last executing test programs: 8.245670398s ago: executing program 2 (id=704): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000080)=r2, 0x4) r3 = syz_open_dev$usbmon(&(0x7f0000000900), 0xa, 0x0) ioctl$MON_IOCX_GETX(r3, 0x80089203, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffc9b}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000bfe000/0x400000)=nil) ioctl$KVM_SET_SREGS2(0xffffffffffffffff, 0x4140aecd, 0x0) openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0xa00, 0x0, 0x0, {0x5, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000890) r6 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000500)='illinois', 0x8) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 8.1907983s ago: executing program 3 (id=705): socket$inet6_sctp(0xa, 0x5, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f0000000640)='./file2\x00', 0x0, &(0x7f00000003c0)={[{@gid}, {@barrier}, {@umask={'umask', 0x3d, 0x5}}, {@creator={'creator', 0x3d, "04c22302"}}, {@nls={'nls', 0x3d, 'koi8-r'}}, {@gid}, {@gid}, {@type={'type', 0x3d, "5361c9e5"}}]}, 0x1, 0x5de, &(0x7f0000000d40)="$eJzs3cFvHFcdB/DvbGLHDlK6SZOmICSscgA1IrF3IxMkJKAUZKEKVeLSq5VsaiubNLK3yO0BAuLc/gvlYM4cOKEg5cCZf8GoRwR334xmdta7Sbau3TjeTfr5SLPvvX0zb37vl5nRzFjRBvjaWnkvM4/mk5Ur72yV7Z3tdndnu313UE9yJkkjmUtSlF//LcnnyYP0l3xz0DFSPqX4dOXm2sNPLvdbc/VSrV8ctN3h7MfS7Mdalcc1XuuZxxvOcCHJhbqEidsb+PfY7mc8LwGAaVYkp8Z930zO1jfr5XNA/664f4/9Qnsw6QAAAADgBLyym91s5dyk4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAXSf37/0W9NAb1hRSD3/+frb9LXX+hPZp0AAAAAAAAAABwDL6zm91s5dygvVdUf/N/o2pcrD6/kQ+zmU42cjVbWU0vvWxkKUlzZKDZrdVeb2PpEFu2xm7ZOpn5AgAAAAAAAMBL6o9ZGf79HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApkGRnOoX1XJxUG+mcTrJXJLZcr0HycNB/UX2aNIBAAAAwAl4ZTe72cq5QXuvqJ75X6ue++fyYe6ll/X00k0nt6p3Af2n/sbOdru7s92+Wy5Pj/uz/x0pjGrE9N89jN/zYrXGpf0tVvLL/CZXspB3s5H1/Dar6aWThbxd1VZTpFm/vWgO4hwf708fa737ZbG+XkUyn9tZr2K7mpv5IN3cSqOaQ7XOwXv8Q5md4ie1Q+boVl2WM/pVXU6HZpWRmf2MLNa5L7Nx/uBMHPE4eXJPS2nsv4O6+BxyfrYuy1y/PdU5b40cfa8dnIlksfXf+2vde3fWbm9emZ4pfUVPZqI9konLR87E3t7e7098Csdkts5G/yp6tKvlG9W257KeX+eD3EonN7KYG1nO9bSznB9leSSvlw5xrjWOdq599/t1ZSbJL+pyOpR5PT+S19ErXbPqG/1mmKULx39FOv2tulIerG9N3RXp/BPX5kEmXj04E3/eKz83u/fubKyt3j/k/r5Xl2UGfj5VmSiPlwvlP1bVevzoKPteHdu3VPVd3O9rPNV3ab/vy87U2foe7umRWlXf5bF97arv9ZG+cXc5AEy9s2+enZ3/z/y/5j+b/9P82vw7c2+duXHm27OZ+efpv5/6a+MvjR8Xb+az/G74/A8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHx1mx99fGe12+1sqKhMvjKX5LArD373adIxv6SVCV+YgOfuWu/u/WubH338g/W7q+933u/cu7603Lp+fXH5hzeu3V7vdhb7n5MOEwA4RsOb/klHAgAAAAAAAAAAAAAAfJGT+O/Ek54jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwclt5LzOPUmRp8epi2d7ZbnfLZVAfrjmXpCgr/0jyefIg/SXNkeGKL9pP8enKzbWHn1wejjU3WL84aLvDeSyWxhMxPet4rWcebzjDhSQX6hIm7v8BAAD//6YMAag=") read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x25, 0x1, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x1000000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r2, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) syz_emit_ethernet(0x8c, &(0x7f0000000000)={@link_local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010120", 0x56, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x0, 0x8, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96489269748e254c1e4a8a8b3f0ab0c430d3be27df3e3406fd42ca0a5c15b37ada"}]}}}}}}, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x48) write$cgroup_devices(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='b *:2 r'], 0x9) shutdown(r2, 0x1) 6.87020988s ago: executing program 2 (id=708): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 6.86748988s ago: executing program 3 (id=709): socket$kcm(0x2, 0x1000000000000005, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x8) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_pts(r1, 0x60300) dup3(r2, r1, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x0) 6.764300755s ago: executing program 2 (id=710): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f00000000c0)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @printk={@ld={0x18, 0x0}, {0x3, 0x3, 0x3, 0xa, 0x1, 0xfe00}, {0x5}, {}, {}, {}, {0x85, 0x0, 0x0, 0x76}}]}, &(0x7f0000000180)='GPL\x00', 0x9}, 0x94) 6.763874015s ago: executing program 3 (id=711): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000000)={0x3ff, 0xfffffffffffffff9, 0x1000000000000, 0xdc21, 0x0, 0x2000000f, 0x3}, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000180)={@empty, @multicast2, @dev}, &(0x7f0000000240)=0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x101, &(0x7f00000002c0)) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) sendmsg$nl_route(r3, 0x0, 0x0) epoll_pwait(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x1c, &(0x7f0000000100)={[0x3]}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x11, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x437, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50483}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4400, 0x8002}}}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) clock_gettime(0x3, 0x0) chmod(0x0, 0x22) mount$tmpfs(0x0, 0x0, &(0x7f0000000280), 0x2000001, 0x0) ioctl$USBDEVFS_WAIT_FOR_RESUME(0xffffffffffffffff, 0x5523) getegid() socketpair(0x1d, 0x2, 0x2, &(0x7f0000000280)) newfstatat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={[], [{@seclabel}, {@euid_gt={'euid>', r4}}]}) 6.694428559s ago: executing program 2 (id=712): io_uring_setup(0x1b7b, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) r4 = socket(0x80000000000000a, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r6 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', &(0x7f00000004c0)={0x400, 0x160, 0x22}, 0x18) execveat(r6, &(0x7f0000000500)='./bus\x00', &(0x7f0000000740)={[&(0x7f0000000540)='\xbb\xbb\xbb\xbb\xbb\xbb', &(0x7f0000000580)='\xff\xff', &(0x7f00000005c0)='/dev/ptmx\x00', &(0x7f0000000600)='@{#*)&\x00', &(0x7f0000000640)='{+\x00', &(0x7f0000000680)='\x00', &(0x7f0000000700)='\xaa\xaa\xaa\xaa\xaa']}, 0x0, 0x100) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r5, 0x40384708, &(0x7f0000000080)={0x4, 0xfffff001, 0x9, 0x8000003, 0x20, "3eccd2000500000000000e00"}) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa098100100086dd60da000800000000bbff02000000"], 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0xfffd, 0x0, @remote}}}, 0x108) 4.779571779s ago: executing program 2 (id=713): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000900)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.744721471s ago: executing program 0 (id=715): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtfilter={0x24, 0x2c, 0xd27, 0x2070bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r1, {0x6, 0x10}, {}, {0x8, 0xffe0}}}, 0x24}}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB='V?\x00'], 0xfe33) 4.584446709s ago: executing program 3 (id=716): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xb0, &(0x7f0000001100)=[@in6={0xa, 0x4e21, 0x9b6, @mcast1, 0x9}, @in6={0xa, 0x4e23, 0x3, @rand_addr=' \x01\x00', 0x2}, @in6={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x4000100}, @in={0x2, 0x4e24, @empty}, @in6={0xa, 0x4e21, 0x7, @mcast1, 0xffffffff}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e21, @loopback}]}, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fsopen(0x0, 0x1) fchdir(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x400) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000040)={0x1, 0x3, 0xc3, 0x3, 0x7f}) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r5, @ANYBLOB="05"], 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000980)={'syztnl0\x00', 0x0, 0x80, 0x1, 0x0, 0xfffffffd, {{0x5, 0x4, 0x0, 0x20, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @local}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0x2e76be}], 0x1}, 0x3) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x100003, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x934a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) 4.495225654s ago: executing program 0 (id=717): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000080)=r2, 0x4) r3 = syz_open_dev$usbmon(&(0x7f0000000900), 0xa, 0x0) ioctl$MON_IOCX_GETX(r3, 0x80089203, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffc9b}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000bfe000/0x400000)=nil) ioctl$KVM_SET_SREGS2(0xffffffffffffffff, 0x4140aecd, 0x0) openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0xa00, 0x0, 0x0, {0x5, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000890) r6 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000500)='illinois', 0x8) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 3.757911133s ago: executing program 1 (id=718): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'macvtap0\x00'}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4040040) r3 = socket(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x89fe, &(0x7f0000000340)={'bridge0\x00', &(0x7f0000000000)=@ethtool_coalesce={0xf, 0x0, 0x200, 0x2, 0x7, 0x9, 0x0, 0x5, 0x9, 0x2, 0xca1, 0x8, 0x1, 0x6, 0xff, 0x9, 0x3, 0x7, 0x7, 0xb, 0x64, 0x1000, 0xc}}) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040011) ioctl$RTC_AIE_OFF(r1, 0x7002) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000180)) ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000b80)={{0x7, 0x5, 0xc, 0xd, 'syz0\x00', 0x401}, 0x1, [0x2, 0x1, 0x2, 0x4, 0x2, 0x2, 0x4, 0x0, 0x7db6, 0xd, 0x2, 0x10, 0x6, 0xffff, 0x81, 0xc5e, 0x81, 0x1ff, 0xc5b, 0x1, 0x6, 0x4, 0x7, 0x6, 0x1, 0x0, 0x9, 0x10000, 0x4e0, 0x8, 0x1000, 0x844, 0x7, 0x0, 0x0, 0x10, 0x6, 0x0, 0x5, 0x3, 0x3, 0x80, 0x280, 0x100000000, 0x3, 0x81, 0xe, 0x5, 0x3, 0xffffffffffffffff, 0x3, 0x3ff, 0xd69, 0x9, 0x1, 0x4, 0xfffffffffffffff7, 0x3, 0x7, 0xa1, 0x6, 0x5, 0x2, 0x3, 0xce, 0x1, 0xf1d, 0x6, 0xa9, 0x1, 0x4, 0x0, 0x7, 0x7f, 0x2, 0xa6, 0x6, 0x1, 0x6, 0x80, 0x34a, 0xc, 0x7fffffffffffffff, 0xfffffffffffffff1, 0x6, 0xf, 0xb4c, 0xffffffff80000000, 0xb3, 0x1, 0xb, 0x7, 0x1ff, 0x9, 0x8, 0x0, 0x198, 0x53, 0x8, 0xffffffffffffffe2, 0x6, 0x3f800, 0x7, 0xfff, 0xb6, 0x5, 0x5, 0xffff, 0x8, 0xf, 0x7, 0x7, 0x8, 0x100000000, 0x7, 0x7ff, 0xfffffffffffffffe, 0x0, 0x4, 0x5, 0x7, 0x0, 0x8, 0x6f, 0x5, 0x7fff, 0x0, 0x9]}) 3.197198142s ago: executing program 0 (id=719): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 3.187567772s ago: executing program 1 (id=720): socket$qrtr(0x2a, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000080)={0x0, 0xd, 0x572, 0x8000, 0x6, "ff000d00009a468e0cd912098d00"}) r4 = syz_open_pts(0xffffffffffffffff, 0x2400) ioctl$TCSETA(r4, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xb, "6c06002004dc17a8"}) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) fsopen(&(0x7f0000000000)='udf\x00', 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e44020210"], 0x47) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="02c9800c00080005000606040006000700c3bd780f8785c31adaa4115ac788d48903f2f4429536a0f760fc0d4eede19d32dba787eac487fbe0a7d30a02b02fe64bf54f309cc4b972dd61dbbdb9650b7c58eada289b5437a8cc3d3f8a903b93e0be4d031b8821595ccc3207eff7e8"], 0x11) 3.115354306s ago: executing program 3 (id=721): socket$nl_generic(0x10, 0x3, 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001a400)=""/102384, 0x18ff0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@private0, @in=@private=0xa010101, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x10000, 0x0, 0x9, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x7, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[]) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, 0x0, 0x5) socket$inet_smc(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r5, 0x0, 0x4000) 3.058012639s ago: executing program 0 (id=722): chdir(0x0) socket(0xa, 0x2, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x17, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x80}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffa}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0xfed, &(0x7f0000000780)=""/4077, 0x41000, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) 1.70176555s ago: executing program 1 (id=723): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r1 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000340)=ANY=[@ANYRES32=0x0, @ANYRES64, @ANYRES64, @ANYRES16], 0x1, 0x374, &(0x7f0000000f80)="$eJzs3c9rI2UYwPEnbX5MWrbJQRQF6YNe9DK01bMaZBfEgEt3I+4Kwux2oiFjUmZCJCK2N6/izX9AcNnjgocF9R/oxdt68eLJXgRBFxFH5leapJMfjSmb7n4/0OZJ3veZed/84nkDeXP83pcfN+ueWbc6smKoZEREHoqUZUUSmegiLykO5eX1Px48f+3Gzbcr1erlXdUrleuv7Kjqxub3n3xWjLvdL8hR+YNjMX49evro2eN/r3/U8LThaavdUUtvtX/pWLccW/caXtNUverYlmdro+XZbtTejtrrTnt/v6dWa+/S2r5re55arZ427Z522tpxe2p9aDVaapqmXlpLG+5jzJgjp3Znd9eqzHnC23PmYdH+9n1/QrPrVqxVEbN4qqV251zHBQAAltJI/f91UiOUZaVfUGbitUA+jIeXAUH9n8Rh/R8sFk7q/7sv/NhZf/feRlz/38+n1f+v/hzlD9X/wdkXXv9/O3L9dEV04R2cpfP/qv+xHDaHX5G/nazYY0H9H7wa+iv63Pt3t8KA+h8AAAAAAAAAAAAAAAAAAAAAgIvgoe+XfN8vJZfJ38lXCOLrybVJXzTGhTPu8S/EOwr0nw94LF27cVOM8It72Q0R54turVuLLuP2pOOWlOSf8PkQizacOAwbNVCWH5yDbi0XJ6yG/ysiKo7Ysi0lKQ/lh/GVt6qXtzUS5YfnP+jWMtm1IL8ujTB/R0ryVHr+Tmp+Xl56cSDflJL8dFva4she/D6W5H++rfrmO9WR/GLYL83r5/uQAAAAAACwcKaqES+fy8Pr32j9bpqqae3BWl4G1+enPx/or6+3Utfn2dJz2Uc7dwAAAAAAnhRe/tOm5Ti26/XGBkWZ1qcQH22kKStTjhwE2Rn6DAUPwiA3qc/qwAxnPXI+/gWNWYfhej2ZecxJ8GdBUu/MZAvXoSYj/V6dMUjmP0Nn46wPgeutnH3ututtBuPRuaYzECQfG43rI1fnPfK4INk5d1rnZ7765q/5TpGJd+0dbHrtnjFlpmGQGbnlcMqT9nffD17UE8eTS3+3+G6eH5kBAAAAsCSSor/oJbe8MSVj/fwHBQAAAAAAAAAAAAAAAAAAAAAAAAAAAADAE2ah26SNCR71HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBl8V8AAAD//1f39NU=") r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x10507e, 0xa6) fallocate(r4, 0x0, 0x0, 0x1000f4) io_setup(0x7d, &(0x7f0000000600)=0x0) io_submit(r6, 0x2, &(0x7f0000001d00)=[&(0x7f0000000080)={0xfffffffffffffdef, 0x0, 0x0, 0x0, 0x0, r5, &(0x7f0000000000)="96", 0xfffffe10, 0x0, 0x0, 0x0, r5}, &(0x7f0000000740)={0x0, 0x0, 0x41, 0x3, 0x0, r4, 0x0, 0x0, 0xffffffffffffffff}]) 1.674289012s ago: executing program 3 (id=724): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000000)={0x3ff, 0xfffffffffffffff9, 0x1000000000000, 0xdc21, 0x0, 0x2000000f, 0x3}, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000180)={@empty, @multicast2, @dev}, &(0x7f0000000240)=0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x101, &(0x7f00000002c0)) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) sendmsg$nl_route(r3, 0x0, 0x0) epoll_pwait(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x1c, &(0x7f0000000100)={[0x3]}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x11, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x437, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50483}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4400, 0x8002}}}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) clock_gettime(0x3, 0x0) chmod(0x0, 0x22) mount$tmpfs(0x0, 0x0, &(0x7f0000000280), 0x2000001, 0x0) ioctl$USBDEVFS_WAIT_FOR_RESUME(0xffffffffffffffff, 0x5523) getegid() socketpair(0x1d, 0x2, 0x2, &(0x7f0000000280)) newfstatat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={[], [{@seclabel}, {@euid_gt={'euid>', r4}}]}) 1.496197641s ago: executing program 2 (id=725): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="200e06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000040)={&(0x7f0000002540)=[{0x80, 0x1000, 0x0, 0x0}, {0x8, 0x6810, 0x0, 0x0}], 0x2}) 1.154846919s ago: executing program 0 (id=726): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = dup(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) munmap(&(0x7f000053c000/0x4000)=nil, 0x4000) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, &(0x7f0000000000), 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000010c0)='net/igmp\x00') pread64(r7, &(0x7f0000004500)=""/122, 0x7a, 0x3) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x1010, r8, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000180)={0x2, &(0x7f00000001c0)=[{0x1, 0xe, 0x0, 0x7}, {0x3ff, 0xb0, 0x7, 0x6}]}) 1.009711846s ago: executing program 1 (id=727): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000080)=r2, 0x4) r3 = syz_open_dev$usbmon(&(0x7f0000000900), 0xa, 0x0) ioctl$MON_IOCX_GETX(r3, 0x80089203, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffc9b}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000bfe000/0x400000)=nil) ioctl$KVM_SET_SREGS2(0xffffffffffffffff, 0x4140aecd, 0x0) openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0xa00, 0x0, 0x0, {0x5, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000890) r6 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000500)='illinois', 0x8) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 151.820961ms ago: executing program 1 (id=728): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'macvtap0\x00'}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4040040) r3 = socket(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x89fe, &(0x7f0000000340)={'bridge0\x00', &(0x7f0000000000)=@ethtool_coalesce={0xf, 0x0, 0x200, 0x2, 0x7, 0x9, 0x0, 0x5, 0x9, 0x2, 0xca1, 0x8, 0x1, 0x6, 0xff, 0x9, 0x3, 0x7, 0x7, 0xb, 0x64, 0x1000, 0xc}}) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040011) ioctl$RTC_AIE_OFF(r1, 0x7002) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000180)) ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000b80)={{0x7, 0x5, 0xc, 0xd, 'syz0\x00', 0x401}, 0x1, [0x2, 0x1, 0x2, 0x4, 0x2, 0x2, 0x4, 0x0, 0x7db6, 0xd, 0x2, 0x10, 0x6, 0xffff, 0x81, 0xc5e, 0x81, 0x1ff, 0xc5b, 0x1, 0x6, 0x4, 0x7, 0x6, 0x1, 0x0, 0x9, 0x10000, 0x4e0, 0x8, 0x1000, 0x844, 0x7, 0x0, 0x0, 0x10, 0x6, 0x0, 0x5, 0x3, 0x3, 0x80, 0x280, 0x100000000, 0x3, 0x81, 0xe, 0x5, 0x3, 0xffffffffffffffff, 0x3, 0x3ff, 0xd69, 0x9, 0x1, 0x4, 0xfffffffffffffff7, 0x3, 0x7, 0xa1, 0x6, 0x5, 0x2, 0x3, 0xce, 0x1, 0xf1d, 0x6, 0xa9, 0x1, 0x4, 0x0, 0x7, 0x7f, 0x2, 0xa6, 0x6, 0x1, 0x6, 0x80, 0x34a, 0xc, 0x7fffffffffffffff, 0xfffffffffffffff1, 0x6, 0xf, 0xb4c, 0xffffffff80000000, 0xb3, 0x1, 0xb, 0x7, 0x1ff, 0x9, 0x8, 0x0, 0x198, 0x53, 0x8, 0xffffffffffffffe2, 0x6, 0x3f800, 0x7, 0xfff, 0xb6, 0x5, 0x5, 0xffff, 0x8, 0xf, 0x7, 0x7, 0x8, 0x100000000, 0x7, 0x7ff, 0xfffffffffffffffe, 0x0, 0x4, 0x5, 0x7, 0x0, 0x8, 0x6f, 0x5, 0x7fff, 0x0, 0x9]}) 34.032818ms ago: executing program 0 (id=729): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xb0, &(0x7f0000001100)=[@in6={0xa, 0x4e21, 0x9b6, @mcast1, 0x9}, @in6={0xa, 0x4e23, 0x3, @rand_addr=' \x01\x00', 0x2}, @in6={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x4000100}, @in={0x2, 0x4e24, @empty}, @in6={0xa, 0x4e21, 0x7, @mcast1, 0xffffffff}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e21, @loopback}]}, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fsopen(0x0, 0x1) fchdir(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x400) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000040)={0x1, 0x3, 0xc3, 0x3, 0x7f}) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r5, @ANYBLOB="05"], 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000980)={'syztnl0\x00', 0x0, 0x80, 0x1, 0x0, 0xfffffffd, {{0x5, 0x4, 0x0, 0x20, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @local}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0x2e76be}], 0x1}, 0x3) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x100003, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x934a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) 0s ago: executing program 1 (id=730): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.46' (ED25519) to the list of known hosts. [ 61.136076][ T5749] cgroup: Unknown subsys name 'net' [ 61.320601][ T5749] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 62.730442][ T5749] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.142233][ T5769] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.142939][ T5772] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.157204][ T5769] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.158648][ T5772] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.172074][ T5769] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.172671][ T5772] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.179768][ T5769] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.194982][ T5769] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.202435][ T5769] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.211018][ T5772] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.211692][ T5769] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.229515][ T5773] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.234865][ T5772] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 64.238247][ T5773] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.243769][ T5769] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.259435][ T5769] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 64.266627][ T5772] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.273743][ T5769] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.273825][ T5775] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.282625][ T5772] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.288681][ T5775] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 64.302583][ T5775] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.303045][ T5772] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 64.317417][ T5775] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.750350][ T5761] chnl_net:caif_netlink_parms(): no params data found [ 64.767235][ T5762] chnl_net:caif_netlink_parms(): no params data found [ 64.801826][ T5763] chnl_net:caif_netlink_parms(): no params data found [ 64.876998][ T5764] chnl_net:caif_netlink_parms(): no params data found [ 64.988231][ T5763] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.995907][ T5763] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.003084][ T5763] bridge_slave_0: entered allmulticast mode [ 65.010079][ T5763] bridge_slave_0: entered promiscuous mode [ 65.017916][ T5762] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.025235][ T5762] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.032457][ T5762] bridge_slave_0: entered allmulticast mode [ 65.039210][ T5762] bridge_slave_0: entered promiscuous mode [ 65.047521][ T5762] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.054773][ T5762] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.061898][ T5762] bridge_slave_1: entered allmulticast mode [ 65.069116][ T5762] bridge_slave_1: entered promiscuous mode [ 65.079755][ T5761] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.086959][ T5761] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.094366][ T5761] bridge_slave_0: entered allmulticast mode [ 65.100929][ T5761] bridge_slave_0: entered promiscuous mode [ 65.109084][ T5763] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.116587][ T5763] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.123879][ T5763] bridge_slave_1: entered allmulticast mode [ 65.130959][ T5763] bridge_slave_1: entered promiscuous mode [ 65.151786][ T5761] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.159061][ T5761] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.166311][ T5761] bridge_slave_1: entered allmulticast mode [ 65.172894][ T5761] bridge_slave_1: entered promiscuous mode [ 65.221785][ T5761] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.240128][ T5762] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.261283][ T5761] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.274865][ T5763] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.288782][ T5762] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.318022][ T5763] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.336701][ T5764] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.343800][ T5764] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.351563][ T5764] bridge_slave_0: entered allmulticast mode [ 65.358206][ T5764] bridge_slave_0: entered promiscuous mode [ 65.365567][ T5764] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.372640][ T5764] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.379863][ T5764] bridge_slave_1: entered allmulticast mode [ 65.386483][ T5764] bridge_slave_1: entered promiscuous mode [ 65.430350][ T5761] team0: Port device team_slave_0 added [ 65.447805][ T5762] team0: Port device team_slave_0 added [ 65.464104][ T5762] team0: Port device team_slave_1 added [ 65.471653][ T5761] team0: Port device team_slave_1 added [ 65.479813][ T5763] team0: Port device team_slave_0 added [ 65.496388][ T5764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.516223][ T5763] team0: Port device team_slave_1 added [ 65.533028][ T5764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.561388][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.568575][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.594677][ T5761] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.607111][ T5762] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.614112][ T5762] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.640043][ T5762] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.677481][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.685638][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.712085][ T5761] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.723733][ T5762] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.733058][ T5762] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.761710][ T5762] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.788800][ T5763] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.795798][ T5763] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.821712][ T5763] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.838486][ T5763] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.845554][ T5763] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.871568][ T5763] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.888254][ T5764] team0: Port device team_slave_0 added [ 65.897013][ T5764] team0: Port device team_slave_1 added [ 65.975249][ T5764] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.982224][ T5764] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.008921][ T5764] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.025252][ T5761] hsr_slave_0: entered promiscuous mode [ 66.031427][ T5761] hsr_slave_1: entered promiscuous mode [ 66.053068][ T5762] hsr_slave_0: entered promiscuous mode [ 66.059482][ T5762] hsr_slave_1: entered promiscuous mode [ 66.065921][ T5762] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.073902][ T5762] Cannot create hsr debugfs directory [ 66.080069][ T5764] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.087488][ T5764] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.113454][ T5764] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.142679][ T5763] hsr_slave_0: entered promiscuous mode [ 66.148887][ T5763] hsr_slave_1: entered promiscuous mode [ 66.154970][ T5763] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.162511][ T5763] Cannot create hsr debugfs directory [ 66.209952][ T5764] hsr_slave_0: entered promiscuous mode [ 66.216216][ T5764] hsr_slave_1: entered promiscuous mode [ 66.222144][ T5764] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.230014][ T5764] Cannot create hsr debugfs directory [ 66.364864][ T5765] Bluetooth: hci1: command tx timeout [ 66.364876][ T51] Bluetooth: hci0: command tx timeout [ 66.365104][ T51] Bluetooth: hci2: command tx timeout [ 66.370538][ T5765] Bluetooth: hci3: command tx timeout [ 66.596099][ T5763] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 66.612489][ T5763] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 66.621950][ T5763] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 66.631409][ T5763] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 66.693233][ T5761] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.703936][ T5761] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.720394][ T5761] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.730337][ T5761] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.779011][ T5762] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 66.790032][ T5762] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 66.804617][ T5762] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 66.826479][ T5762] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 66.901603][ T5764] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 66.915499][ T5764] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 66.947166][ T5764] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 66.967954][ T5764] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 66.998557][ T5763] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.059016][ T5763] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.079839][ T1136] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.087177][ T1136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.113679][ T5761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.130101][ T1136] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.137235][ T1136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.169674][ T5761] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.180285][ T5762] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.212286][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.219434][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.245889][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.252974][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.278553][ T5762] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.327286][ T1136] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.334428][ T1136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.350401][ T5764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.366127][ T5761] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.376731][ T5761] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.404892][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.412027][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.459627][ T5764] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.508511][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.515677][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.536254][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.543410][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.676677][ T5762] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.763329][ T5761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.834392][ T5763] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.915170][ T5761] veth0_vlan: entered promiscuous mode [ 67.950966][ T5761] veth1_vlan: entered promiscuous mode [ 67.982736][ T5763] veth0_vlan: entered promiscuous mode [ 68.035561][ T5763] veth1_vlan: entered promiscuous mode [ 68.057863][ T5762] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.082284][ T5761] veth0_macvtap: entered promiscuous mode [ 68.093022][ T5761] veth1_macvtap: entered promiscuous mode [ 68.109909][ T5764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.152403][ T5763] veth0_macvtap: entered promiscuous mode [ 68.163170][ T5763] veth1_macvtap: entered promiscuous mode [ 68.172899][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.200891][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.226091][ T5761] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.235296][ T5761] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.244665][ T5761] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.253368][ T5761] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.273696][ T5762] veth0_vlan: entered promiscuous mode [ 68.298114][ T5763] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.310887][ T5763] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.322119][ T5763] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.338994][ T5762] veth1_vlan: entered promiscuous mode [ 68.353202][ T5764] veth0_vlan: entered promiscuous mode [ 68.363066][ T5763] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.375198][ T5763] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.386630][ T5763] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.402261][ T5764] veth1_vlan: entered promiscuous mode [ 68.411978][ T5763] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.421227][ T5763] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.429974][ T5763] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.438685][ T5763] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.448108][ T5775] Bluetooth: hci1: command tx timeout [ 68.448137][ T5771] Bluetooth: hci3: command tx timeout [ 68.453547][ T5765] Bluetooth: hci2: command tx timeout [ 68.459002][ T51] Bluetooth: hci0: command tx timeout [ 68.531604][ T5762] veth0_macvtap: entered promiscuous mode [ 68.597622][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.608962][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.609225][ T5762] veth1_macvtap: entered promiscuous mode [ 68.661590][ T5764] veth0_macvtap: entered promiscuous mode [ 68.670818][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.675540][ T5762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.690167][ T5762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.690860][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.700706][ T5762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.700721][ T5762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.702009][ T5762] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.745972][ T5762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.758189][ T5762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.769107][ T5762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.779795][ T5762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.790502][ T5762] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.830423][ T5764] veth1_macvtap: entered promiscuous mode [ 68.838963][ T5762] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.850122][ T5762] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.859214][ T5762] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.867954][ T5762] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.883135][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.894959][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.946748][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.956983][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.972499][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.988535][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.998478][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.011757][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.022126][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.036202][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.048631][ T5764] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.066398][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.079597][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.092069][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.107913][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.118078][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.128786][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.139963][ T5764] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.184821][ T1136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.187025][ T5764] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.192636][ T1136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.234456][ T5764] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.243171][ T5764] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.258167][ T5764] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.306898][ T5823] syz.0.1[5823]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 69.338500][ T5823] loop0: detected capacity change from 0 to 128 [ 69.422308][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.432779][ T5823] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 69.453407][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.467317][ T5823] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 69.517738][ T1139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.554463][ T1139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.634815][ T5802] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 69.692215][ T1136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.702023][ T1136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.935515][ T5802] usb 4-1: Using ep0 maxpacket: 16 [ 70.042113][ T5802] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 70.201671][ T5802] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 70.290304][ T5802] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 70.310423][ T5802] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.350426][ T5802] usb 4-1: Product: syz [ 70.359156][ T5802] usb 4-1: Manufacturer: syz [ 70.365812][ T5802] usb 4-1: SerialNumber: syz [ 70.397316][ T5761] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 70.542794][ T51] Bluetooth: hci0: command tx timeout [ 70.548382][ T5771] Bluetooth: hci3: command tx timeout [ 70.548446][ T5775] Bluetooth: hci1: command tx timeout [ 70.565684][ T5765] Bluetooth: hci2: command tx timeout [ 70.810583][ T5802] usb 4-1: 0:2 : does not exist [ 71.155854][ T5802] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 72.130029][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 72.141402][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.611521][ T5765] Bluetooth: hci0: command tx timeout [ 72.614555][ T5775] Bluetooth: hci3: command tx timeout [ 72.618347][ T51] Bluetooth: hci2: command tx timeout [ 72.622377][ T5771] Bluetooth: hci1: command tx timeout [ 72.665930][ T5802] usb 4-1: USB disconnect, device number 2 [ 74.153081][ T5755] udevd[5755]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 75.867979][ T79] Bluetooth: hci4: Frame reassembly failed (-84) [ 75.929784][ T5893] loop0: detected capacity change from 0 to 8192 [ 77.461022][ T5906] loop3: detected capacity change from 0 to 32768 [ 77.884994][ T5775] Bluetooth: hci4: command 0xfc11 tx timeout [ 77.891374][ T5771] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 81.074091][ T5821] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 81.304089][ T5821] usb 3-1: Using ep0 maxpacket: 16 [ 81.334318][ T5821] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 81.366433][ T5821] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 81.389567][ T5821] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 81.422289][ T5821] usb 3-1: SerialNumber: syz [ 81.465826][ T5821] cdc_acm 3-1:1.0: skipping garbage [ 81.471329][ T5821] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 81.522503][ T5821] cdc_acm 3-1:1.0: This needs exactly 3 endpoints [ 81.541094][ T5821] cdc_acm: probe of 3-1:1.0 failed with error -22 [ 82.126137][ T5931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.175410][ T787] cfg80211: failed to load regulatory.db [ 82.183635][ T5931] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.221342][ T5821] usb 3-1: USB disconnect, device number 2 [ 82.264585][ T5933] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.446437][ T5933] netlink: 8 bytes leftover after parsing attributes in process `syz.3.35'. [ 82.994971][ T5952] syzkaller0: entered promiscuous mode [ 83.000575][ T5952] syzkaller0: entered allmulticast mode [ 83.099652][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 83.212592][ T5956] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 83.236884][ T5956] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 83.246292][ T5956] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 83.259969][ T5956] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 83.267898][ T8] usb 2-1: device descriptor read/64, error -71 [ 83.276542][ T5956] kvm: requested 41904 ns i8254 timer period limited to 200000 ns [ 83.285153][ T5956] kvm: requested 2514 ns i8254 timer period limited to 200000 ns [ 83.293087][ T5956] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 83.302833][ T5956] kvm: requested 100571 ns i8254 timer period limited to 200000 ns [ 83.311510][ T5956] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 83.319447][ T5956] kvm: requested 170133 ns i8254 timer period limited to 200000 ns [ 83.556453][ T8] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 83.703761][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802caba000: rx timeout, send abort [ 83.714095][ T8] usb 2-1: device descriptor read/64, error -71 [ 83.838591][ T8] usb usb2-port1: attempt power cycle [ 84.204471][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802cab9c00: rx timeout, send abort [ 84.212752][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802caba000: abort rx timeout. Force session deactivation [ 84.575634][ T8] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 84.712713][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802cab9c00: abort rx timeout. Force session deactivation [ 85.105854][ T8] usb 2-1: device descriptor read/8, error -71 [ 85.474164][ T8] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 85.616458][ T8] usb 2-1: device descriptor read/8, error -71 [ 85.854433][ T8] usb usb2-port1: unable to enumerate USB device [ 86.062838][ T5982] netlink: 8 bytes leftover after parsing attributes in process `syz.2.48'. [ 86.860779][ T5976] loop3: detected capacity change from 0 to 32768 [ 86.945358][ T5976] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 87.060846][ T5976] XFS (loop3): Ending clean mount [ 87.137229][ T5976] process 'syz.3.47' launched './file2' with NULL argv: empty string added [ 87.531752][ T5763] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 89.199077][ T6017] capability: warning: `syz.0.54' uses 32-bit capabilities (legacy support in use) [ 89.526230][ T6021] loop2: detected capacity change from 0 to 1024 [ 89.650974][ T6021] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 89.716032][ T6021] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 89.799207][ T6021] netlink: 196 bytes leftover after parsing attributes in process `syz.2.55'. [ 89.937011][ T6033] netlink: 8 bytes leftover after parsing attributes in process `syz.1.59'. [ 90.007055][ T6036] Zero length message leads to an empty skb [ 90.106333][ T5762] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.888174][ T6158] netlink: 8 bytes leftover after parsing attributes in process `syz.0.71'. [ 100.925817][ T23] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 101.654152][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 101.679663][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.820107][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.860651][ T23] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 101.878330][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.947057][ T23] usb 4-1: config 0 descriptor?? [ 102.555719][ T23] ft260 0003:0403:6030.0001: unknown main item tag 0x0 [ 102.568650][ T23] ft260 0003:0403:6030.0001: unknown main item tag 0x0 [ 102.649354][ T6210] netlink: 4 bytes leftover after parsing attributes in process `syz.0.85'. [ 102.655417][ T6202] netlink: 8 bytes leftover after parsing attributes in process `syz.1.84'. [ 103.056981][ T23] ft260 0003:0403:6030.0001: chip code: 0000 0000 [ 103.326341][ T23] ft260 0003:0403:6030.0001: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 103.526821][ T23] ft260 0003:0403:6030.0001: failed to retrieve status: -32, no wakeup [ 103.754511][ T23] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 104.634178][ T5766] usb 4-1: USB disconnect, device number 3 [ 106.126573][ T6249] netlink: 8 bytes leftover after parsing attributes in process `syz.1.95'. [ 110.279291][ T6277] syz.2.103 (6277) used greatest stack depth: 17896 bytes left [ 111.764178][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 116.884214][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 117.340113][ T6324] netlink: 8 bytes leftover after parsing attributes in process `syz.2.117'. [ 118.434176][ T23] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 118.647648][ T23] usb 4-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 118.759290][ T23] usb 4-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 118.787881][ T23] usb 4-1: Product: syz [ 118.805069][ T23] usb 4-1: config 0 descriptor?? [ 118.849198][ T23] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 118.913667][ T23] usb 4-1: Detected FT232H [ 119.187837][ T23] ftdi_sio ttyUSB0: Unable to read latency timer: -121 [ 119.392568][ T23] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 119.460024][ T23] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 119.496799][ T23] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 119.514562][ T23] usb 4-1: USB disconnect, device number 4 [ 119.530078][ T23] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 119.555347][ T23] ftdi_sio 4-1:0.0: device disconnected [ 125.591719][ T6407] loop1: detected capacity change from 0 to 32768 [ 128.752742][ T6434] comedi comedi3: s526: I/O port conflict (0xcf7,64) [ 132.142586][ T6457] netlink: 8 bytes leftover after parsing attributes in process `syz.3.162'. [ 132.927503][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.933839][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.207017][ T6463] loop3: detected capacity change from 0 to 4096 [ 133.226660][ T6463] ntfs3: Unknown parameter 'ÿÿ' [ 133.335826][ T5755] I/O error, dev loop3, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 134.085185][ T6463] loop3: detected capacity change from 0 to 1024 [ 134.831125][ T6463] hfsplus: found bad thread record in catalog [ 135.028051][ T6119] hfsplus: b-tree write err: -5, ino 25 [ 135.057065][ T6119] hfsplus: b-tree write err: -5, ino 4 [ 135.069715][ T6119] hfsplus: b-tree write err: -5, ino 2 [ 135.088392][ T6119] hfsplus: b-tree write err: -5, ino 26 [ 135.984035][ T5802] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 136.954303][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 137.440739][ T6494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.171'. [ 137.814077][ T5802] usb 2-1: Using ep0 maxpacket: 8 [ 137.852715][ T5802] usb 2-1: unable to get BOS descriptor or descriptor too short [ 137.877487][ T5802] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 137.914091][ T5802] usb 2-1: can't read configurations, error -71 [ 138.533268][ T6502] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 139.127304][ T6509] loop1: detected capacity change from 0 to 32768 [ 139.370403][ T6516] loop0: detected capacity change from 0 to 512 [ 139.381857][ T6509] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 139.390245][ T6509] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 140.194231][ T6516] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 140.309185][ T6509] gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms [ 140.321126][ T5802] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 140.328248][ T5802] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 140.423553][ T6516] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 142.039241][ T5802] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 1710ms [ 142.225663][ T5802] gfs2: fsid=syz:syz.0: jid=0: Done [ 142.325012][ T6509] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 142.338711][ T6509] gfs2: fsid=syz:syz.0: can't create logd thread: -4 [ 144.769181][ T5761] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.455148][ T6545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.183'. [ 147.194344][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 147.668136][ T6557] netlink: 8 bytes leftover after parsing attributes in process `syz.0.189'. [ 149.754326][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 151.579152][ T6580] loop3: detected capacity change from 0 to 2048 [ 151.785077][ T6580] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 152.314254][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 153.522686][ T6590] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 153.561089][ T6590] iommufd_mock iommufd_mock2: Adding to iommu group 1 [ 155.872397][ T6615] syzkaller0: entered promiscuous mode [ 155.884105][ T6615] syzkaller0: entered allmulticast mode [ 156.191301][ T6622] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.200'. [ 157.434225][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 162.075676][ T5766] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 162.274433][ T5766] usb 2-1: Using ep0 maxpacket: 16 [ 162.297691][ T5766] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 162.311820][ T5766] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 162.327267][ T5766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 162.336848][ T5766] usb 2-1: SerialNumber: syz [ 162.408233][ T5766] cdc_acm 2-1:1.0: skipping garbage [ 162.429393][ T5766] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 162.460714][ T5766] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 162.474176][ T5766] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 162.918953][ T6673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.936156][ T6673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 163.374991][ T5766] usb 2-1: USB disconnect, device number 8 [ 165.456004][ T6075] Bluetooth: hci4: Frame reassembly failed (-90) [ 168.114640][ T5775] Bluetooth: hci4: command 0xfc11 tx timeout [ 168.209922][ T5771] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 168.526728][ T5771] Bluetooth: Frame is too long (len 16, expected len 4) [ 171.106806][ T6742] syzkaller0: entered promiscuous mode [ 171.112361][ T6742] syzkaller0: entered allmulticast mode [ 176.529461][ T6785] syzkaller0: entered promiscuous mode [ 176.564258][ T6785] syzkaller0: entered allmulticast mode [ 179.593976][ C0] sched: RT throttling activated [ 179.954565][ T6819] fuse: Bad value for 'fd' [ 182.974150][ T8] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 183.693156][ T6839] syzkaller0: entered promiscuous mode [ 183.714344][ T6839] syzkaller0: entered allmulticast mode [ 183.834126][ T8] usb 4-1: device not accepting address 5, error -71 [ 184.056907][ T6849] fuse: Bad value for 'fd' [ 184.288561][ T6854] xt_hashlimit: size too large, truncated to 1048576 [ 186.004141][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 186.259041][ T5766] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 186.454176][ T5766] usb 2-1: Using ep0 maxpacket: 16 [ 186.465805][ T5766] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 186.507775][ T5766] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 186.534004][ T5766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 186.548514][ T5766] usb 2-1: SerialNumber: syz [ 186.579833][ T5766] cdc_acm 2-1:1.0: skipping garbage [ 186.604048][ T5766] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 186.616127][ T5766] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 186.635792][ T5766] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 186.807872][ T6864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.836100][ T6864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.866060][ T5766] usb 2-1: USB disconnect, device number 9 [ 187.624045][ T28] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 187.655156][ T6877] fuse: Bad value for 'fd' [ 187.834789][ T28] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 187.844042][ T28] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 187.874158][ T28] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.916642][ T28] usb 3-1: config 0 descriptor?? [ 189.685424][ T6888] syzkaller0: entered promiscuous mode [ 189.752050][ T6888] syzkaller0: entered allmulticast mode [ 190.714345][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 191.256820][ T787] usb 3-1: USB disconnect, device number 3 [ 191.329775][ T5765] Bluetooth: hci3: command 0x0406 tx timeout [ 191.336754][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 191.342796][ T5775] Bluetooth: hci2: command 0x0406 tx timeout [ 192.630328][ T5805] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 192.904023][ T5805] usb 2-1: Using ep0 maxpacket: 16 [ 193.691690][ T5805] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 193.703484][ T5805] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 193.714094][ T5805] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 193.722168][ T5805] usb 2-1: SerialNumber: syz [ 193.745374][ T5805] cdc_acm 2-1:1.0: skipping garbage [ 193.754434][ T5805] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 193.764960][ T5805] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 193.774222][ T5805] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 194.039405][ T6900] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.061044][ T6900] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.180852][ T5805] usb 2-1: USB disconnect, device number 10 [ 194.302257][ T51] Bluetooth: hci3: unexpected event for opcode 0x1002 [ 194.371871][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.396163][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.678135][ T6924] ubi16: attaching mtd0 [ 197.166799][ T6924] ubi16: scanning is finished [ 197.171495][ T6924] ubi16: empty MTD device detected [ 197.274049][ T5805] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 197.298675][ T6924] ubi16: attached mtd0 (name "mtdram test device", size 0 MiB) [ 197.325555][ T6924] ubi16: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 197.344311][ T6924] ubi16: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 197.358300][ T6924] ubi16: VID header offset: 64 (aligned 64), data offset: 128 [ 197.384016][ T6924] ubi16: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 197.406373][ T6924] ubi16: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 197.434174][ T6924] ubi16: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2053549660 [ 197.458097][ T6924] ubi16: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 197.485712][ T6932] ubi16: background thread "ubi_bgt16d" started, PID 6932 [ 197.489598][ T5805] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 197.522248][ T5805] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 197.564175][ T5805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.585409][ T5805] usb 1-1: config 0 descriptor?? [ 198.812221][ T6942] syzkaller0: entered promiscuous mode [ 198.818782][ T6942] syzkaller0: entered allmulticast mode [ 198.956934][ T8] usb 1-1: USB disconnect, device number 2 [ 200.082876][ T8] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 201.204079][ T8] usb 1-1: Using ep0 maxpacket: 16 [ 201.232342][ T8] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 201.274356][ T8] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 201.314019][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 201.344016][ T8] usb 1-1: SerialNumber: syz [ 201.353064][ T8] cdc_acm 1-1:1.0: skipping garbage [ 201.369831][ T8] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 201.398065][ T8] cdc_acm 1-1:1.0: This needs exactly 3 endpoints [ 201.414436][ T8] cdc_acm: probe of 1-1:1.0 failed with error -22 [ 201.603411][ T6949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.632477][ T6949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.673044][ T8] usb 1-1: USB disconnect, device number 3 [ 203.744041][ T8] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 204.581055][ T8] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 204.684841][ T8] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 204.726246][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.740131][ T8] usb 2-1: config 0 descriptor?? [ 204.795330][ T6980] syzkaller0: entered promiscuous mode [ 204.808081][ T6980] syzkaller0: entered allmulticast mode [ 206.664467][ T8] usb 2-1: USB disconnect, device number 11 [ 206.966732][ T5802] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 207.201205][ T5802] usb 4-1: Using ep0 maxpacket: 16 [ 207.336244][ T5802] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.474512][ T5802] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 207.544476][ T5802] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 207.589107][ T5802] usb 4-1: SerialNumber: syz [ 207.621321][ T5802] cdc_acm 4-1:1.0: skipping garbage [ 207.639318][ T5802] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 207.660072][ T5802] cdc_acm 4-1:1.0: This needs exactly 3 endpoints [ 207.666990][ T5802] cdc_acm: probe of 4-1:1.0 failed with error -22 [ 207.841875][ T6994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.856372][ T6994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.869293][ T5802] usb 4-1: USB disconnect, device number 7 [ 208.035281][ T7017] loop2: detected capacity change from 0 to 1024 [ 209.003363][ T7022] Cannot find del_set index 2 as target [ 210.285124][ T7022] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.305402][ T7022] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.499172][ T7017] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.506746][ T7017] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.524535][ T7017] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.531839][ T7017] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.553567][ T7017] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.560962][ T7017] hfsplus: request for non-existent node 33423360 in B*Tree [ 210.604160][ T28] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 210.846489][ T28] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 210.944678][ T28] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.061603][ T28] usb 4-1: config 0 descriptor?? [ 211.111301][ T28] cp210x 4-1:0.0: cp210x converter detected [ 211.341896][ T28] cp210x 4-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 211.427223][ T28] cp210x 4-1:0.0: querying part number failed [ 211.472419][ T28] usb 4-1: cp210x converter now attached to ttyUSB0 [ 212.552430][ T7094] program syz.2.331 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 213.600135][ T787] usb 4-1: USB disconnect, device number 8 [ 213.660956][ T787] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 213.728830][ T787] cp210x 4-1:0.0: device disconnected [ 214.227131][ T7110] loop0: detected capacity change from 0 to 32768 [ 215.229491][ T7110] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 215.314400][ T5766] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 215.379337][ T7110] XFS (loop0): Ending clean mount [ 215.604207][ T5766] usb 2-1: Using ep0 maxpacket: 16 [ 215.617897][ T5766] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 215.638667][ T27] audit: type=1800 audit(1776477363.572:2): pid=7127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.336" name="file1" dev="loop0" ino=6150 res=0 errno=0 [ 215.802794][ T5766] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 215.813201][ T5766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 215.823398][ T5766] usb 2-1: SerialNumber: syz [ 216.031953][ T5766] cdc_acm 2-1:1.0: skipping garbage [ 216.037351][ T5766] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 216.046352][ T5766] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 216.052859][ T5766] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 216.165699][ T5761] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 216.302495][ T7106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.325226][ T7106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.353812][ T8] usb 2-1: USB disconnect, device number 12 [ 216.710416][ T23] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 216.964320][ T23] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 216.994154][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.009557][ T23] usb 4-1: config 0 descriptor?? [ 217.242587][ T23] cp210x 4-1:0.0: cp210x converter detected [ 217.391214][ T23] cp210x 4-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 217.480114][ T23] cp210x 4-1:0.0: querying part number failed [ 217.597677][ T23] usb 4-1: cp210x converter now attached to ttyUSB0 [ 219.781685][ T787] usb 4-1: USB disconnect, device number 9 [ 219.811623][ T787] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 219.853270][ T787] cp210x 4-1:0.0: device disconnected [ 220.597923][ T7188] loop0: detected capacity change from 0 to 4096 [ 220.783401][ T7188] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 221.178074][ T7188] NILFS (loop0): mounting unchecked fs [ 221.205854][ T7188] NILFS (loop0): recovery required for readonly filesystem [ 221.240708][ T7188] NILFS (loop0): write access will be enabled during recovery [ 221.682999][ T6871] udevd[6871]: incorrect nilfs2 checksum on /dev/loop0 [ 221.702735][ T7188] NILFS (loop0): norecovery option specified, skipping roll-forward recovery [ 221.849454][ T7188] NILFS (loop0): couldn't remount because the filesystem is in an incomplete recovery state [ 221.892277][ T6871] udevd[6871]: incorrect nilfs2 checksum on /dev/loop0 [ 223.008463][ T7214] overlayfs: missing 'lowerdir' [ 223.754155][ T23] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 223.958429][ T23] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 223.967703][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.017814][ T23] usb 1-1: config 0 descriptor?? [ 224.091354][ T23] cp210x 1-1:0.0: cp210x converter detected [ 224.351671][ T23] cp210x 1-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 224.351786][ T23] cp210x 1-1:0.0: querying part number failed [ 224.367231][ T23] usb 1-1: cp210x converter now attached to ttyUSB0 [ 225.846408][ T7237] loop1: detected capacity change from 0 to 32768 [ 225.917631][ T7237] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.369 (7237) [ 225.985618][ T7237] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 225.995985][ T7237] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 226.004741][ T7237] BTRFS info (device loop1): turning on sync discard [ 226.011574][ T7237] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 226.021132][ T7237] BTRFS info (device loop1): use zstd compression, level 3 [ 226.028385][ T7237] BTRFS info (device loop1): turning on async discard [ 226.035285][ T7237] BTRFS warning (device loop1): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 226.046190][ T7237] BTRFS info (device loop1): trying to use backup root at mount time [ 226.054301][ T7237] BTRFS info (device loop1): enabling auto defrag [ 226.060700][ T7237] BTRFS info (device loop1): using free space tree [ 226.103611][ T8] usb 1-1: USB disconnect, device number 4 [ 226.113161][ T8] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 226.122812][ T8] cp210x 1-1:0.0: device disconnected [ 226.272255][ T6105] BTRFS warning (device loop1): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 226.534408][ T7237] BTRFS error (device loop1): failed to load root extent [ 226.541551][ T7237] BTRFS warning (device loop1): try to load backup roots slot 1 [ 226.550607][ T6105] BTRFS warning (device loop1): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 226.797836][ T7237] BTRFS warning (device loop1): couldn't read tree root [ 226.805001][ T7237] BTRFS warning (device loop1): try to load backup roots slot 2 [ 226.840946][ T6119] BTRFS error (device loop1): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 227.041124][ T7237] BTRFS warning (device loop1): couldn't read tree root [ 227.048261][ T7237] BTRFS warning (device loop1): try to load backup roots slot 3 [ 227.076533][ T7237] BTRFS info (device loop1): enabling ssd optimizations [ 227.087318][ T7237] BTRFS info (device loop1): rebuilding free space tree [ 227.131004][ T7237] BTRFS info (device loop1): checking UUID tree [ 228.694403][ T5764] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 232.324656][ T7312] netlink: 8 bytes leftover after parsing attributes in process `syz.3.385'. [ 233.685283][ T7326] ======================================================= [ 233.685283][ T7326] WARNING: The mand mount option has been deprecated and [ 233.685283][ T7326] and is ignored by this kernel. Remove the mand [ 233.685283][ T7326] option from the mount to silence this warning. [ 233.685283][ T7326] ======================================================= [ 233.720406][ T7326] overlayfs: failed to resolve './file1/file0': -2 [ 233.727910][ T8] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 234.023923][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 234.642432][ T5081] Bluetooth: hci2: command 0x0406 tx timeout [ 234.735142][ T8] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 234.890848][ T8] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 235.135394][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 235.241826][ T8] usb 2-1: SerialNumber: syz [ 235.274203][ T8] cdc_acm 2-1:1.0: skipping garbage [ 235.279470][ T8] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 235.308149][ T8] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 235.320710][ T8] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 235.608183][ T7322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.624455][ T7322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.648341][ T23] usb 2-1: USB disconnect, device number 13 [ 236.717853][ T7361] netlink: 8 bytes leftover after parsing attributes in process `syz.0.397'. [ 238.302517][ T5081] Bluetooth: hci3: unexpected event for opcode 0x1002 [ 240.893480][ T7392] overlayfs: overlapping lowerdir path [ 240.915719][ T7394] netlink: 8 bytes leftover after parsing attributes in process `syz.3.408'. [ 241.646061][ T6105] Bluetooth: hci4: Frame reassembly failed (-90) [ 243.684089][ T51] Bluetooth: hci4: command 0xfc11 tx timeout [ 243.692198][ T5081] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 244.289192][ T7428] netlink: 8 bytes leftover after parsing attributes in process `syz.1.418'. [ 245.031041][ T5081] Bluetooth: hci1: unexpected event for opcode 0x1002 [ 247.865210][ T6097] Bluetooth: hci4: Frame reassembly failed (-90) [ 247.871600][ T6097] Bluetooth: hci4: Frame reassembly failed (-84) [ 249.884272][ T51] Bluetooth: hci4: command 0xfc11 tx timeout [ 249.890984][ T5081] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 250.442678][ T7456] loop3: detected capacity change from 0 to 32768 [ 250.625233][ T7466] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.431'. [ 251.712084][ T7471] netlink: 8 bytes leftover after parsing attributes in process `syz.3.432'. [ 253.069759][ T6097] Bluetooth: hci4: Frame reassembly failed (-90) [ 253.970931][ T7481] ALSA: mixer_oss: invalid OSS volume '' [ 255.084115][ T5081] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 255.816354][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.822885][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.704898][ T7522] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.449'. [ 259.153785][ T7518] ALSA: mixer_oss: invalid OSS volume '' [ 259.234701][ T7528] netlink: 8 bytes leftover after parsing attributes in process `syz.1.451'. [ 263.136636][ T7556] loop0: detected capacity change from 0 to 1024 [ 264.665735][ T7563] loop0: detected capacity change from 0 to 32768 [ 264.692918][ T7563] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.460 (7563) [ 264.750771][ T7563] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 264.761027][ T7563] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 264.769852][ T7563] BTRFS info (device loop0): turning on sync discard [ 264.776566][ T7563] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 264.785961][ T7563] BTRFS info (device loop0): use zstd compression, level 3 [ 264.793150][ T7563] BTRFS info (device loop0): turning on async discard [ 264.799942][ T7563] BTRFS warning (device loop0): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 264.810531][ T7563] BTRFS info (device loop0): trying to use backup root at mount time [ 264.818623][ T7563] BTRFS info (device loop0): enabling auto defrag [ 264.825047][ T7563] BTRFS info (device loop0): using free space tree [ 264.909454][ T6102] BTRFS warning (device loop0): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 264.942231][ T7563] BTRFS error (device loop0): failed to load root extent [ 264.949418][ T7563] BTRFS warning (device loop0): try to load backup roots slot 1 [ 264.961136][ T6094] BTRFS warning (device loop0): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 265.033202][ T7563] BTRFS warning (device loop0): couldn't read tree root [ 265.040390][ T7563] BTRFS warning (device loop0): try to load backup roots slot 2 [ 265.054458][ T6094] BTRFS error (device loop0): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 265.108052][ T7563] BTRFS warning (device loop0): couldn't read tree root [ 265.115130][ T7563] BTRFS warning (device loop0): try to load backup roots slot 3 [ 265.144178][ T7563] BTRFS info (device loop0): enabling ssd optimizations [ 265.160649][ T7563] BTRFS info (device loop0): rebuilding free space tree [ 265.180337][ T7563] BTRFS info (device loop0): checking UUID tree [ 265.360732][ T7585] tmpfs: Unknown parameter 'urquota' [ 266.119003][ T7583] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 266.134328][ T7583] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 266.193007][ T7583] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 266.219615][ T7583] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 266.249501][ T7583] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 266.391542][ T7583] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 267.061990][ T6097] Bluetooth: hci4: Frame reassembly failed (-84) [ 268.124115][ T5081] Bluetooth: hci1: command 0x0406 tx timeout [ 268.214101][ T5081] Bluetooth: hci3: command 0x0406 tx timeout [ 268.284615][ T5081] Bluetooth: hci2: command 0x0406 tx timeout [ 268.696161][ T7594] syz.1.464 (7594): drop_caches: 2 [ 268.897911][ T5761] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 269.097673][ T51] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 270.202180][ T7612] ubi: mtd0 is already attached to ubi16 [ 270.215117][ T5081] Bluetooth: hci1: command 0x0406 tx timeout [ 270.284645][ T5081] Bluetooth: hci3: command 0x0406 tx timeout [ 270.374064][ T5081] Bluetooth: hci2: command 0x0406 tx timeout [ 270.642683][ T7614] netlink: 8 bytes leftover after parsing attributes in process `syz.0.466'. [ 270.657373][ T7613] loop2: detected capacity change from 0 to 1024 [ 275.194685][ T8] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 275.525641][ T8] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 275.535113][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.556245][ T8] usb 1-1: config 0 descriptor?? [ 275.563501][ T8] cp210x 1-1:0.0: cp210x converter detected [ 275.800040][ T8] cp210x 1-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 275.824123][ T8] cp210x 1-1:0.0: querying part number failed [ 276.063007][ T7643] ubi: mtd0 is already attached to ubi16 [ 276.137876][ T8] usb 1-1: cp210x converter now attached to ttyUSB0 [ 278.310839][ T8] usb 1-1: USB disconnect, device number 5 [ 278.481018][ T8] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 278.540075][ T8] cp210x 1-1:0.0: device disconnected [ 279.594794][ T7658] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 280.383395][ T7676] ubi: mtd0 is already attached to ubi16 [ 282.459694][ T787] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 282.715943][ T787] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 282.757358][ T787] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.575658][ T787] usb 1-1: config 0 descriptor?? [ 283.645518][ T787] cp210x 1-1:0.0: cp210x converter detected [ 283.884244][ T787] cp210x 1-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 283.969220][ T787] cp210x 1-1:0.0: querying part number failed [ 284.040056][ T787] usb 1-1: cp210x converter now attached to ttyUSB0 [ 285.362540][ T5805] usb 1-1: USB disconnect, device number 6 [ 285.472437][ T5805] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 285.501095][ T5805] cp210x 1-1:0.0: device disconnected [ 285.693558][ T7757] ubi: mtd0 is already attached to ubi16 [ 286.458515][ T5081] Bluetooth: hci1: unexpected event for opcode 0x1002 [ 287.191372][ T5081] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 289.154104][ T5802] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 290.554113][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 291.515199][ T5802] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 291.528838][ T5802] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.548340][ T5802] usb 2-1: config 0 descriptor?? [ 291.563848][ T5802] cp210x 2-1:0.0: cp210x converter detected [ 292.564767][ T5802] cp210x 2-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 292.606050][ T5802] cp210x 2-1:0.0: querying part number failed [ 292.638698][ T5802] usb 2-1: cp210x converter now attached to ttyUSB0 [ 292.880086][ T7798] ubi: mtd0 is already attached to ubi16 [ 294.656817][ T787] usb 2-1: USB disconnect, device number 14 [ 294.686448][ T787] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 294.712572][ T787] cp210x 2-1:0.0: device disconnected [ 298.268278][ T7837] loop2: detected capacity change from 0 to 1024 [ 298.327333][ T7837] Cannot find del_set index 2 as target [ 298.558332][ T787] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 298.867552][ T787] usb 4-1: Using ep0 maxpacket: 16 [ 298.870309][ T7833] ALSA: mixer_oss: invalid OSS volume '' [ 298.887813][ T787] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 298.915386][ T787] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 298.944412][ T787] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 298.952871][ T787] usb 4-1: SerialNumber: syz [ 299.167522][ T787] cdc_acm 4-1:1.0: skipping garbage [ 299.172780][ T787] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 299.197399][ T787] cdc_acm 4-1:1.0: This needs exactly 3 endpoints [ 299.383814][ T787] cdc_acm: probe of 4-1:1.0 failed with error -22 [ 299.842053][ T787] usb 4-1: USB disconnect, device number 10 [ 303.576729][ T7888] ubi: mtd0 is already attached to ubi16 [ 306.051306][ T7885] ALSA: mixer_oss: invalid OSS volume '' [ 306.172728][ T8] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 306.364279][ T8] usb 3-1: Using ep0 maxpacket: 16 [ 307.821199][ T8] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 307.894039][ T8] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 307.943098][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 307.964082][ T8] usb 3-1: SerialNumber: syz [ 307.991211][ T8] cdc_acm 3-1:1.0: skipping garbage [ 308.001465][ T8] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 308.011774][ T8] cdc_acm 3-1:1.0: This needs exactly 3 endpoints [ 308.037563][ T8] cdc_acm: probe of 3-1:1.0 failed with error -22 [ 308.204053][ T23] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 308.214961][ T8] usb 3-1: USB disconnect, device number 4 [ 308.493110][ T23] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 308.502285][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.528381][ T23] usb 1-1: config 0 descriptor?? [ 308.535722][ T23] cp210x 1-1:0.0: cp210x converter detected [ 308.777425][ T23] usb 1-1: cp210x converter now attached to ttyUSB0 [ 308.948027][ T7916] fuse: Unknown parameter 'group_i00000000000000000000' [ 309.274070][ T7926] ubi: mtd0 is already attached to ubi16 [ 310.982441][ T7930] ALSA: mixer_oss: invalid OSS volume '' [ 311.025364][ T5766] usb 1-1: USB disconnect, device number 7 [ 311.076667][ T5766] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 311.093018][ T7941] loop2: detected capacity change from 0 to 32768 [ 311.114672][ T7941] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.546 (7941) [ 311.133798][ T5766] cp210x 1-1:0.0: device disconnected [ 311.150153][ T7941] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 311.160558][ T7941] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 311.169673][ T7941] BTRFS info (device loop2): turning on sync discard [ 311.176571][ T7941] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 311.186020][ T7941] BTRFS info (device loop2): use zstd compression, level 3 [ 311.193238][ T7941] BTRFS info (device loop2): turning on async discard [ 311.200330][ T7941] BTRFS warning (device loop2): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 311.211113][ T7941] BTRFS info (device loop2): trying to use backup root at mount time [ 311.219254][ T7941] BTRFS info (device loop2): enabling auto defrag [ 311.225749][ T7941] BTRFS info (device loop2): using free space tree [ 311.368201][ T63] BTRFS warning (device loop2): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 311.497411][ T7941] BTRFS error (device loop2): failed to load root extent [ 311.504670][ T7941] BTRFS warning (device loop2): try to load backup roots slot 1 [ 311.515120][ T6097] BTRFS warning (device loop2): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 311.659185][ T7941] BTRFS warning (device loop2): couldn't read tree root [ 311.666401][ T7941] BTRFS warning (device loop2): try to load backup roots slot 2 [ 311.685901][ T63] BTRFS error (device loop2): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 311.807159][ T7941] BTRFS warning (device loop2): couldn't read tree root [ 311.814268][ T7941] BTRFS warning (device loop2): try to load backup roots slot 3 [ 311.849390][ T7941] BTRFS info (device loop2): enabling ssd optimizations [ 311.857494][ T7941] BTRFS info (device loop2): rebuilding free space tree [ 311.873347][ T7941] BTRFS info (device loop2): checking UUID tree [ 312.995376][ T7973] fuse: Unknown parameter 'group_i00000000000000000000' [ 313.176042][ T7976] ubi: mtd0 is already attached to ubi16 [ 313.194340][ T23] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 313.504164][ T23] usb 1-1: Using ep0 maxpacket: 16 [ 313.519299][ T23] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 313.604684][ T23] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 313.613801][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 313.627472][ T23] usb 1-1: SerialNumber: syz [ 313.648627][ T23] cdc_acm 1-1:1.0: skipping garbage [ 313.653858][ T23] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 313.689001][ T5762] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 313.727134][ T23] cdc_acm 1-1:1.0: This needs exactly 3 endpoints [ 313.733599][ T23] cdc_acm: probe of 1-1:1.0 failed with error -22 [ 313.909150][ T7970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.953029][ T7970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.983616][ T23] usb 1-1: USB disconnect, device number 8 [ 316.656047][ T8005] overlayfs: missing 'lowerdir' [ 317.250336][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.256681][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.676020][ T8017] fuse: Unknown parameter 'group_id00000000000000000000' [ 318.173184][ T8022] ubi: mtd0 is already attached to ubi16 [ 319.832114][ T5805] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 320.174116][ T5805] usb 3-1: Using ep0 maxpacket: 16 [ 320.881247][ T5805] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 320.893259][ T5805] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 320.913361][ T5805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 320.921761][ T5805] usb 3-1: SerialNumber: syz [ 320.932223][ T5805] cdc_acm 3-1:1.0: skipping garbage [ 320.938056][ T5805] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 320.946183][ T5805] cdc_acm 3-1:1.0: This needs exactly 3 endpoints [ 320.953066][ T5805] cdc_acm: probe of 3-1:1.0 failed with error -22 [ 321.231369][ T8046] loop3: detected capacity change from 0 to 8 [ 321.238161][ T8046] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 321.261612][ T8046] cramfs: Error -3 while decompressing! [ 321.267377][ T8046] cramfs: ffffffff973fa368(26)->ffff88805419b000(4096) [ 321.274579][ T8046] cramfs: Error -3 while decompressing! [ 321.280113][ T8046] cramfs: ffffffff973fa382(26)->ffff88805419c000(4096) [ 321.287008][ T8046] cramfs: Error -3 while decompressing! [ 321.292531][ T8046] cramfs: ffffffff973fa39c(16)->ffff88805419d000(4096) [ 321.299437][ T8046] cramfs: Error -3 while decompressing! [ 321.305016][ T8046] cramfs: ffffffff973fa368(26)->ffff88805419b000(4096) [ 321.314970][ T8046] netlink: 'syz.3.569': attribute type 21 has an invalid length. [ 321.330653][ T8033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 321.342455][ T6871] udevd[6871]: incorrect cramfs checksum on /dev/loop3 [ 321.364670][ T8033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.525920][ T5805] usb 3-1: USB disconnect, device number 5 [ 321.620684][ T6838] udevd[6838]: incorrect cramfs checksum on /dev/loop3 [ 321.773812][ T8051] loop1: detected capacity change from 0 to 1024 [ 321.927022][ T8052] Cannot find del_set index 2 as target [ 324.374211][ T8106] ubi: mtd0 is already attached to ubi16 [ 326.141336][ T8115] netlink: 'syz.2.581': attribute type 39 has an invalid length. [ 326.164423][ T23] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 326.342706][ T8118] loop5: detected capacity change from 0 to 7 [ 326.408541][ T8119] binder: 8114:8119 ioctl c0285840 200000000000 returned -22 [ 326.997946][ T8118] loop5: [CUMANA/ADFS] p1 [ADFS] p1 [ 327.018278][ T23] usb 2-1: Using ep0 maxpacket: 32 [ 327.031836][ T8118] loop5: partition table partially beyond EOD, truncated [ 327.040392][ T8118] loop5: p1 size 487441168 extends beyond EOD, truncated [ 327.082759][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 327.110120][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 327.159412][ T23] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 327.185544][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.192553][ T5081] Bluetooth: hci2: unexpected event for opcode 0x1002 [ 327.215229][ T5081] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 327.262212][ T23] usb 2-1: config 0 descriptor?? [ 327.269961][ T6871] udevd[6871]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 327.904807][ T23] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 327.911853][ T23] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 328.005445][ T23] ft260 0003:0403:6030.0002: chip code: 0000 0000 [ 328.212960][ T23] ft260 0003:0403:6030.0002: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 328.335781][ T5802] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 328.426977][ T23] ft260 0003:0403:6030.0002: failed to retrieve status: -32, no wakeup [ 328.524219][ T5802] usb 1-1: Using ep0 maxpacket: 16 [ 328.546752][ T5802] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 328.571772][ T5802] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 328.600193][ T5802] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 328.638384][ T5802] usb 1-1: SerialNumber: syz [ 328.656879][ T5802] cdc_acm 1-1:1.0: skipping garbage [ 328.687440][ T5802] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 328.722560][ T5802] cdc_acm 1-1:1.0: This needs exactly 3 endpoints [ 328.741182][ T8113] i2c i2c-1: adapter quirk: 2nd comb msg must be read (addr 0x0008, size 0, write) [ 328.778770][ T5802] cdc_acm: probe of 1-1:1.0 failed with error -22 [ 328.801473][ T5802] usb 2-1: USB disconnect, device number 15 [ 328.892412][ T8133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.942385][ T8133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.996482][ T23] usb 1-1: USB disconnect, device number 9 [ 331.154071][ T23] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 331.355955][ T23] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 331.396574][ T23] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.425992][ T23] usb 3-1: config 0 descriptor?? [ 331.447852][ T23] cp210x 3-1:0.0: cp210x converter detected [ 331.662410][ T23] usb 3-1: cp210x converter now attached to ttyUSB0 [ 331.796937][ T5081] Bluetooth: hci1: unexpected event for opcode 0x1002 [ 331.803927][ T5081] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 333.728081][ T23] usb 3-1: USB disconnect, device number 6 [ 333.750347][ T23] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 333.778649][ T23] cp210x 3-1:0.0: device disconnected [ 340.197030][ T8320] syz.2.621 (8320): drop_caches: 2 [ 342.525017][ T8353] syz.0.631 (8353): drop_caches: 2 [ 351.613161][ T8436] syz.0.640 (8436): drop_caches: 2 [ 354.383630][ T27] audit: type=1326 audit(1776477502.382:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 354.546793][ T27] audit: type=1326 audit(1776477502.382:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 354.683111][ T27] audit: type=1326 audit(1776477502.382:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 356.090304][ T27] audit: type=1326 audit(1776477502.382:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=275 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 356.292942][ T27] audit: type=1326 audit(1776477502.382:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 356.452527][ T27] audit: type=1326 audit(1776477502.382:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 356.791120][ T27] audit: type=1326 audit(1776477502.382:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 356.893286][ T27] audit: type=1326 audit(1776477502.382:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8456 comm="syz.2.651" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f18abf9c819 code=0x7ffc0000 [ 360.645363][ T5805] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 360.894143][ T5805] usb 2-1: Using ep0 maxpacket: 16 [ 360.932900][ T5805] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 360.951980][ T5805] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 361.014965][ T5805] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 361.024047][ T5805] usb 2-1: SerialNumber: syz [ 361.073872][ T5805] cdc_acm 2-1:1.0: skipping garbage [ 361.084714][ T5805] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 361.104057][ T5805] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 361.184190][ T5805] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 361.329032][ T6111] Bluetooth: hci4: Frame reassembly failed (-90) [ 362.613826][ T8522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.325126][ T51] Bluetooth: hci4: command 0xfc11 tx timeout [ 363.325511][ T5081] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 363.611952][ T8522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 363.931169][ T23] usb 2-1: USB disconnect, device number 16 [ 365.334131][ T8554] lo speed is unknown, defaulting to 1000 [ 365.340280][ T8554] lo speed is unknown, defaulting to 1000 [ 365.348606][ T8554] lo speed is unknown, defaulting to 1000 [ 365.360097][ T8554] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 365.376828][ T8554] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 365.565610][ T8554] lo speed is unknown, defaulting to 1000 [ 365.625924][ T8554] lo speed is unknown, defaulting to 1000 [ 365.694992][ T8554] lo speed is unknown, defaulting to 1000 [ 365.758013][ T8554] lo speed is unknown, defaulting to 1000 [ 366.857018][ T8558] loop0: detected capacity change from 0 to 512 [ 366.873822][ T8558] EXT4-fs: Ignoring removed nobh option [ 366.890730][ T8558] EXT4-fs: Ignoring removed bh option [ 366.925494][ T8558] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 367.004356][ T8558] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.671: invalid indirect mapped block 256 (level 1) [ 367.284572][ T8558] EXT4-fs (loop0): Remounting filesystem read-only [ 367.291616][ T8558] EXT4-fs (loop0): 1 truncate cleaned up [ 367.333778][ T8558] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 369.407723][ T5761] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 369.464096][ T5802] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 369.714066][ T5802] usb 2-1: Using ep0 maxpacket: 16 [ 370.440792][ T5802] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 370.597722][ T5802] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 370.696885][ T5802] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 370.825324][ T5802] usb 2-1: SerialNumber: syz [ 370.838147][ T5802] cdc_acm 2-1:1.0: skipping garbage [ 370.843675][ T5802] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 370.932716][ T5802] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 370.950368][ T5802] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 371.096615][ T8574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.108839][ T8574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.139266][ T5805] usb 2-1: USB disconnect, device number 17 [ 371.315725][ T8603] syz.3.685 (8603): drop_caches: 2 [ 374.107142][ T28] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 374.151859][ T8641] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.695'. [ 374.235239][ T8643] syz.1.697 (8643): drop_caches: 2 [ 374.270102][ T28] usb 4-1: device descriptor read/64, error -71 [ 374.719720][ T28] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 375.791910][ T8] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 376.151719][ T28] usb 4-1: device descriptor read/64, error -71 [ 376.234104][ T8] usb 1-1: Using ep0 maxpacket: 16 [ 376.243498][ T8] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 376.258238][ T8] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 376.278418][ T28] usb usb4-port1: attempt power cycle [ 376.779313][ T28] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 376.925576][ T28] usb 4-1: device descriptor read/8, error -71 [ 376.958831][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 376.967073][ T8] usb 1-1: SerialNumber: syz [ 376.976391][ T8] cdc_acm 1-1:1.0: skipping garbage [ 376.981933][ T8] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 377.004476][ T8] cdc_acm 1-1:1.0: This needs exactly 3 endpoints [ 377.010939][ T8] cdc_acm: probe of 1-1:1.0 failed with error -22 [ 377.056717][ T8670] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.706'. [ 377.110737][ T8672] loop3: detected capacity change from 0 to 1024 [ 377.137749][ T8672] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only. [ 377.610584][ T8648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 377.654491][ T8648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.211056][ T5805] usb 1-1: USB disconnect, device number 10 [ 378.332322][ T8680] syz.2.708 (8680): drop_caches: 2 [ 378.685908][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.692258][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.997147][ T5081] Bluetooth: hci2: command 0x0406 tx timeout [ 380.541417][ T8703] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.715'. [ 380.714426][ T8] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 381.278989][ T8] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 381.423842][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.685420][ T8] usb 3-1: config 0 descriptor?? [ 381.825626][ T8] cp210x 3-1:0.0: cp210x converter detected [ 382.051209][ T8719] syz.0.719 (8719): drop_caches: 2 [ 382.179986][ T8] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 382.188681][ T8] cp210x 3-1:0.0: failed to get vendor val 0x370c size 73: -32 [ 382.215630][ T8] cp210x 3-1:0.0: GPIO initialisation failed: -32 [ 382.273601][ T8] usb 3-1: cp210x converter now attached to ttyUSB0 [ 383.210824][ T8] usb 3-1: USB disconnect, device number 7 [ 383.252342][ T8] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 383.344609][ T8] cp210x 3-1:0.0: device disconnected [ 383.777446][ T8744] loop1: detected capacity change from 0 to 128 [ 383.835234][ T27] audit: type=1800 audit(1776477531.812:11): pid=8744 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.723" name="bus" dev="loop1" ino=1048602 res=0 errno=0 [ 383.860031][ T8744] syz.1.723: attempt to access beyond end of device [ 383.860031][ T8744] loop1: rw=0, sector=121, nr_sectors = 920 limit=128 [ 384.366219][ T8] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 385.194044][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 385.215685][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 385.234178][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 385.254273][ T8] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 385.271764][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.295066][ T8] usb 3-1: config 0 descriptor?? [ 440.126027][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.132364][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 492.293972][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 492.300970][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P42/2:b..l P28/1:b..l [ 492.310034][ C0] rcu: (detected by 0, t=10502 jiffies, g=30065, q=30 ncpus=2) [ 492.317651][ C0] task:kworker/1:1 state:R running task stack:22864 pid:28 ppid:2 flags:0x00004000 [ 492.329214][ C0] Workqueue: events_power_efficient gc_worker [ 492.335297][ C0] Call Trace: [ 492.338563][ C0] [ 492.341485][ C0] __schedule+0x1553/0x45a0 [ 492.345987][ C0] ? verify_lock_unused+0x140/0x140 [ 492.351171][ C0] ? mark_lock+0x94/0x320 [ 492.355487][ C0] ? asan.module_dtor+0x20/0x20 [ 492.360335][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 492.366477][ C0] preempt_schedule_notrace+0xdd/0x110 [ 492.371916][ C0] ? preempt_schedule_common+0xc0/0xc0 [ 492.377365][ C0] preempt_schedule_notrace_thunk+0x1a/0x30 [ 492.383242][ C0] rcu_is_watching+0x7a/0xb0 [ 492.387825][ C0] gc_worker+0x2aa/0x1490 [ 492.392158][ C0] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 492.398124][ C0] ? gc_worker+0x269/0x1490 [ 492.402619][ C0] ? init_conntrack+0xf10/0xf10 [ 492.407450][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 492.412655][ C0] ? process_scheduled_works+0x96f/0x15d0 [ 492.418371][ C0] ? process_scheduled_works+0x96f/0x15d0 [ 492.424081][ C0] process_scheduled_works+0xa5d/0x15d0 [ 492.429623][ C0] ? worker_attach_to_pool+0x380/0x380 [ 492.435069][ C0] ? assign_work+0x3d2/0x5d0 [ 492.439646][ C0] worker_thread+0xa55/0xfc0 [ 492.444231][ C0] kthread+0x2fa/0x390 [ 492.448284][ C0] ? pr_cont_work+0x560/0x560 [ 492.452942][ C0] ? kthread_blkcg+0xd0/0xd0 [ 492.457523][ C0] ret_from_fork+0x48/0x80 [ 492.461925][ C0] ? kthread_blkcg+0xd0/0xd0 [ 492.466497][ C0] ret_from_fork_asm+0x11/0x20 [ 492.471254][ C0] [ 492.474255][ C0] task:kworker/u4:2 state:R running task stack:24648 pid:42 ppid:2 flags:0x00004000 [ 492.485008][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 492.491240][ C0] Call Trace: [ 492.494504][ C0] [ 492.497423][ C0] __schedule+0x1553/0x45a0 [ 492.501923][ C0] ? asan.module_dtor+0x20/0x20 [ 492.506762][ C0] ? mark_lock+0x94/0x320 [ 492.511074][ C0] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 492.517041][ C0] ? preempt_schedule_irq+0xb4/0x150 [ 492.522308][ C0] preempt_schedule_irq+0xbf/0x150 [ 492.527398][ C0] ? preempt_schedule_notrace+0x110/0x110 [ 492.533102][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 492.538894][ C0] irqentry_exit+0x67/0x70 [ 492.543292][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 492.549256][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 [ 492.555395][ C0] Code: 00 0f 0b 0f 1f 80 00 00 00 00 f3 0f 1e fa 53 48 89 fb e8 13 00 00 00 48 8b 3d 1c f5 03 0d 48 89 de 5b e9 e3 67 57 00 cc cc cc 0f 1e fa 48 8b 04 24 65 48 8b 0d b0 93 7c 7e 65 8b 15 b1 93 7c [ 492.574985][ C0] RSP: 0018:ffffc90000b2f748 EFLAGS: 00000202 [ 492.581033][ C0] RAX: 0000000000000001 RBX: ffffffff8a06056a RCX: 9b1218eea9d08600 [ 492.588994][ C0] RDX: ffff8880196a1e00 RSI: ffffffff8b1c8e40 RDI: ffffffff8b1c8e00 [ 492.596962][ C0] RBP: 0000000000000000 R08: dffffc0000000000 R09: 1ffffffff2238aa0 [ 492.604942][ C0] R10: dffffc0000000000 R11: fffffbfff2238aa1 R12: dffffc0000000000 [ 492.612900][ C0] R13: ffff888078421000 R14: 0000000000000001 R15: dffffc0000000000 [ 492.620861][ C0] ? ieee80211_vif_get_shift+0x1a/0x290 [ 492.626409][ C0] ieee80211_vif_get_shift+0x196/0x290 [ 492.631866][ C0] ieee80211_sta_get_rates+0xf9/0x6b0 [ 492.637227][ C0] ? sta_info_get+0x4f/0x2a0 [ 492.641799][ C0] ? sta_info_get+0x4f/0x2a0 [ 492.646368][ C0] ? sta_info_get+0x4f/0x2a0 [ 492.650944][ C0] ? sta_info_get+0x28d/0x2a0 [ 492.655604][ C0] ieee80211_ibss_rx_queued_mgmt+0x10db/0x2c80 [ 492.661764][ C0] ? ieee80211_ibss_rx_queued_mgmt+0xe9d/0x2c80 [ 492.667985][ C0] ? ieee80211_ibss_rx_no_sta+0x7a0/0x7a0 [ 492.673702][ C0] ? mark_lock+0x94/0x320 [ 492.678016][ C0] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 492.683993][ C0] ? lock_chain_count+0x20/0x20 [ 492.688826][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 492.694714][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 492.699901][ C0] ? skb_dequeue+0x124/0x160 [ 492.704474][ C0] ieee80211_iface_work+0x717/0xc70 [ 492.709652][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 492.714849][ C0] cfg80211_wiphy_work+0x225/0x260 [ 492.719943][ C0] ? process_scheduled_works+0x96f/0x15d0 [ 492.725647][ C0] process_scheduled_works+0xa5d/0x15d0 [ 492.731188][ C0] ? worker_attach_to_pool+0x380/0x380 [ 492.736636][ C0] ? assign_work+0x3d2/0x5d0 [ 492.741211][ C0] worker_thread+0xa55/0xfc0 [ 492.745797][ C0] kthread+0x2fa/0x390 [ 492.749844][ C0] ? pr_cont_work+0x560/0x560 [ 492.754502][ C0] ? kthread_blkcg+0xd0/0xd0 [ 492.759070][ C0] ret_from_fork+0x48/0x80 [ 492.763465][ C0] ? kthread_blkcg+0xd0/0xd0 [ 492.768036][ C0] ret_from_fork_asm+0x11/0x20 [ 492.772787][ C0] [ 492.775790][ C0] rcu: rcu_preempt kthread starved for 2080 jiffies! g30065 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 492.786883][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 492.796841][ C0] rcu: RCU grace-period kthread stack dump: [ 492.802724][ C0] task:rcu_preempt state:R running task stack:27720 pid:17 ppid:2 flags:0x00004000 [ 492.813484][ C0] Call Trace: [ 492.816745][ C0] [ 492.819661][ C0] __schedule+0x1553/0x45a0 [ 492.824169][ C0] ? asan.module_dtor+0x20/0x20 [ 492.829006][ C0] ? enqueue_timer+0x23d/0x550 [ 492.833750][ C0] ? __mod_timer+0x984/0xdb0 [ 492.838341][ C0] schedule+0xbd/0x170 [ 492.842409][ C0] schedule_timeout+0x188/0x2d0 [ 492.847254][ C0] ? console_conditional_schedule+0x40/0x40 [ 492.853130][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 492.859005][ C0] ? update_process_times+0x1b0/0x1b0 [ 492.864362][ C0] ? prepare_to_swait_event+0x339/0x360 [ 492.869904][ C0] rcu_gp_fqs_loop+0x313/0x1590 [ 492.874739][ C0] ? rcu_gp_init+0x1162/0x1560 [ 492.879489][ C0] ? rcu_gp_kthread+0x3b0/0x3b0 [ 492.884321][ C0] ? dyntick_save_progress_counter+0x2b0/0x2b0 [ 492.890457][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 492.895640][ C0] ? rcu_gp_init+0x1560/0x1560 [ 492.900386][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 492.906295][ C0] ? finish_swait+0xc7/0x1d0 [ 492.910884][ C0] rcu_gp_kthread+0x9d/0x3b0 [ 492.915457][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 492.920548][ C0] ? __kthread_parkme+0x7a/0x1c0 [ 492.925464][ C0] ? __kthread_parkme+0x162/0x1c0 [ 492.930489][ C0] kthread+0x2fa/0x390 [ 492.934550][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 492.939652][ C0] ? kthread_blkcg+0xd0/0xd0 [ 492.944229][ C0] ret_from_fork+0x48/0x80 [ 492.948632][ C0] ? kthread_blkcg+0xd0/0xd0 [ 492.953205][ C0] ret_from_fork_asm+0x11/0x20 [ 492.957960][ C0] [ 492.960968][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 492.967273][ C0] Sending NMI from CPU 0 to CPUs 1: [ 492.972491][ C1] NMI backtrace for cpu 1 [ 492.972515][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 [ 492.972529][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 492.972537][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 492.972559][ C1] Code: 29 21 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 83 e3 41 00 fb f4 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2e 41 89 de 80 [ 492.972571][ C1] RSP: 0018:ffffc90000187de0 EFLAGS: 000002c6 [ 492.972584][ C1] RAX: 8a1123440e8e0300 RBX: ffffffff8162a8f1 RCX: 8a1123440e8e0300 [ 492.972595][ C1] RDX: 0000000000000001 RSI: ffffffff8acac9e0 RDI: ffffffff8b1c8e60 [ 492.972605][ C1] RBP: ffffc90000187f20 R08: ffff8880b8f36b2b R09: 1ffff110171e6d65 [ 492.972616][ C1] R10: dffffc0000000000 R11: ffffed10171e6d66 R12: 1ffff92000030fc8 [ 492.972626][ C1] R13: dffffc0000000000 R14: 1ffff110036cd780 R15: 0000000000000000 [ 492.972637][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 492.972660][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 492.972671][ C1] CR2: 00007f5b9cd47841 CR3: 0000000062c26000 CR4: 00000000003526e0 [ 492.972684][ C1] Call Trace: [ 492.972691][ C1] [ 492.972696][ C1] default_idle+0x13/0x20 [ 492.972713][ C1] default_idle_call+0x6c/0xa0 [ 492.972731][ C1] do_idle+0x221/0x590 [ 492.972752][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 492.972769][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 492.972794][ C1] cpu_startup_entry+0x43/0x60 [ 492.972811][ C1] start_secondary+0xee/0xf0 [ 492.972826][ C1] secondary_startup_64_no_verify+0x179/0x17b [ 492.972853][ C1]