 0x9, 0xf, 0x6, 0x0, 0x7, 0x6, 0x5, 0x3, 0x4, 0x401, 0x6, 0x5, 0x40, 0x3, 0x9, 0xef5c, 0x4, 0x3, 0x3, 0x1, 0x2, 0x8, 0xfffffff7, 0xe6, 0x8, 0xffff, 0x0, 0x8, 0xb, 0x5, 0x6, 0x0, 0x5, 0x400, 0x3, 0x5, 0xfffffff8, 0x1, 0xc6d, 0x72d8630e, 0x3, 0x7, 0x6, 0x7, 0x5b, 0x1, 0xf1, 0x62, 0x6, 0xfff, 0xc, 0x7f, 0x6, 0x800, 0x6, 0x6, 0x7, 0x0, 0x6, 0x9, 0x5, 0x6, 0x63c9, 0x0, 0x800, 0x6, 0x388, 0x4, 0x5, 0x7, 0x2, 0x6, 0xf, 0x1, 0x3ff, 0x401, 0x2, 0x3, 0x1, 0x6d, 0x7, 0x5, 0x41d1, 0x8, 0xff, 0x7ff, 0xf, 0x6, 0x2, 0x4, 0x4, 0x6, 0xfff, 0x3, 0x53, 0x2, 0x56, 0x80000001, 0xf, 0x5, 0xfffffffd, 0x6, 0xc, 0x4, 0xffff, 0x1, 0xa52, 0x401, 0x7ff, 0xa, 0xb, 0x6, 0x3, 0xfffffff8, 0x3, 0x3ff, 0x6, 0x5, 0x4, 0xea, 0x81, 0x9, 0xffff8000, 0xe, 0x5, 0x4, 0x7, 0x4, 0x0, 0x5, 0x40, 0xfffffff8, 0x4, 0x8, 0x1, 0x4041, 0x27, 0x9bc, 0x1, 0x2, 0x10, 0xa, 0x7fff, 0xfffffffc, 0x5, 0x3, 0x5, 0x0, 0x1, 0x7f, 0x0, 0x8, 0x0, 0x779, 0x7, 0x200, 0x8, 0x1, 0x1fc, 0x6, 0x7, 0x9, 0x0, 0x1ff, 0x2, 0xfffffe9b, 0x4, 0x8, 0x9, 0x401, 0x1, 0x2, 0x6, 0x2, 0x5, 0x80000001, 0x1, 0xffffffff, 0xcbb6, 0xe3, 0x10000, 0x8, 0x3, 0x86, 0x1, 0x1, 0x2, 0x2, 0xd, 0x5, 0x4, 0x1, 0x100000, 0xe, 0x3, 0x0, 0x5, 0x7, 0x8, 0x1, 0x0, 0x8001, 0x9, 0x9, 0x4, 0x90, 0x1, 0x9, 0x5, 0xd690, 0x0, 0x0, 0xffffffff, 0xfffffc00, 0x4, 0x0, 0x6, 0x8001, 0x8, 0x8, 0xb, 0xfffffffe, 0x7, 0xfffffffa, 0xfce1, 0xfffffff8, 0x0, 0x8, 0x8, 0x400, 0x2, 0xe3, 0x3, 0x1000, 0x9, 0x4, 0x0, 0x1, 0x0, 0x100000, 0x14]}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x5, 0x7, 0x4, 0xe5, 0xdd1, 0x2}}, @TCA_CBQ_RATE={0x10, 0x5, {0x1, 0x2, 0x1ff, 0x0, 0xb357, 0xb8}}, @TCA_CBQ_RTAB={0x404, 0x6, [0xe321, 0x40, 0x356a6e72, 0xfffffffc, 0xfff, 0x8, 0x2, 0x7, 0x5f8, 0x5a7c, 0x4, 0x3ff, 0xffff, 0x3, 0x400, 0x5, 0x9, 0x3, 0xc, 0x7, 0x200, 0x401, 0x8, 0xb, 0x2, 0x4, 0xfffffffe, 0x4, 0x1, 0xfffffffb, 0x8, 0x6, 0x3, 0x7, 0x200, 0xfa2a, 0x10000, 0x9fc, 0x800, 0x9, 0x8, 0x0, 0x7, 0x4, 0xfffffff9, 0x1, 0x6, 0x5, 0xfff, 0x4, 0x2, 0x9, 0xa, 0x1000, 0x1, 0x5, 0x8000, 0x40, 0x5, 0x1, 0xfffffe01, 0x1ff, 0x0, 0x6bdc, 0x9e, 0xfffffffe, 0x5, 0x100, 0x10, 0x1, 0xc, 0xbc, 0x1, 0x5, 0x0, 0x5, 0x4, 0x90c, 0x7, 0xfffffff8, 0x101, 0xdf8, 0x80, 0x92, 0x8000, 0xab6, 0x6, 0x3, 0x9, 0x8, 0x5, 0x4, 0x8, 0x1, 0x6, 0x3, 0xe44f, 0x10000, 0x7, 0x10, 0x3, 0x4, 0x0, 0x6, 0x905d, 0x3, 0x1, 0x5, 0x2, 0x9, 0x401, 0xfffffffb, 0x8, 0x9, 0x8, 0x1, 0x7, 0x3, 0x4, 0x5, 0x20bf, 0x2, 0xd, 0x0, 0xc, 0x4, 0x7, 0x6, 0x0, 0x2, 0x8, 0x7, 0x64ca, 0xfffffffa, 0x8000, 0x4, 0x400, 0x9, 0x400, 0x30fc, 0x401, 0x9, 0x9, 0x638c, 0x8000, 0x7, 0x10000, 0x6, 0x9, 0x8, 0xff, 0x5, 0xe, 0x1000, 0x9, 0xde4d, 0x101, 0x1, 0x56, 0x8f5e, 0xe1, 0x779, 0xc, 0x6, 0xff, 0x0, 0x9, 0xb, 0x33b, 0x9, 0x5, 0x2, 0x9, 0x8, 0x3, 0x1, 0x2, 0x1, 0x8, 0x3, 0x8000, 0x5bf, 0x6, 0x401, 0x1e6, 0xffff8000, 0x1, 0xfffffff4, 0x7, 0x41c, 0x5, 0x5, 0x0, 0x8000, 0x0, 0x3, 0xe0000000, 0x7a2, 0xffff, 0x7, 0xfffffff7, 0x8, 0xfffffffd, 0x9, 0x7, 0xffff, 0xe, 0x0, 0x2, 0x9, 0xc1, 0xf0, 0x2, 0x2, 0x4, 0x0, 0x2, 0x4, 0x40, 0xc4, 0x9, 0x4, 0x6, 0x3, 0x3, 0xe4f2, 0x9, 0x101, 0x2, 0x3, 0x99, 0x800, 0x5, 0xc02, 0x7, 0x6, 0x6, 0x9, 0x8, 0x8, 0xffffffc0, 0x3, 0x2, 0x7, 0x8, 0x4, 0x25, 0x400, 0x2, 0x7, 0x7c1, 0x10, 0xffff, 0xc0000000, 0x1, 0x2]}]}}, @c_cbq={{0x8}, {0x84, 0x2, [@TCA_CBQ_LSSOPT={0x18, 0x1, {0x1a, 0x2, 0x11, 0x5, 0x400, 0x4, 0xa, 0x1}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x0, 0x7, 0x6, 0xd4, 0x4, 0xfff}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0xb, 0x1, 0x0, 0x8, 0x1, 0x7}}, @TCA_CBQ_RATE={0x10, 0x5, {0x4, 0x2, 0x2, 0x7, 0x1, 0x7fffffff}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x22, 0x1, 0x5, 0xf, 0x7ff, 0x8ee, 0x200, 0x5}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0xfff3, 0xfff1}, 0x3, 0x7}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0x0, 0x6}, 0x9, 0x40000000}}]}}, @c_cbq={{0x8}, {0x34, 0x2, [@TCA_CBQ_RATE={0x10, 0x5, {0x6, 0x1, 0x7, 0x6, 0x9, 0x3}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x8, 0x8, 0x2, 0x4c, 0x9, 0xb975}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x4, 0x6, 0x7, 0xb, 0x3, 0xfffffff7}}]}}]}, 0x9a4}, 0x1, 0x0, 0x0, 0x4094}, 0x80) sendmsg$IPSET_CMD_SWAP(r6, &(0x7f0000001140)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001100)={&(0x7f0000001080)={0x50, 0x6, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x81}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000001180), 0x200b00, 0x0) write$tun(r8, &(0x7f00000011c0)={@void, @val={0x3, 0x3, 0x2, 0x6e31, 0xc2, 0x4}, @llc={@llc={0xbc, 0xf4, "8f", "7a3e4591d21b6346041b535b6e310c1790772e8a4355043bf7f105aeee47a3985de307afded78d30eeb72d8c38d30f8b064146914b9c028534bd343a933bf46799ebc2db96934ff7f25e723382b1b9224ab2bc3417b997747e4f28cf8d53f8ad6d9d641941248f98115f2cf6093d851302c32c085bae7a41e56fcf9d70ff"}}}, 0x8b) add_key$keyring(&(0x7f0000001380), &(0x7f00000013c0)={'syz', 0x1}, 0x0, 0x0, 0x0) (async) r9 = add_key$keyring(&(0x7f0000001380), &(0x7f00000013c0)={'syz', 0x1}, 0x0, 0x0, 0x0) add_key$fscrypt_provisioning(&(0x7f0000001280), &(0x7f00000012c0)={'syz', 0x0}, &(0x7f0000001300)={0x1, 0x0, @b}, 0x48, r9) openat$sysfs(0xffffffffffffff9c, &(0x7f0000001400)='/sys/kernel/rcu_expedited', 0x26c280, 0x1) (async) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000001400)='/sys/kernel/rcu_expedited', 0x26c280, 0x1) getsockopt$CAN_RAW_FILTER(r10, 0x65, 0x1, &(0x7f0000001440)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001480)=0x30) request_key(&(0x7f00000014c0)='trusted\x00', &(0x7f0000001500)={'syz', 0x0}, &(0x7f0000001540)='(*{^:\x00', r9) keyctl$revoke(0x3, r9) ioctl$SG_GET_REQUEST_TABLE(r10, 0x2286, &(0x7f0000001580)) (async) ioctl$SG_GET_REQUEST_TABLE(r10, 0x2286, &(0x7f0000001580)) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001740), r6) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000001800)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x180000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x14, r11, 0x1, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000020) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r1, &(0x7f0000001840)={0x10}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r6, &(0x7f0000001980)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x101}, 0x48184) (async) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r6, &(0x7f0000001980)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x101}, 0x48184) 2.735232845s ago: executing program 2 (id=2510): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x0, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x5, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a00000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000028000000060a010400000000000000000100000008000b40000000010900010073797a3000000000140000001100010000000000000000000000000a6ca9f3f040f5e8921017bfc446d1c437665c81cad37b960b62ae31"], 0x9c}}, 0x0) 2.587561897s ago: executing program 0 (id=2511): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000003580)={0x2, 0x0, @dev}, 0x10) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x48c0) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r3, 0x3b82, &(0x7f0000000200)={0x18, 0x0, 0x2, 0x0, &(0x7f0000000100)=[{0xfffffffffffffffd, 0x4}, {0x5, 0x3752}]}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x2c, 0x17, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}}, 0x4880) setuid(0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xff, 0x86, 0x76, 0x8, 0x424, 0x7800, 0xe941, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x7a, 0xcd, 0x37}}]}}]}}, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x11) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x4}, 0x90) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000c40)='encrypted\x00', &(0x7f0000000c80)={'syz', 0x0}, &(0x7f0000000cc0)='[,\v]@+\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000000e00)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000440)="d4e666e247641d8d52a3ef9c12c8178a747bbd0977ea55bea644a3797cd4bd60faef2cacc01e4d7e7b27f8b0f4dbc1fde22bed4446377541a15dc8a2d0f1146c6c2ad4868908c8982f6ab02197684785fa68", 0x52}], 0x1, &(0x7f0000000740)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r6, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000180)=""/74, 0xf}, {&(0x7f0000000580)=""/66, 0x42}], 0x2}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000140)={0x40, 0xc, 0xfffffffb}) 1.980226144s ago: executing program 2 (id=2512): r0 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000f00), &(0x7f0000000f40)=0x4) 1.780491351s ago: executing program 2 (id=2513): unshare(0x68040200) r0 = socket$packet(0x11, 0x3, 0x300) r1 = io_uring_setup(0x5a9, &(0x7f00000005c0)={0x0, 0xd309, 0x200, 0x0, 0x4}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000020000002c00048028000180070001ff000000001c952017d05f14712a4c352a0002800500030000000000080002400000000908001140000000040900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a040b990005334b7619dcf4181e04da7cc98db77039d81e931c02559884140558edfb3f4ce1a6444da388d15af2019350ddc7f10a54b070edc858f36b51165bfd160755170d8446fe25a0bc8b28b671ec0f6ffcfa5b9e607a351e90a6a7bcb2f3ec7a78ed1b59d15ab7386431db74ddebbcac7ace10db71bb6887c388fff019c5"], 0x80}}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth1_vlan\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="03000300030000000000ab5d71acedd7c9560385dcb188a8", 0x18, 0x0, &(0x7f0000000000)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev}, 0x14) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400200142603600e122f00160006000500a8000600200006400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdfb8951f215ce3bbce81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92782f9ffcdb020e6f3baf26d57a000000000000", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) r5 = socket$kcm(0x29, 0x5, 0x0) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) getsockopt$kcm_KCM_RECV_DISABLE(r5, 0x119, 0x2, 0x0, 0x20000007) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff0000000000010902"], 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_addr=@remote, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$MRT_FLUSH(r6, 0x0, 0xd4, &(0x7f0000000040)=0x8, 0x4) 1.384315442s ago: executing program 3 (id=2514): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x23, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x2, 0x0, 0x1b8, 0x2e0, 0xd0, 0x2e0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x2000}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) 1.228337036s ago: executing program 3 (id=2515): r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc018480b, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x18, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x9c, &(0x7f0000000280)=""/156, 0x41100, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000680)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f00000006c0)=[{0x5, 0x0, 0x0, 0x5}], 0x10, 0x1}, 0x90) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_io_uring_setup(0x2875, &(0x7f00000000c0)={0x0, 0x0, 0x7000000}, 0x0, 0x0) 1.048700812s ago: executing program 4 (id=2516): r0 = fsopen(&(0x7f0000000380)='hfsplus\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, &(0x7f0000000080)='silent\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0xf9fdffff, &(0x7f00000000c0)='nomand\x00', 0x0, 0x0) 854.372495ms ago: executing program 4 (id=2517): msgget$private(0x0, 0x0) msgctl$MSG_STAT_ANY(0x0, 0xd, 0xfffffffffffffffe) socket$inet(0x2, 0x4000000805, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x4, 0x0, &(0x7f0000000000)=0x1) syz_emit_ethernet(0x36, &(0x7f0000001800)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa20080045000028000000000002907800000000ffffffff11e090780000000062ea00000004000000000000"], 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xffffffffffffffca, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) creat(0x0, 0x0) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9463cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r2 = socket(0x840000000002, 0x3, 0x100) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8e37f3", 0x14, 0x2c, 0x0, @remote, @local, {[], {{0x3a00, 0x5, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) lseek(r3, 0x0, 0x0) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) sendmmsg$inet(r2, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r5, 0xaf01, 0x0) r6 = eventfd2(0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x4008af20, &(0x7f0000000100)={0x1, r6}) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r6}) write$eventfd(r6, &(0x7f00000000c0), 0x8) 573.950618ms ago: executing program 1 (id=2518): bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sysvipc/msg\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x8000000000000000, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mremap(&(0x7f00004f8000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000f99000/0x3000)=nil) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x10001) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r4 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr, 0x80, 0x0}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x41}, 0x18) fsetxattr$system_posix_acl(r6, &(0x7f0000000340)='system.posix_acl_access\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000001000000000000000400fffe0000000000000000000000000000000000000000baee2780088f1de2b5a906666249249144a02acbd8958e33bb80506310cf17ffced7eece7f6417a1ade79ef5a99de1d4e456234135de41708c94900fc0537fb54ca7a9f53c2c53444ca6cd10e724a61bd07b202f7b974173c9b569b74299b17570b5f7293f0c2209ad64fea18ee07b30419b"], 0x24, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000000)={0x8075, {0xf, 0x950, 0x8, 0x4d1, 0x7003, 0x1}}) read$nci(r6, &(0x7f0000000040)=""/32, 0x20) write(r5, &(0x7f0000001b40)="29000000140005b7ff000000040860eb0101b6ff02150014a1e7100596d3134a613e8fa794bd570400", 0x29) 352.494534ms ago: executing program 1 (id=2519): r0 = socket$kcm(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d00)={0x0, 0x4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000c40)=[{}, {}, {0x0, 0x0, 0x0, 0x4}]}, 0x90) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = syz_io_uring_setup(0x3665, &(0x7f00000003c0)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0xa3d, 0x0, 0x0, 0x0, 0xff39) syz_clone(0x20000011, 0x0, 0x0, 0x0, 0x0, 0x0) poll(&(0x7f0000b2c000)=[{}], 0x2c, 0xffffffffffbffff8) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000003c0)="a4e5b02d1c7ffa7b68b5c942445bc327fb0283ec570f6b01c1a767b1b8acab91febb0760616d1e163fd58bcd74265405868f9299f0cbeb2d33c1d3bb97901a77f03d4af07dffc18482e604d26d48977724b274d9e046320dabcf3c71b6ab25cbb7605166c53f0d652bc08c6735fde42e69b31f589199aba1028e9b6ead6dd49db6259f5204ab946ab1d638db9fc0a2a3c9d245da78c300e9db57a87fa4015a3b841477616fb87111671981a5f6cb841503465f4c9a29e914a5826df91b2c1d0d130ff6e2ffd9589417d587ed3aa5ebb7c73af9ea33fc8ce2263514d7aea795c68e4f55389fc263ca28d515032b37e9ab6b9e0f4cc2f7e50c5856280989c0fc0ecb4a16b2417bee0606394ee20a76d64be08900eedf5ab1a004e382ba526ac9cce3b915a5a35ae7e93f3d10591f921f8503683451cbf8137d7564f0b2acc5f11df1629892ab7c926a97f66f02641287f950f0ac756c6d3377452fb5b495bc706c3f5b4b2e23ca1a2b84adb79ca73acce8d377a4d99c8f56b6f6b956dfb458e8eb96aa50cec11a90da84c9b6bb867c98d69a69ed5b4fbb069864a92ea9c9e885b21ccb120df669d4c9fd29e81ab3763001c1485be5d82cf46dd87c9ad36612f57b3ace8173a8dd455214f6cfab2cb7894a7f5d6bc08ef8e697ae86d076ba5a291b1fdee071b73c525c6de0e78580d7c6156a8f7b7fc4e236fb0d6aff75e10629fdc99d1ab3cfcb9b03f64653ecc8bb5b69eb57f90ce92cc30c6e3eb06fa984805cb35c841fad9f72b26cbc993dcb6bed925b0201f9ba482b7f9797f02441f9a5f36a285b8728b883fbc23c34eadca443f0a611b08034bb4896b8fad7f4357a032bde001dc8f467e99c2c0f72fa1059e36c6fc348a33e8eccdbd2ec5f6f4853cccaa3dbd70547bba6968c8187cb05095d6f7a29434099ac48c49b58854e4ba0f48813e4596a5b1140887f697b9bf2615fa96490a5f25328768099399a9fc6d942e86112af2024e5911f2d64e4cfd04a405e2f5a27120c547e48e1af647d19015540701faf706c2263976de6616f365cfef3ed64b85834b7252eb3165f8c86db134a2ae2f0ea3735f49d148f10f640661b2d4329eab4dcb9e04186643f6f18e5c96f79e139f8e541c1dbe2f62bea14953b4896ac46b81c3a8298e7819448e461317ce2b13aa0bc1e135355ad9a1c5c2ba410917a751d7e0dc4db52eb46bdaad9b20f3bbcc4f2fb23c24ed006dce16b0bc6e4b5deeffd22a607ed7fafc9c464d925c7268468ebfe25770b18e3457e0268d8cf32d82ca3fd5a391bfa7c333490f6264fd213bcefbd2b17dfbb0a5ae961d3994478bf5ac6d88e8986b8351d105862cd9f05b0bfc8bd6d54fb2d50d642da92c1165f06ec4baf7a9c87d984439927b835d7087f28e82d9d2e0312986beaf9b1d7efa95d7bff2c72bbc7419b902b58bb0f1bbf0071aec1098122579b301302b7ddd49385c7c9172ba3cc1aae62760836e156fbc59c9292220cf437550f6c27a23049cce5a2c8f1cbd86f61b26ce5453db05a26771efdf46e96ef78cf061520aa769b0b5d30ff83f31920be55227b2385286eaeac2d44e91a10bb22a5d80e7906439d6635c9ae1fbe30318c80758665eb68794039fe9d9d945874aa18ec942f526b81ca277e223329a50fa209088677a75c43f88e5f555b8156fc572f6710d8d4e6cd608294f0ab05c2d0d992ff8f6365ff784596874f2dc12ab6952a2f2d693ccf3d624d53fd56894826e78dc01f95a65d65f1370c330755112809604f48a28528b0004cc0c1957561ca5b97e6b68bed39ead403c8d6116cfb3a30bc37828cb76573ab65f2c4d738891a5cf23bf6ed449f3fe743a5ebaea84bd031fe7e32c1499510b123d7a9e6116beea49cd2286e7ce2a0687c560eeb55634655c322a34243319dbfdecf53b5199c4905d85c8cf133f5a17dfc48683578902eafcf4b63e13fb36c9798610afec95b961f6215f1f44275bd7ea02daeefe09a1227b86a891ba133ff2686f11ad71f2d40f53f61d0f561ce4d3305c83a41467dfabc3c2664b21cb8edbe6dabde62205ca8e79eec12ea8ae3228a25758f136d5492d6b6736a9b2a49b4563494aaf535afa9655eef94078f04f5c1cb385123ce95610a2d0bc2886e76903d1eda0a8e40710ba53d94df3ec8d4fac4bc3c7dedad541cd5b580478a2432b2aa2fcaa0649bf2b46f4ecd90e55a576a236b2daf322b33b76b32341589ae5aff45d48e55664a3025557497a6ebf6219d90da0b044615157d860f87cbd9466c8cfee47c8281a61ca4e2e6ee7a5e515ef19e308c915c363bf3e536ec5e44ce08892645c55f94d844abdd11455499c396af31342af32d0bbe93eb2ecf3c93258b41a220681f7ac84ffbc5939eb0c7cbfb59764484e5886e0fa50ffb55817b6cfcdaab64054b2d5a673b4fdeb849eadb8a6699ebb295f973db7f4ec0ac65182d284a5753d3954e439ee0124c3dd95603a389ee54d1313f4da95ac251f31fe77211ce1c3fee6c7bc8de376b12b4836ae4b26e1e9d73368be43cc93a0c4e6cb42596357d58ade783af7d2eaed445e4ac899c7749327ef8618f5187df9f7b37ccb497bab8776984397a521b442b51cabce7144c37520896aa77733a85a4bd3a2b13a721ea509ca17aa8df71156cc612b91330418fc6ba8eee7ce04d611a687a32c4c50a5690f564c9e65197e6212dd9a3e30eefcccc307407e0a975aa5b43069d2ed447d209dd110598f9622fbe573db976c5f4bef82f5474dd0ea5bfe736e0f3f969bb38469839ff24b7157e6b8846b4710d7ad7f3cc3ac3be89160b9b429a899d4722fefaf6b05e540afae163b1a1a88deba6ea8501c375e856c5997dd6587a8a02c910df6ea9516c8d9e9a2422e980b5c044d4e57a2fb3f8c39a749176669f22d270dbca7cd656e88d2467271e38f79748205af3e8c154d74253e5223fe00ef53df3acdddc732d1139b6e6ce3382c7d0aa5885f1c98c53cedc5c4850eed9393277516a125c96d61b8319771a83fb02ff0e6cde27ce894ecfc4b42695b45037ebc6db705a661e29e031509b2eaa4dd48a2fe9768440278ffd9dbdca1a36b788fee353c45b2197be3805feea42012efdbecc6521dd0e24271a16", 0x8a7}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e03002a000b05d25a806c8c6f94f90424fc601100077a0a000312050282c137153e370e0c1180fc0b0c000300", 0x2e}], 0x1}, 0x4010001) memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local, {[@generic={0x7, 0x2}, @timestamp_addr={0x44, 0x4, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010100000000105801000100000000000109022400010000002009040000010300000009210000000122dc01090589"], 0x0) r5 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r5, &(0x7f0000000a00)={&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000500)=[{&(0x7f0000000280)="c109000000000000001d1e010271261c", 0x10}], 0x1}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0x4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}]}, 0x38}}, 0x0) r7 = fanotify_init(0x200, 0x0) r8 = memfd_create(&(0x7f0000001440)='-\x88\x8cG\xf3\xbd\xbd\xe2\xd0@\x1e\x8b\xf4\x87\xe5I\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdbQ\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x1e\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf8\xdah\x94:\x9cc\x10d\xee\xa7\x8b\x066\xb8G\xd1c\xe1$\xe8\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xf5\xcc\x82n=\x7f=\xcdJxR\xa5~\xb80a\xa9\xb2\x04K\x98\x93=\xabw\x05\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00_\x99=\x12\xb3\x15\x1b?\xd7\x95\xc4\x85y\xef\xef\xff\xff\xff\xff\xff\xff\xff\xff\xb3\x02\x03\x00\x00\x00\x00\x00\x00\x00\xf6\xed\xc7\x80\xa5Pj\xa4\x06', 0x0) r9 = dup(r8) fanotify_mark(r7, 0x1, 0x4000007b, r9, 0x0) write$cgroup_pid(r9, &(0x7f0000000040), 0x12) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x8, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @remote, {[@timestamp_addr={0x44, 0x4, 0xb3, 0x1, 0xa}, @lsrr={0x83, 0x3, 0x84}, @ra={0x94, 0x4, 0x1}]}}}}}) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240), 0x208e24b) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r11, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010600000000000000000900000024000480130001"], 0x38}}, 0x0) 160.614089ms ago: executing program 0 (id=2520): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x0) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqsrc(r3, 0x0, 0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) (async) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYRESHEX, @ANYBLOB="59d878bbcd92051af42e028cfacd8f5ad6ee4c74077d2511e3e41ac7be78c17bb2eabc012b4146afc4b54325", @ANYBLOB, @ANYRESHEX=r1, @ANYRES64, @ANYRES32=r1, @ANYRES16=r3, @ANYRESDEC=0x0], 0x64}}, 0x8004) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0xbf22}, 0x48) (async, rerun: 64) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.current\x00', 0x275a, 0x0) (async, rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='sys_exit\x00'}, 0x10) (async) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) setsockopt$inet_udp_int(r4, 0x11, 0x67, &(0x7f00000001c0)=0x7, 0x4) (async) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x20001400) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x67000000}, 0x90) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x802, 0x0) writev(r7, &(0x7f0000000300), 0x0) (async) ioctl$TUNSETOFFLOAD(r6, 0x4010744d, 0x20000000) (async) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0xfea7) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETLED(r8, 0x4b63, 0x4) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x49, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r5], 0x38}}, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r10 = syz_io_uring_setup(0x1173, &(0x7f0000000280)={0x0, 0x311b, 0x400, 0x4, 0x2da}, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3000000, 0x30, r10, 0x10000000) (async) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000002300)={0x84}, 0x10) 0s ago: executing program 0 (id=2521): keyctl$restrict_keyring(0x3, 0xfffffffffffffffb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000940)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x1) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x40, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x40}}, 0x0) ioctl$TCSETSW2(r0, 0x5435, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r2, &(0x7f0000000240)=[{&(0x7f0000001a80)=""/102386, 0x18ff2}], 0x1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='setgroups\x00') sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005b40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000400)="be86bee2eb7cd52386acbb852ef2ebfda2d635ec067e1fc8400449f82e43b51d0168731ec0992b0ffbf3cbee93516f17fa696e61098f947b0b994137c75b1f893b3e28a654dd286f7ff4b835d8fb5e878ea5e35e54a67ae574ffbdfe1a57dc5015027d1855bb0306fd73c454fef0cb925471981085874a5348a65d2afa17dadd73b7e43492722b8d2d5377b66f274f4b08c2a4ad6346ba38ec0744aa7e0528e560a728dae79bfaef2d164b941b7d663d1bee93", 0xb3}], 0xbe7d6019aadec558}}, {{0x0, 0x0, &(0x7f0000004240)=[{&(0x7f0000003140)}], 0x1}}], 0x2, 0xc080) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) write$UHID_INPUT2(r3, &(0x7f0000000340)={0xc, {0x8c, "c2d8793510addf5a1d56bbed12c5f858f80a6481c85689cefef59cad05f9761391f97041ed94263c493eca15026746c3084346aca0abd92d9d248f3aef127bfcb1999fa3d0b84f4cef60b72753b58627f3509bf5090e4b89ddf55b7e29da13f5c6aa66009d15441856a3bde9f3054af49960bb0a130a4b0a72f768e75e491aacab7b2bec427b1214a89d5fcd"}}, 0x92) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000f40)=[{{0x0, 0xcb000000, 0x0}}], 0x28000, 0x0) kernel console output (not intermixed with test programs): 1 - 0 [ 554.882309][ T11] bridge_slave_1: left allmulticast mode [ 554.891394][ T11] bridge_slave_1: left promiscuous mode [ 554.926975][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.968051][ T11] bridge_slave_0: left allmulticast mode [ 554.976949][ T11] bridge_slave_0: left promiscuous mode [ 554.982844][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.178501][ T29] audit: type=1326 audit(1722485676.848:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14750 comm="syz.2.2223" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd4d1d773b9 code=0x0 [ 555.528636][ T5231] Bluetooth: hci8: command tx timeout [ 555.655704][ T940] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 555.880508][ T940] usb 3-1: too many configurations: 18, using maximum allowed: 8 [ 555.900935][ T940] usb 3-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 555.911275][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 555.920555][ T940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.928899][ T5231] Bluetooth: hci6: command tx timeout [ 555.956230][ T940] usb 3-1: config 0 descriptor?? [ 555.972860][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 555.973875][ T940] gspca_main: 0c45:8001 too many config [ 556.013529][ T11] bond0 (unregistering): Released all slaves [ 556.042039][T14734] chnl_net:caif_netlink_parms(): no params data found [ 556.175013][ T8] usb 3-1: USB disconnect, device number 83 [ 556.263179][T14764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.294975][T14764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.543261][T14764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.555769][T14764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.594301][T14734] bridge0: port 1(bridge_slave_0) entered blocking state [ 556.615679][T14734] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.633606][T14734] bridge_slave_0: entered allmulticast mode [ 556.639727][T14777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.640018][T14777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.667378][T14734] bridge_slave_0: entered promiscuous mode [ 556.688498][T14734] bridge0: port 2(bridge_slave_1) entered blocking state [ 556.701378][T14734] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.721429][T14734] bridge_slave_1: entered allmulticast mode [ 556.741739][T14734] bridge_slave_1: entered promiscuous mode [ 556.767184][T14773] bridge_slave_1: left allmulticast mode [ 556.773896][T14773] bridge_slave_1: left promiscuous mode [ 556.795671][T14773] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.957537][T14682] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 556.983292][T14682] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 557.016891][ T11] hsr_slave_0: left promiscuous mode [ 557.040861][ T11] hsr_slave_1: left promiscuous mode [ 557.055867][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 557.065791][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 557.074251][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 557.083995][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 557.137239][ T11] veth1_macvtap: left promiscuous mode [ 557.144453][ T11] veth0_macvtap: left promiscuous mode [ 557.154766][ T11] veth1_vlan: left promiscuous mode [ 557.162205][ T11] veth0_vlan: left promiscuous mode [ 557.561082][T14794] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 557.615929][ T5231] Bluetooth: hci8: command tx timeout [ 558.005629][ T5231] Bluetooth: hci6: command tx timeout [ 558.127741][ T11] team0 (unregistering): Port device team_slave_1 removed [ 558.193592][ T11] team0 (unregistering): Port device team_slave_0 removed [ 558.733797][T14734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 558.780122][T14734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 558.835557][T14682] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 558.934539][T14804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.966770][T14804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.980302][T14682] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 559.029006][T14734] team0: Port device team_slave_0 added [ 559.040280][T14734] team0: Port device team_slave_1 added [ 559.133099][T14734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 559.147297][ T940] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 559.154832][T14734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 559.187061][T14734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 559.216084][T14734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 559.223673][T14734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 559.287402][T14734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 559.359218][ T940] usb 3-1: Using ep0 maxpacket: 16 [ 559.378588][ T940] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 559.410664][ T940] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 559.429959][ T940] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 559.459885][ T940] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 559.498121][ T940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.532675][ T940] usb 3-1: config 0 descriptor?? [ 559.564220][T14734] hsr_slave_0: entered promiscuous mode [ 559.606472][T14734] hsr_slave_1: entered promiscuous mode [ 559.695701][ T5231] Bluetooth: hci8: command tx timeout [ 559.974917][ T940] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0013/input/input43 [ 560.086436][ T5231] Bluetooth: hci6: command tx timeout [ 560.132862][T14832] bridge_slave_1: left allmulticast mode [ 560.166605][T14832] bridge_slave_1: left promiscuous mode [ 560.172422][T14832] bridge0: port 2(bridge_slave_1) entered disabled state [ 560.229681][ T940] microsoft 0003:045E:07DA.0013: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 560.303477][ T940] usb 3-1: USB disconnect, device number 84 [ 560.459190][T14682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 560.509391][T12239] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 560.562436][T14682] 8021q: adding VLAN 0 to HW filter on device team0 [ 560.642840][ T5273] bridge0: port 1(bridge_slave_0) entered blocking state [ 560.650102][ T5273] bridge0: port 1(bridge_slave_0) entered forwarding state [ 560.716026][ T3152] bridge0: port 2(bridge_slave_1) entered blocking state [ 560.723244][ T3152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 560.753859][T12239] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 560.776464][T12239] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 560.798726][T12239] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.841469][T12239] usb 5-1: config 0 descriptor?? [ 560.869549][T12239] pwc: Askey VC010 type 2 USB webcam detected. [ 561.080257][T12239] pwc: send_video_command error -71 [ 561.101042][T12239] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 561.127076][T12239] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 561.165847][T12239] usb 5-1: USB disconnect, device number 78 [ 561.249188][T14682] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 561.469611][T14734] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 561.478866][T14866] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 561.494981][T14682] veth0_vlan: entered promiscuous mode [ 561.504761][T14734] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 561.522939][T14734] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 561.540896][T14734] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 561.569510][T14682] veth1_vlan: entered promiscuous mode [ 561.676372][T14682] veth0_macvtap: entered promiscuous mode [ 561.689246][T14682] veth1_macvtap: entered promiscuous mode [ 561.696047][T12239] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 561.757887][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.770748][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.781322][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.792887][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.802945][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.813549][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.823512][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.835109][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.848270][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.858893][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.869075][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.880502][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.890417][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.901054][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.911347][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.922644][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.923845][T12239] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 561.944180][T12239] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 561.950308][T14682] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 561.953838][T12239] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.980567][T12239] usb 5-1: config 0 descriptor?? [ 562.002244][T14734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 562.027882][T12239] pwc: Askey VC010 type 2 USB webcam detected. [ 562.047098][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.079292][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.105394][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.125651][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.154109][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.165784][ T5231] Bluetooth: hci6: command tx timeout [ 562.172713][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.183585][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.198173][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.209042][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.221009][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.231858][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.250556][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.262389][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.273454][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.283979][T14682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.305004][T14682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.329014][T14682] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 562.350265][T14682] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.364643][T14682] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.379953][T14682] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.389250][T14682] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.406360][ T5275] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 562.473534][T14734] 8021q: adding VLAN 0 to HW filter on device team0 [ 562.509453][ T3152] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.516731][ T3152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 562.527300][T12239] pwc: recv_control_msg error -32 req 02 val 2b00 [ 562.537556][T12239] pwc: recv_control_msg error -32 req 02 val 2700 [ 562.545079][T12239] pwc: recv_control_msg error -32 req 02 val 2c00 [ 562.567895][T12239] pwc: recv_control_msg error -32 req 04 val 1000 [ 562.579640][T12239] pwc: recv_control_msg error -32 req 04 val 1300 [ 562.597660][T14837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.606408][T12239] pwc: recv_control_msg error -32 req 04 val 1400 [ 562.620748][ T5275] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 562.626101][T14837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.642289][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.649580][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 562.668017][T12239] pwc: recv_control_msg error -32 req 02 val 2000 [ 562.670363][ T5275] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 562.676338][T12239] pwc: recv_control_msg error -32 req 02 val 2100 [ 562.692995][ T5275] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 562.704499][T12239] pwc: recv_control_msg error -32 req 04 val 1500 [ 562.712873][T12239] pwc: recv_control_msg error -32 req 02 val 2500 [ 562.749946][ T5275] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.787880][ T5275] usb 3-1: config 0 descriptor?? [ 562.861878][ T1052] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 562.884215][ T1052] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 562.922540][T14734] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 562.936178][T12239] pwc: recv_control_msg error -32 req 02 val 2600 [ 562.955894][T12239] pwc: recv_control_msg error -32 req 02 val 2900 [ 562.979228][T12239] pwc: recv_control_msg error -71 req 02 val 2800 [ 562.997259][T12239] pwc: recv_control_msg error -71 req 04 val 1100 [ 563.006284][T12239] pwc: recv_control_msg error -71 req 04 val 1200 [ 563.035735][T12239] pwc: Registered as video71. [ 563.042194][T12239] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input44 [ 563.093905][T12239] usb 5-1: USB disconnect, device number 79 [ 563.164288][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 563.193194][T14734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 563.204591][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 563.294832][ T1269] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.303094][ T1269] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.333199][ T5275] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 563.357543][T14734] veth0_vlan: entered promiscuous mode [ 563.401455][T14734] veth1_vlan: entered promiscuous mode [ 563.407627][ T5275] cp2112 0003:10C4:EA90.0014: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 563.481878][T14897] vlan2: entered promiscuous mode [ 563.530818][ T5275] cp2112 0003:10C4:EA90.0014: Part Number: 0x82 Device Version: 0xFE [ 563.561204][T14734] veth0_macvtap: entered promiscuous mode [ 563.590129][T14734] veth1_macvtap: entered promiscuous mode [ 563.649006][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.672159][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.685239][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.699182][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.712159][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.733266][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.733493][ T5275] cp2112 0003:10C4:EA90.0014: error requesting SMBus config [ 563.779530][ T5275] cp2112 0003:10C4:EA90.0014: probe with driver cp2112 failed with error -32 [ 563.784745][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.829721][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.860166][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.891173][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.911490][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.935397][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.955399][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.976091][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.990721][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 564.003120][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.013830][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 564.024594][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.037429][T14734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 564.055571][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.066832][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.088072][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.111089][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.131610][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.149960][T14919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.163749][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.166793][T14919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.174604][ T5275] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 564.215781][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.235680][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.247470][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.275340][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.285202][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.316510][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.335041][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.355662][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.376574][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.400754][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.423302][T14734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.438459][ T5275] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 564.447926][ T5275] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.450073][T14734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.470723][ T5275] usb 5-1: config 0 descriptor?? [ 564.481186][T14734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 564.484333][ T5275] cp210x 5-1:0.0: cp210x converter detected [ 564.556886][T14734] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.575228][T14734] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.594618][T14734] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.625604][T14734] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.893845][T14911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.905793][ T5275] cp210x 5-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 564.930493][T14911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.941536][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 564.967182][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 564.993460][ T5275] usb 5-1: cp210x converter now attached to ttyUSB0 [ 565.125633][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 565.156284][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 565.217594][ T5275] usb 5-1: USB disconnect, device number 80 [ 565.248489][ T5275] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 565.284621][ T5275] cp210x 5-1:0.0: device disconnected [ 565.353169][ T940] usb 3-1: USB disconnect, device number 85 [ 565.365589][ T5223] Bluetooth: hci1: command 0x0406 tx timeout [ 565.871550][T14959] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 566.346977][ T29] audit: type=1326 audit(1722485688.018:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.392173][ T29] audit: type=1326 audit(1722485688.018:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.509888][ T29] audit: type=1326 audit(1722485688.018:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.565023][ T29] audit: type=1326 audit(1722485688.018:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.568367][T14968] FAULT_INJECTION: forcing a failure. [ 566.568367][T14968] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 566.628524][ T29] audit: type=1326 audit(1722485688.038:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.629355][T14968] CPU: 0 UID: 0 PID: 14968 Comm: syz.3.2253 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 566.661634][T14968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 566.671714][T14968] Call Trace: [ 566.675011][T14968] [ 566.677956][T14968] dump_stack_lvl+0x241/0x360 [ 566.682665][T14968] ? __pfx_dump_stack_lvl+0x10/0x10 [ 566.687894][T14968] ? __pfx__printk+0x10/0x10 [ 566.687968][ T29] audit: type=1326 audit(1722485688.038:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.692491][T14968] ? __pfx_lock_release+0x10/0x10 [ 566.692524][T14968] ? _raw_spin_unlock_irq+0x23/0x50 [ 566.692548][T14968] should_fail_ex+0x3b0/0x4e0 [ 566.729733][T14968] _copy_from_user+0x2f/0xe0 [ 566.734354][T14968] snd_seq_write+0x31c/0xab0 [ 566.739068][T14968] ? __pfx_snd_seq_write+0x10/0x10 [ 566.744224][T14968] ? security_file_permission+0x7f/0xa0 [ 566.747776][ T29] audit: type=1326 audit(1722485688.038:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.749785][T14968] ? rw_verify_area+0x1d2/0x6b0 [ 566.749815][T14968] ? __pfx_snd_seq_write+0x10/0x10 [ 566.773753][ T29] audit: type=1326 audit(1722485688.038:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.777108][T14968] vfs_write+0x2a2/0xc90 [ 566.777145][T14968] ? __pfx_vfs_write+0x10/0x10 [ 566.777169][T14968] ? __fget_files+0x29/0x470 [ 566.777195][T14968] ? __fget_files+0x3f6/0x470 [ 566.777217][T14968] ? __fget_files+0x29/0x470 [ 566.777252][T14968] ksys_write+0x1a0/0x2c0 [ 566.777286][T14968] ? __pfx_ksys_write+0x10/0x10 [ 566.777310][T14968] ? do_syscall_64+0x100/0x230 [ 566.777336][T14968] ? do_syscall_64+0xb6/0x230 [ 566.786813][ T29] audit: type=1326 audit(1722485688.038:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 566.804698][T14968] do_syscall_64+0xf3/0x230 [ 566.804733][T14968] ? clear_bhb_loop+0x35/0x90 [ 566.804754][T14968] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.804779][T14968] RIP: 0033:0x7f4e323773b9 [ 566.804798][T14968] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 566.804813][T14968] RSP: 002b:00007f4e331c8048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 566.804834][T14968] RAX: ffffffffffffffda RBX: 00007f4e32505f80 RCX: 00007f4e323773b9 [ 566.804848][T14968] RDX: 000000000000ffc8 RSI: 0000000020000000 RDI: 0000000000000003 [ 566.804859][T14968] RBP: 00007f4e331c80a0 R08: 0000000000000000 R09: 0000000000000000 [ 566.804872][T14968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 566.804882][T14968] R13: 000000000000000b R14: 00007f4e32505f80 R15: 00007f4e3262fa38 [ 566.804907][T14968] [ 567.116338][ T29] audit: type=1326 audit(1722485688.038:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14947 comm="syz.3.2248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e323773b9 code=0x7fc00000 [ 567.446843][T12239] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 567.637101][T12239] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 567.674169][T12239] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.693823][T12239] usb 3-1: config 0 descriptor?? [ 567.710586][T12239] cp210x 3-1:0.0: cp210x converter detected [ 568.126569][T12239] cp210x 3-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 568.127307][T14987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.148717][T14987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.177928][T12239] usb 3-1: cp210x converter now attached to ttyUSB0 [ 568.220282][T14996] IPVS: sync thread started: state = BACKUP, mcast_ifn = dummy0, syncid = 0, id = 0 [ 568.228888][T14994] IPVS: stopping backup sync thread 14996 ... [ 568.265905][ T940] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 568.375147][T12239] usb 3-1: USB disconnect, device number 86 [ 568.386240][T12239] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 568.455648][T12239] cp210x 3-1:0.0: device disconnected [ 568.467559][ T940] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 568.507128][ T940] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 568.533349][ T940] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 568.560010][ T940] usb 1-1: New USB device found, idVendor=28bd, idProduct=1903, bcdDevice= 0.00 [ 568.580334][ T940] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.609026][ T940] usb 1-1: config 0 descriptor?? [ 568.720022][T14998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 568.734313][T14998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 569.111941][T15002] bridge_slave_1: left allmulticast mode [ 569.129337][T15002] bridge_slave_1: left promiscuous mode [ 569.145576][T15002] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.230878][T15004] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.805660][T13681] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 569.995402][T13681] usb 3-1: Using ep0 maxpacket: 8 [ 570.002717][T13681] usb 3-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice=7f.01 [ 570.013312][T13681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.033653][T13681] usb 3-1: config 0 descriptor?? [ 570.043740][T13681] usb 3-1: unknown interface protocol 0x3f, assuming v1 [ 570.054422][T13681] usb 3-1: cannot find UAC_HEADER [ 570.075487][T13681] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 570.119098][T11545] udevd[11545]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 570.399565][T12239] usb 3-1: USB disconnect, device number 87 [ 570.795555][ T5273] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 570.808733][ T5223] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 570.822660][ T5223] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 570.831148][ T5223] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 570.840341][ T5223] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 570.850392][ T5223] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 570.859763][ T5223] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 571.099109][ T5273] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 571.164802][ T5273] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.191987][ T5273] usb 4-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 571.239410][ T940] usbhid 1-1:0.0: can't add hid device: -71 [ 571.277048][ T940] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 571.288024][ T5273] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.336682][ T5273] usb 4-1: config 0 descriptor?? [ 571.342304][ T940] usb 1-1: USB disconnect, device number 65 [ 571.351701][T15029] chnl_net:caif_netlink_parms(): no params data found [ 571.472275][T15029] bridge0: port 1(bridge_slave_0) entered blocking state [ 571.480656][T15029] bridge0: port 1(bridge_slave_0) entered disabled state [ 571.490536][T15029] bridge_slave_0: entered allmulticast mode [ 571.498096][T15029] bridge_slave_0: entered promiscuous mode [ 571.508021][T15029] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.515238][T15029] bridge0: port 2(bridge_slave_1) entered disabled state [ 571.523268][T15029] bridge_slave_1: entered allmulticast mode [ 571.532751][T15029] bridge_slave_1: entered promiscuous mode [ 571.535607][ T8] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 571.598814][T15029] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 571.621964][T15029] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 571.646612][T15045] bridge_slave_1: left allmulticast mode [ 571.652298][T15045] bridge_slave_1: left promiscuous mode [ 571.658865][T15045] bridge0: port 2(bridge_slave_1) entered disabled state [ 571.730299][T15029] team0: Port device team_slave_0 added [ 571.746794][T15029] team0: Port device team_slave_1 added [ 571.747978][ T8] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 571.785367][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.808507][ T8] usb 5-1: config 0 descriptor?? [ 571.818674][ T8] cp210x 5-1:0.0: cp210x converter detected [ 571.834919][T15029] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 571.863376][ T5273] usbhid 4-1:0.0: can't add hid device: -71 [ 571.863914][T15029] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 571.883240][ T5273] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 571.934471][ T5273] usb 4-1: USB disconnect, device number 96 [ 571.945724][T15029] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 571.985086][T15029] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 571.992408][T15029] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 572.019022][T15029] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 572.094884][T15029] hsr_slave_0: entered promiscuous mode [ 572.107066][T15029] hsr_slave_1: entered promiscuous mode [ 572.136879][T15029] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 572.144523][T15029] Cannot create hsr debugfs directory [ 572.168880][T15056] FAULT_INJECTION: forcing a failure. [ 572.168880][T15056] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 572.221662][T15056] CPU: 0 UID: 0 PID: 15056 Comm: syz.0.2284 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 572.232471][T15056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 572.242547][T15056] Call Trace: [ 572.245853][T15056] [ 572.248815][T15056] dump_stack_lvl+0x241/0x360 [ 572.253522][T15056] ? __pfx_dump_stack_lvl+0x10/0x10 [ 572.258739][T15056] ? __pfx__printk+0x10/0x10 [ 572.263412][T15056] ? __pfx_lock_release+0x10/0x10 [ 572.268441][T15056] ? snd_seq_client_enqueue_event+0x37e/0x530 [ 572.274541][T15056] should_fail_ex+0x3b0/0x4e0 [ 572.279253][T15056] _copy_from_user+0x2f/0xe0 [ 572.283874][T15056] snd_seq_write+0x31c/0xab0 [ 572.288510][T15056] ? __pfx_snd_seq_write+0x10/0x10 [ 572.293679][T15056] ? security_file_permission+0x7f/0xa0 [ 572.299258][T15056] ? rw_verify_area+0x1d2/0x6b0 [ 572.304134][T15056] ? __pfx_snd_seq_write+0x10/0x10 [ 572.309364][T15056] vfs_write+0x2a2/0xc90 [ 572.313640][T15056] ? __pfx_vfs_write+0x10/0x10 [ 572.318430][T15056] ? __fget_files+0x29/0x470 [ 572.323301][T15056] ? __fget_files+0x3f6/0x470 [ 572.327976][T15056] ? __fget_files+0x29/0x470 [ 572.332662][T15056] ksys_write+0x1a0/0x2c0 [ 572.337166][T15056] ? __pfx_ksys_write+0x10/0x10 [ 572.342007][T15056] ? do_syscall_64+0x100/0x230 [ 572.346767][T15056] ? do_syscall_64+0xb6/0x230 [ 572.351439][T15056] do_syscall_64+0xf3/0x230 [ 572.355951][T15056] ? clear_bhb_loop+0x35/0x90 [ 572.360623][T15056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.366514][T15056] RIP: 0033:0x7fb198d773b9 [ 572.370918][T15056] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 572.390526][T15056] RSP: 002b:00007fb199b0b048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 572.398944][T15056] RAX: ffffffffffffffda RBX: 00007fb198f05f80 RCX: 00007fb198d773b9 [ 572.406907][T15056] RDX: 000000000000ffc8 RSI: 0000000020000000 RDI: 0000000000000003 [ 572.414870][T15056] RBP: 00007fb199b0b0a0 R08: 0000000000000000 R09: 0000000000000000 [ 572.422835][T15056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 572.430801][T15056] R13: 000000000000000b R14: 00007fb198f05f80 R15: 00007fb19902fa38 [ 572.438789][T15056] [ 572.474859][T15034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 572.477283][ T8] cp210x 5-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 572.509640][T15034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 572.565820][ T8] usb 5-1: cp210x converter now attached to ttyUSB0 [ 572.576350][ T5273] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 572.666944][T15065] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 572.714219][T15029] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.763907][ T5274] usb 5-1: USB disconnect, device number 81 [ 572.775942][ T5273] usb 4-1: Using ep0 maxpacket: 32 [ 572.776344][ T5274] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 572.823195][ T5273] usb 4-1: unable to get BOS descriptor or descriptor too short [ 572.838741][T15029] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.849627][ T5274] cp210x 5-1:0.0: device disconnected [ 572.850740][ T5273] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 572.866359][ T5273] usb 4-1: can't read configurations, error -71 [ 572.897796][ T5231] Bluetooth: hci9: command tx timeout [ 572.964665][T15029] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.005547][ T8] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 573.059187][T15029] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.179531][ T8] usb 1-1: device descriptor read/64, error -71 [ 573.204171][T15029] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 573.214303][T15029] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 573.225240][T15029] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 573.252827][T15029] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 573.413484][T15071] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2289'. [ 573.468254][T15029] 8021q: adding VLAN 0 to HW filter on device bond0 [ 573.475427][ T8] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 573.500649][T15029] 8021q: adding VLAN 0 to HW filter on device team0 [ 573.516887][ T940] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.524165][ T940] bridge0: port 1(bridge_slave_0) entered forwarding state [ 573.559880][ T940] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.567095][ T940] bridge0: port 2(bridge_slave_1) entered forwarding state [ 573.585785][T13681] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 573.655677][ T8] usb 1-1: device descriptor read/64, error -71 [ 573.698204][T15029] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 573.780514][T13681] usb 3-1: New USB device found, idVendor=1d50, idProduct=606f, bcdDevice=14.d4 [ 573.796451][T13681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.797403][ T8] usb usb1-port1: attempt power cycle [ 573.812936][T15029] veth0_vlan: entered promiscuous mode [ 573.818147][T13681] usb 3-1: config 0 descriptor?? [ 573.853612][T15029] veth1_vlan: entered promiscuous mode [ 573.926779][T15029] veth0_macvtap: entered promiscuous mode [ 573.952912][T15029] veth1_macvtap: entered promiscuous mode [ 573.987386][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.001780][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.013283][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.024935][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.035200][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.075839][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.097627][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.112273][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.125485][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.137318][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.148467][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.160898][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.176985][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.188659][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.202035][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.213707][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.227231][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.239608][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.252764][T13681] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 574.253128][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 574.270994][ T8] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 574.283541][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.307432][ T8] usb 1-1: device descriptor read/8, error -71 [ 574.327527][T15029] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 574.400669][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.430706][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.462586][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.473442][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.486634][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.498329][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.521364][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.538660][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.549055][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.562982][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.577077][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.592574][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.603823][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.614991][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.615756][ T8] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 574.637059][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.679058][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.679559][ T8] usb 1-1: device descriptor read/8, error -71 [ 574.708810][T13681] gs_usb 3-1:0.0: Disabling termination support for channel 0 (-EPROTO) [ 574.725650][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.777993][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.789864][T15029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.801346][T15029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.818882][ T8] usb usb1-port1: unable to enumerate USB device [ 574.819799][T15029] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 574.879127][T15029] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.894181][T13681] usb 3-1: USB disconnect, device number 88 [ 574.913287][T15029] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.935379][T15029] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.947232][T15029] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.966098][ T5231] Bluetooth: hci9: command tx timeout [ 575.242933][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 575.259197][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.298229][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 575.307551][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.493115][T15098] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2274'. [ 575.502537][T15098] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2274'. [ 575.766586][T15099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 575.784282][T15105] bridge0: entered allmulticast mode [ 575.809982][T15099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 575.823810][T15105] bridge0: left allmulticast mode [ 575.885538][T15098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 575.920574][T15098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 576.155736][ T5277] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 576.359929][ T5277] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 576.381778][ T5277] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.411509][ T5277] usb 1-1: config 0 descriptor?? [ 576.425429][ T8] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 576.433837][ T5277] cp210x 1-1:0.0: cp210x converter detected [ 576.659481][ T8] usb 4-1: Using ep0 maxpacket: 32 [ 576.688625][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 576.715427][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 576.763249][ T8] usb 4-1: New USB device found, idVendor=0079, idProduct=1801, bcdDevice= 0.00 [ 576.782116][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.856909][ T8] usb 4-1: config 0 descriptor?? [ 576.876686][T15110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 576.888524][ T5277] cp210x 1-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 576.945619][T15110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 577.042729][ T5277] usb 1-1: cp210x converter now attached to ttyUSB0 [ 577.056527][ T5231] Bluetooth: hci9: command tx timeout [ 577.258036][ T5277] usb 1-1: USB disconnect, device number 70 [ 577.305197][ T5277] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 577.325757][T15133] FAULT_INJECTION: forcing a failure. [ 577.325757][T15133] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.356145][T15133] CPU: 0 UID: 0 PID: 15133 Comm: syz.4.2307 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 577.366945][T15133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 577.377015][T15133] Call Trace: [ 577.380281][T15133] [ 577.383197][T15133] dump_stack_lvl+0x241/0x360 [ 577.387863][T15133] ? __pfx_dump_stack_lvl+0x10/0x10 [ 577.393043][T15133] ? __pfx__printk+0x10/0x10 [ 577.397623][T15133] ? __pfx_lock_release+0x10/0x10 [ 577.402636][T15133] ? snd_seq_client_enqueue_event+0x37e/0x530 [ 577.408691][T15133] should_fail_ex+0x3b0/0x4e0 [ 577.413365][T15133] _copy_from_user+0x2f/0xe0 [ 577.417942][T15133] snd_seq_write+0x31c/0xab0 [ 577.422611][T15133] ? __pfx_snd_seq_write+0x10/0x10 [ 577.427708][T15133] ? security_file_permission+0x7f/0xa0 [ 577.433242][T15133] ? rw_verify_area+0x1d2/0x6b0 [ 577.438078][T15133] ? __pfx_snd_seq_write+0x10/0x10 [ 577.443201][T15133] vfs_write+0x2a2/0xc90 [ 577.447435][T15133] ? __pfx_vfs_write+0x10/0x10 [ 577.452199][T15133] ? __fget_files+0x29/0x470 [ 577.456864][T15133] ? __fget_files+0x3f6/0x470 [ 577.461519][T15133] ? __fget_files+0x29/0x470 [ 577.466102][T15133] ksys_write+0x1a0/0x2c0 [ 577.470421][T15133] ? __pfx_ksys_write+0x10/0x10 [ 577.475356][T15133] ? do_syscall_64+0x100/0x230 [ 577.480198][T15133] ? do_syscall_64+0xb6/0x230 [ 577.484874][T15133] do_syscall_64+0xf3/0x230 [ 577.489369][T15133] ? clear_bhb_loop+0x35/0x90 [ 577.494028][T15133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.499915][T15133] RIP: 0033:0x7f4a157773b9 [ 577.504314][T15133] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 577.523906][T15133] RSP: 002b:00007f4a165a9048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 577.532307][T15133] RAX: ffffffffffffffda RBX: 00007f4a15905f80 RCX: 00007f4a157773b9 [ 577.540268][T15133] RDX: 000000000000ffc8 RSI: 0000000020000000 RDI: 0000000000000003 [ 577.548227][T15133] RBP: 00007f4a165a90a0 R08: 0000000000000000 R09: 0000000000000000 [ 577.556182][T15133] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.564133][T15133] R13: 000000000000000b R14: 00007f4a15905f80 R15: 00007f4a15a2fa38 [ 577.572097][T15133] [ 577.575149][ C0] vkms_vblank_simulate: vblank timer overrun [ 577.591985][T15117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.636647][T15117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 577.787529][ T5277] cp210x 1-1:0.0: device disconnected [ 577.926744][ T8] usbhid 4-1:0.0: can't add hid device: -71 [ 577.945859][ T8] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 578.019249][ T8] usb 4-1: USB disconnect, device number 99 [ 578.118597][T15143] vlan2: entered promiscuous mode [ 578.586327][T15159] IPVS: stopping master sync thread 15161 ... [ 578.781388][T15166] team_slave_0: entered promiscuous mode [ 578.787650][T15166] team_slave_1: entered promiscuous mode [ 578.845726][T15166] macvtap1: entered promiscuous mode [ 578.851066][T15166] team0: entered promiscuous mode [ 578.929597][T15166] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 579.105431][ T5276] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 579.125940][ T5231] Bluetooth: hci9: command tx timeout [ 579.306400][ T5276] usb 1-1: Using ep0 maxpacket: 32 [ 579.323860][ T5276] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 579.358396][ T5276] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 579.384339][ T5276] usb 1-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 579.412159][ T5276] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 579.446947][ T5276] usb 1-1: config 0 descriptor?? [ 579.725556][ T940] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 579.753143][T15185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 579.775793][T15185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 579.888496][ T5276] usbhid 1-1:0.0: can't add hid device: -71 [ 579.894538][ T5276] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 579.928661][ T5276] usb 1-1: USB disconnect, device number 71 [ 579.940567][ T940] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 579.952363][ T940] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 579.963302][ T940] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 579.975695][ T940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 579.990414][ T940] usb 3-1: config 0 descriptor?? [ 580.449142][ T940] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 580.526608][ T940] cp2112 0003:10C4:EA90.0015: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 580.649010][ T940] cp2112 0003:10C4:EA90.0015: Part Number: 0x82 Device Version: 0xFE [ 580.720352][T15212] FAULT_INJECTION: forcing a failure. [ 580.720352][T15212] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 580.734915][T15212] CPU: 0 UID: 0 PID: 15212 Comm: syz.0.2334 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 580.745715][T15212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 580.755794][T15212] Call Trace: [ 580.759092][T15212] [ 580.762042][T15212] dump_stack_lvl+0x241/0x360 [ 580.766743][T15212] ? __pfx_dump_stack_lvl+0x10/0x10 [ 580.771948][T15212] ? __pfx__printk+0x10/0x10 [ 580.776536][T15212] ? __pfx_lock_release+0x10/0x10 [ 580.781554][T15212] ? snd_seq_client_enqueue_event+0x37e/0x530 [ 580.787624][T15212] should_fail_ex+0x3b0/0x4e0 [ 580.792303][T15212] _copy_from_user+0x2f/0xe0 [ 580.796887][T15212] snd_seq_write+0x31c/0xab0 [ 580.801489][T15212] ? __pfx_snd_seq_write+0x10/0x10 [ 580.806601][T15212] ? security_file_permission+0x7f/0xa0 [ 580.812146][T15212] ? rw_verify_area+0x1d2/0x6b0 [ 580.816991][T15212] ? __pfx_snd_seq_write+0x10/0x10 [ 580.822099][T15212] vfs_write+0x2a2/0xc90 [ 580.826341][T15212] ? __pfx_vfs_write+0x10/0x10 [ 580.831097][T15212] ? __fget_files+0x29/0x470 [ 580.835684][T15212] ? __fget_files+0x3f6/0x470 [ 580.840352][T15212] ? __fget_files+0x29/0x470 [ 580.844946][T15212] ksys_write+0x1a0/0x2c0 [ 580.849272][T15212] ? __pfx_ksys_write+0x10/0x10 [ 580.854113][T15212] ? do_syscall_64+0x100/0x230 [ 580.858874][T15212] ? do_syscall_64+0xb6/0x230 [ 580.863543][T15212] do_syscall_64+0xf3/0x230 [ 580.868039][T15212] ? clear_bhb_loop+0x35/0x90 [ 580.872711][T15212] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.878600][T15212] RIP: 0033:0x7fb198d773b9 [ 580.883014][T15212] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 580.902707][T15212] RSP: 002b:00007fb199b0b048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 580.911116][T15212] RAX: ffffffffffffffda RBX: 00007fb198f05f80 RCX: 00007fb198d773b9 [ 580.919077][T15212] RDX: 000000000000ffc8 RSI: 0000000020000000 RDI: 0000000000000003 [ 580.927036][T15212] RBP: 00007fb199b0b0a0 R08: 0000000000000000 R09: 0000000000000000 [ 580.935016][T15212] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 580.943000][T15212] R13: 000000000000000b R14: 00007fb198f05f80 R15: 00007fb19902fa38 [ 580.950982][T15212] [ 580.982998][ T940] cp2112 0003:10C4:EA90.0015: error requesting SMBus config [ 581.002327][ T940] cp2112 0003:10C4:EA90.0015: probe with driver cp2112 failed with error -32 [ 581.025408][ T5274] usb 5-1: new low-speed USB device number 82 using dummy_hcd [ 581.162745][T15221] input: syz1 as /devices/virtual/input/input45 [ 581.205655][ T5274] usb 5-1: device descriptor read/64, error -71 [ 581.234527][T15225] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 581.241894][T15225] IPv6: NLM_F_CREATE should be set when creating new route [ 581.258245][T15221] "syz.3.2336" (15221) uses obsolete ecb(arc4) skcipher [ 581.435672][T15231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 581.465401][T15231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 581.496610][ T5274] usb 5-1: new low-speed USB device number 83 using dummy_hcd [ 581.655549][ T5274] usb 5-1: device descriptor read/64, error -71 [ 581.689419][T15236] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 581.785694][ T5274] usb usb5-port1: attempt power cycle [ 582.006387][ T940] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 582.033653][T15243] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 582.051757][T15243] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2340'. [ 582.196469][ T940] usb 4-1: Using ep0 maxpacket: 16 [ 582.204346][ T5274] usb 5-1: new low-speed USB device number 84 using dummy_hcd [ 582.206194][ T940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 582.253473][ T940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 1792, setting to 1024 [ 582.256135][ T5274] usb 5-1: device descriptor read/8, error -71 [ 582.290676][ T940] usb 4-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=19.82 [ 582.310453][ T940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.345127][ T940] usb 4-1: Product: syz [ 582.357473][ T940] usb 4-1: Manufacturer: syz [ 582.375352][ T940] usb 4-1: SerialNumber: syz [ 582.401752][ T940] usb 4-1: config 0 descriptor?? [ 582.425858][T15238] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 582.442511][ T940] kobil_sct 4-1:0.0: KOBIL USB smart card terminal converter detected [ 582.488722][ T940] usb 4-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 582.550224][ T5274] usb 5-1: new low-speed USB device number 85 using dummy_hcd [ 582.596381][ T5274] usb 5-1: device descriptor read/8, error -71 [ 582.640449][ T5277] usb 3-1: USB disconnect, device number 89 [ 582.653183][T15238] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2339'. [ 582.705447][ T5273] usb 4-1: USB disconnect, device number 100 [ 582.728357][ T5274] usb usb5-port1: unable to enumerate USB device [ 582.729271][ T5273] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 582.759303][T15259] FAULT_INJECTION: forcing a failure. [ 582.759303][T15259] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 582.770825][ T5273] kobil_sct 4-1:0.0: device disconnected [ 582.791980][T15259] CPU: 1 UID: 0 PID: 15259 Comm: syz.2.2346 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 582.802779][T15259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 582.813012][T15259] Call Trace: [ 582.816317][T15259] [ 582.819261][T15259] dump_stack_lvl+0x241/0x360 [ 582.824052][T15259] ? __pfx_dump_stack_lvl+0x10/0x10 [ 582.829272][T15259] ? __pfx__printk+0x10/0x10 [ 582.833888][T15259] ? __pfx_lock_release+0x10/0x10 [ 582.838932][T15259] ? snd_seq_client_enqueue_event+0x37e/0x530 [ 582.845029][T15259] should_fail_ex+0x3b0/0x4e0 [ 582.849744][T15259] _copy_from_user+0x2f/0xe0 [ 582.854356][T15259] snd_seq_write+0x31c/0xab0 [ 582.858989][T15259] ? __pfx_snd_seq_write+0x10/0x10 [ 582.864124][T15259] ? security_file_permission+0x7f/0xa0 [ 582.869703][T15259] ? rw_verify_area+0x1d2/0x6b0 [ 582.874584][T15259] ? __pfx_snd_seq_write+0x10/0x10 [ 582.879728][T15259] vfs_write+0x2a2/0xc90 [ 582.884004][T15259] ? __pfx_vfs_write+0x10/0x10 [ 582.888788][T15259] ? __fget_files+0x29/0x470 [ 582.893406][T15259] ? __fget_files+0x3f6/0x470 [ 582.898104][T15259] ? __fget_files+0x29/0x470 [ 582.902703][T15259] ksys_write+0x1a0/0x2c0 [ 582.907039][T15259] ? __pfx_ksys_write+0x10/0x10 [ 582.911880][T15259] ? do_syscall_64+0x100/0x230 [ 582.916639][T15259] ? do_syscall_64+0xb6/0x230 [ 582.921330][T15259] do_syscall_64+0xf3/0x230 [ 582.925852][T15259] ? clear_bhb_loop+0x35/0x90 [ 582.930529][T15259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.936428][T15259] RIP: 0033:0x7fd4d1d773b9 [ 582.940848][T15259] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 582.960455][T15259] RSP: 002b:00007fd4d2aa4048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 582.968864][T15259] RAX: ffffffffffffffda RBX: 00007fd4d1f05f80 RCX: 00007fd4d1d773b9 [ 582.976920][T15259] RDX: 000000000000ffc8 RSI: 0000000020000000 RDI: 0000000000000003 [ 582.984880][T15259] RBP: 00007fd4d2aa40a0 R08: 0000000000000000 R09: 0000000000000000 [ 582.992841][T15259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 583.000801][T15259] R13: 000000000000000b R14: 00007fd4d1f05f80 R15: 00007fd4d202fa38 [ 583.008774][T15259] [ 583.110655][T15263] vlan2: entered promiscuous mode [ 583.761739][T15280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.818792][T15280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 583.853327][T15281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.873289][T15281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 584.028194][T15285] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 584.050280][ T5273] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 584.059612][T15285] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 584.275744][ T5273] usb 5-1: Using ep0 maxpacket: 16 [ 584.308620][ T5273] usb 5-1: config 0 has an invalid interface number: 104 but max is 1 [ 584.342959][ T5273] usb 5-1: config 0 has an invalid interface number: 104 but max is 1 [ 584.357672][ T5273] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 584.368058][ T5273] usb 5-1: config 0 has no interface number 0 [ 584.373101][T15298] fuse: Bad value for 'fd' [ 584.374168][ T5273] usb 5-1: config 0 interface 104 has no altsetting 1 [ 584.391559][ T5273] usb 5-1: New USB device found, idVendor=1189, idProduct=0893, bcdDevice= 7.36 [ 584.401326][ T5273] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.450892][ T5273] usb 5-1: Product: syz [ 584.455190][ T5273] usb 5-1: Manufacturer: syz [ 584.498352][ T5273] usb 5-1: SerialNumber: syz [ 584.513734][ T5273] usb 5-1: config 0 descriptor?? [ 584.793746][ T5273] asix 5-1:0.104 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 584.823869][ T5273] asix 5-1:0.104: probe with driver asix failed with error -71 [ 584.844750][ T5273] usb 5-1: USB disconnect, device number 86 [ 585.039765][ T5274] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 585.285896][ T5274] usb 3-1: Using ep0 maxpacket: 8 [ 585.312283][ T5274] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 585.356367][ T5274] usb 3-1: config 0 has no interface number 0 [ 585.389267][ T5274] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 585.427619][ T5274] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 585.454808][ T5274] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.500935][ T5274] usb 3-1: config 0 descriptor?? [ 585.555533][ T5274] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 585.755471][ T5273] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 585.955461][ T5273] usb 5-1: Using ep0 maxpacket: 32 [ 585.971988][ T5273] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 586.006618][ T5273] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.050701][ T5273] usb 5-1: config 0 descriptor?? [ 586.088791][ T5273] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 586.691091][ T5273] gspca_nw80x: reg_r err -32 [ 586.724809][ T5273] nw80x 5-1:0.0: probe with driver nw80x failed with error -32 [ 587.066973][T15345] bridge_slave_1: left allmulticast mode [ 587.074165][T15345] bridge_slave_1: left promiscuous mode [ 587.095792][T15345] bridge0: port 2(bridge_slave_1) entered disabled state [ 587.318831][T15354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 587.347963][T15352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.365868][T15352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.377482][T15354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 587.441586][ T5276] usb 5-1: USB disconnect, device number 87 [ 587.520221][ T5277] usb 3-1: USB disconnect, device number 90 [ 587.558145][ T5277] iowarrior 3-1:0.1: I/O-Warror #0 now disconnected [ 588.101665][T15375] netlink: 'syz.1.2378': attribute type 10 has an invalid length. [ 588.184319][T15372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 588.207976][T15375] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 588.222942][T15372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 588.305673][T15375] team0: Port device netdevsim0 added [ 589.018807][T15394] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 589.042553][T15394] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 589.211843][ T5274] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 589.222725][ T5223] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 589.236090][T15401] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2388'. [ 589.246722][ T5223] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 589.256020][T15401] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2388'. [ 589.257868][ T5223] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 589.274949][T15401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.286883][ T5223] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 589.304186][ T5223] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 589.304515][T15401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.320359][ T5223] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 589.407229][ T5274] usb 1-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 589.426373][ T5274] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 589.457210][ T5274] usb 1-1: config 0 descriptor?? [ 589.470116][ T5274] usb-storage 1-1:0.0: USB Mass Storage device detected [ 589.498873][ T5274] usb-storage 1-1:0.0: Quirks match for vid 04e6 pid 000b: 4 [ 589.670070][T15392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.705667][T15392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.726168][ T8] usb 1-1: USB disconnect, device number 72 [ 589.853383][T15406] chnl_net:caif_netlink_parms(): no params data found [ 590.121110][T15406] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.141842][T15406] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.160812][T15406] bridge_slave_0: entered allmulticast mode [ 590.190246][T15406] bridge_slave_0: entered promiscuous mode [ 590.245936][T15406] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.255692][T15406] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.280503][T15406] bridge_slave_1: entered allmulticast mode [ 590.299877][T15406] bridge_slave_1: entered promiscuous mode [ 590.377773][T15406] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 590.412648][T15426] vlan2: entered promiscuous mode [ 590.514781][T15406] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 590.611970][T15406] team0: Port device team_slave_0 added [ 590.638583][T15406] team0: Port device team_slave_1 added [ 590.680708][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 590.680726][ T29] audit: type=1326 audit(1722485712.348:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.715897][ T29] audit: type=1326 audit(1722485712.348:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.750643][ T29] audit: type=1326 audit(1722485712.348:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.755682][T15406] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 590.780114][ T29] audit: type=1326 audit(1722485712.348:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.804826][T15406] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 590.836231][ T29] audit: type=1326 audit(1722485712.348:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.858687][T15406] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 590.861224][T15406] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 590.877584][T15406] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 590.881787][ T29] audit: type=1326 audit(1722485712.348:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.904180][T15406] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 590.941431][ T29] audit: type=1326 audit(1722485712.348:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.943154][T15438] netlink: 'syz.0.2397': attribute type 10 has an invalid length. [ 590.963791][ T29] audit: type=1326 audit(1722485712.348:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.963841][ T29] audit: type=1326 audit(1722485712.348:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 590.963880][ T29] audit: type=1326 audit(1722485712.348:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15433 comm="syz.4.2398" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a157773b9 code=0x7ffc0000 [ 591.098366][T15438] team0: Port device netdevsim0 added [ 591.143761][T15406] hsr_slave_0: entered promiscuous mode [ 591.167800][T15406] hsr_slave_1: entered promiscuous mode [ 591.180180][T15406] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 591.188054][T15406] Cannot create hsr debugfs directory [ 591.285690][ T5276] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 591.366171][ T5231] Bluetooth: hci0: command tx timeout [ 591.477506][ T5276] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 591.499236][ T5276] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 591.531897][T15406] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.532360][ T5276] usb 1-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 591.576045][ T5274] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 591.591334][ T5276] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.657090][ T5276] usb 1-1: config 0 descriptor?? [ 591.748011][T15406] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.769386][ T5274] usb 4-1: too many configurations: 18, using maximum allowed: 8 [ 591.837076][ T5274] usb 4-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 591.881094][ T5274] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.917082][T15406] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.946869][ T5274] usb 4-1: config 0 descriptor?? [ 591.985994][ T5274] gspca_main: 0c45:8001 too many config [ 592.103885][ T5276] usbhid 1-1:0.0: can't add hid device: -71 [ 592.149139][ T5276] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 592.202697][ T5276] usb 1-1: USB disconnect, device number 73 [ 592.268601][ T8] usb 4-1: USB disconnect, device number 101 [ 592.521283][T15406] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 592.543527][T15406] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 592.580738][T15406] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 592.604603][T15406] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 592.910271][T15406] 8021q: adding VLAN 0 to HW filter on device bond0 [ 592.955109][T15406] 8021q: adding VLAN 0 to HW filter on device team0 [ 592.992950][T13681] bridge0: port 1(bridge_slave_0) entered blocking state [ 593.000086][T13681] bridge0: port 1(bridge_slave_0) entered forwarding state [ 593.022303][T13681] bridge0: port 2(bridge_slave_1) entered blocking state [ 593.029604][T13681] bridge0: port 2(bridge_slave_1) entered forwarding state [ 593.168758][T15406] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 593.396519][T15406] veth0_vlan: entered promiscuous mode [ 593.446091][ T5231] Bluetooth: hci0: command tx timeout [ 593.477477][T15406] veth1_vlan: entered promiscuous mode [ 593.623526][T15406] veth0_macvtap: entered promiscuous mode [ 593.641365][T15406] veth1_macvtap: entered promiscuous mode [ 593.672922][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.688435][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.699308][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.713947][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.744190][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.773853][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.787289][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.858596][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.871579][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.906719][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.922973][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.927508][T15464] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 593.980169][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.057233][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.102086][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.112037][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.163087][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.200154][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.265703][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.305892][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.316564][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.326980][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.337600][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.363134][T15406] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 594.381823][T15467] vlan2: entered promiscuous mode [ 594.607087][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.637248][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.665368][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.685344][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.695203][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.720364][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.747467][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.765999][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.785936][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.803207][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.814560][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.825504][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.835444][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.845961][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.858664][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.873121][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.885504][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.923147][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.938139][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.948783][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.959629][T15406] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.972372][T15406] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.989151][T15406] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 595.001412][T15480] sctp: [Deprecated]: syz.1.2410 (pid 15480) Use of int in max_burst socket option deprecated. [ 595.001412][T15480] Use struct sctp_assoc_value instead [ 595.094527][T15480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 595.127649][T15480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 595.163188][ T2497] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 595.525945][ T5231] Bluetooth: hci0: command tx timeout [ 596.058628][T15406] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.091366][T15406] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.135889][T15406] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.182763][T15406] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.291480][ T2497] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.572568][ T2497] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.803633][ T2497] team0: Port device netdevsim0 removed [ 596.825093][ T2497] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.845462][ T5223] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 596.864958][ T5223] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 596.899321][ T5223] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 596.910216][ T5223] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 596.920804][ T5223] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 596.928797][ T5223] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 597.163266][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.172835][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.424217][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.453743][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.474877][ T2497] bridge_slave_0: left allmulticast mode [ 597.494385][ T2497] bridge_slave_0: left promiscuous mode [ 597.505763][ T2497] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.605525][ T5231] Bluetooth: hci0: command tx timeout [ 597.839117][T15499] fuse: Bad value for 'fd' [ 598.485067][ T2497] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 598.555839][ T2497] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 598.569304][ T2497] bond0 (unregistering): Released all slaves [ 598.842936][T15515] fuse: Bad value for 'fd' [ 598.966151][ T5231] Bluetooth: hci6: command tx timeout [ 599.311185][T15492] chnl_net:caif_netlink_parms(): no params data found [ 599.388417][ T2497] hsr_slave_0: left promiscuous mode [ 599.426184][ T2497] hsr_slave_1: left promiscuous mode [ 599.455023][ T2497] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.470477][ T2497] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 599.502685][ T2497] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.505383][ T8] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 599.526171][ T2497] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 599.661475][ T2497] veth1_macvtap: left promiscuous mode [ 599.669505][ T2497] veth0_macvtap: left promiscuous mode [ 599.675065][ T2497] veth1_vlan: left promiscuous mode [ 599.715375][ T8] usb 3-1: Using ep0 maxpacket: 8 [ 599.720555][ T2497] veth0_vlan: left promiscuous mode [ 599.790798][ T8] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 599.831770][ T8] usb 3-1: config 0 has no interface number 0 [ 599.872267][ T8] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 599.952838][ T8] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 599.984022][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.027656][ T8] usb 3-1: config 0 descriptor?? [ 600.074801][ T8] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 601.058968][ T5231] Bluetooth: hci6: command tx timeout [ 601.484824][ T2497] team0 (unregistering): Port device team_slave_1 removed [ 601.651556][ T2497] team0 (unregistering): Port device team_slave_0 removed [ 602.302941][T12239] usb 3-1: USB disconnect, device number 91 [ 602.333859][T12239] iowarrior 3-1:0.1: I/O-Warror #0 now disconnected [ 603.126020][ T5231] Bluetooth: hci6: command tx timeout [ 603.537601][T15492] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.544886][T15492] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.567161][T15492] bridge_slave_0: entered allmulticast mode [ 603.577009][T15492] bridge_slave_0: entered promiscuous mode [ 603.596640][T15492] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.610867][T15492] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.630209][T15492] bridge_slave_1: entered allmulticast mode [ 603.650495][T15492] bridge_slave_1: entered promiscuous mode [ 603.662313][T15580] netlink: 'syz.4.2430': attribute type 10 has an invalid length. [ 603.707925][T15580] team0: Port device netdevsim0 added [ 603.779251][T15492] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.850512][T15492] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 603.915481][ T5275] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 604.023981][T15492] team0: Port device team_slave_0 added [ 604.060388][T15492] team0: Port device team_slave_1 added [ 604.167665][ T5275] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 604.216928][ T5275] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 604.259836][T15492] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 604.275861][T15492] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 604.302695][T15492] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 604.328189][ T5275] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 604.358180][T15492] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 604.385710][ T5275] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.398523][ T5275] usb 5-1: config 0 descriptor?? [ 604.415960][T15492] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 604.474429][T15492] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 604.537369][T15604] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 604.577741][T15492] hsr_slave_0: entered promiscuous mode [ 604.597054][T15492] hsr_slave_1: entered promiscuous mode [ 604.883898][ T5275] usbhid 5-1:0.0: can't add hid device: -71 [ 604.890993][ T5275] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 604.980208][ T5275] usb 5-1: USB disconnect, device number 88 [ 605.177267][ T5276] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 605.205946][ T5231] Bluetooth: hci6: command tx timeout [ 605.387777][ T5276] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 605.413417][ T5276] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.452929][ T5223] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 605.457462][ T5276] usb 3-1: config 0 descriptor?? [ 605.479934][ T5223] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 605.487717][ T5276] cp210x 3-1:0.0: cp210x converter detected [ 605.494755][ T5223] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 605.515850][ T5223] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 605.524539][ T5223] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 605.533298][ T5223] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 605.860416][T15492] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 605.889339][T15492] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 605.924717][T15492] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 605.936617][ T5276] cp210x 3-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 605.948318][T15613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 605.980316][T15492] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 605.999468][T15613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 606.065108][ T5276] usb 3-1: cp210x converter now attached to ttyUSB0 [ 606.132448][T15640] No such timeout policy "syz0" [ 606.387441][ T940] usb 3-1: USB disconnect, device number 92 [ 606.394019][T15631] chnl_net:caif_netlink_parms(): no params data found [ 606.404284][ T940] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 606.456784][ T940] cp210x 3-1:0.0: device disconnected [ 606.486187][ T8] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 606.487768][T15492] 8021q: adding VLAN 0 to HW filter on device bond0 [ 606.707368][ T8] usb 4-1: config 0 descriptor has 1 excess byte, ignoring [ 606.726133][ T8] usb 4-1: config 0 has no interfaces? [ 606.746959][T15631] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.756428][ T8] usb 4-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 606.768645][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.777376][ T8] usb 4-1: Product: syz [ 606.781660][ T8] usb 4-1: Manufacturer: syz [ 606.786917][ T8] usb 4-1: SerialNumber: syz [ 606.792654][T15631] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.794826][ T8] usb 4-1: config 0 descriptor?? [ 606.838143][T15631] bridge_slave_0: entered allmulticast mode [ 606.857403][T15631] bridge_slave_0: entered promiscuous mode [ 606.884085][T15492] 8021q: adding VLAN 0 to HW filter on device team0 [ 606.909350][T15631] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.935672][T15631] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.953496][T15631] bridge_slave_1: entered allmulticast mode [ 606.977642][T15631] bridge_slave_1: entered promiscuous mode [ 607.077343][T15631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 607.115036][ T940] bridge0: port 1(bridge_slave_0) entered blocking state [ 607.122194][ T940] bridge0: port 1(bridge_slave_0) entered forwarding state [ 607.188163][T15631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 607.236639][ T5274] usb 4-1: USB disconnect, device number 102 [ 607.241946][ T940] bridge0: port 2(bridge_slave_1) entered blocking state [ 607.249877][ T940] bridge0: port 2(bridge_slave_1) entered forwarding state [ 607.301035][T15664] devpts: called with bogus options [ 607.463026][T15631] team0: Port device team_slave_0 added [ 607.514114][T15631] team0: Port device team_slave_1 added [ 607.616061][ T5231] Bluetooth: hci10: command tx timeout [ 607.708777][T15631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 607.725838][T15631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 607.759954][T15631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 607.810505][T15631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 607.822107][T15631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 607.932939][T15631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 608.094305][T15682] FAULT_INJECTION: forcing a failure. [ 608.094305][T15682] name failslab, interval 1, probability 0, space 0, times 0 [ 608.107166][T15682] CPU: 1 UID: 0 PID: 15682 Comm: syz.4.2447 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 608.117953][T15682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 608.128028][T15682] Call Trace: [ 608.131331][T15682] [ 608.134279][T15682] dump_stack_lvl+0x241/0x360 [ 608.138980][T15682] ? __pfx_dump_stack_lvl+0x10/0x10 [ 608.144172][T15682] ? __pfx__printk+0x10/0x10 [ 608.148756][T15682] should_fail_ex+0x3b0/0x4e0 [ 608.153427][T15682] ? skb_clone+0x20c/0x390 [ 608.157828][T15682] should_failslab+0xac/0x100 [ 608.162489][T15682] ? skb_clone+0x20c/0x390 [ 608.166904][T15682] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 608.172281][T15682] skb_clone+0x20c/0x390 [ 608.176514][T15682] ? dev_queue_xmit_nit+0x220/0xc10 [ 608.181708][T15682] dev_queue_xmit_nit+0x419/0xc10 [ 608.186730][T15682] ? dev_queue_xmit_nit+0x2b/0xc10 [ 608.191845][T15682] ? validate_xmit_skb+0x9f9/0x1120 [ 608.197043][T15682] dev_hard_start_xmit+0x15f/0x7e0 [ 608.202152][T15682] ? __pfx_validate_xmit_skb+0x10/0x10 [ 608.207615][T15682] __dev_queue_xmit+0x1b63/0x3e90 [ 608.212633][T15682] ? kasan_save_track+0x51/0x80 [ 608.217483][T15682] ? do_syscall_64+0xf3/0x230 [ 608.222165][T15682] ? __dev_queue_xmit+0x2da/0x3e90 [ 608.227270][T15682] ? __pfx___dev_queue_xmit+0x10/0x10 [ 608.232665][T15682] ? __copy_skb_header+0x437/0x5b0 [ 608.237769][T15682] ? __asan_memcpy+0x40/0x70 [ 608.242363][T15682] ? skb_clone+0x240/0x390 [ 608.246772][T15682] __netlink_deliver_tap+0x54d/0x7c0 [ 608.252061][T15682] ? netlink_deliver_tap+0x2e/0x1b0 [ 608.257252][T15682] netlink_deliver_tap+0x19d/0x1b0 [ 608.262363][T15682] netlink_unicast+0x7be/0x990 [ 608.267132][T15682] ? __pfx_netlink_unicast+0x10/0x10 [ 608.272408][T15682] ? __virt_addr_valid+0x183/0x530 [ 608.277511][T15682] ? __check_object_size+0x49c/0x900 [ 608.282784][T15682] ? bpf_lsm_netlink_send+0x9/0x10 [ 608.287892][T15682] netlink_sendmsg+0x8e4/0xcb0 [ 608.292658][T15682] ? __pfx_netlink_sendmsg+0x10/0x10 [ 608.297935][T15682] ? __import_iovec+0x536/0x820 [ 608.302776][T15682] ? aa_sock_msg_perm+0x91/0x160 [ 608.307706][T15682] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 608.312985][T15682] ? security_socket_sendmsg+0x87/0xb0 [ 608.318441][T15682] ? __pfx_netlink_sendmsg+0x10/0x10 [ 608.323721][T15682] __sock_sendmsg+0x221/0x270 [ 608.328399][T15682] ____sys_sendmsg+0x525/0x7d0 [ 608.333160][T15682] ? __pfx_____sys_sendmsg+0x10/0x10 [ 608.338449][T15682] __sys_sendmsg+0x2b0/0x3a0 [ 608.343083][T15682] ? __pfx___sys_sendmsg+0x10/0x10 [ 608.348183][T15682] ? vfs_write+0x7c4/0xc90 [ 608.352627][T15682] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 608.358949][T15682] ? do_syscall_64+0x100/0x230 [ 608.363711][T15682] ? do_syscall_64+0xb6/0x230 [ 608.368385][T15682] do_syscall_64+0xf3/0x230 [ 608.372888][T15682] ? clear_bhb_loop+0x35/0x90 [ 608.377557][T15682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.383448][T15682] RIP: 0033:0x7f4a157773b9 [ 608.387857][T15682] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 608.407470][T15682] RSP: 002b:00007f4a165a9048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 608.415882][T15682] RAX: ffffffffffffffda RBX: 00007f4a15905f80 RCX: 00007f4a157773b9 [ 608.423934][T15682] RDX: 0000000000000000 RSI: 0000000020001200 RDI: 0000000000000003 [ 608.431897][T15682] RBP: 00007f4a165a90a0 R08: 0000000000000000 R09: 0000000000000000 [ 608.439866][T15682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 608.447831][T15682] R13: 000000000000000b R14: 00007f4a15905f80 R15: 00007f4a15a2fa38 [ 608.455806][T15682] [ 608.590411][T15631] hsr_slave_0: entered promiscuous mode [ 608.632190][T15631] hsr_slave_1: entered promiscuous mode [ 608.657865][T15631] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 608.679183][T15631] Cannot create hsr debugfs directory [ 608.760179][T15690] netlink: 'syz.4.2448': attribute type 30 has an invalid length. [ 609.291192][T15631] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.422171][T15492] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 609.559420][T15631] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.695868][ T5231] Bluetooth: hci10: command tx timeout [ 609.756960][T15631] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.937814][T15631] team0: Port device netdevsim0 removed [ 609.972271][T15631] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.239077][T15492] veth0_vlan: entered promiscuous mode [ 610.369281][T15492] veth1_vlan: entered promiscuous mode [ 610.671375][T15492] veth0_macvtap: entered promiscuous mode [ 610.756727][T15492] veth1_macvtap: entered promiscuous mode [ 610.774581][T15631] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 610.810384][T15631] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 610.873752][T15631] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 610.937627][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 610.969680][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 610.989375][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.005384][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.041153][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.071051][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.109002][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.165330][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.201643][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.235466][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.255311][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.275361][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.287031][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.314195][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.324250][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.356189][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.376732][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.413540][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.437812][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.456555][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.480957][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 611.504037][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.530697][T15492] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 611.553629][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 611.582234][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.606767][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 611.631993][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.658808][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 611.690518][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.741831][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 611.767030][ T5231] Bluetooth: hci10: command tx timeout [ 611.815096][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.838880][T15769] devpts: called with bogus options [ 611.870506][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 611.892954][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.921723][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 611.951466][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 611.983432][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.014251][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.046184][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.061509][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.073483][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.084441][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.098493][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.114287][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.126209][T15492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.151962][T15492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.184444][T15492] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 612.201653][T15631] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 612.289957][T15492] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.315683][T15492] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.350556][T15492] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.393972][T15492] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.446399][T15777] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2461'. [ 612.490331][T15777] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2461'. [ 612.694689][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 612.734285][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 612.803929][ T2497] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 612.813811][ T5274] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 612.843666][ T2497] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 612.884619][T15631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 612.992962][T15631] 8021q: adding VLAN 0 to HW filter on device team0 [ 613.007380][ T5277] bridge0: port 1(bridge_slave_0) entered blocking state [ 613.014508][ T5277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 613.025751][ T5274] usb 3-1: Using ep0 maxpacket: 8 [ 613.044226][ T5274] usb 3-1: New USB device found, idVendor=0424, idProduct=7800, bcdDevice=e9.41 [ 613.077650][ T5274] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 613.088053][T13681] bridge0: port 2(bridge_slave_1) entered blocking state [ 613.095191][T13681] bridge0: port 2(bridge_slave_1) entered forwarding state [ 613.136156][ T5274] usb 3-1: config 0 descriptor?? [ 613.286067][ T940] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 613.383939][T15631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 613.476157][ T940] usb 1-1: Using ep0 maxpacket: 8 [ 613.490377][ T940] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 613.528784][T15631] veth0_vlan: entered promiscuous mode [ 613.558677][ T940] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 613.577765][T15631] veth1_vlan: entered promiscuous mode [ 613.602794][ T940] usb 1-1: New USB device found, idVendor=056a, idProduct=00c5, bcdDevice= 0.00 [ 613.631967][ T940] usb 1-1: New USB device strings: Mfr=8, Product=0, SerialNumber=0 [ 613.672478][ T940] usb 1-1: Manufacturer: syz [ 613.703794][T15631] veth0_macvtap: entered promiscuous mode [ 613.705307][ T940] usb 1-1: config 0 descriptor?? [ 613.725414][ T8] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 613.752148][ T5273] usb 3-1: USB disconnect, device number 93 [ 613.769039][T15631] veth1_macvtap: entered promiscuous mode [ 613.842541][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 613.855655][ T5231] Bluetooth: hci10: command tx timeout [ 613.870072][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 613.886789][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 613.911447][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 613.942126][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 613.957864][ T8] usb 5-1: too many configurations: 18, using maximum allowed: 8 [ 613.987964][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 613.994065][ T8] usb 5-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 614.015385][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.051317][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.069385][ T8] usb 5-1: config 0 descriptor?? [ 614.074719][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.082780][ T8] gspca_main: 0c45:8001 too many config [ 614.098920][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.115402][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.181334][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.199483][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.206574][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.228282][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.237148][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.250656][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.280624][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.300975][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.301846][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.329023][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.357390][T13681] usb 5-1: USB disconnect, device number 89 [ 614.380107][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.422407][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.450751][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.459240][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.490620][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.494938][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.527211][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.537818][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.545153][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.577094][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.582795][ T940] wacom 0003:056A:00C5.0016: unknown main item tag 0x0 [ 614.637288][ T940] wacom 0003:056A:00C5.0016: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 614.655741][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.678826][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.695525][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 614.707093][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.739334][T15631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 614.765109][ T940] usb 1-1: USB disconnect, device number 74 [ 614.822737][T15800] bridge_slave_1: left allmulticast mode [ 614.840043][T15800] bridge_slave_1: left promiscuous mode [ 614.860250][T15800] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.881604][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 614.915172][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.930413][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 614.945539][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 614.977896][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 614.990226][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.004630][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.016047][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.038482][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.052246][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.066677][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.085616][ T5276] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 615.101535][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.115629][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.129958][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.169099][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.214899][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.249140][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.263259][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.275768][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.292169][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.304652][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.336600][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.339587][ T5276] usb 4-1: New USB device found, idVendor=0547, idProduct=2727, bcdDevice=b0.d2 [ 615.369102][T15631] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 615.388050][T15631] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 615.432775][T15631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 615.485730][ T5276] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.513774][ T5276] usb 4-1: Product: syz [ 615.524719][T15631] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 615.534089][ T5276] usb 4-1: Manufacturer: syz [ 615.554008][T15631] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 615.563707][ T5276] usb 4-1: SerialNumber: syz [ 615.590260][T15631] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 615.607622][ T5276] usb 4-1: config 0 descriptor?? [ 615.608134][T15631] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 615.918141][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 615.919233][ T5276] cdc_subset 4-1:0.0: probe with driver cdc_subset failed with error -71 [ 615.956044][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 616.003922][ T5276] usb 4-1: USB disconnect, device number 103 [ 616.020878][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 616.047063][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 616.576063][ T5231] Bluetooth: hci3: command 0x0406 tx timeout [ 616.788777][T15838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 616.810455][T15838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 616.975705][ T5273] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 617.195545][ T5273] usb 3-1: Using ep0 maxpacket: 8 [ 617.216194][ T5273] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 617.243601][ T5273] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 617.273738][ T5273] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 617.319926][ T5273] usb 3-1: New USB device found, idVendor=05ac, idProduct=0240, bcdDevice= 0.40 [ 617.344249][ T5273] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.373349][ T5273] usb 3-1: Product: syz [ 617.385177][ T5273] usb 3-1: Manufacturer: syz [ 617.392808][ T5273] usb 3-1: SerialNumber: syz [ 617.453135][ T5273] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input49 [ 617.811905][T15855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 617.834075][T15855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 617.865839][ T5277] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 617.954983][T15859] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2483'. [ 618.014143][T15862] netlink: 'syz.1.2483': attribute type 20 has an invalid length. [ 618.076722][ T5277] usb 5-1: too many configurations: 18, using maximum allowed: 8 [ 618.153599][ T5277] usb 5-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 618.176960][ T4663] bcm5974 3-1:1.0: could not read from device [ 618.183174][ T5277] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.204577][ T4663] bcm5974 3-1:1.0: could not read from device [ 618.223795][ T5273] usb 3-1: USB disconnect, device number 94 [ 618.225789][ T5277] usb 5-1: config 0 descriptor?? [ 618.285147][ T5277] gspca_main: 0c45:8001 too many config [ 618.405438][ T940] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 618.572188][ T5277] usb 5-1: USB disconnect, device number 90 [ 618.618155][ T940] usb 4-1: Using ep0 maxpacket: 16 [ 618.638759][ T940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 618.692710][ T940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 618.732422][ T940] usb 4-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 618.733718][T15868] capability: warning: `syz.0.2485' uses 32-bit capabilities (legacy support in use) [ 618.751853][ T940] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.785230][ T940] usb 4-1: config 0 descriptor?? [ 619.231294][ T940] samsung 0003:0419:0001.0017: unknown main item tag 0x0 [ 619.274046][ T940] samsung 0003:0419:0001.0017: hidraw0: USB HID v0.00 Device [HID 0419:0001] on usb-dummy_hcd.3-1/input0 [ 619.416166][ T940] usb 4-1: USB disconnect, device number 104 [ 620.492971][T15912] Unknown options in mask 2474 [ 620.595567][T12239] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 620.689992][T15917] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 620.783104][T12239] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 620.808780][T12239] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 620.825388][T12239] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 620.839194][T12239] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 620.848898][T12239] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.867333][T12239] usb 1-1: config 0 descriptor?? [ 620.893476][T11709] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 621.109178][T11709] usb 3-1: config 1 has an invalid interface number: 5 but max is 2 [ 621.138865][T11709] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 621.165462][T11709] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 621.182941][T11709] usb 3-1: config 1 has no interface number 1 [ 621.196466][T11709] usb 3-1: config 1 interface 5 has no altsetting 0 [ 621.215136][T11709] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 621.229141][T11709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 621.245408][T11709] usb 3-1: SerialNumber: syz [ 621.286768][T12239] plantronics 0003:047F:FFFF.0018: No inputs registered, leaving [ 621.341703][T12239] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 621.480640][T15934] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2503'. [ 621.483084][T11709] usb 3-1: 0:2 : does not exist [ 621.573380][T11709] usb 3-1: USB disconnect, device number 95 [ 621.588170][ T29] kauditd_printk_skb: 32 callbacks suppressed [ 621.588190][ T29] audit: type=1326 audit(1722485743.258:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15906 comm="syz.0.2496" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f04815773b9 code=0x0 [ 621.685756][ T5223] Bluetooth: hci7: command 0x0406 tx timeout [ 621.827395][T15784] udevd[15784]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 621.905763][ T940] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 622.085748][ T940] usb 4-1: Using ep0 maxpacket: 16 [ 622.094139][ T940] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 622.123416][ T940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 622.134125][ T940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 42369, setting to 1024 [ 622.148427][ T940] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 622.173549][ T940] usb 4-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice=50.0d [ 622.193121][ T940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.226927][ T940] usb 4-1: Product: syz [ 622.238098][ T940] usb 4-1: Manufacturer: syz [ 622.254080][ T940] usb 4-1: SerialNumber: syz [ 622.265458][T11709] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 622.277340][ T940] usb 4-1: config 0 descriptor?? [ 622.301969][ T940] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 622.318758][ T940] gspca_stv06xx: st6422 sensor detected [ 622.478810][T11709] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 622.527583][T15951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 622.536243][T11709] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 622.541948][T15951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 622.563701][T11709] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 622.584922][T11709] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 622.659663][T11709] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 622.687237][T11709] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 622.717310][T11709] usb 5-1: Product: syz [ 622.733047][T11709] usb 5-1: Manufacturer: syz [ 622.755420][T11709] cdc_wdm 5-1:1.0: skipping garbage [ 622.778280][T12239] usb 1-1: reset high-speed USB device number 75 using dummy_hcd [ 622.794825][T11709] cdc_wdm 5-1:1.0: skipping garbage [ 622.842219][T11709] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 622.857981][T11709] cdc_wdm 5-1:1.0: Unknown control protocol [ 623.507318][T15962] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2511'. [ 623.516694][T15962] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2511'. [ 623.995553][T12239] usb 1-1: device descriptor read/64, error -71 [ 624.259420][ T940] STV06xx 4-1:0.0: probe with driver STV06xx failed with error -71 [ 624.275458][T12239] usb 1-1: reset high-speed USB device number 75 using dummy_hcd [ 624.283710][T15967] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2513'. [ 624.307702][T12239] usb 1-1: device reset changed ep0 maxpacket size! [ 624.325052][ T940] usb 4-1: USB disconnect, device number 105 [ 624.327507][ T5274] usb 1-1: USB disconnect, device number 75 [ 624.365007][T15967] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2513'. [ 624.452782][T15968] netlink: 'syz.2.2513': attribute type 21 has an invalid length. [ 624.476448][T15968] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2513'. [ 624.512060][T15968] netlink: 'syz.2.2513': attribute type 5 has an invalid length. [ 624.526549][T15968] netlink: 'syz.2.2513': attribute type 6 has an invalid length. [ 624.536068][T15968] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2513'. [ 624.575673][ T5274] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 624.735576][ T1269] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.741921][ T1269] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.785509][ T5274] usb 1-1: Using ep0 maxpacket: 8 [ 624.796353][ T5273] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 624.817302][ T5274] usb 1-1: New USB device found, idVendor=0424, idProduct=7800, bcdDevice=e9.41 [ 624.835378][ T5274] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.846993][ T5274] usb 1-1: config 0 descriptor?? [ 624.870407][ T940] usb 5-1: USB disconnect, device number 91 [ 625.010638][ T5273] usb 3-1: config index 0 descriptor too short (expected 45961, got 36) [ 625.048328][ T5273] usb 3-1: config 39 has an invalid descriptor of length 186, skipping remainder of the config [ 625.063615][ T5273] usb 3-1: config 39 has 0 interfaces, different from the descriptor's value: 22 [ 625.074775][ T5273] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 625.140705][ T5273] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.240543][ T940] usb 1-1: USB disconnect, device number 76 [ 625.290344][T15981] netlink: 'syz.4.2517': attribute type 12 has an invalid length. [ 625.447681][T15966] dvmrp0: entered allmulticast mode [ 625.472647][T15967] dvmrp0: left allmulticast mode [ 625.671047][ T5273] usb 3-1: string descriptor 0 read error: -71 [ 625.707260][ T5273] usb 3-1: USB disconnect, device number 96 [ 625.862463][T15991] binder: 15990:15991 ioctl 40046205 0 returned -22 [ 625.882788][T15993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.901892][T15993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.014595][T15998] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2519'. [ 626.018073][ T30] INFO: task syz.0.1816:13052 blocked for more than 143 seconds. [ 626.050195][ T30] Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 626.058741][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 626.073349][ T30] task:syz.0.1816 state:D stack:26584 pid:13052 tgid:13052 ppid:12493 flags:0x00004006 [ 626.123298][ T30] Call Trace: [ 626.127722][ T30] [ 626.131061][ T30] __schedule+0x1800/0x4a60 [ 626.173430][ T30] ? __pfx___schedule+0x10/0x10 [ 626.189919][ T30] ? __pfx_lock_release+0x10/0x10 [ 626.194994][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 626.253896][ T30] ? schedule+0x90/0x320 [ 626.300707][ T30] schedule+0x14b/0x320 [ 626.304922][ T30] schedule_preempt_disabled+0x13/0x30 [ 626.359741][ T30] __mutex_lock+0x6a4/0xd70 [ 626.364309][ T30] ? __mutex_lock+0x527/0xd70 [ 626.372983][ T30] ? usbdev_release+0x7a/0x7a0 [ 626.377844][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 626.382891][ T30] ? __fsnotify_parent+0x20c/0x5e0 [ 626.388159][ T30] ? __pfx___fsnotify_parent+0x10/0x10 [ 626.393658][ T30] usbdev_release+0x7a/0x7a0 [ 626.405553][ T30] ? evm_file_release+0x140/0x1d0 [ 626.410629][ T30] ? __pfx_usbdev_release+0x10/0x10 [ 626.435347][ T30] __fput+0x24a/0x8a0 [ 626.439414][ T30] task_work_run+0x24f/0x310 [ 626.444027][ T30] ? __pfx_task_work_run+0x10/0x10 [ 626.450799][ T30] get_signal+0x15e6/0x1740 [ 626.455649][ T30] ? __pfx_lock_acquire+0x10/0x10 [ 626.460710][ T30] ? __close_range+0x49a/0x940 [ 626.465857][ T30] ? __pfx_lock_release+0x10/0x10 [ 626.471004][ T30] ? __pfx_get_signal+0x10/0x10 [ 626.476137][ T30] arch_do_signal_or_restart+0x96/0x860 [ 626.481717][ T30] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 626.488243][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 626.494265][ T30] ? syscall_exit_to_user_mode+0xa3/0x370 [ 626.500487][ T30] syscall_exit_to_user_mode+0xc9/0x370 [ 626.506340][ T30] do_syscall_64+0x100/0x230 [ 626.510950][ T30] ? clear_bhb_loop+0x35/0x90 [ 626.515938][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.521852][ T30] RIP: 0033:0x7f709ab773b9 [ 626.526565][ T30] RSP: 002b:00007f709ae2fb98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 626.535173][ T30] RAX: 0000000000000000 RBX: 00007f709ad07a80 RCX: 00007f709ab773b9 [ 626.543210][ T30] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 626.552714][ T30] RBP: 00007f709ad07a80 R08: 0000000000000006 R09: 00007f709ae2fe7f [ 626.560769][ T30] R10: 00000000003ffbc0 R11: 0000000000000246 R12: 0000000000072006 [ 626.578013][ T30] R13: 00007f709ae2fc90 R14: 00007f709ae2fcb0 R15: ffffffffffffffff [ 626.586366][ T30] [ 626.617113][ T30] [ 626.617113][ T30] Showing all locks held in the system: [ 626.624872][ T30] 2 locks held by kworker/u8:0/11: [ 626.676438][ T30] 1 lock held by khungtaskd/30: [ 626.681341][ T30] #0: ffffffff8e9377a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 [ 626.715419][ T30] 5 locks held by kworker/u8:4/63: [ 626.720579][ T30] #0: ffff8880166e5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 [ 626.785524][ T30] #1: ffffc900015efd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 [ 626.845357][ T30] #2: ffffffff8fc732d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x16a/0xcc0 [ 626.885831][ T30] #3: ffffffff8fc7fe48 (rtnl_mutex){+.+.}-{3:3}, at: cleanup_net+0x6af/0xcc0 [ 626.894789][ T30] #4: ffffffff8e93cb78 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 [ 626.925437][ T30] 2 locks held by klogd/4667: [ 626.930187][ T30] 2 locks held by getty/4976: [ 626.934958][ T30] #0: ffff88802af9c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 626.974834][ T30] #1: ffffc9000311b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 [ 627.010416][ T30] 5 locks held by kworker/1:3/5226: [ 627.015927][ T30] #0: ffff88801bac2d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 [ 627.043240][ T30] #1: ffffc900037f7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 [ 627.055731][ T30] #2: ffff888024065190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 [ 627.075384][ T30] #3: ffff888077410518 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x25b6/0x5150 [ 627.095362][ T30] #4: ffff888023605d68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x25f4/0x5150 [ 627.105097][ T30] 2 locks held by kworker/0:4/5273: [ 627.121770][ T30] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 [ 627.133396][ T30] #1: ffffc9000408fd00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 [ 627.144081][ T30] 4 locks held by kworker/1:4/5274: [ 627.149806][ T30] #0: ffff8880b923ea18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb0/0x140 [ 627.159865][ T30] #1: ffff8880b9328948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x441/0x770 [ 627.172873][ T30] #2: ffffffff8e937800 (rcu_read_lock_bh){....}-{1:2}, at: wg_packet_tx_worker+0x25f/0x810 [ 627.183060][ T30] #3: ffffffff8e9377a0 (rcu_read_lock){....}-{1:2}, at: ip6_input_finish+0xdc/0x2d0 [ 627.192862][ T30] 1 lock held by syz.0.1816/13052: [ 627.198041][ T30] #0: ffff888024065190 (&dev->mutex){....}-{3:3}, at: usbdev_release+0x7a/0x7a0 [ 627.208321][ T30] 1 lock held by syz.1.1932/13439: [ 627.213866][ T30] #0: ffff888024065190 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x156/0x780 [ 627.223018][ T30] 1 lock held by syz.3.2133/14463: [ 627.228191][ T30] #0: ffff888024065190 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x156/0x780 [ 627.237273][ T30] 1 lock held by syz.1.2239/14842: [ 627.242392][ T30] #0: ffff888024065190 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x156/0x780 [ 627.251481][ T30] 3 locks held by syz-executor/15406: [ 627.256934][ T30] #0: ffff88804914cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 [ 627.268486][ T30] #1: ffff88804914c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 [ 627.278573][ T30] #2: ffffffff8fdeb668 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 [ 627.292884][ T30] 1 lock held by syz.1.2410/15480: [ 627.298634][ T30] #0: ffff888024065190 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x156/0x780 [ 627.308300][ T30] 3 locks held by syz.3.2515/15974: [ 627.313517][ T30] #0: ffff88804ccc0d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 [ 627.323627][ T30] #1: ffff88804ccc0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 [ 627.333346][ T30] #2: ffffffff8fdeb668 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 [ 627.343401][ T30] 1 lock held by syz.4.2517/15977: [ 627.348584][ T30] #0: ffffffff8e93cb78 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 [ 627.359557][ T30] 3 locks held by syz.1.2519/15993: [ 627.364748][ T30] #0: ffff8880238a8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 [ 627.375597][ T30] #1: ffff8880238a8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 [ 627.385422][ T30] #2: ffffffff8fdeb668 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 [ 627.395556][ T30] 3 locks held by syz.0.2521/15999: [ 627.400760][ T30] #0: ffff88802e2e4d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 [ 627.410781][ T30] #1: ffff88802e2e4078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 [ 627.420571][ T30] #2: ffffffff8fdeb668 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 [ 627.445355][ T30] [ 627.447721][ T30] ============================================= [ 627.447721][ T30] [ 627.498192][ T30] NMI backtrace for cpu 0 [ 627.502558][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 627.513076][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 627.523148][ T30] Call Trace: [ 627.526442][ T30] [ 627.529385][ T30] dump_stack_lvl+0x241/0x360 [ 627.534077][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 627.539275][ T30] ? __pfx__printk+0x10/0x10 [ 627.543874][ T30] ? vprintk_emit+0x631/0x770 [ 627.548553][ T30] ? __pfx_vprintk_emit+0x10/0x10 [ 627.553562][ T30] nmi_cpu_backtrace+0x49c/0x4d0 [ 627.558504][ T30] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 627.563974][ T30] ? _printk+0xd5/0x120 [ 627.568133][ T30] ? __pfx__printk+0x10/0x10 [ 627.572723][ T30] ? __wake_up_klogd+0xcc/0x110 [ 627.577585][ T30] ? __pfx__printk+0x10/0x10 [ 627.582167][ T30] ? __rcu_read_unlock+0xa1/0x110 [ 627.587184][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 627.593154][ T30] nmi_trigger_cpumask_backtrace+0x198/0x320 [ 627.599132][ T30] watchdog+0xfee/0x1030 [ 627.603368][ T30] ? watchdog+0x1ea/0x1030 [ 627.607871][ T30] ? __pfx_watchdog+0x10/0x10 [ 627.612541][ T30] kthread+0x2f0/0x390 [ 627.616600][ T30] ? __pfx_watchdog+0x10/0x10 [ 627.621267][ T30] ? __pfx_kthread+0x10/0x10 [ 627.625844][ T30] ret_from_fork+0x4b/0x80 [ 627.630252][ T30] ? __pfx_kthread+0x10/0x10 [ 627.634826][ T30] ret_from_fork_asm+0x1a/0x30 [ 627.639594][ T30] [ 627.644396][ T30] Sending NMI from CPU 0 to CPUs 1: [ 627.650145][ C1] NMI backtrace for cpu 1 [ 627.650158][ C1] CPU: 1 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 627.650179][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 627.650190][ C1] Workqueue: 0x0 (events_unbound) [ 627.650213][ C1] RIP: 0010:memset_orig+0x75/0xb0 [ 627.650236][ C1] Code: 89 47 30 48 89 47 38 48 8d 7f 40 75 d8 0f 1f 84 00 00 00 00 00 89 d1 83 e1 38 74 14 c1 e9 03 66 0f 1f 44 00 00 ff c9 48 89 07 <48> 8d 7f 08 75 f5 83 e2 07 74 0a ff ca 88 07 48 8d 7f 01 75 f6 4c [ 627.650250][ C1] RSP: 0018:ffffc90000107bb8 EFLAGS: 00000046 [ 627.650263][ C1] RAX: 0000000000000000 RBX: ffff888015895c05 RCX: 0000000000000000 [ 627.650275][ C1] RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffff8880176d6a20 [ 627.650286][ C1] RBP: ffffc90000107dc0 R08: ffff8880176d6a27 R09: 0000000000000000 [ 627.650298][ C1] R10: ffff8880176d6a10 R11: ffffed1002edad45 R12: dffffc0000000000 [ 627.650311][ C1] R13: ffff8880176d6a40 R14: ffff8880158a02f8 R15: ffff8880176d6a38 [ 627.650324][ C1] FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 [ 627.650338][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 627.650349][ C1] CR2: 0000000020000000 CR3: 000000000e734000 CR4: 00000000003526f0 [ 627.650363][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 627.650373][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 627.650384][ C1] Call Trace: [ 627.650391][ C1] [ 627.650398][ C1] ? nmi_cpu_backtrace+0x3c2/0x4d0 [ 627.650420][ C1] ? __pfx_lock_acquire+0x10/0x10 [ 627.650442][ C1] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 627.650463][ C1] ? nmi_handle+0x2a/0x5a0 [ 627.650487][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 627.650511][ C1] ? nmi_handle+0x14f/0x5a0 [ 627.650526][ C1] ? nmi_handle+0x2a/0x5a0 [ 627.650543][ C1] ? memset_orig+0x75/0xb0 [ 627.650561][ C1] ? default_do_nmi+0x63/0x160 [ 627.650582][ C1] ? exc_nmi+0x123/0x1f0 [ 627.650602][ C1] ? end_repeat_nmi+0xf/0x53 [ 627.650629][ C1] ? memset_orig+0x75/0xb0 [ 627.650648][ C1] ? memset_orig+0x75/0xb0 [ 627.650667][ C1] ? memset_orig+0x75/0xb0 [ 627.650686][ C1] [ 627.650692][ C1] [ 627.650698][ C1] process_scheduled_works+0xee4/0x1830 [ 627.650733][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 627.650757][ C1] ? assign_work+0x364/0x3d0 [ 627.650778][ C1] worker_thread+0x86d/0xd40 [ 627.650804][ C1] ? __kthread_parkme+0x169/0x1d0 [ 627.650827][ C1] ? __pfx_worker_thread+0x10/0x10 [ 627.650845][ C1] kthread+0x2f0/0x390 [ 627.650860][ C1] ? __pfx_worker_thread+0x10/0x10 [ 627.650878][ C1] ? __pfx_kthread+0x10/0x10 [ 627.650894][ C1] ret_from_fork+0x4b/0x80 [ 627.650913][ C1] ? __pfx_kthread+0x10/0x10 [ 627.650927][ C1] ret_from_fork_asm+0x1a/0x30 [ 627.650955][ C1] [ 627.938818][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 627.945691][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 627.956210][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 627.966372][ T30] Call Trace: [ 627.969657][ T30] [ 627.972592][ T30] dump_stack_lvl+0x241/0x360 [ 627.977283][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 627.982492][ T30] ? __pfx__printk+0x10/0x10 [ 627.987093][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 627.993079][ T30] ? vscnprintf+0x5d/0x90 [ 627.997404][ T30] panic+0x349/0x860 [ 628.001289][ T30] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 628.007438][ T30] ? __pfx_panic+0x10/0x10 [ 628.011844][ T30] ? tick_nohz_tick_stopped+0x82/0xb0 [ 628.017206][ T30] ? __irq_work_queue_local+0x137/0x410 [ 628.022741][ T30] ? preempt_schedule_thunk+0x1a/0x30 [ 628.028099][ T30] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 628.034242][ T30] ? nmi_trigger_cpumask_backtrace+0x2d4/0x320 [ 628.040390][ T30] ? nmi_trigger_cpumask_backtrace+0x2d9/0x320 [ 628.046538][ T30] watchdog+0x102d/0x1030 [ 628.050861][ T30] ? watchdog+0x1ea/0x1030 [ 628.055283][ T30] ? __pfx_watchdog+0x10/0x10 [ 628.059956][ T30] kthread+0x2f0/0x390 [ 628.064012][ T30] ? __pfx_watchdog+0x10/0x10 [ 628.068679][ T30] ? __pfx_kthread+0x10/0x10 [ 628.073270][ T30] ret_from_fork+0x4b/0x80 [ 628.077678][ T30] ? __pfx_kthread+0x10/0x10 [ 628.082259][ T30] ret_from_fork_asm+0x1a/0x30 [ 628.087029][ T30] [ 628.090271][ T30] Kernel Offset: disabled [ 628.094582][ T30] Rebooting in 86400 seconds..